[Agda] termination proofs

Serge D. Mechveliani mechvel at botik.ru
Sat Sep 22 15:05:56 CEST 2012


People, 
I have a question on the termination proofs.
Consider the example:

  merge : List Nat x List Nat -> List Nat        
  merge ([] ,      ys     ) =  ys
  merge (xs ,      []     ) =  xs
  merge (x :: xs , y :: ys)  with  x <=? y
  ...                    | yes _ =  x :: (merge (xs ,      y :: ys))
  ...                    | _     =  y :: (merge (x :: xs , ys     ))

(a couple of math symbols are replaced, for this letter).
Agda-2.3.0.1  reports  "Termination checking failed ...". 

I hoped that each the argument   (xs , y:: ys)  and  (x :: xs , ys)
is syntactically smaller than    (x :: xs , y ::ys),

that the compiler would find it, and that this is sufficient for the
termination proof.

Has it sense considering some development for the Agda termination 
syntax ordering?

What may be a possibly simple way out for this particular program?
To introduce to the loop an additional argument of  
                                       l = length (xs ++ ys)  : Nat 
?
(similarly, put  counterList = xs ++ ys,  and remove the head from  
counterList in the loop).

Now, for a general situation: my current naive idea is as follows.
(1) The programmer introduces for each problem function  foo  the size 
    function   
             size-foo : <arguments of foo> -> Nat
    and adds its value  s  to the arguments -- which makes it  foo'.
(2) The proof is provided in the program loop for that  
    size-foo args > size-foo args'  for  args  and  args'  from LHS 
    and RHS respectively ...
(3) s == 0  is set as an additional stop point for  foo' (and the proof 
    is provided in the result for the aimed properties of  foo, foo').

Seeing (1), (2), (3), the compiler will hopefully decide that  foo'
terminates, and this looks like a verification.

What an approach does  Agda  suggest for a programmer?

Thank you in advance for explanation,

-------
Sergei


More information about the Agda mailing list