8745
|
1 |
(*<*)
|
|
2 |
theory Trie = Main:;
|
|
3 |
(*>*)
|
|
4 |
text{*
|
|
5 |
To minimize running time, each node of a trie should contain an array that maps
|
|
6 |
letters to subtries. We have chosen a (sometimes) more space efficient
|
|
7 |
representation where the subtries are held in an association list, i.e.\ a
|
9792
|
8 |
list of (letter,trie) pairs. Abstracting over the alphabet @{typ"'a"} and the
|
|
9 |
values @{typ"'v"} we define a trie as follows:
|
9458
|
10 |
*};
|
8745
|
11 |
|
|
12 |
datatype ('a,'v)trie = Trie "'v option" "('a * ('a,'v)trie)list";
|
|
13 |
|
|
14 |
text{*\noindent
|
|
15 |
The first component is the optional value, the second component the
|
|
16 |
association list of subtries. This is an example of nested recursion involving products,
|
|
17 |
which is fine because products are datatypes as well.
|
|
18 |
We define two selector functions:
|
9458
|
19 |
*};
|
8745
|
20 |
|
10171
|
21 |
consts value :: "('a,'v)trie \<Rightarrow> 'v option"
|
|
22 |
alist :: "('a,'v)trie \<Rightarrow> ('a * ('a,'v)trie)list";
|
8745
|
23 |
primrec "value(Trie ov al) = ov";
|
|
24 |
primrec "alist(Trie ov al) = al";
|
|
25 |
|
|
26 |
text{*\noindent
|
|
27 |
Association lists come with a generic lookup function:
|
9458
|
28 |
*};
|
8745
|
29 |
|
10171
|
30 |
consts assoc :: "('key * 'val)list \<Rightarrow> 'key \<Rightarrow> 'val option";
|
8745
|
31 |
primrec "assoc [] x = None"
|
|
32 |
"assoc (p#ps) x =
|
|
33 |
(let (a,b) = p in if a=x then Some b else assoc ps x)";
|
|
34 |
|
|
35 |
text{*
|
|
36 |
Now we can define the lookup function for tries. It descends into the trie
|
|
37 |
examining the letters of the search string one by one. As
|
|
38 |
recursion on lists is simpler than on tries, let us express this as primitive
|
|
39 |
recursion on the search string argument:
|
9458
|
40 |
*};
|
8745
|
41 |
|
10171
|
42 |
consts lookup :: "('a,'v)trie \<Rightarrow> 'a list \<Rightarrow> 'v option";
|
8745
|
43 |
primrec "lookup t [] = value t"
|
|
44 |
"lookup t (a#as) = (case assoc (alist t) a of
|
10171
|
45 |
None \<Rightarrow> None
|
|
46 |
| Some at \<Rightarrow> lookup at as)";
|
8745
|
47 |
|
|
48 |
text{*
|
|
49 |
As a first simple property we prove that looking up a string in the empty
|
10171
|
50 |
trie @{term"Trie None []"} always returns @{term None}. The proof merely
|
8745
|
51 |
distinguishes the two cases whether the search string is empty or not:
|
9458
|
52 |
*};
|
8745
|
53 |
|
|
54 |
lemma [simp]: "lookup (Trie None []) as = None";
|
10171
|
55 |
apply(case_tac as, simp_all);
|
|
56 |
done
|
8745
|
57 |
|
|
58 |
text{*
|
|
59 |
Things begin to get interesting with the definition of an update function
|
|
60 |
that adds a new (string,value) pair to a trie, overwriting the old value
|
|
61 |
associated with that string:
|
9458
|
62 |
*};
|
8745
|
63 |
|
10171
|
64 |
consts update :: "('a,'v)trie \<Rightarrow> 'a list \<Rightarrow> 'v \<Rightarrow> ('a,'v)trie";
|
8745
|
65 |
primrec
|
|
66 |
"update t [] v = Trie (Some v) (alist t)"
|
|
67 |
"update t (a#as) v =
|
|
68 |
(let tt = (case assoc (alist t) a of
|
10171
|
69 |
None \<Rightarrow> Trie None [] | Some at \<Rightarrow> at)
|
8745
|
70 |
in Trie (value t) ((a,update tt as v)#alist t))";
|
|
71 |
|
|
72 |
text{*\noindent
|
|
73 |
The base case is obvious. In the recursive case the subtrie
|
10171
|
74 |
@{term tt} associated with the first letter @{term a} is extracted,
|
8745
|
75 |
recursively updated, and then placed in front of the association list.
|
10171
|
76 |
The old subtrie associated with @{term a} is still in the association list
|
|
77 |
but no longer accessible via @{term assoc}. Clearly, there is room here for
|
8745
|
78 |
optimizations!
|
|
79 |
|
10171
|
80 |
Before we start on any proofs about @{term update} we tell the simplifier to
|
|
81 |
expand all @{text let}s and to split all @{text case}-constructs over
|
8745
|
82 |
options:
|
9458
|
83 |
*};
|
8745
|
84 |
|
9933
|
85 |
declare Let_def[simp] option.split[split]
|
8745
|
86 |
|
|
87 |
text{*\noindent
|
|
88 |
The reason becomes clear when looking (probably after a failed proof
|
10171
|
89 |
attempt) at the body of @{term update}: it contains both
|
|
90 |
@{text let} and a case distinction over type @{text option}.
|
8745
|
91 |
|
10171
|
92 |
Our main goal is to prove the correct interaction of @{term update} and
|
|
93 |
@{term lookup}:
|
9458
|
94 |
*};
|
8745
|
95 |
|
10171
|
96 |
theorem "\<forall>t v bs. lookup (update t as v) bs =
|
8745
|
97 |
(if as=bs then Some v else lookup t bs)";
|
|
98 |
|
|
99 |
txt{*\noindent
|
10171
|
100 |
Our plan is to induct on @{term as}; hence the remaining variables are
|
8745
|
101 |
quantified. From the definitions it is clear that induction on either
|
10171
|
102 |
@{term as} or @{term bs} is required. The choice of @{term as} is merely
|
|
103 |
guided by the intuition that simplification of @{term lookup} might be easier
|
|
104 |
if @{term update} has already been simplified, which can only happen if
|
|
105 |
@{term as} is instantiated.
|
8745
|
106 |
The start of the proof is completely conventional:
|
9458
|
107 |
*};
|
8771
|
108 |
apply(induct_tac as, auto);
|
8745
|
109 |
|
|
110 |
txt{*\noindent
|
|
111 |
Unfortunately, this time we are left with three intimidating looking subgoals:
|
9723
|
112 |
\begin{isabelle}
|
8745
|
113 |
~1.~\dots~{\isasymLongrightarrow}~lookup~\dots~bs~=~lookup~t~bs\isanewline
|
|
114 |
~2.~\dots~{\isasymLongrightarrow}~lookup~\dots~bs~=~lookup~t~bs\isanewline
|
9792
|
115 |
~3.~\dots~{\isasymLongrightarrow}~lookup~\dots~bs~=~lookup~t~bs
|
9723
|
116 |
\end{isabelle}
|
10171
|
117 |
Clearly, if we want to make headway we have to instantiate @{term bs} as
|
8745
|
118 |
well now. It turns out that instead of induction, case distinction
|
|
119 |
suffices:
|
9458
|
120 |
*};
|
10171
|
121 |
apply(case_tac[!] bs, auto);
|
|
122 |
done
|
8745
|
123 |
|
|
124 |
text{*\noindent
|
10171
|
125 |
All methods ending in @{text tac} take an optional first argument that
|
9792
|
126 |
specifies the range of subgoals they are applied to, where @{text"[!]"} means
|
|
127 |
all subgoals, i.e.\ @{text"[1-3]"} in our case. Individual subgoal numbers,
|
|
128 |
e.g. @{text"[2]"} are also allowed.
|
8745
|
129 |
|
|
130 |
This proof may look surprisingly straightforward. However, note that this
|
9792
|
131 |
comes at a cost: the proof script is unreadable because the intermediate
|
|
132 |
proof states are invisible, and we rely on the (possibly brittle) magic of
|
10171
|
133 |
@{text auto} (@{text simp_all} will not do---try it) to split the subgoals
|
|
134 |
of the induction up in such a way that case distinction on @{term bs} makes
|
9792
|
135 |
sense and solves the proof. Part~\ref{Isar} shows you how to write readable
|
|
136 |
and stable proofs.
|
9458
|
137 |
*};
|
8745
|
138 |
|
|
139 |
(*<*)
|
9458
|
140 |
end;
|
8745
|
141 |
(*>*)
|