Proofs: Quadratic probing
These are the human proofs of Quadratic probing, at full length.
Quadratic probing with triangular offsets finds each key and each free slot full
This proof shows: correctness, termination.
Let with . For a key and , write . A slot is full when it holds a key, and free when it is EMPTY or DELETED.
Lemma 1 (coverage). The values for are pairwise different. So for each key , the slots are the slots of the table, each one exactly once.
Proof. For there is one value. Let and assume that and . Then divides , so divides . The sum of the two factors is , which is odd, so one factor is odd. An odd factor has no factor 2, so divides the other factor. But and . A positive integer less than is not a multiple of . This is a contradiction. So the values are different, and as they lie in , they are all of its values. Adding modulo is a bijection of , which gives the second claim.
Lemma 2 (the variable ). In QP-SEARCH and QP-INSERT, at the start of the iteration with counter , .
Proof. By induction on . For , line L1 or L7 sets . If at the start of iteration and the iteration does not return, line L5 or L10 sets to .
The invariant. Consider a table built from an EMPTY table by calls of QP-INSERT (each with its precondition) and QP-DELETE.
(Q) No key occurs in two slots. For each key in the table there is a with such that and none of the slots is EMPTY.
Lemma 3. QP-SEARCH returns the slot of if is in , and NIL otherwise, when (Q) holds. It does not change .
Proof. QP-SEARCH writes nothing. It returns a slot only at line L4, where , so a returned slot holds . If is not in , no slot passes the test of line L4, so the result is NIL (line L3 or L6).
Let be in , with as in (Q). By Lemma 2, iteration looks at . For , the slot is not EMPTY by (Q), so line L3 does not return. It does not hold : by Lemma 1, , and by (Q) is only at . So line L4 does not return either. In iteration the slot holds , which is not EMPTY, and line L4 returns it.
Lemma 4. If is not in and (Q) holds, QP-INSERT either raises "the table is full", and then every slot is full and is not changed, or it writes into one free slot, and then (Q) holds again.
Proof. By Lemma 2, iteration tests slot , and by Lemma 1 the iterations test every slot once. If no slot is free, line L9 never writes and line L11 raises the error. Otherwise let be the first iteration at which is free. Line L9 writes there. The slots were full at line L9, and they stay full, so none of them is EMPTY: (Q) holds for . As was not in , it now occurs once. For another key , its slot is not changed, because line L9 writes only to a free slot. The write turns one free slot into a full one, so the set of EMPTY slots does not grow, and (Q) stays true for .
Lemma 5. If (Q) holds, QP-DELETE removes when it is present, changes nothing else, and (Q) holds after it.
Proof. By Lemma 3, line L12 finds the only slot that holds , or NIL. If NIL, nothing changes. Otherwise line L13 writes DELETED there, so is no longer in . The set of EMPTY slots does not change, and no other key moves, so (Q) holds for each other key.
Theorem. Start from a table of EMPTY slots, and apply any sequence of QP-INSERT calls (each for a key that is not in the table) and QP-DELETE calls. After each call, the set of keys in is the set given by the sequence of operations, each QP-SEARCH answers correctly, and each QP-INSERT succeeds unless all slots are full. Each call ends after at most iterations of its loop.
Proof. The EMPTY table has no keys, so (Q) holds. By induction on the number of calls, with Lemmas 4 and 5 for the step, (Q) holds after each call, and each call changes the set of keys as its specification says. Lemma 3 then gives the answer of each search. The loops of lines L2 and L8 have exactly iterations at most, because the counter grows by 1 from 0 to , and QP-DELETE makes one search and one write.