Commit 3b32bd70 by Jean-Christophe Filliatre

matrix.Matrix: no more use of pairs

```Matrix.get and Matrix.set are now currified
no more matrix.MatrixSyntax```
parent 6c548dc1
 module TestMatrix use import int.Int use import matrix.Syntax use import matrix.Matrix let test1 () = let m1 = make 3 3 2 in assert { m1[(0,0)] = 2 }; m1[(0,0)] <- 4; assert { m1[(0,0)] = 4 }; assert { m1[(0,1)] = 2 }; assert { m1[(1,0)] = 2 }; assert { get m1 0 0 = 2 }; set m1 0 0 4; assert { get m1 0 0 = 4 }; assert { get m1 0 1 = 2 }; assert { get m1 1 0 = 2 }; () end ... ...
 ... ... @@ -18,7 +18,7 @@ module WarshallAlgorithm inductive path (matrix bool) int int int = | Path_empty: forall m: matrix bool, i j k: int. get m (i,j) -> path m i j k get m i j -> path m i j k | Path_cons: forall m: matrix bool, i x j k: int. 0 <= x < k -> path m i x k -> path m x j k -> path m i j k ... ... @@ -35,26 +35,26 @@ module WarshallAlgorithm requires { m.rows = m.columns } ensures { let n = m.rows in forall x y: int. 0 <= x < n -> 0 <= y < n -> get result (x,y) <-> path m x y n } get result x y <-> path m x y n } = let t = copy m in let n = m.rows in for k = 0 to n - 1 do invariant { forall x y. 0 <= x < n -> 0 <= y < n -> get t (x,y) <-> path m x y k } get t x y <-> path m x y k } for i = 0 to n - 1 do invariant { forall x y. 0 <= x < n -> 0 <= y < n -> get t (x,y) <-> get t x y <-> if x < i then path m x y (k+1) else path m x y k } for j = 0 to n - 1 do invariant { forall x y. 0 <= x < n -> 0 <= y < n -> get t (x,y) <-> get t x y <-> if x < i \/ (x = i /\ y < j) then path m x y (k+1) else path m x y k } set t (i,j) (get t (i,j) || get t (i,k) && get t (k,j)) set t i j (get t i j || get t i k && get t k j) done done done; ... ...
 ... ... @@ -39,30 +39,18 @@ Definition rows {a:Type} {a_WT:WhyType a} (v:(matrix a)): Z := end. (* Why3 assumption *) Definition index := (Z* Z)%type. Definition get {a:Type} {a_WT:WhyType a} (a1:(matrix a)) (r:Z) (c:Z): a := (map.Map.get (map.Map.get (elts a1) r) c). (* Why3 assumption *) Definition get {a:Type} {a_WT:WhyType a} (a1:(matrix a)) (i:(Z* Z)%type): a := match i with | (r, c) => (map.Map.get (map.Map.get (elts a1) r) c) end. Definition set {a:Type} {a_WT:WhyType a} (a1:(matrix a)) (r:Z) (c:Z) (v:a): (matrix a) := (mk_matrix (rows a1) (columns a1) (map.Map.set (elts a1) r (map.Map.set (map.Map.get (elts a1) r) c v))). (* Why3 assumption *) Definition set {a:Type} {a_WT:WhyType a} (a1:(matrix a)) (i:(Z* Z)%type) (v:a): (matrix a) := match i with | (r, c) => (mk_matrix (rows a1) (columns a1) (map.Map.set (elts a1) r (map.Map.set (map.Map.get (elts a1) r) c v))) end. (* Why3 assumption *) Definition valid_index {a:Type} {a_WT:WhyType a} (a1:(matrix a)) (i:(Z* Z)%type): Prop := match i with | (r, c) => ((0%Z <= r)%Z /\ (r < (rows a1))%Z) /\ ((0%Z <= c)%Z /\ (c < (columns a1))%Z) end. Definition valid_index {a:Type} {a_WT:WhyType a} (a1:(matrix a)) (r:Z) (c:Z): Prop := ((0%Z <= r)%Z /\ (r < (rows a1))%Z) /\ ((0%Z <= c)%Z /\ (c < (columns a1))%Z). (* Why3 assumption *) Definition make {a:Type} {a_WT:WhyType a} (r:Z) (c:Z) (v:a): (matrix a) := ... ... @@ -71,8 +59,8 @@ Definition make {a:Type} {a_WT:WhyType a} (r:Z) (c:Z) (v:a): (matrix a) := (* Why3 assumption *) Inductive path: (matrix bool) -> Z -> Z -> Z -> Prop := | Path_empty : forall (m:(matrix bool)) (i:Z) (j:Z) (k:Z), ((get m (i, j)) = true) -> (path m i j k) | Path_empty : forall (m:(matrix bool)) (i:Z) (j:Z) (k:Z), ((get m i j) = true) -> (path m i j k) | Path_cons : forall (m:(matrix bool)) (i:Z) (x:Z) (j:Z) (k:Z), ((0%Z <= x)%Z /\ (x < k)%Z) -> ((path m i x k) -> ((path m x j k) -> (path m i j k))). ... ... @@ -80,6 +68,7 @@ Inductive path: (matrix bool) -> Z -> Z -> Z -> Prop := (* Why3 goal *) Theorem weakening : forall (m:(matrix bool)) (i:Z) (j:Z) (k1:Z) (k2:Z), ((0%Z <= k1)%Z /\ (k1 <= k2)%Z) -> ((path m i j k1) -> (path m i j k2)). (* Why3 intros m i j k1 k2 (h1,h2) h3. *) intros m i j k1 k2 (h1,h2) h3. induction h3. apply Path_empty; auto. ... ...
This diff is collapsed.
No preview for this file type
 ... ... @@ -9,26 +9,23 @@ module Matrix model { rows: int; columns: int; mutable elts: map int (map int 'a) } invariant { 0 <= self.rows /\ 0 <= self.columns } type index = (int, int) function get (a: matrix 'a) (r c: int) : 'a = M.get (M.get a.elts r) c function get (a: matrix 'a) (i: index) : 'a = let r,c = i in M.get (M.get a.elts r) c function set (a: matrix 'a) (i: index) (v: 'a) : matrix 'a = let r,c = i in function set (a: matrix 'a) (r c: int) (v: 'a) : matrix 'a = { a with elts = M.set a.elts r (M.set (M.get a.elts r) c v) } predicate valid_index (a: matrix 'a) (i: index) = let r,c = i in 0 <= r < a.rows /\ 0 <= c < a.columns predicate valid_index (a: matrix 'a) (r c: int) = 0 <= r < a.rows /\ 0 <= c < a.columns val get (a: matrix 'a) (i: index) : 'a requires { valid_index a i } ensures { result = get a i } val get (a: matrix 'a) (r c: int) : 'a requires { valid_index a r c } ensures { result = get a r c } val set (a: matrix 'a) (i: index) (v: 'a) : unit writes {a} requires { valid_index a i } ensures { let r,c = i in a.elts = M.set (old a.elts) r (M.set (M.get (old a.elts) r) c v) } val set (a: matrix 'a) (r c: int) (v: 'a) : unit requires { valid_index a r c } writes {a} ensures { a.elts = M.set (old a.elts) r (M.set (M.get (old a.elts) r) c v)} val rows (a: matrix 'a) : int ensures { result = a.rows } val columns (a: matrix 'a) : int ensures { result = a.columns } ... ... @@ -36,52 +33,32 @@ module Matrix (** unsafe get/set operations with no precondition *) exception OutOfBounds let defensive_get (a: matrix 'a) (i: index) ensures { valid_index a i /\ result = get a i } raises { OutOfBounds -> not (valid_index a i) } = let r,c = i in if r < 0 || r >= a.rows || c < 0 || c >= a.columns then raise OutOfBounds; get a i let defensive_get (a: matrix 'a) (r c: int) : 'a ensures { valid_index a r c } ensures { result = get a r c } raises { OutOfBounds -> not (valid_index a r c) } = if r < 0 || r >= a.rows || c < 0 || c >= a.columns then raise OutOfBounds; get a r c let defensive_set (a: matrix 'a) (i: index) (v: 'a) ensures { valid_index a i /\ a = set (old a) i v } raises { OutOfBounds -> not (valid_index a i) /\ a = old a } = let r,c = i in if r < 0 || r >= a.rows || c < 0 || c >= a.columns then raise OutOfBounds; set a i v let defensive_set (a: matrix 'a) (r c: int) (v: 'a) : unit ensures { valid_index a r c } ensures { a.elts = M.set (old a.elts) r (M.set (M.get (old a.elts) r) c v)} raises { OutOfBounds -> not (valid_index a r c) /\ a = old a } = if r < 0 || r >= a.rows || c < 0 || c >= a.columns then raise OutOfBounds; set a r c v function make (r c: int) (v: 'a) : matrix 'a = { rows = r; columns = c; elts = M.const (M.const v) } val make (r c: int) (v: 'a) : matrix 'a requires { r >= 0 /\ c >= 0 } ensures { result = make r c v } requires { r >= 0 /\ c >= 0 } ensures { result = make r c v } val copy (a: matrix 'a) : matrix 'a ensures { result.rows = a.rows /\ result.columns = a.columns } ensures { forall r:int. 0 <= r < result.rows -> forall c:int. 0 <= c < result.columns -> get result (r,c) = get a (r,c) } end (* {2 Square bracket syntax in both logic and programs} *) module Syntax use import int.Int use export Matrix function ([]) (a: matrix 'a) (i: index) : 'a = get a i function ([<-]) (a: matrix 'a) (i: index) (v: 'a) : matrix 'a = set a i v val ([]) (a: matrix 'a) (i: index) : 'a requires { valid_index a i } ensures { result = get a i } val ([]<-) (a: matrix 'a) (i: index) (v: 'a) : unit writes {a} requires { let r,c = i in 0 <= r < a.rows /\ 0 <= c < a.columns } ensures { let r,c = i in a.elts = M.set (old a.elts) r (M.set (M.get (old a.elts) r) c v) } get result r c = get a r c } end
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!