An important use of mathematical induction is to prove the correctness of algorithms. Because we will use induction in this way repeatedly over the course of the term I wrote up this sample proof for you.

The idea is that we will annotate an algorithm or program with statements that assert what is true at that point in the program. We will also provide these algorithm with conditions on the input and output (sometimes as expressed as pre-conditions and post-conditions). These are statements about the input to the algorithm and about the final values of variables after the program has been executed.

We illustrate with a program to raise numbers to powers:

The commentsAlgorithm Power(base, exp);Inputs: base (integer), exp (non-negative integer);Outputs: Answer (integer)beginAnswer := 1;base' := base;exp' := exp;while exp' > 0 do {INV1}if odd(exp') thenAnswer := Answer * base';exp' := exp' - 1elsebase' := base' * base';exp' := exp' div 2endendend {POST1}

Thus the post-condition asserts that the algorithm really does compute the value of raising the first argument to the power given by the second argument.INV1: Answer * base'^{exp'}= base^{exp}& exp' >= 0POST1: Answer = base^{exp}

How can we prove the post-condition is true? It is a little tricky since we
don't know in advance how many times we will go through the loop of the program
(it depends on the value of `exp`). However, it turns out that if we
know the invariant is always true when the program comes to the top of the
while loop, it is easy to show that the post-condition holds. First we show
the invariant always holds.

**Lemma**: Every time that execution reaches the top of the while statement
the invariant will be true.

**Proof**: The proof is by induction (of course) on the number of times the
program reaches the top of the while statement.

__Base case__: n = 1. The first time execution reaches the top of the
while loop, Answer = 1, base' = base, and exp' = exp. As a result, Answer *
base'^{exp'} = 1*base^{exp} = base^{exp}. Thus the
invariant holds.

__Induction case__:

*Induction hypothesis*: Suppose the invariant is true the nth time the
program reaches the top of the while statement.

To complete the proof we must show that if the program reaches the top of the while statement n+1 times, then the invariant will be true that (n+1)st time.

The first thing we notice is that we will only get to the top of the while loop the (n+1)st time if exp' > 0 the nth time we are there. Thus, for the rest of the proof, we assume that exp' > 0 at the nth time the program is at the top of the while loop.

By the induction hypothesis, we assume that

the nth time the program is at the top of the while loop. To keep track of the changing values of the variables between the nth and (n+1) st times of reaching the top of the while loop. We write AnswerAnswer * base'^{exp'}= base^{exp}& exp' >= 0

There are two cases, depending on which branch of the if statement is executed:$Answer$_{old}* (base'_{old})^{(exp'}^{old)}= base^{exp}& exp' > 0

__Case i__: odd(exp'_{old}) is true - i.e. exp'_{old} is
odd. Then it follows from the code that:

ThusAnswer_{new}= Answer_{old}* base'_{old}, base'_{new}= base'_{old}, exp'_{new}= exp'_{old}- 1.

where the last equality follows by the induction hypothesis.Answer_{new}* (base'_{new})^{(exp'}^{new) }= (Answer_{old}* base'_{old}) * (base'_{old})^{(exp'}^{old - 1)}=Answer_{old}* (base'_{old})^{(exp'old)}=base^{exp}

Notice also that exp'_{new} = exp'_{old} - 1 > 0 - 1 >= 0.

Thus the invariant holds for the values of the variables when it reaches the top of the while loop for the (n+1)st time.

__Case ii__: odd(exp'_{old}) is false - i.e. exp'_{old} is even. Then it follows
from the code that:

AnswerThus_{new}= Answer_{old}, base'_{new}= base'_{old}* base'_{old}, exp'_{new}= exp'_{old}div 2.

where the last equality follows from the induction hypothesis.Answer_{new}* (base'_{new})^{(exp'}^{new) }=Answer_{old}* (base'_{old}* base'_{old})^{(exp'}^{old div 2)}=Answer_{old}* (base'_{old})^{2 * (exp'}^{old div 2)}=Answer_{old}* (base'_{old})^{exp'}^{old}= base^{exp}

Note also that

exp'where the inequality follows from the induction hypothesis. Thus exp'_{new}= exp'_{old}div 2 > 0 div 2 = 0.

**End of proof of lemma.**

Now we can easily prove that the postcondition holds when the algorithm exits.

**Theorem**: When the algorithm exits, `Answer =
base ^{exp}`.

**Proof**: Just before the algorithm exits, it is at the while loop for the
last time, and then falls through to the end because exp' > 0 fails.

By the lemma, when it is there for the last time, the invariant holds. Thus

but because we exit, exp' <= 0, as well. It follows from this and the last part of the invariant that exp' = 0. If we write the remaining part of the invariant in reverse we getAnswer * base'^{exp'}= base^{exp}& exp' >= 0

Thusbase^{exp}= Answer * base'^{exp'}= Answer * base'^{0}= Answer * 1^{}= Answer

**End of proof of Theorem**

Notice that we proved the Lemma by induction, but induction was not needed for the proof of the theorem.

kim@cs.williams.edu