8749
|
1 |
\begin{isabelle}%
|
|
2 |
%
|
|
3 |
\begin{isamarkuptext}%
|
|
4 |
To minimize running time, each node of a trie should contain an array that maps
|
|
5 |
letters to subtries. We have chosen a (sometimes) more space efficient
|
|
6 |
representation where the subtries are held in an association list, i.e.\ a
|
|
7 |
list of (letter,trie) pairs. Abstracting over the alphabet \isa{'a} and the
|
|
8 |
values \isa{'v} we define a trie as follows:%
|
|
9 |
\end{isamarkuptext}%
|
|
10 |
\isacommand{datatype}~('a,'v)trie~=~Trie~~{"}'v~option{"}~~{"}('a~*~('a,'v)trie)list{"}%
|
|
11 |
\begin{isamarkuptext}%
|
|
12 |
\noindent
|
|
13 |
The first component is the optional value, the second component the
|
|
14 |
association list of subtries. This is an example of nested recursion involving products,
|
|
15 |
which is fine because products are datatypes as well.
|
|
16 |
We define two selector functions:%
|
|
17 |
\end{isamarkuptext}%
|
|
18 |
\isacommand{consts}~value~::~{"}('a,'v)trie~{\isasymRightarrow}~'v~option{"}\isanewline
|
|
19 |
~~~~~~~alist~::~{"}('a,'v)trie~{\isasymRightarrow}~('a~*~('a,'v)trie)list{"}\isanewline
|
|
20 |
\isacommand{primrec}~{"}value(Trie~ov~al)~=~ov{"}\isanewline
|
|
21 |
\isacommand{primrec}~{"}alist(Trie~ov~al)~=~al{"}%
|
|
22 |
\begin{isamarkuptext}%
|
|
23 |
\noindent
|
|
24 |
Association lists come with a generic lookup function:%
|
|
25 |
\end{isamarkuptext}%
|
|
26 |
\isacommand{consts}~~~assoc~::~{"}('key~*~'val)list~{\isasymRightarrow}~'key~{\isasymRightarrow}~'val~option{"}\isanewline
|
|
27 |
\isacommand{primrec}~{"}assoc~[]~x~=~None{"}\isanewline
|
|
28 |
~~~~~~~~{"}assoc~(p\#ps)~x~=\isanewline
|
|
29 |
~~~~~~~~~~~(let~(a,b)~=~p~in~if~a=x~then~Some~b~else~assoc~ps~x){"}%
|
|
30 |
\begin{isamarkuptext}%
|
|
31 |
Now we can define the lookup function for tries. It descends into the trie
|
|
32 |
examining the letters of the search string one by one. As
|
|
33 |
recursion on lists is simpler than on tries, let us express this as primitive
|
|
34 |
recursion on the search string argument:%
|
|
35 |
\end{isamarkuptext}%
|
|
36 |
\isacommand{consts}~~~lookup~::~{"}('a,'v)trie~{\isasymRightarrow}~'a~list~{\isasymRightarrow}~'v~option{"}\isanewline
|
|
37 |
\isacommand{primrec}~{"}lookup~t~[]~=~value~t{"}\isanewline
|
|
38 |
~~~~~~~~{"}lookup~t~(a\#as)~=~(case~assoc~(alist~t)~a~of\isanewline
|
|
39 |
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~None~{\isasymRightarrow}~None\isanewline
|
|
40 |
~~~~~~~~~~~~~~~~~~~~~~~~~~~~|~Some~at~{\isasymRightarrow}~lookup~at~as){"}%
|
|
41 |
\begin{isamarkuptext}%
|
|
42 |
As a first simple property we prove that looking up a string in the empty
|
|
43 |
trie \isa{Trie~None~[]} always returns \isa{None}. The proof merely
|
|
44 |
distinguishes the two cases whether the search string is empty or not:%
|
|
45 |
\end{isamarkuptext}%
|
|
46 |
\isacommand{lemma}~[simp]:~{"}lookup~(Trie~None~[])~as~=~None{"}\isanewline
|
8771
|
47 |
\isacommand{apply}(case\_tac~as,~auto)\isacommand{.}%
|
8749
|
48 |
\begin{isamarkuptext}%
|
|
49 |
Things begin to get interesting with the definition of an update function
|
|
50 |
that adds a new (string,value) pair to a trie, overwriting the old value
|
|
51 |
associated with that string:%
|
|
52 |
\end{isamarkuptext}%
|
|
53 |
\isacommand{consts}~update~::~{"}('a,'v)trie~{\isasymRightarrow}~'a~list~{\isasymRightarrow}~'v~{\isasymRightarrow}~('a,'v)trie{"}\isanewline
|
|
54 |
\isacommand{primrec}\isanewline
|
|
55 |
~~{"}update~t~[]~~~~~v~=~Trie~(Some~v)~(alist~t){"}\isanewline
|
|
56 |
~~{"}update~t~(a\#as)~v~=\isanewline
|
|
57 |
~~~~~(let~tt~=~(case~assoc~(alist~t)~a~of\isanewline
|
|
58 |
~~~~~~~~~~~~~~~~~~None~{\isasymRightarrow}~Trie~None~[]~|~Some~at~{\isasymRightarrow}~at)\isanewline
|
|
59 |
~~~~~~in~Trie~(value~t)~((a,update~tt~as~v)\#alist~t)){"}%
|
|
60 |
\begin{isamarkuptext}%
|
|
61 |
\noindent
|
|
62 |
The base case is obvious. In the recursive case the subtrie
|
|
63 |
\isa{tt} associated with the first letter \isa{a} is extracted,
|
|
64 |
recursively updated, and then placed in front of the association list.
|
|
65 |
The old subtrie associated with \isa{a} is still in the association list
|
|
66 |
but no longer accessible via \isa{assoc}. Clearly, there is room here for
|
|
67 |
optimizations!
|
|
68 |
|
|
69 |
Before we start on any proofs about \isa{update} we tell the simplifier to
|
|
70 |
expand all \isa{let}s and to split all \isa{case}-constructs over
|
|
71 |
options:%
|
|
72 |
\end{isamarkuptext}%
|
|
73 |
\isacommand{theorems}~[simp]~=~Let\_def\isanewline
|
|
74 |
\isacommand{theorems}~[split]~=~option.split%
|
|
75 |
\begin{isamarkuptext}%
|
|
76 |
\noindent
|
|
77 |
The reason becomes clear when looking (probably after a failed proof
|
|
78 |
attempt) at the body of \isa{update}: it contains both
|
|
79 |
\isa{let} and a case distinction over type \isa{option}.
|
|
80 |
|
|
81 |
Our main goal is to prove the correct interaction of \isa{update} and
|
|
82 |
\isa{lookup}:%
|
|
83 |
\end{isamarkuptext}%
|
|
84 |
\isacommand{theorem}~{"}{\isasymforall}t~v~bs.~lookup~(update~t~as~v)~bs~=\isanewline
|
|
85 |
~~~~~~~~~~~~~~~~~~~~(if~as=bs~then~Some~v~else~lookup~t~bs){"}%
|
|
86 |
\begin{isamarkuptxt}%
|
|
87 |
\noindent
|
|
88 |
Our plan is to induct on \isa{as}; hence the remaining variables are
|
|
89 |
quantified. From the definitions it is clear that induction on either
|
|
90 |
\isa{as} or \isa{bs} is required. The choice of \isa{as} is merely
|
|
91 |
guided by the intuition that simplification of \isa{lookup} might be easier
|
|
92 |
if \isa{update} has already been simplified, which can only happen if
|
|
93 |
\isa{as} is instantiated.
|
|
94 |
The start of the proof is completely conventional:%
|
|
95 |
\end{isamarkuptxt}%
|
8771
|
96 |
\isacommand{apply}(induct\_tac~as,~auto)%
|
8749
|
97 |
\begin{isamarkuptxt}%
|
|
98 |
\noindent
|
|
99 |
Unfortunately, this time we are left with three intimidating looking subgoals:
|
|
100 |
\begin{isabellepar}%
|
|
101 |
~1.~\dots~{\isasymLongrightarrow}~lookup~\dots~bs~=~lookup~t~bs\isanewline
|
|
102 |
~2.~\dots~{\isasymLongrightarrow}~lookup~\dots~bs~=~lookup~t~bs\isanewline
|
|
103 |
~3.~\dots~{\isasymLongrightarrow}~lookup~\dots~bs~=~lookup~t~bs%
|
|
104 |
\end{isabellepar}%
|
|
105 |
Clearly, if we want to make headway we have to instantiate \isa{bs} as
|
|
106 |
well now. It turns out that instead of induction, case distinction
|
|
107 |
suffices:%
|
|
108 |
\end{isamarkuptxt}%
|
|
109 |
\isacommand{apply}(case\_tac[!]~bs)\isanewline
|
|
110 |
\isacommand{apply}(auto)\isacommand{.}%
|
|
111 |
\begin{isamarkuptext}%
|
|
112 |
\noindent
|
|
113 |
Both \isaindex{case_tac} and \isaindex{induct_tac}
|
|
114 |
take an optional first argument that specifies the range of subgoals they are
|
8771
|
115 |
applied to, where \isa{!} means all subgoals, i.e.\ \isa{[1-3]} in our case. Individual
|
|
116 |
subgoal numbers are also allowed.
|
8749
|
117 |
|
|
118 |
This proof may look surprisingly straightforward. However, note that this
|
|
119 |
comes at a cost: the proof script is unreadable because the
|
|
120 |
intermediate proof states are invisible, and we rely on the (possibly
|
|
121 |
brittle) magic of \isa{auto} (after the induction) to split the remaining
|
|
122 |
goals up in such a way that case distinction on \isa{bs} makes sense and
|
|
123 |
solves the proof. Part~\ref{Isar} shows you how to write readable and stable
|
|
124 |
proofs.%
|
|
125 |
\end{isamarkuptext}%
|
|
126 |
\end{isabelle}%
|