9722
|
1 |
%
|
|
2 |
\begin{isabellebody}%
|
9924
|
3 |
\def\isabellecontext{Trie}%
|
17056
|
4 |
%
|
|
5 |
\isadelimtheory
|
|
6 |
%
|
|
7 |
\endisadelimtheory
|
|
8 |
%
|
|
9 |
\isatagtheory
|
|
10 |
%
|
|
11 |
\endisatagtheory
|
|
12 |
{\isafoldtheory}%
|
|
13 |
%
|
|
14 |
\isadelimtheory
|
|
15 |
%
|
|
16 |
\endisadelimtheory
|
8749
|
17 |
%
|
|
18 |
\begin{isamarkuptext}%
|
|
19 |
To minimize running time, each node of a trie should contain an array that maps
|
10795
|
20 |
letters to subtries. We have chosen a
|
8749
|
21 |
representation where the subtries are held in an association list, i.e.\ a
|
9792
|
22 |
list of (letter,trie) pairs. Abstracting over the alphabet \isa{{\isacharprime}a} and the
|
|
23 |
values \isa{{\isacharprime}v} we define a trie as follows:%
|
8749
|
24 |
\end{isamarkuptext}%
|
17175
|
25 |
\isamarkuptrue%
|
|
26 |
\isacommand{datatype}\isamarkupfalse%
|
|
27 |
\ {\isacharparenleft}{\isacharprime}a{\isacharcomma}{\isacharprime}v{\isacharparenright}trie\ {\isacharequal}\ Trie\ \ {\isachardoublequoteopen}{\isacharprime}v\ option{\isachardoublequoteclose}\ \ {\isachardoublequoteopen}{\isacharparenleft}{\isacharprime}a\ {\isacharasterisk}\ {\isacharparenleft}{\isacharprime}a{\isacharcomma}{\isacharprime}v{\isacharparenright}trie{\isacharparenright}list{\isachardoublequoteclose}%
|
8749
|
28 |
\begin{isamarkuptext}%
|
|
29 |
\noindent
|
11480
|
30 |
\index{datatypes!and nested recursion}%
|
8749
|
31 |
The first component is the optional value, the second component the
|
|
32 |
association list of subtries. This is an example of nested recursion involving products,
|
|
33 |
which is fine because products are datatypes as well.
|
|
34 |
We define two selector functions:%
|
|
35 |
\end{isamarkuptext}%
|
17175
|
36 |
\isamarkuptrue%
|
|
37 |
\isacommand{consts}\isamarkupfalse%
|
|
38 |
\ value\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}{\isacharparenleft}{\isacharprime}a{\isacharcomma}{\isacharprime}v{\isacharparenright}trie\ {\isasymRightarrow}\ {\isacharprime}v\ option{\isachardoublequoteclose}\isanewline
|
|
39 |
\ \ \ \ \ \ \ alist\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}{\isacharparenleft}{\isacharprime}a{\isacharcomma}{\isacharprime}v{\isacharparenright}trie\ {\isasymRightarrow}\ {\isacharparenleft}{\isacharprime}a\ {\isacharasterisk}\ {\isacharparenleft}{\isacharprime}a{\isacharcomma}{\isacharprime}v{\isacharparenright}trie{\isacharparenright}list{\isachardoublequoteclose}\isanewline
|
|
40 |
\isacommand{primrec}\isamarkupfalse%
|
|
41 |
\ {\isachardoublequoteopen}value{\isacharparenleft}Trie\ ov\ al{\isacharparenright}\ {\isacharequal}\ ov{\isachardoublequoteclose}\isanewline
|
|
42 |
\isacommand{primrec}\isamarkupfalse%
|
|
43 |
\ {\isachardoublequoteopen}alist{\isacharparenleft}Trie\ ov\ al{\isacharparenright}\ {\isacharequal}\ al{\isachardoublequoteclose}%
|
8749
|
44 |
\begin{isamarkuptext}%
|
|
45 |
\noindent
|
11309
|
46 |
Association lists come with a generic lookup function. Its result
|
|
47 |
involves type \isa{option} because a lookup can fail:%
|
8749
|
48 |
\end{isamarkuptext}%
|
17175
|
49 |
\isamarkuptrue%
|
|
50 |
\isacommand{consts}\isamarkupfalse%
|
|
51 |
\ \ \ assoc\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}{\isacharparenleft}{\isacharprime}key\ {\isacharasterisk}\ {\isacharprime}val{\isacharparenright}list\ {\isasymRightarrow}\ {\isacharprime}key\ {\isasymRightarrow}\ {\isacharprime}val\ option{\isachardoublequoteclose}\isanewline
|
|
52 |
\isacommand{primrec}\isamarkupfalse%
|
|
53 |
\ {\isachardoublequoteopen}assoc\ {\isacharbrackleft}{\isacharbrackright}\ x\ {\isacharequal}\ None{\isachardoublequoteclose}\isanewline
|
|
54 |
\ \ \ \ \ \ \ \ {\isachardoublequoteopen}assoc\ {\isacharparenleft}p{\isacharhash}ps{\isacharparenright}\ x\ {\isacharequal}\isanewline
|
|
55 |
\ \ \ \ \ \ \ \ \ \ \ {\isacharparenleft}let\ {\isacharparenleft}a{\isacharcomma}b{\isacharparenright}\ {\isacharequal}\ p\ in\ if\ a{\isacharequal}x\ then\ Some\ b\ else\ assoc\ ps\ x{\isacharparenright}{\isachardoublequoteclose}%
|
8749
|
56 |
\begin{isamarkuptext}%
|
|
57 |
Now we can define the lookup function for tries. It descends into the trie
|
|
58 |
examining the letters of the search string one by one. As
|
|
59 |
recursion on lists is simpler than on tries, let us express this as primitive
|
|
60 |
recursion on the search string argument:%
|
|
61 |
\end{isamarkuptext}%
|
17175
|
62 |
\isamarkuptrue%
|
|
63 |
\isacommand{consts}\isamarkupfalse%
|
|
64 |
\ \ \ lookup\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}{\isacharparenleft}{\isacharprime}a{\isacharcomma}{\isacharprime}v{\isacharparenright}trie\ {\isasymRightarrow}\ {\isacharprime}a\ list\ {\isasymRightarrow}\ {\isacharprime}v\ option{\isachardoublequoteclose}\isanewline
|
|
65 |
\isacommand{primrec}\isamarkupfalse%
|
|
66 |
\ {\isachardoublequoteopen}lookup\ t\ {\isacharbrackleft}{\isacharbrackright}\ {\isacharequal}\ value\ t{\isachardoublequoteclose}\isanewline
|
|
67 |
\ \ \ \ \ \ \ \ {\isachardoublequoteopen}lookup\ t\ {\isacharparenleft}a{\isacharhash}as{\isacharparenright}\ {\isacharequal}\ {\isacharparenleft}case\ assoc\ {\isacharparenleft}alist\ t{\isacharparenright}\ a\ of\isanewline
|
9521
|
68 |
\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ None\ {\isasymRightarrow}\ None\isanewline
|
17175
|
69 |
\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ {\isacharbar}\ Some\ at\ {\isasymRightarrow}\ lookup\ at\ as{\isacharparenright}{\isachardoublequoteclose}%
|
8749
|
70 |
\begin{isamarkuptext}%
|
|
71 |
As a first simple property we prove that looking up a string in the empty
|
9792
|
72 |
trie \isa{Trie\ None\ {\isacharbrackleft}{\isacharbrackright}} always returns \isa{None}. The proof merely
|
8749
|
73 |
distinguishes the two cases whether the search string is empty or not:%
|
|
74 |
\end{isamarkuptext}%
|
17175
|
75 |
\isamarkuptrue%
|
|
76 |
\isacommand{lemma}\isamarkupfalse%
|
|
77 |
\ {\isacharbrackleft}simp{\isacharbrackright}{\isacharcolon}\ {\isachardoublequoteopen}lookup\ {\isacharparenleft}Trie\ None\ {\isacharbrackleft}{\isacharbrackright}{\isacharparenright}\ as\ {\isacharequal}\ None{\isachardoublequoteclose}\isanewline
|
17056
|
78 |
%
|
|
79 |
\isadelimproof
|
|
80 |
%
|
|
81 |
\endisadelimproof
|
|
82 |
%
|
|
83 |
\isatagproof
|
17175
|
84 |
\isacommand{apply}\isamarkupfalse%
|
|
85 |
{\isacharparenleft}case{\isacharunderscore}tac\ as{\isacharcomma}\ simp{\isacharunderscore}all{\isacharparenright}\isanewline
|
|
86 |
\isacommand{done}\isamarkupfalse%
|
|
87 |
%
|
17056
|
88 |
\endisatagproof
|
|
89 |
{\isafoldproof}%
|
|
90 |
%
|
|
91 |
\isadelimproof
|
|
92 |
%
|
|
93 |
\endisadelimproof
|
11866
|
94 |
%
|
8749
|
95 |
\begin{isamarkuptext}%
|
|
96 |
Things begin to get interesting with the definition of an update function
|
12328
|
97 |
that adds a new (string, value) pair to a trie, overwriting the old value
|
8749
|
98 |
associated with that string:%
|
|
99 |
\end{isamarkuptext}%
|
17175
|
100 |
\isamarkuptrue%
|
|
101 |
\isacommand{consts}\isamarkupfalse%
|
|
102 |
\ update\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}{\isacharparenleft}{\isacharprime}a{\isacharcomma}{\isacharprime}v{\isacharparenright}trie\ {\isasymRightarrow}\ {\isacharprime}a\ list\ {\isasymRightarrow}\ {\isacharprime}v\ {\isasymRightarrow}\ {\isacharparenleft}{\isacharprime}a{\isacharcomma}{\isacharprime}v{\isacharparenright}trie{\isachardoublequoteclose}\isanewline
|
|
103 |
\isacommand{primrec}\isamarkupfalse%
|
|
104 |
\isanewline
|
|
105 |
\ \ {\isachardoublequoteopen}update\ t\ {\isacharbrackleft}{\isacharbrackright}\ \ \ \ \ v\ {\isacharequal}\ Trie\ {\isacharparenleft}Some\ v{\isacharparenright}\ {\isacharparenleft}alist\ t{\isacharparenright}{\isachardoublequoteclose}\isanewline
|
|
106 |
\ \ {\isachardoublequoteopen}update\ t\ {\isacharparenleft}a{\isacharhash}as{\isacharparenright}\ v\ {\isacharequal}\isanewline
|
9674
|
107 |
\ \ \ \ \ {\isacharparenleft}let\ tt\ {\isacharequal}\ {\isacharparenleft}case\ assoc\ {\isacharparenleft}alist\ t{\isacharparenright}\ a\ of\isanewline
|
|
108 |
\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ None\ {\isasymRightarrow}\ Trie\ None\ {\isacharbrackleft}{\isacharbrackright}\ {\isacharbar}\ Some\ at\ {\isasymRightarrow}\ at{\isacharparenright}\isanewline
|
17175
|
109 |
\ \ \ \ \ \ in\ Trie\ {\isacharparenleft}value\ t{\isacharparenright}\ {\isacharparenleft}{\isacharparenleft}a{\isacharcomma}update\ tt\ as\ v{\isacharparenright}\ {\isacharhash}\ alist\ t{\isacharparenright}{\isacharparenright}{\isachardoublequoteclose}%
|
8749
|
110 |
\begin{isamarkuptext}%
|
|
111 |
\noindent
|
|
112 |
The base case is obvious. In the recursive case the subtrie
|
|
113 |
\isa{tt} associated with the first letter \isa{a} is extracted,
|
|
114 |
recursively updated, and then placed in front of the association list.
|
|
115 |
The old subtrie associated with \isa{a} is still in the association list
|
|
116 |
but no longer accessible via \isa{assoc}. Clearly, there is room here for
|
|
117 |
optimizations!
|
|
118 |
|
|
119 |
Before we start on any proofs about \isa{update} we tell the simplifier to
|
|
120 |
expand all \isa{let}s and to split all \isa{case}-constructs over
|
|
121 |
options:%
|
|
122 |
\end{isamarkuptext}%
|
17175
|
123 |
\isamarkuptrue%
|
|
124 |
\isacommand{declare}\isamarkupfalse%
|
|
125 |
\ Let{\isacharunderscore}def{\isacharbrackleft}simp{\isacharbrackright}\ option{\isachardot}split{\isacharbrackleft}split{\isacharbrackright}%
|
8749
|
126 |
\begin{isamarkuptext}%
|
|
127 |
\noindent
|
|
128 |
The reason becomes clear when looking (probably after a failed proof
|
|
129 |
attempt) at the body of \isa{update}: it contains both
|
|
130 |
\isa{let} and a case distinction over type \isa{option}.
|
|
131 |
|
|
132 |
Our main goal is to prove the correct interaction of \isa{update} and
|
|
133 |
\isa{lookup}:%
|
|
134 |
\end{isamarkuptext}%
|
17175
|
135 |
\isamarkuptrue%
|
|
136 |
\isacommand{theorem}\isamarkupfalse%
|
|
137 |
\ {\isachardoublequoteopen}{\isasymforall}t\ v\ bs{\isachardot}\ lookup\ {\isacharparenleft}update\ t\ as\ v{\isacharparenright}\ bs\ {\isacharequal}\isanewline
|
|
138 |
\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ {\isacharparenleft}if\ as{\isacharequal}bs\ then\ Some\ v\ else\ lookup\ t\ bs{\isacharparenright}{\isachardoublequoteclose}%
|
17056
|
139 |
\isadelimproof
|
|
140 |
%
|
|
141 |
\endisadelimproof
|
|
142 |
%
|
|
143 |
\isatagproof
|
16069
|
144 |
%
|
|
145 |
\begin{isamarkuptxt}%
|
|
146 |
\noindent
|
|
147 |
Our plan is to induct on \isa{as}; hence the remaining variables are
|
|
148 |
quantified. From the definitions it is clear that induction on either
|
|
149 |
\isa{as} or \isa{bs} is required. The choice of \isa{as} is
|
|
150 |
guided by the intuition that simplification of \isa{lookup} might be easier
|
|
151 |
if \isa{update} has already been simplified, which can only happen if
|
|
152 |
\isa{as} is instantiated.
|
|
153 |
The start of the proof is conventional:%
|
|
154 |
\end{isamarkuptxt}%
|
17175
|
155 |
\isamarkuptrue%
|
|
156 |
\isacommand{apply}\isamarkupfalse%
|
|
157 |
{\isacharparenleft}induct{\isacharunderscore}tac\ as{\isacharcomma}\ auto{\isacharparenright}%
|
16069
|
158 |
\begin{isamarkuptxt}%
|
|
159 |
\noindent
|
|
160 |
Unfortunately, this time we are left with three intimidating looking subgoals:
|
|
161 |
\begin{isabelle}
|
|
162 |
~1.~\dots~{\isasymLongrightarrow}~lookup~\dots~bs~=~lookup~t~bs\isanewline
|
|
163 |
~2.~\dots~{\isasymLongrightarrow}~lookup~\dots~bs~=~lookup~t~bs\isanewline
|
|
164 |
~3.~\dots~{\isasymLongrightarrow}~lookup~\dots~bs~=~lookup~t~bs
|
|
165 |
\end{isabelle}
|
|
166 |
Clearly, if we want to make headway we have to instantiate \isa{bs} as
|
|
167 |
well now. It turns out that instead of induction, case distinction
|
|
168 |
suffices:%
|
|
169 |
\end{isamarkuptxt}%
|
17175
|
170 |
\isamarkuptrue%
|
|
171 |
\isacommand{apply}\isamarkupfalse%
|
|
172 |
{\isacharparenleft}case{\isacharunderscore}tac{\isacharbrackleft}{\isacharbang}{\isacharbrackright}\ bs{\isacharcomma}\ auto{\isacharparenright}\isanewline
|
|
173 |
\isacommand{done}\isamarkupfalse%
|
|
174 |
%
|
17056
|
175 |
\endisatagproof
|
|
176 |
{\isafoldproof}%
|
|
177 |
%
|
|
178 |
\isadelimproof
|
|
179 |
%
|
|
180 |
\endisadelimproof
|
11866
|
181 |
%
|
8749
|
182 |
\begin{isamarkuptext}%
|
|
183 |
\noindent
|
11480
|
184 |
\index{subgoal numbering}%
|
9541
|
185 |
All methods ending in \isa{tac} take an optional first argument that
|
9792
|
186 |
specifies the range of subgoals they are applied to, where \isa{{\isacharbrackleft}{\isacharbang}{\isacharbrackright}} means
|
10187
|
187 |
all subgoals, i.e.\ \isa{{\isacharbrackleft}{\isadigit{1}}{\isacharminus}{\isadigit{3}}{\isacharbrackright}} in our case. Individual subgoal numbers,
|
|
188 |
e.g. \isa{{\isacharbrackleft}{\isadigit{2}}{\isacharbrackright}} are also allowed.
|
8749
|
189 |
|
|
190 |
This proof may look surprisingly straightforward. However, note that this
|
9792
|
191 |
comes at a cost: the proof script is unreadable because the intermediate
|
|
192 |
proof states are invisible, and we rely on the (possibly brittle) magic of
|
10971
|
193 |
\isa{auto} (\isa{simp{\isacharunderscore}all} will not do --- try it) to split the subgoals
|
9792
|
194 |
of the induction up in such a way that case distinction on \isa{bs} makes
|
11480
|
195 |
sense and solves the proof.
|
11294
|
196 |
|
|
197 |
\begin{exercise}
|
|
198 |
Modify \isa{update} (and its type) such that it allows both insertion and
|
11304
|
199 |
deletion of entries with a single function. Prove the corresponding version
|
|
200 |
of the main theorem above.
|
|
201 |
Optimize your function such that it shrinks tries after
|
|
202 |
deletion if possible.
|
11294
|
203 |
\end{exercise}
|
|
204 |
|
|
205 |
\begin{exercise}
|
|
206 |
Write an improved version of \isa{update} that does not suffer from the
|
|
207 |
space leak (pointed out above) caused by not deleting overwritten entries
|
|
208 |
from the association list. Prove the main theorem for your improved
|
|
209 |
\isa{update}.
|
|
210 |
\end{exercise}
|
|
211 |
|
|
212 |
\begin{exercise}
|
|
213 |
Conceptually, each node contains a mapping from letters to optional
|
|
214 |
subtries. Above we have implemented this by means of an association
|
|
215 |
list. Replay the development replacing \isa{{\isacharparenleft}{\isacharprime}a\ {\isasymtimes}\ {\isacharparenleft}{\isacharprime}a{\isacharcomma}\ {\isacharprime}v{\isacharparenright}\ trie{\isacharparenright}\ list}
|
14179
|
216 |
with \isa{{\isacharprime}a\ {\isasymrightharpoonup}\ {\isacharparenleft}{\isacharprime}a{\isacharcomma}\ {\isacharprime}v{\isacharparenright}\ trie}.
|
11294
|
217 |
\end{exercise}%
|
8749
|
218 |
\end{isamarkuptext}%
|
17175
|
219 |
\isamarkuptrue%
|
17056
|
220 |
%
|
|
221 |
\isadelimproof
|
|
222 |
%
|
|
223 |
\endisadelimproof
|
|
224 |
%
|
|
225 |
\isatagproof
|
|
226 |
%
|
|
227 |
\endisatagproof
|
|
228 |
{\isafoldproof}%
|
|
229 |
%
|
|
230 |
\isadelimproof
|
|
231 |
%
|
|
232 |
\endisadelimproof
|
|
233 |
%
|
|
234 |
\isadelimproof
|
|
235 |
%
|
|
236 |
\endisadelimproof
|
|
237 |
%
|
|
238 |
\isatagproof
|
|
239 |
%
|
|
240 |
\endisatagproof
|
|
241 |
{\isafoldproof}%
|
|
242 |
%
|
|
243 |
\isadelimproof
|
|
244 |
%
|
|
245 |
\endisadelimproof
|
|
246 |
%
|
|
247 |
\isadelimproof
|
|
248 |
%
|
|
249 |
\endisadelimproof
|
|
250 |
%
|
|
251 |
\isatagproof
|
|
252 |
%
|
|
253 |
\endisatagproof
|
|
254 |
{\isafoldproof}%
|
|
255 |
%
|
|
256 |
\isadelimproof
|
|
257 |
%
|
|
258 |
\endisadelimproof
|
|
259 |
%
|
|
260 |
\isadelimproof
|
|
261 |
%
|
|
262 |
\endisadelimproof
|
|
263 |
%
|
|
264 |
\isatagproof
|
|
265 |
%
|
|
266 |
\endisatagproof
|
|
267 |
{\isafoldproof}%
|
|
268 |
%
|
|
269 |
\isadelimproof
|
|
270 |
%
|
|
271 |
\endisadelimproof
|
|
272 |
%
|
|
273 |
\isadelimproof
|
|
274 |
%
|
|
275 |
\endisadelimproof
|
|
276 |
%
|
|
277 |
\isatagproof
|
|
278 |
%
|
|
279 |
\endisatagproof
|
|
280 |
{\isafoldproof}%
|
|
281 |
%
|
|
282 |
\isadelimproof
|
|
283 |
%
|
|
284 |
\endisadelimproof
|
|
285 |
%
|
|
286 |
\isadelimtheory
|
|
287 |
%
|
|
288 |
\endisadelimtheory
|
|
289 |
%
|
|
290 |
\isatagtheory
|
|
291 |
%
|
|
292 |
\endisatagtheory
|
|
293 |
{\isafoldtheory}%
|
|
294 |
%
|
|
295 |
\isadelimtheory
|
|
296 |
%
|
|
297 |
\endisadelimtheory
|
9722
|
298 |
\end{isabellebody}%
|
9145
|
299 |
%%% Local Variables:
|
|
300 |
%%% mode: latex
|
|
301 |
%%% TeX-master: "root"
|
|
302 |
%%% End:
|