datatype Tree = Leaf | Node(Tree, T, Tree) function Mirror(t: Tree): Tree { match t case Leaf => Leaf case Node(left, x, right) => Node(Mirror(right), x, Mirror(left)) } lemma MirrorMirror(t: Tree) ensures Mirror(Mirror(t)) == t { match t case Leaf => case Node(left, x, right) => calc { Mirror(Mirror(t)); == // what t is Mirror(Mirror(Node(left, x, right))); == // def. Mirror Mirror(Node(Mirror(right), x, Mirror(left))); == // def. Mirror Node(Mirror(Mirror(left)), x, Mirror(Mirror(right))); == { MirrorMirror(left); MirrorMirror(right); } // induction hypothesis Node(left, x, right); == // what t is t; } }