\documentstyle[12pt,twoside,amsfonts,amstex]{article}
\input{macros-course-lectures}

\parskip1.5ex
\parindent0pt

\begin{document}

\lecture{notes1}{Notes 1}{September 5, 1996}

\section{Introduction}
\subsection{Class Content}

\begin{itemize}
\item
Introduces the most important discrete (define) mathematical
{\em structures} for modelling computer systems. 

Numbers, sets, graphs, state machines, probability distributions, ...

\item
Introduces the most useful mathematical {\em techniques} for reasoning
about these math structures.

Propositional and predicate logic, induction, recurrences, generating
functions, ...

\item 
Teaches notion of {\em mathematical proof} as a discipline for
reasoning carefully about such structures.

Does this by doing proofs carefully for virtually everything covered in
the course.
In class, for homework.
Also lots of examples of pitfalls.

\item 
Teaches how one can {\em abstract} from complex application scenarios
to represent/analyze real problems using all this math.

\end{itemize}

We will begin by introducing basic notions of proofs, just using
simple, familiar structures like sets, natural numbers. 
Then we will introduce more structures.
Then methods.
Then probability -- postponed to end because it's harder, do as a long
unit.

Proofs throughout.

(Go over course outline briefly.)

%[[[15 minutes]]]

\section{Basic Proof Notions}

\subsection{Propositions}

A {\it proposition} is a statement that is either true or false but not both.

Knowledge consists of {\em propositions}, such as
\begin{itemize}
\item 2+3=5
\item For every $a$, $b$ and $c$, if $a=b$ and $b=c$ then $a=c$
\item The sum of the interior angles of every triangle is $180^\circ$
\item Every even integer greater than 2 is the sum of two prime
numbers (Goldbach's conjecture).
\item For all $n \ge 1$, $1+2+\cdots+n = n(n+1)/2$
\item For all $n \ge 0$, $n^2+n+41$ is a prime number.
\item With perfect play, chess is a win for white.
\item The Pentium chip divides properly.
\item Every map can be colored with four colors, so that no two
adjacent regions have the same color (Four Color Theorem).
\item With a fair coin, the probability of getting 50 heads in 100
tosses is 1/2.
\end{itemize}

Each of these propositions is either {\em true} or {\em false.} 
We (and Intel) would like to know which.
[[[Too old joke?]]]

Notes:
\begin{itemize}
\item Not all sentences are propositions:
     \begin{itemize}
     \item $+2**=3$ [[[What's this?]]]
     \item What time is it?
     \item This proposition is false.
     \end{itemize}
\item Propositions involve previously {\em defined} terms:
     \begin{itemize}
     \item prime, map, triangle, chess, fair coin, probability
     \item $+$, $=$, $1$, $\ge$
     \end{itemize}
\end{itemize}


\subsection{Proofs -- What (Informal) and Why}

Layman's definition of proof: ``A method of ascertaining the truth.''

Many ways to decide what's true:
\begin{itemize}
\item evidence (eg, general relativity, big bang),
\item reputable authority (eg, Professor),
\item inner conviction (eg, religion),
\end{itemize}
But these methods can go wrong:
\begin{itemize}
\item Evidence: $n^2+n+41$.  Program works fine on all test cases, but$\ldots$,
\item Authority: Intel says Pentium is fine
\item Conviction: There aren't any bugs in {\em my} programs$\ldots$
\end{itemize}
So mathematics focuses on a particularly convincing kind of
argument: a {\em proof.}


{\bf What is a proof?}

In math, it is a verification of a proposition by a chain of logical
deductions from a base set of axioms. An axiom is a proposition that
is assumed to be true.

\begin{itemize}
\item Begin with true propositions.
\item Combine using specific inference rules.
\item Derive more true propositions.
\end{itemize}
Should know and admit {\em all} unproven assumptions.

Example:

\begin{theorem} $\frac{d}{dx} \ln (3x+1) = \frac{3}{3x+1}$
\end{theorem}
\begin{proof}
\begin{eqnarray*}
\frac{d}{dx} 1 &= &0\\
\frac{d}{dx} 3x &= &3\\
\frac{d}{dx} (u+v) &= &\frac{d}{dx} u + \frac{d}{dx} v\\
\end{eqnarray*}
Combine, with $u=3x$, $v=1$:
\begin{eqnarray*}
\frac{d}{dx} (3x+1) &= &3\\
\frac{d}{dx} \ln u &= &\frac{1}{u}\frac{du}{dx}\\
\end{eqnarray*}
Combine, with $u=3x+1$.
 \end{proof}

This was a {\em direct proof:} start with knowns, plug together till
you get desired result.

Why do proofs? 
\begin{itemize}
\item
Convince yourself that your reasoning is correct -- that you haven't
made mistakes.
\item
Convince others. 
\item
A good proof has considerable structure, like a good program.
Much of it can be reused for other related results (like a
well-written program).
\item
A proof pins down {\em why} something is true, so you can know whether
it will stay true when things change.
\item
A failure to prove something often reveals the reason it is false.
\end{itemize}

Program verification: proof that a program does the right thing.
\begin{itemize}
\item Pentium
\item Airbus A300
\item Therac 25
\end{itemize}

[[[The examples above are from David Karger.]]

Other examples:
\begin{itemize}
\item
Kaashoek's Orca system, for which Alan Fekete and I helped to verify
the main algorithm (and found a significant logical error in the
process of doing the proof).
\item 
Current chip designs -- companies like Intel, HP are now
investing in verification people and computer tools.
\item
Communication protocols, AT\&T. 
\item
Practical verification efforts are also beginning for real-time
process control systems, e.g., those systems that control nuclear
power plants and airplanes.  Still preliminary.
\end{itemize}

Program verification is a nice complement to testing -- testing can
often detect bugs quickly.  Verification is harder, but it does help
to find deeper logical mistakes.  And when you're done, you know there
are {\em no more} errors (which testing alone can never guarantee).

\subsection{Basic Concepts/Notation}

\remove{
Start with sets as a basic data type.

Then do logical concepts/notation.
Propositions, Boolean algebra.
Predicates, quantifiers.
Axioms
Inference rules
Example: Peano axioms:
- As an example of using axioms.
- As a way of defining natural numbers (alternative -- we could treat
these naively too, as we're doing for sets).
}

\subsubsection{Sets}

A {\em set} is a collection of objects:
\begin{itemize}
\item $x \in S$ means ``$x$ is in the set $S$''
\item $\emptyset$ is the empty set  (contains no elements).
\item $A \cap B$ means ``the intersection of $A$ and $B$'' (the set of elements
in both sets).
\item $A \cup B$ means ``the union of $A$ and $B$'' (elements in
either set).
\item Set difference. $A-B=\{x| x \in A, but x \not \in B\} $
\item $\subseteq$, subset.
\item $=$, set equivalence.
\end{itemize}

We won't be axiomatic about sets (``naive set theory'').

\subsubsection{Boolean Operators} 

Boolean symbols are useful for brevity and precision, just like
arithmetic symbols.  If
\begin{itemize}
\item  $p$ denotes ``I like chocolate''
\item  $q$ denotes ``I like ice cream''
\end{itemize}
then
\begin{itemize}
\item $p \wedge q$ means ``$p$ and $q$'' (I like chocolate
and I like ice cream).  True iff $p$ and $q$ are both true.
\item $p \vee q$ means ``$p$ or $q$.''  True iff {\em one or both} of
$p$ and $q$ is true.  {\em Not} an exclusive or. (How could I
formulate exclusive or?)
\item $p \implies q$ means ``$p$ implies $q$'' or ``if $p$ then $q$''
(If I like chocolate, then I like ice cream).  True iff $p$ being true
makes $q$ true.
\item {\bf note:} $p\implies q$ is certainly true when $p$ is false!
\item
$p \iff q$
\end{itemize}

[[[Go over truth tables for all these operators.
Make sure they know that $p \implies q$ is true when $p$ is false.

Might be worth doing an example or two, calculating the truth values
for some formula, showing a formula is a tautology, showing that two
formulas are equivalent.

Define contrapositive and assert equivalence with original
proposition. $(p \implies q) \iff (\neg q \implies \neg p)$\\
Converse, inverse?]]]

\subsubsection{Predicates}

Predicates are similar to propositions but they depend on variables.
$P(x,y,z)$
denotes a predicate on variables $x,y,z$.  For example, define:
\begin{itemize}
\item $R(x)$: $x$ is an odd number
\item $Q(x)$: $x > 2$
\item $P(x)$: $x$ is a prime number
\end{itemize}
These predicates are {\em not} propositions, because they can be true
or false depending on $x$.  They are like functions from variables to
truth values. 
\begin{itemize} 
\item $P(2)$ is true
\item $R(2)$ is false
\item $P(4) \vee R(3)$ is true
\item $Q(3) \wedge R(4)$ is false
\item $Q(1) \implies R(2)$ is true.
\end{itemize}

\subsection{Quantifiers}

Many propositions assert that something is true for all or some elements
of a given domain (e.g., all numbers).  Let's agree in advance on a
{\em universe of discourse.}

\begin{itemize}
\item ``$\forall$'' means ``for all.'' $\forall x P(x)$ is a statement
that is true if $P(x)$ is true for {\em every} $x$ in the universe of
discourse. 
\item ``$\exists$'' means ``there exists.'' $\exists x P(x)$ is true
if $P(x)$ is true for {\em at least one} $x$ in the universe of
discourse.
\item ``$\exists !$'' means ``there exists {\em exactly} one.''
\item ``$\forall x \in S$'' means ``for every $x$ in the set $S$.''
$(\forall x \in S) P(x)$ is equivalent to $(\forall x) (x \in S
\implies P(x)).$
\end{itemize}

Quantifies can turn predicates into propositions, e.g.
\[
\forall x, P(x) \wedge Q(x) \implies R(x)
\]
This expression is a (true) proposition, because the variable in the
predicates is {\em bound}.

$\forall x \exists y$ is {\em different} from $\exists y \forall
x$:
\begin{itemize}
\item $S(x,y):$ student $x$ falls asleep in class $y$.
\item $\forall y \exists x P(x,y):$ ``In every class, some student will fall asleep''
\item $\exists x \forall y P(x,y):$ ``There exists a student who will
fall asleep in every class.''
\item what is my universe of discourse above?
\end{itemize}

\subsection{Axioms}

Axioms are propositions that are {\em assumed} to be true.There
doesn't exist a proof that the axiom is true -- you just start with a
reasonable assumption. (``axiom'' comes from Greek ``to think
worthy,'' not ``to be true'').  It is not wrong to make assumptions
(in fact, it is unavoidable), but to be rigorous you have to state
your assumptions explicitly.

Some typical examples of axioms from various parts of mathematics:
\begin{itemize}
\item
If $a=b$ and $b=c$ then $a=c$.
\item
Euclidean geometry has an axiom: Given a line $l$ and a point $p$ not
on $l$, there is exactly one line through $p$ parallel to $l$.
(Sometimes an axiom from one domain contradicts an aiom from another.)
\item
Spherical geometry has an axiom contradicting Euclid's: Given a line
$l$ and a point $p$ not on $l$, there is {\em no} line through $p$
parallel to $l$.
\item
So does hyperbolic geometry: Given a line $l$ and a point $p$ not on
$l$, there are {\em infinitely many} lines through $p$ parallel to
$l$.

None of these axioms is ``better'' than any other: in fact, all yield
equally consistent logical proof systems.
\item
Modern mathematicians still argue about which axioms are ``right,''
e.g., the Axiom of Choice (whose affirmation and negation are equally
consistent).
\end{itemize}

Of course, different axioms lead to very different theorems.  But
anyone who agrees with your axioms and inference rules has to accept
your theorems.

Once you have axioms and some prepositions that are believed to be
true all you need is rules for combining true proposition to form new
true propositions. Such rues are called {\u inference rules}. The most famous rule is modus ponens: 
\begin{itemize}
\item 
Let $p$ and $q$ be propositions.
\item
If $p$ is true and $p \implies q$ is true then q is true.
\end{itemize}

\subsection{Inference Rules for Propositions}

When does one proposition follow from another?

Let $p$ and $q$ be propositions.  Then if $p$ is true, and $p\implies
q$ (read $p$ {\em implies} $q$) is true, we can conclude that $q$ is
true.  This is a rule called {\em modus ponens.}

\newcommand{\alaw}[1]{\parbox[t]{1in}{
\begin{tabular}{l}
#1
\end{tabular}}}

Modus Ponens: \alaw{$p$\\
$p\implies q$\\
\hline
$q$}

Syllogism: \alaw{
$p\implies q$\\
$q\implies r$\\
\hline
$p\implies r$}

Modus Tolens: 
\alaw{$p\implies q$\\
$\neg q$\\
\hline
$\neg p$}

\remove{
Boolean Algebra is a useful aid in reasoning and inferring.  For
example, 
\[
[(p \vee q) \wedge \neg p] \implies q
\] so we can derive an
inference rule:

Disjunctive Syllogism: \alaw{$p \vee q$\\ $\neg p$ \\ \hline $q$}\\

}
Proof by cases: \alaw{$a \vee b$\\ $a \implies q $ \\ $b \implies q$ \\ \hline $q$}


\subsection{Inference Rules for Predicates}

Negation:
\begin{itemize}
\item $(\forall x) S(x)$ is equivalent to $\neg (\exists x) \neg S(x)$
    \begin{itemize}
    \item $(\forall x) S(x):$ For all primes $x > 2$, $x$ is odd.
    \item $\neg(\exists x) S(x):$ There is no prime $x > 2$ such
that $x$ is not odd.
    \end{itemize}
\item $(\exists x) S(x)$ is equivalent to $\neg (\forall x) \neg
S(x)$.
\end{itemize}

Universal generalization is a way to prove $\forall x P(x)$:
\begin{itemize}
\item ``Let $x \ge 2$.  Then $x$ is prime or composite.''
\item  Conclude: $\forall x \ge 2$, $x$ is prime or composite (explain
$\forall x\ge 2$). 
\end{itemize}

We often leave out universal quantifiers if they are implicit.

Like axioms, inference rules are an {\em agreement} to believe certain
inferences.  For example, the intuitionists (e.g. Brouwer) {\em reject}
the claim that $\neg\forall x \neg P(x)$ implies $\exists x P(x)$.
They claim that to prove something exists, you actually have to
construct it.

\subsection{More Formally: Logical Proof Systems}

A logical proof system consists of:
\begin{itemize}
\item A {\bf language} for stating propositions
\item {\bf Axioms:} Propositions accepted as true
\item {\bf Rules of inference:} Acceptable ways of combining propositions
\item {\bf Theorems:} Propositions that can be derived by applying the
inference rules to the axioms.
\end{itemize}

Note: we must always have some axioms: there are no ``self evident''
propositions.  

A logical proof system is 
\begin{itemize}
\item {\bf consistent} if no statement and its complement can both be
derived.
\item {\bf complete} if it can be used to prove or disprove every proposition.
\end{itemize}

Russell and Whitehead, {\em Principia Mathematica}, tried to completely
axiomatize mathematics but failed.

G\"odel's Theorems:
\begin{itemize}
\item no axiomatization of arithmetic is complete and consistent.
\item ``arithmetic is consistent'' is a proposition that cannot be
proved in arithmetic.
\item Gensen: ``arithmetic is consistent'' can be proved by adding
some reasonable-sounding axioms, but these axioms can't be proved
consistent.
\end{itemize}

There are true facts in math that cannot be proven!

%[[[40 minutes]]]


There are lots of ways to prove things, we now give some examples.

\subsection{Direct Proof}

Direct proofs are the most straightforward: we mix together previous
axioms and theorems until the desired claim is inferred.

For natural numbers $a$ and $b$, where $a \neq 0$,
we say $a$ {\em divides} $b$ if there exists a natural number $t$ such that
$at = b$.  We write $a \mid b$.
\begin{itemize}
\item $3 \mid 6$
\item $3\not |~7$
\end{itemize}

[[[Tom:  I changed the above to ``natural number'', though the usual
definitions are made for integers.  This is because we haven't
mentioned integers yet.  Maybe we should be listing some useful
arithmetic data types earlier.]]]

\begin{theorem}
If $a \mid b$ and $a \mid c$, then $a \mid b+c$.
\end{theorem}
\begin{proof}
By definition of divisibility, $(\exists t) b = at$ and $(\exists s) c
= as$.\\  Therefore, $b+c = at+as = a(t+s)$.\\  Therefore, by definition,
$a \mid b+c$.
\end{proof}

Note: distributivity was assumed without mention.

\subsection{Proof by Contradiction}

\alaw{$p \implies FALSE$ \\ \hline $\neg p$}

Proofs can go ``backwards'':
\begin{itemize}
\item Begin by assuming the desired theorem is false.
\item Using inference rules, conclude something known false.
\item Conclude that the assumption is wrong.
\end{itemize}

\begin{theorem} $\sqrt{2}$ is an irrational number.
\end{theorem}
\begin{proof} (Indirect).  Assume $\sqrt{2}$ is rational.  

Conclude $\sqrt{2}$ can be written as a fraction $a/b$ in lowest
terms.\\ Then $2b^2 = a^2$.\\ In other words, $a^2$ is even (since
$2b^2$ is even).\\ Therefore, $a$ is even (the square of an odd number
is odd).\\ Therefore, $a^2$ is divisible by 4.\\ But $b$ is odd (since
$a/b$ is in lowest terms and $a$ is even).\\ Thus $2b^2$ is not
divisible by 4.\\ Thus $4$ divides $a^2$, but not $2b^2 = a^2$,
contradiction.

Since our assumption leads to a false conclusion, it must be false.
Thus, $\sqrt{2}$ is not rational.
\end{proof}

Note: this process is based on the assumption that math is consistent,
since otherwise it would be possible to prove something false.

We freely used lots of basic facts about divisibility, lowest terms
for fractions, definitions of square, all without reference or proof.

Pythagoras and his followers knew this proof, but suppressed it because
they axiomatically denied the existence of irrational numbers (so
their system was not consistent, because they also had an axiom that
every line had a numeric length).

\subsection{A Nonconstructive Existence Proof}

\begin{theorem}
For any number $n$, there is a prime number greater than $n$.
\end{theorem}
\begin{proof}
Fix $n$, and consider $n!+1=(1\cdot2\cdot3\cdots(n-1)\cdot n)+1$.  If
$n!+1$ is prime, we are done.  Otherwise, $n!+1$ has a prime factor
$x$ (relies on the prime number theorem).  By definition, $n!+1$ is
divisible by $x$ (without leaving a remainder).  But if $n!+1$ is
divided by a number less than $n$, the remainder is 1.  Therefore,
$x>n$.
\end{proof}

(Note: $n!+1$ need not be prime.  $5!+1 = 11^2$.)

We don't know what $x$ is, only that it exists.

Intuitionists would deny this is a proof.

\subsection{Proof by Cases}

Proof by cases: 
    \begin{itemize}
    \item show $p\implies (a \vee b)$
    \item show $a \implies q$ and $b \implies q$
    \item deduce $p \implies q$
    \end{itemize}

\begin{theorem}
$(\forall x P(x)) \vee A$ implies $\forall x (P(x)
\vee A)$
\end{theorem}
\begin{proof}
To prove the theorem, we need to show that if the hypothesis is true,
then the consequent is true.  So suppose the hypothesis is true.
There are two cases: either $A$  is true or $A$ is false.

Case 1: $A$ if true.  If $A$ is true, then $P(x) \vee A$ is true
regardless of the truth of $P(x)$.  Thus, $\forall x (P(x) \vee A)$ is
true.

Case 2: $A$ is false.  If $A$ is false, then the only way for the
hypothesis to be true is for the other disjunct, namely $(\forall x
P(x))$, to be true.  But if $P(x)$ is always true then certainly $P(x)
\vee A$ is always true, in other words $\forall x (P(x) \vee A)$.
\end{proof}

%[[[80 minutes]]]

[[[Tom:  I think the timing is iffy.  This may run out of time around
here. Is this OK?  Should the rest be finished in recitation?  There's
nothing hard remaining.]]]


\subsection{Other Proof Methods}

\begin{itemize}
\item Indirect proof: from $\neg q \implies \neg p$, deduce $p
\implies q$ (similar to proof by contradiction).
\item Vacuous proof: if $p$ is false, then $p\implies q$ is true.
\begin{itemize}
\item if $x$ is an even prime greater than 2, then $x$ is a perfect
square.
\end{itemize}
\end{itemize}

\subsection{Fallacies}

There are several ways to generate an incorrect proof.

\begin{eqnarray*}
\sqrt{-1} &= &\sqrt{-1}\\
\sqrt{\frac{1}{-1}} &= &\sqrt{\frac{-1}{1}}\\
\frac{\sqrt{1}}{\sqrt{-1}} &= &\frac{\sqrt{-1}}{\sqrt{1}}\\
\sqrt{1}\cdot\sqrt{1} &= &\sqrt{-1}\cdot\sqrt{-1}\\
1 &= &-1\\
\end{eqnarray*}

Where's the bug?

There are several common fallacies:
\begin{description}
\item[Affirming the conclusion:]
\begin{itemize}
\item If you are tired, you will fall asleep
\item You fall asleep
\item therefore, you are tired
\end{itemize}
The fact that the conclusion is true does not make the hypothesis
true.  Maybe you are just bored.

\item[Denying the hypothesis:]
\begin{itemize}
\item If you work hard, you will pass the course
\item You don't work hard
\item therefore, you will fail the course.
\end{itemize}
Even if the hypothesis is false, the conclusion can be true.  Maybe
you are smart enough to pass without working.

\item[Circular reasoning:] proposition: If $n^2$ is not divisible by 3,
then $n$ is not divisible by 3.
\begin{itemize}
\item If $n^2$ is not divisible by 3, then $n^2$ is not
equal to $3k$ for any integer  $k$.
\item therefore, $n$ does not equal $3l$ for any integer $l$.
\item therefore, $n$ is not divisible by $3$.
\end{itemize}


\end{description}

If you assume (or prove) something FALSE, you can prove anything!


\remove{
\subsection{Peano's Axioms and Addition}

Present Peano arithmetic:
\begin{itemize}
\item
As an example of axioms, rules of inferences.
\item
As a way of defining the natural numbers.
Alternative:  Just assume as understood, with all the usual basic
notions: arithmetic operators, properties of those operators, etc.
\item
As an introduction to an important proof technique:  Induction.
This method is one of the most important methods for reasoning about
computational objects.
It's introduced here very formally, as an explicit axiom.
We will do lots of very formal examples to make sure you understand it
very well.
\end{itemize}

In practice, people do not write out real proofs about interesting
math objects in such a formal, step-by-step style.
(Unless they are using a computer-aided theorem prover, which really
does work step-by-step).
Rather, they work more intuitively, skipping a lot of steps.
Proof sketch.

But it is very important to work {\em correctly}, so that all the
missing steps could really be filled in.
It can be very hard to tell (impossible without some training) if a
proof sketch really is valid.
This course is designed to provide this training.

We will start here by doing some examples very formally, with all the
steps.
Then pretty soon, we start doing proof sketches.
Our goal is to give you enough experience so you can write correct
proof sketches, knowing that they can be completed.

Peano's Axioms define the natural numbers $\naturals$. 
We use two primitive symbols: $0$ and $'$ (successor).
\begin{enumerate}
\item $0 \in \naturals$
\item $\forall x \in \naturals,\ x' \in \naturals$
\item $\forall x,y \in \naturals,\ x'=y' \implies x = y$ (no two
numbers have same successor)
\item $\neg\exists x \in \naturals$ such that $0 = x'$  (equivalently, $\forall x
\in \naturals, x' \ne 0$)
\item (Induction) $\forall S \subseteq N$, if $0 \in S$ and $(x \in S
\implies x' \in S)$, then $S = \naturals$.
\end{enumerate}

Notation: $1 = 0'$, $2 = 1'$, etc.

Discuss these axioms a bit.
E.g., the first four are satisfied by the nonnegative reals.  It is
the fifth, the important Induction Axiom, that ensures that we
generate all of $\naturals$ by starting with $0$ and taking successors.

Starting from just this basis, we can define other operations and
prove their properties, working from the given simple axioms.

We define addition:
\begin{itemize}
\item $n+0 = n$ (implicit universal quantification)
\item $n+k' = (n+k)'$
\end{itemize}
This is a {\em recursive} definition: it lets us compute $n+k$ for any
$n, k$.  For example, 
\begin{eqnarray*}
3+2 &= &3+1'\\ &= &(3+1)'\\ &= &(3+0')'\\ &= &((3+0)')'\\ &=
&(3')'\\ &= &4'\\ &= &5.\\
\end{eqnarray*}

Addition is {\em commutative:} $m+n = n+m$.  How can we prove this?

\begin{lemma}
\label{lem:1}
$0+n=n$
\end{lemma}
\begin{proof}
Let $S = \{n\in \naturals \mid 0+n = n\}$ (``The set of all
$n\in\naturals$ such that $0+n=n$'').  We prove $S=\naturals$.
\begin{itemize} 
\item $0 \in S$ since $0+0 = 0$ by definition of $+$.
\item if $x\in S$, so that $0+x = x$, then 
\begin{eqnarray*}
0+x' &= &(0+x)'\quad\mbox{(definition of $+$)}\\
     &= &x', \quad\mbox{(since $x \in S$)}\\
\end{eqnarray*}
so $x'\in S$.  In other words, $\forall x, (x\in S) \implies (x' \in S)$.
\end{itemize}
Therefore, by the induction axiom, $S = \naturals$.
\end{proof}

\begin{lemma}
$m'+n = m+n'$
\end{lemma}
\begin{proof}
Fix $m$.  Let $S = \{n \mid m'+n = m+n'\}$. We prove $S = \naturals$. 
\begin{itemize}
\item $0 \in S$, since $m'+0 = m' = (m+0)' = m+0'$
\item if $n \in S$, so that $m'+n = m+n'$, then
\begin{eqnarray*}
m'+n' &= &(m'+n)'\quad \mbox{(definition of $+$)}\\
      &= &(m+n')'\quad \mbox{(true for $n$)}\\
      &= & m+(n')'\quad \mbox{(definition of $+$)}
\end{eqnarray*}
\end{itemize}
Since $0\in S$, and $n \in S  \implies n' \in S$, the induction axiom
proves $S=\naturals$.  We proved $P(m)$, therefore by universal
generalization, we know that $(\forall m)P(m)$.
\end{proof}

\begin{lemma}
$m+n = n+m$
\end{lemma}
\begin{proof}
Let $S = \{n \mid ( \forall m)m+n = n+m\}$. We prove $S = \naturals$. 
\begin{itemize}
\item $0 \in S$, since $m+0 = m = 0+m$ by Lemma~\ref{lem:1}.
\item Suppose $n \in S$, so that $(\forall m) m+n=n+m$.  Then
\begin{eqnarray*}
m+n' &= &(m+n)' \quad \mbox{(definition)}\\
     &= &(n+m)' \quad \mbox{(true for $n$)}\\
     &= &n+m'   \quad \mbox{(definition)}\\
     &= &n'+m   \quad \mbox{(previous lemma)}
\end{eqnarray*}
\end{itemize}
Therefore, $S=\naturals$ by induction axiom.
\end{proof}

Have we been rigorous?  No: naive set theory.  Set theory axioms are
harder than you might think.

Real numbers can be defined by about 10 axioms.
}
%[[[60 minutes]]]

\section{How To Prove Things}

Now we discuss how proofs are actually done in practice.
Sketches that it's supposed to be possible to complete.

We discuss some proofs that have arisen in actual math practice.
Also algorithm proofs.

Then say what we actually expect in this course.

Then start doing through a catalog of practical proof methods.
Some simple ones today, next two days concentrate on induction.

\subsection{Some Actual Proofs...}

Rigorous logical proof systems are nice, but no one really
has the time or energy to be so careful.  We prove things in a less
formal way.   The objective is to convince everyone that a truly
rigorous proof could be built if someone took the time to do it.  
As a result, even great mathematicians can goof proofs.
\begin{itemize}
\item Andrew Wiles and Fermat's Last Theorem
\item Kempe's invalid ``proof'' of the Four Color Theorem stood for 10
years (1879--1890)
\item Gauss's 1799 Ph.D. thesis is usually referred to as being the
first rigorous proof of the Fundamental Theorem of Algebra (every
polynomial has a zero over the complex numbers).  But it contains
quotes like
\begin{quote}
  "If a branch of an algebraic curve enters a bounded region, it
   must necessarily leave it again. ... Nobody, to my knowledge,
   has ever doubted [this fact].  But if anybody desires it, then
   on another occasion I intend to give a demonstration which will
   leave no doubt."
\end{quote}
Fields Medalist Steve Smale writes about this, calling it an "immense
gap" in the proof that was not filled in until 1920, more than a hundred
years later.
\item In 1900 Poincare carelessly claimed a certain very simple topological 
characterization of the 3-dimensional sphere.  Later realizing it was 
not so obvious, he demoted the claim to the status of a "conjecture" 
in 1904.  The Poincare Conjecture is now one of the biggest open questions
in mathematics (two Fields Medals have been given out for partial progress
on it).
\item In the 1940's Paul Erdos conjectured a certain combinatorial fact about 
arithmetic progressions (every set of natural numbers of positive density 
contains arbitrarily long arithmetic progressions), and offered \$1000 for a
proof or disproof.  Endre Szemeredi proved the conjecture in 1972, but
the proof was so long and badly written that Erdos was not sure whether
to believe it.  Finally, Andras Hajnal stepped in and wrote a much clearer
version of the same proof, which was eventually published under Szemeredi's
name.  At some point during the write-up, Hajnal informed Erdos that
he was now confident enough of the proof that he was willing to buy it 
from Szemeredi for \$500.
\item  There's also the story of Newton waiting 20 years to publish
the Principia because he didn't see how to prove one could assume all
the mass of a sphere to be concentrated at its center when calculating
gravitational attraction.  The proof ultimately required the invention 
of calculus ...

\end{itemize}

In programming, the current state of the art is that people do not
actually prove correctness of running programs.
There has been a lot of research directed toward making this possible,
but it hasn't yet gotten far enough to be practical.
The problem is that the concepts that have to be reasoned about seem
too low-level, complicated in their details.

In contrast, people do know how to model programs/systems 
abstractly, and prove correctness of the abstract versions.
E.g., the {\em algorithm} used in a communication protocol can be
described formally, and its correctness proved.
But there is still a gap between what is verified and the actual code
that runs on real systems -- programmers implement algorithms in a
rather ad hoc manner, and errors can creep in there.
There isn't much available now to help programmers bridge this gap.

The high-level algorithm proofs are usually done as sketches.
Some are very complicated, and some errors have been found in
published proofs.
There is also considerable research in actually doing complete
algorithm proofs axiomatically, and having a computer tool (an
``automatic theorem-prover'') help in checking or even filling in the
low-level steps.
This sort of work is becoming practical.

Whether done by hand or with computer assistance, algorithm proofs are
of great help in getting your programs right (and understanding why).
I think this will be done much more in the future.
Will become an important part of quality assurance for programs.
It takes a lot of work to do it.
And you have to understand formal logic proofs to do it.

\subsection{What we Expect in this Course}

Basic objective: like a scientific experiment, it has to be possible
for someone else to ``replicate'' (ie, understand) your proof.

In the real world, anything that can be cited can be used without
proof.  But in homework, where everything we ask you to prove is already
known, this defeats the purpose (namely, learning how to prove
something that isn't already known).  

We don't expect you to reprove arithmetic.  Anything from high school
math can be used without proof.  
[[[Tom:  Presumably this doesn't mean in the first assignment, where
Peano axioms are being exercised.]]]

Once something has been proved, you can use it again without proof,
citing the theorem.  Once it has been used so often as to become
commonplace, you can even stop citing the theorem.

No new axioms!

When in doubt about whether something can be stated without proof,
prove it!

Elements of a proof:
\begin{itemize}
\item correctness
\item clarity
\item brevity
\item elegance
\end{itemize}
``The book proof'' (Paul Erdos).

[[[David listed the above characteristics.  I would add some more:]]]

A good proof:
\begin{itemize}
\item
Has nice structure, like a good program.
It is broken up into separate ``lemmas'' that prove key intermediate
properties.
This makes it easy to understand the {\em reasons} why the whole thing
works.
It also makes it more likely that pieces can be reused.
\item
Has its pieces presented abstractly and generally. 
If you give an intermediate fact, state it as generally as you can. 
This avoids cluttering up a key piece of a proof with unnecessary
hypotheses and arguments.
It also makes it more likely you can reuse the piece.

This is exactly analogous to what you do in designing subroutines for
programs -- make them general and abstract.
\end{itemize}





\end{document}
