author | urbanc |
Thu, 17 Feb 2011 21:30:26 +0000 | |
changeset 112 | 62fdb4bf7239 |
parent 111 | d65d071798ff |
child 113 | ec774952190c |
permissions | -rw-r--r-- |
24 | 1 |
(*<*) |
2 |
theory Paper |
|
94 | 3 |
imports "../Myhill" "LaTeXsugar" |
24 | 4 |
begin |
39
a59473f0229d
tuned a little bit the section about finite partitions
urbanc
parents:
37
diff
changeset
|
5 |
|
a59473f0229d
tuned a little bit the section about finite partitions
urbanc
parents:
37
diff
changeset
|
6 |
declare [[show_question_marks = false]] |
a59473f0229d
tuned a little bit the section about finite partitions
urbanc
parents:
37
diff
changeset
|
7 |
|
54 | 8 |
consts |
9 |
REL :: "(string \<times> string) \<Rightarrow> bool" |
|
66 | 10 |
UPLUS :: "'a set \<Rightarrow> 'a set \<Rightarrow> (nat \<times> 'a) set" |
54 | 11 |
|
70 | 12 |
abbreviation |
13 |
"EClass x R \<equiv> R `` {x}" |
|
54 | 14 |
|
92 | 15 |
abbreviation |
16 |
"append_rexp2 r_itm r \<equiv> append_rexp r r_itm" |
|
17 |
||
18 |
||
39
a59473f0229d
tuned a little bit the section about finite partitions
urbanc
parents:
37
diff
changeset
|
19 |
notation (latex output) |
50 | 20 |
str_eq_rel ("\<approx>\<^bsub>_\<^esub>") and |
75 | 21 |
str_eq ("_ \<approx>\<^bsub>_\<^esub> _") and |
50 | 22 |
Seq (infixr "\<cdot>" 100) and |
23 |
Star ("_\<^bsup>\<star>\<^esup>") and |
|
24 |
pow ("_\<^bsup>_\<^esup>" [100, 100] 100) and |
|
58 | 25 |
Suc ("_+1" [100] 100) and |
54 | 26 |
quotient ("_ \<^raw:\ensuremath{\!\sslash\!}> _" [90, 90] 90) and |
66 | 27 |
REL ("\<approx>") and |
67 | 28 |
UPLUS ("_ \<^raw:\ensuremath{\uplus}> _" [90, 90] 90) and |
82 | 29 |
L ("\<^raw:\ensuremath{\cal{L}}>'(_')" [0] 101) and |
75 | 30 |
Lam ("\<lambda>'(_')" [100] 100) and |
89 | 31 |
Trn ("'(_, _')" [100, 100] 100) and |
71 | 32 |
EClass ("\<lbrakk>_\<rbrakk>\<^bsub>_\<^esub>" [100, 100] 100) and |
88 | 33 |
transition ("_ \<^raw:\ensuremath{\stackrel{\text{>_\<^raw:}}{\Longmapsto}}> _" [100, 100, 100] 100) and |
92 | 34 |
Setalt ("\<^raw:\ensuremath{\bigplus}>_" [1000] 999) and |
35 |
append_rexp2 ("_ \<^raw:\ensuremath{\triangleleft}> _" [100, 100] 100) and |
|
112 | 36 |
append_rhs_rexp ("_ \<^raw:\ensuremath{\triangleleft}> _" [100, 100] 50) and |
37 |
uminus ("\<^raw:\ensuremath{\overline{>_\<^raw:}}>" [100] 100) |
|
38 |
||
24 | 39 |
(*>*) |
40 |
||
70 | 41 |
|
24 | 42 |
section {* Introduction *} |
43 |
||
44 |
text {* |
|
58 | 45 |
Regular languages are an important and well-understood subject in Computer |
60 | 46 |
Science, with many beautiful theorems and many useful algorithms. There is a |
66 | 47 |
wide range of textbooks on this subject, many of which are aimed at students |
48 |
and contain very detailed ``pencil-and-paper'' proofs |
|
60 | 49 |
(e.g.~\cite{Kozen97}). It seems natural to exercise theorem provers by |
101 | 50 |
formalising the theorems and by verifying formally the algorithms. |
59 | 51 |
|
66 | 52 |
There is however a problem: the typical approach to regular languages is to |
53 |
introduce finite automata and then define everything in terms of them. For |
|
54 |
example, a regular language is normally defined as one whose strings are |
|
55 |
recognised by a finite deterministic automaton. This approach has many |
|
71 | 56 |
benefits. Among them is the fact that it is easy to convince oneself that |
66 | 57 |
regular languages are closed under complementation: one just has to exchange |
58 |
the accepting and non-accepting states in the corresponding automaton to |
|
59 |
obtain an automaton for the complement language. The problem, however, lies with |
|
67 | 60 |
formalising such reasoning in a HOL-based theorem prover, in our case |
70 | 61 |
Isabelle/HOL. Automata are build up from states and transitions that |
82 | 62 |
need to be represented as graphs, matrices or functions, none |
63 |
of which can be defined as inductive datatype. |
|
66 | 64 |
|
82 | 65 |
In case of graphs and matrices, this means we have to build our own |
66 |
reasoning infrastructure for them, as neither Isabelle/HOL nor HOL4 nor |
|
67 |
HOLlight support them with libraries. Even worse, reasoning about graphs and |
|
68 |
matrices can be a real hassle in HOL-based theorem provers. Consider for |
|
69 |
example the operation of sequencing two automata, say $A_1$ and $A_2$, by |
|
70 |
connecting the accepting states of $A_1$ to the initial state of $A_2$: |
|
60 | 71 |
|
72 |
\begin{center} |
|
66 | 73 |
\begin{tabular}{ccc} |
74 |
\begin{tikzpicture}[scale=0.8] |
|
75 |
%\draw[step=2mm] (-1,-1) grid (1,1); |
|
76 |
||
77 |
\draw[rounded corners=1mm, very thick] (-1.0,-0.3) rectangle (-0.2,0.3); |
|
78 |
\draw[rounded corners=1mm, very thick] ( 0.2,-0.3) rectangle ( 1.0,0.3); |
|
79 |
||
80 |
\node (A) at (-1.0,0.0) [circle, very thick, draw, fill=white, inner sep=0.4mm] {}; |
|
81 |
\node (B) at ( 0.2,0.0) [circle, very thick, draw, fill=white, inner sep=0.4mm] {}; |
|
82 |
||
83 |
\node (C) at (-0.2, 0.13) [circle, very thick, draw, fill=white, inner sep=0.4mm] {}; |
|
84 |
\node (D) at (-0.2,-0.13) [circle, very thick, draw, fill=white, inner sep=0.4mm] {}; |
|
85 |
||
86 |
\node (E) at (1.0, 0.2) [circle, very thick, draw, fill=white, inner sep=0.4mm] {}; |
|
87 |
\node (F) at (1.0,-0.0) [circle, very thick, draw, fill=white, inner sep=0.4mm] {}; |
|
88 |
\node (G) at (1.0,-0.2) [circle, very thick, draw, fill=white, inner sep=0.4mm] {}; |
|
89 |
||
90 |
\draw (-0.6,0.0) node {\footnotesize$A_1$}; |
|
91 |
\draw ( 0.6,0.0) node {\footnotesize$A_2$}; |
|
92 |
\end{tikzpicture} |
|
93 |
||
94 |
& |
|
95 |
||
96 |
\raisebox{1.1mm}{\bf\Large$\;\;\;\Rightarrow\,\;\;$} |
|
97 |
||
98 |
& |
|
99 |
||
100 |
\begin{tikzpicture}[scale=0.8] |
|
101 |
%\draw[step=2mm] (-1,-1) grid (1,1); |
|
102 |
||
103 |
\draw[rounded corners=1mm, very thick] (-1.0,-0.3) rectangle (-0.2,0.3); |
|
104 |
\draw[rounded corners=1mm, very thick] ( 0.2,-0.3) rectangle ( 1.0,0.3); |
|
105 |
||
106 |
\node (A) at (-1.0,0.0) [circle, very thick, draw, fill=white, inner sep=0.4mm] {}; |
|
107 |
\node (B) at ( 0.2,0.0) [circle, very thick, draw, fill=white, inner sep=0.4mm] {}; |
|
108 |
||
109 |
\node (C) at (-0.2, 0.13) [circle, very thick, draw, fill=white, inner sep=0.4mm] {}; |
|
110 |
\node (D) at (-0.2,-0.13) [circle, very thick, draw, fill=white, inner sep=0.4mm] {}; |
|
111 |
||
112 |
\node (E) at (1.0, 0.2) [circle, very thick, draw, fill=white, inner sep=0.4mm] {}; |
|
113 |
\node (F) at (1.0,-0.0) [circle, very thick, draw, fill=white, inner sep=0.4mm] {}; |
|
114 |
\node (G) at (1.0,-0.2) [circle, very thick, draw, fill=white, inner sep=0.4mm] {}; |
|
115 |
||
116 |
\draw (C) to [very thick, bend left=45] (B); |
|
117 |
\draw (D) to [very thick, bend right=45] (B); |
|
118 |
||
119 |
\draw (-0.6,0.0) node {\footnotesize$A_1$}; |
|
120 |
\draw ( 0.6,0.0) node {\footnotesize$A_2$}; |
|
121 |
\end{tikzpicture} |
|
122 |
||
123 |
\end{tabular} |
|
60 | 124 |
\end{center} |
125 |
||
126 |
\noindent |
|
67 | 127 |
On ``paper'' we can define the corresponding graph in terms of the disjoint |
88 | 128 |
union of the state nodes. Unfortunately in HOL, the standard definition for disjoint |
66 | 129 |
union, namely |
82 | 130 |
% |
131 |
\begin{equation}\label{disjointunion} |
|
66 | 132 |
@{term "UPLUS A\<^isub>1 A\<^isub>2 \<equiv> {(1, x) | x. x \<in> A\<^isub>1} \<union> {(2, y) | y. y \<in> A\<^isub>2}"} |
82 | 133 |
\end{equation} |
60 | 134 |
|
61 | 135 |
\noindent |
66 | 136 |
changes the type---the disjoint union is not a set, but a set of pairs. |
137 |
Using this definition for disjoint unions means we do not have a single type for automata |
|
92 | 138 |
and hence will not be able to state certain properties about \emph{all} |
67 | 139 |
automata, since there is no type quantification available in HOL. An |
140 |
alternative, which provides us with a single type for automata, is to give every |
|
141 |
state node an identity, for example a natural |
|
70 | 142 |
number, and then be careful to rename these identities apart whenever |
67 | 143 |
connecting two automata. This results in clunky proofs |
66 | 144 |
establishing that properties are invariant under renaming. Similarly, |
67 | 145 |
connecting two automata represented as matrices results in very adhoc |
66 | 146 |
constructions, which are not pleasant to reason about. |
147 |
||
82 | 148 |
Functions are much better supported in Isabelle/HOL, but they still lead to similar |
88 | 149 |
problems as with graphs. Composing, for example, two non-deterministic automata in parallel |
93 | 150 |
requires also the formalisation of disjoint unions. Nipkow \cite{Nipkow98} |
101 | 151 |
dismisses for this the option of using identities, because it leads according to |
152 |
him to ``messy proofs''. He |
|
103 | 153 |
opts for a variant of \eqref{disjointunion} using bit lists, but writes |
82 | 154 |
|
155 |
\begin{quote} |
|
93 | 156 |
\it% |
157 |
\begin{tabular}{@ {}l@ {}p{0.88\textwidth}@ {}} |
|
101 | 158 |
`` & All lemmas appear obvious given a picture of the composition of automata\ldots |
159 |
Yet their proofs require a painful amount of detail.'' |
|
160 |
\end{tabular} |
|
161 |
\end{quote} |
|
162 |
||
163 |
\noindent |
|
164 |
and |
|
165 |
||
166 |
\begin{quote} |
|
167 |
\it% |
|
168 |
\begin{tabular}{@ {}l@ {}p{0.88\textwidth}@ {}} |
|
93 | 169 |
`` & If the reader finds the above treatment in terms of bit lists revoltingly |
101 | 170 |
concrete, I cannot disagree. A more abstract approach is clearly desirable.'' |
93 | 171 |
\end{tabular} |
82 | 172 |
\end{quote} |
101 | 173 |
|
174 |
||
82 | 175 |
\noindent |
176 |
Moreover, it is not so clear how to conveniently impose a finiteness condition |
|
177 |
upon functions in order to represent \emph{finite} automata. The best is |
|
92 | 178 |
probably to resort to more advanced reasoning frameworks, such as \emph{locales} |
179 |
or \emph{type classes}, |
|
110 | 180 |
which are \emph{not} avaiable in all HOL-based theorem provers. |
82 | 181 |
|
66 | 182 |
Because of these problems to do with representing automata, there seems |
183 |
to be no substantial formalisation of automata theory and regular languages |
|
93 | 184 |
carried out in HOL-based theorem provers. Nipkow establishes in |
82 | 185 |
\cite{Nipkow98} the link between regular expressions and automata in |
100 | 186 |
the context of lexing. The only larger formalisations of automata theory |
82 | 187 |
are carried out in Nuprl \cite{Constable00} and in Coq (for example |
188 |
\cite{Filliatre97}). |
|
58 | 189 |
|
82 | 190 |
In this paper, we will not attempt to formalise automata theory in |
191 |
Isabelle/HOL, but take a completely different approach to regular |
|
192 |
languages. Instead of defining a regular language as one where there exists |
|
193 |
an automaton that recognises all strings of the language, we define a |
|
194 |
regular language as: |
|
54 | 195 |
|
82 | 196 |
\begin{definition} |
77 | 197 |
A language @{text A} is \emph{regular}, provided there is a regular expression that matches all |
54 | 198 |
strings of @{text "A"}. |
199 |
\end{definition} |
|
200 |
||
201 |
\noindent |
|
110 | 202 |
The reason is that regular expressions, unlike graphs, matrices and functions, can |
71 | 203 |
be easily defined as inductive datatype. Consequently a corresponding reasoning |
204 |
infrastructure comes for free. This has recently been exploited in HOL4 with a formalisation |
|
101 | 205 |
of regular expression matching based on derivatives \cite{OwensSlind08} and |
206 |
with an equivalence checker for regular expressions in Isabelle/HOL \cite{KraussNipkow11}. |
|
207 |
The purpose of this paper is to |
|
71 | 208 |
show that a central result about regular languages---the Myhill-Nerode theorem---can |
209 |
be recreated by only using regular expressions. This theorem gives necessary |
|
210 |
and sufficient conditions for when a language is regular. As a corollary of this |
|
67 | 211 |
theorem we can easily establish the usual closure properties, including |
212 |
complementation, for regular languages.\smallskip |
|
61 | 213 |
|
214 |
\noindent |
|
88 | 215 |
{\bf Contributions:} |
216 |
There is an extensive literature on regular languages. |
|
217 |
To our knowledge, our proof of the Myhill-Nerode theorem is the |
|
67 | 218 |
first that is based on regular expressions, only. We prove the part of this theorem |
219 |
stating that a regular expression has only finitely many partitions using certain |
|
220 |
tagging-functions. Again to our best knowledge, these tagging functions have |
|
221 |
not been used before to establish the Myhill-Nerode theorem. |
|
24 | 222 |
*} |
223 |
||
50 | 224 |
section {* Preliminaries *} |
225 |
||
226 |
text {* |
|
67 | 227 |
Strings in Isabelle/HOL are lists of characters with the \emph{empty string} |
92 | 228 |
being represented by the empty list, written @{term "[]"}. \emph{Languages} |
67 | 229 |
are sets of strings. The language containing all strings is written in |
71 | 230 |
Isabelle/HOL as @{term "UNIV::string set"}. The concatenation of two languages |
90 | 231 |
is written @{term "A ;; B"} and a language raised to the power @{text n} is written |
93 | 232 |
@{term "A \<up> n"}. They are defined as usual |
54 | 233 |
|
234 |
\begin{center} |
|
58 | 235 |
@{thm Seq_def[THEN eq_reflection, where A1="A" and B1="B"]} |
236 |
\hspace{7mm} |
|
237 |
@{thm pow.simps(1)[THEN eq_reflection, where A1="A"]} |
|
238 |
\hspace{7mm} |
|
239 |
@{thm pow.simps(2)[THEN eq_reflection, where A1="A" and n1="n"]} |
|
54 | 240 |
\end{center} |
241 |
||
242 |
\noindent |
|
58 | 243 |
where @{text "@"} is the usual list-append operation. The Kleene-star of a language @{text A} |
71 | 244 |
is defined as the union over all powers, namely @{thm Star_def}. In the paper |
88 | 245 |
we will make use of the following properties of these constructions. |
58 | 246 |
|
71 | 247 |
\begin{proposition}\label{langprops}\mbox{}\\ |
92 | 248 |
\begin{tabular}{@ {}ll} |
249 |
(i) & @{thm star_cases} \\ |
|
250 |
(ii) & @{thm[mode=IfThen] pow_length}\\ |
|
251 |
(iii) & @{thm seq_Union_left} \\ |
|
71 | 252 |
\end{tabular} |
253 |
\end{proposition} |
|
254 |
||
255 |
\noindent |
|
100 | 256 |
In @{text "(ii)"} we use the notation @{term "length s"} for the length of a |
257 |
string. This property states that if @{term "[] \<notin> A"} then the lengths of |
|
258 |
the strings in @{term "A \<up> (Suc n)"} must be longer than @{text n}. We omit |
|
259 |
the proofs for these properties, but invite the reader to consult our |
|
260 |
formalisation.\footnote{Available at ???} |
|
71 | 261 |
|
90 | 262 |
The notation in Isabelle/HOL for the quotient of a language @{text A} according to an |
263 |
equivalence relation @{term REL} is @{term "A // REL"}. We will write |
|
71 | 264 |
@{text "\<lbrakk>x\<rbrakk>\<^isub>\<approx>"} for the equivalence class defined |
265 |
as @{text "{y | y \<approx> x}"}. |
|
266 |
||
267 |
||
51 | 268 |
Central to our proof will be the solution of equational systems |
101 | 269 |
involving equivalence classes of languages. For this we will use Arden's lemma \cite{Brzozowski64} |
93 | 270 |
which solves equations of the form @{term "X = A ;; X \<union> B"} provided |
71 | 271 |
@{term "[] \<notin> A"}. However we will need the following ``reverse'' |
50 | 272 |
version of Arden's lemma. |
273 |
||
75 | 274 |
\begin{lemma}[Reverse Arden's Lemma]\label{arden}\mbox{}\\ |
86 | 275 |
If @{thm (prem 1) arden} then |
276 |
@{thm (lhs) arden} has the unique solution |
|
277 |
@{thm (rhs) arden}. |
|
50 | 278 |
\end{lemma} |
279 |
||
280 |
\begin{proof} |
|
86 | 281 |
For the right-to-left direction we assume @{thm (rhs) arden} and show |
282 |
that @{thm (lhs) arden} holds. From Prop.~\ref{langprops}@{text "(i)"} |
|
71 | 283 |
we have @{term "A\<star> = {[]} \<union> A ;; A\<star>"}, |
50 | 284 |
which is equal to @{term "A\<star> = {[]} \<union> A\<star> ;; A"}. Adding @{text B} to both |
285 |
sides gives @{term "B ;; A\<star> = B ;; ({[]} \<union> A\<star> ;; A)"}, whose right-hand side |
|
51 | 286 |
is equal to @{term "(B ;; A\<star>) ;; A \<union> B"}. This completes this direction. |
50 | 287 |
|
86 | 288 |
For the other direction we assume @{thm (lhs) arden}. By a simple induction |
51 | 289 |
on @{text n}, we can establish the property |
50 | 290 |
|
291 |
\begin{center} |
|
86 | 292 |
@{text "(*)"}\hspace{5mm} @{thm (concl) arden_helper} |
50 | 293 |
\end{center} |
294 |
||
295 |
\noindent |
|
296 |
Using this property we can show that @{term "B ;; (A \<up> n) \<subseteq> X"} holds for |
|
71 | 297 |
all @{text n}. From this we can infer @{term "B ;; A\<star> \<subseteq> X"} using the definition |
298 |
of @{text "\<star>"}. |
|
51 | 299 |
For the inclusion in the other direction we assume a string @{text s} |
86 | 300 |
with length @{text k} is element in @{text X}. Since @{thm (prem 1) arden} |
75 | 301 |
we know by Prop.~\ref{langprops}@{text "(ii)"} that |
71 | 302 |
@{term "s \<notin> X ;; (A \<up> Suc k)"} since its length is only @{text k} |
51 | 303 |
(the strings in @{term "X ;; (A \<up> Suc k)"} are all longer). |
53 | 304 |
From @{text "(*)"} it follows then that |
50 | 305 |
@{term s} must be element in @{term "(\<Union>m\<in>{0..k}. B ;; (A \<up> m))"}. This in turn |
75 | 306 |
implies that @{term s} is in @{term "(\<Union>n. B ;; (A \<up> n))"}. Using Prop.~\ref{langprops}@{text "(iii)"} |
71 | 307 |
this is equal to @{term "B ;; A\<star>"}, as we needed to show.\qed |
50 | 308 |
\end{proof} |
67 | 309 |
|
310 |
\noindent |
|
88 | 311 |
Regular expressions are defined as the inductive datatype |
67 | 312 |
|
313 |
\begin{center} |
|
314 |
@{text r} @{text "::="} |
|
315 |
@{term NULL}\hspace{1.5mm}@{text"|"}\hspace{1.5mm} |
|
316 |
@{term EMPTY}\hspace{1.5mm}@{text"|"}\hspace{1.5mm} |
|
317 |
@{term "CHAR c"}\hspace{1.5mm}@{text"|"}\hspace{1.5mm} |
|
318 |
@{term "SEQ r r"}\hspace{1.5mm}@{text"|"}\hspace{1.5mm} |
|
319 |
@{term "ALT r r"}\hspace{1.5mm}@{text"|"}\hspace{1.5mm} |
|
320 |
@{term "STAR r"} |
|
321 |
\end{center} |
|
322 |
||
323 |
\noindent |
|
88 | 324 |
and the language matched by a regular expression is defined as |
67 | 325 |
|
326 |
\begin{center} |
|
327 |
\begin{tabular}{c@ {\hspace{10mm}}c} |
|
328 |
\begin{tabular}{rcl} |
|
329 |
@{thm (lhs) L_rexp.simps(1)} & @{text "\<equiv>"} & @{thm (rhs) L_rexp.simps(1)}\\ |
|
330 |
@{thm (lhs) L_rexp.simps(2)} & @{text "\<equiv>"} & @{thm (rhs) L_rexp.simps(2)}\\ |
|
331 |
@{thm (lhs) L_rexp.simps(3)[where c="c"]} & @{text "\<equiv>"} & @{thm (rhs) L_rexp.simps(3)[where c="c"]}\\ |
|
332 |
\end{tabular} |
|
333 |
& |
|
334 |
\begin{tabular}{rcl} |
|
335 |
@{thm (lhs) L_rexp.simps(4)[where ?r1.0="r\<^isub>1" and ?r2.0="r\<^isub>2"]} & @{text "\<equiv>"} & |
|
336 |
@{thm (rhs) L_rexp.simps(4)[where ?r1.0="r\<^isub>1" and ?r2.0="r\<^isub>2"]}\\ |
|
337 |
@{thm (lhs) L_rexp.simps(5)[where ?r1.0="r\<^isub>1" and ?r2.0="r\<^isub>2"]} & @{text "\<equiv>"} & |
|
338 |
@{thm (rhs) L_rexp.simps(5)[where ?r1.0="r\<^isub>1" and ?r2.0="r\<^isub>2"]}\\ |
|
339 |
@{thm (lhs) L_rexp.simps(6)[where r="r"]} & @{text "\<equiv>"} & |
|
340 |
@{thm (rhs) L_rexp.simps(6)[where r="r"]}\\ |
|
341 |
\end{tabular} |
|
342 |
\end{tabular} |
|
343 |
\end{center} |
|
70 | 344 |
|
100 | 345 |
Given a finite set of regular expressions @{text rs}, we will make use of the operation of generating |
92 | 346 |
a regular expression that matches all languages of @{text rs}. We only need to know the existence |
347 |
of such a regular expression and therefore we use Isabelle/HOL's @{const "fold_graph"} and Hilbert's |
|
93 | 348 |
@{text "\<epsilon>"} to define @{term "\<Uplus>rs"}. This operation, roughly speaking, folds @{const ALT} over the |
100 | 349 |
set @{text rs} with @{const NULL} for the empty set. We can prove that for a finite set @{text rs} |
110 | 350 |
% |
351 |
\begin{equation}\label{uplus} |
|
352 |
\mbox{@{thm (lhs) folds_alt_simp} @{text "= \<Union> (\<calL> ` rs)"}} |
|
353 |
\end{equation} |
|
88 | 354 |
|
355 |
\noindent |
|
90 | 356 |
holds, whereby @{text "\<calL> ` rs"} stands for the |
357 |
image of the set @{text rs} under function @{text "\<calL>"}. |
|
50 | 358 |
*} |
39
a59473f0229d
tuned a little bit the section about finite partitions
urbanc
parents:
37
diff
changeset
|
359 |
|
100 | 360 |
section {* The Myhill-Nerode Theorem, First Part *} |
54 | 361 |
|
362 |
text {* |
|
77 | 363 |
The key definition in the Myhill-Nerode theorem is the |
75 | 364 |
\emph{Myhill-Nerode relation}, which states that w.r.t.~a language two |
365 |
strings are related, provided there is no distinguishing extension in this |
|
366 |
language. This can be defined as: |
|
367 |
||
70 | 368 |
\begin{definition}[Myhill-Nerode Relation]\mbox{}\\ |
75 | 369 |
@{thm str_eq_def[simplified str_eq_rel_def Pair_Collect]} |
70 | 370 |
\end{definition} |
371 |
||
71 | 372 |
\noindent |
75 | 373 |
It is easy to see that @{term "\<approx>A"} is an equivalence relation, which |
374 |
partitions the set of all strings, @{text "UNIV"}, into a set of disjoint |
|
108 | 375 |
equivalence classes. To illustrate this quotient construction, let us give a simple |
101 | 376 |
example: consider the regular language containing just |
92 | 377 |
the string @{text "[c]"}. The relation @{term "\<approx>({[c]})"} partitions @{text UNIV} |
101 | 378 |
into three equivalence classes @{text "X\<^isub>1"}, @{text "X\<^isub>2"} and @{text "X\<^isub>3"} |
90 | 379 |
as follows |
380 |
||
381 |
\begin{center} |
|
382 |
@{text "X\<^isub>1 = {[]}"}\hspace{5mm} |
|
383 |
@{text "X\<^isub>2 = {[c]}"}\hspace{5mm} |
|
384 |
@{text "X\<^isub>3 = UNIV - {[], [c]}"} |
|
385 |
\end{center} |
|
386 |
||
387 |
One direction of the Myhill-Nerode theorem establishes |
|
93 | 388 |
that if there are finitely many equivalence classes, like in the example above, then |
389 |
the language is regular. In our setting we therefore have to show: |
|
75 | 390 |
|
391 |
\begin{theorem}\label{myhillnerodeone} |
|
96 | 392 |
@{thm[mode=IfThen] Myhill_Nerode1} |
75 | 393 |
\end{theorem} |
71 | 394 |
|
75 | 395 |
\noindent |
90 | 396 |
To prove this theorem, we first define the set @{term "finals A"} as those equivalence |
100 | 397 |
classes from @{term "UNIV // \<approx>A"} that contain strings of @{text A}, namely |
75 | 398 |
% |
71 | 399 |
\begin{equation} |
70 | 400 |
@{thm finals_def} |
71 | 401 |
\end{equation} |
402 |
||
403 |
\noindent |
|
92 | 404 |
In our running example, @{text "X\<^isub>2"} is the only equivalence class in @{term "finals {[c]}"}. |
90 | 405 |
It is straightforward to show that in general @{thm lang_is_union_of_finals} and |
79 | 406 |
@{thm finals_in_partitions} hold. |
75 | 407 |
Therefore if we know that there exists a regular expression for every |
100 | 408 |
equivalence class in \mbox{@{term "finals A"}} (which by assumption must be |
93 | 409 |
a finite set), then we can use @{text "\<bigplus>"} to obtain a regular expression |
98 | 410 |
that matches every string in @{text A}. |
70 | 411 |
|
75 | 412 |
|
90 | 413 |
Our proof of Thm.~\ref{myhillnerodeone} relies on a method that can calculate a |
79 | 414 |
regular expression for \emph{every} equivalence class, not just the ones |
77 | 415 |
in @{term "finals A"}. We |
93 | 416 |
first define the notion of \emph{one-character-transition} between |
417 |
two equivalence classes |
|
75 | 418 |
% |
71 | 419 |
\begin{equation} |
420 |
@{thm transition_def} |
|
421 |
\end{equation} |
|
70 | 422 |
|
71 | 423 |
\noindent |
92 | 424 |
which means that if we concatenate the character @{text c} to the end of all |
425 |
strings in the equivalence class @{text Y}, we obtain a subset of |
|
77 | 426 |
@{text X}. Note that we do not define an automaton here, we merely relate two sets |
110 | 427 |
(with the help of a character). In our concrete example we have |
92 | 428 |
@{term "X\<^isub>1 \<Turnstile>c\<Rightarrow> X\<^isub>2"}, @{term "X\<^isub>1 \<Turnstile>d\<Rightarrow> X\<^isub>3"} with @{text d} being any |
93 | 429 |
other character than @{text c}, and @{term "X\<^isub>3 \<Turnstile>d\<Rightarrow> X\<^isub>3"} for any @{text d}. |
75 | 430 |
|
110 | 431 |
Next we build an \emph{initial equational system} that |
75 | 432 |
contains an equation for each equivalence class. Suppose we have |
433 |
the equivalence classes @{text "X\<^isub>1,\<dots>,X\<^isub>n"}, there must be one and only one that |
|
434 |
contains the empty string @{text "[]"} (since equivalence classes are disjoint). |
|
77 | 435 |
Let us assume @{text "[] \<in> X\<^isub>1"}. We build the following equational system |
75 | 436 |
|
437 |
\begin{center} |
|
438 |
\begin{tabular}{rcl} |
|
439 |
@{text "X\<^isub>1"} & @{text "="} & @{text "(Y\<^isub>1\<^isub>1, CHAR c\<^isub>1\<^isub>1) + \<dots> + (Y\<^isub>1\<^isub>p, CHAR c\<^isub>1\<^isub>p) + \<lambda>(EMPTY)"} \\ |
|
440 |
@{text "X\<^isub>2"} & @{text "="} & @{text "(Y\<^isub>2\<^isub>1, CHAR c\<^isub>2\<^isub>1) + \<dots> + (Y\<^isub>2\<^isub>o, CHAR c\<^isub>2\<^isub>o)"} \\ |
|
441 |
& $\vdots$ \\ |
|
442 |
@{text "X\<^isub>n"} & @{text "="} & @{text "(Y\<^isub>n\<^isub>1, CHAR c\<^isub>n\<^isub>1) + \<dots> + (Y\<^isub>n\<^isub>q, CHAR c\<^isub>n\<^isub>q)"}\\ |
|
443 |
\end{tabular} |
|
444 |
\end{center} |
|
70 | 445 |
|
75 | 446 |
\noindent |
100 | 447 |
where the terms @{text "(Y\<^isub>i\<^isub>j, CHAR c\<^isub>i\<^isub>j)"} |
448 |
stand for all transitions @{term "Y\<^isub>i\<^isub>j \<Turnstile>c\<^isub>i\<^isub>j\<Rightarrow> |
|
449 |
X\<^isub>i"}. There can only be |
|
110 | 450 |
finitely many such terms in a right-hand side since by assumption there are only finitely many |
100 | 451 |
equivalence classes and only finitely many characters. The term @{text |
452 |
"\<lambda>(EMPTY)"} in the first equation acts as a marker for the equivalence class |
|
453 |
containing @{text "[]"}.\footnote{Note that we mark, roughly speaking, the |
|
75 | 454 |
single ``initial'' state in the equational system, which is different from |
100 | 455 |
the method by Brzozowski \cite{Brzozowski64}, where he marks the |
456 |
``terminal'' states. We are forced to set up the equational system in our |
|
457 |
way, because the Myhill-Nerode relation determines the ``direction'' of the |
|
458 |
transitions. The successor ``state'' of an equivalence class @{text Y} can |
|
459 |
be reached by adding characters to the end of @{text Y}. This is also the |
|
460 |
reason why we have to use our reverse version of Arden's lemma.} |
|
461 |
Overloading the function @{text \<calL>} for the two kinds of terms in the |
|
92 | 462 |
equational system, we have |
75 | 463 |
|
464 |
\begin{center} |
|
92 | 465 |
@{text "\<calL>(Y, r) \<equiv>"} % |
466 |
@{thm (rhs) L_rhs_item.simps(2)[where X="Y" and r="r", THEN eq_reflection]}\hspace{10mm} |
|
86 | 467 |
@{thm L_rhs_item.simps(1)[where r="r", THEN eq_reflection]} |
75 | 468 |
\end{center} |
469 |
||
470 |
\noindent |
|
100 | 471 |
and we can prove for @{text "X\<^isub>2\<^isub>.\<^isub>.\<^isub>n"} that the following equations |
75 | 472 |
% |
473 |
\begin{equation}\label{inv1} |
|
83 | 474 |
@{text "X\<^isub>i = \<calL>(Y\<^isub>i\<^isub>1, CHAR c\<^isub>i\<^isub>1) \<union> \<dots> \<union> \<calL>(Y\<^isub>i\<^isub>q, CHAR c\<^isub>i\<^isub>q)"}. |
75 | 475 |
\end{equation} |
476 |
||
477 |
\noindent |
|
478 |
hold. Similarly for @{text "X\<^isub>1"} we can show the following equation |
|
479 |
% |
|
480 |
\begin{equation}\label{inv2} |
|
83 | 481 |
@{text "X\<^isub>1 = \<calL>(Y\<^isub>i\<^isub>1, CHAR c\<^isub>i\<^isub>1) \<union> \<dots> \<union> \<calL>(Y\<^isub>i\<^isub>p, CHAR c\<^isub>i\<^isub>p) \<union> \<calL>(\<lambda>(EMPTY))"}. |
75 | 482 |
\end{equation} |
483 |
||
484 |
\noindent |
|
101 | 485 |
The reason for adding the @{text \<lambda>}-marker to our initial equational system is |
103 | 486 |
to obtain this equation: it only holds with the marker, since none of |
108 | 487 |
the other terms contain the empty string. The point of the initial equational system is |
488 |
that solving it means we will be able to extract a regular expression for every equivalence class. |
|
100 | 489 |
|
101 | 490 |
Our representation for the equations in Isabelle/HOL are pairs, |
108 | 491 |
where the first component is an equivalence class (a set of strings) |
492 |
and the second component |
|
101 | 493 |
is a set of terms. Given a set of equivalence |
100 | 494 |
classes @{text CS}, our initial equational system @{term "Init CS"} is thus |
101 | 495 |
formally defined as |
104 | 496 |
% |
497 |
\begin{equation}\label{initcs} |
|
498 |
\mbox{\begin{tabular}{rcl} |
|
100 | 499 |
@{thm (lhs) Init_rhs_def} & @{text "\<equiv>"} & |
500 |
@{text "if"}~@{term "[] \<in> X"}\\ |
|
501 |
& & @{text "then"}~@{term "{Trn Y (CHAR c) | Y c. Y \<in> CS \<and> Y \<Turnstile>c\<Rightarrow> X} \<union> {Lam EMPTY}"}\\ |
|
502 |
& & @{text "else"}~@{term "{Trn Y (CHAR c)| Y c. Y \<in> CS \<and> Y \<Turnstile>c\<Rightarrow> X}"}\\ |
|
503 |
@{thm (lhs) Init_def} & @{text "\<equiv>"} & @{thm (rhs) Init_def} |
|
104 | 504 |
\end{tabular}} |
505 |
\end{equation} |
|
100 | 506 |
|
507 |
||
508 |
||
509 |
\noindent |
|
510 |
Because we use sets of terms |
|
101 | 511 |
for representing the right-hand sides of equations, we can |
100 | 512 |
prove \eqref{inv1} and \eqref{inv2} more concisely as |
93 | 513 |
% |
100 | 514 |
\begin{lemma}\label{inv} |
515 |
If @{thm (prem 1) test} then @{text "X = \<Union> \<calL> ` rhs"}. |
|
516 |
\end{lemma} |
|
77 | 517 |
|
93 | 518 |
\noindent |
92 | 519 |
Our proof of Thm.~\ref{myhillnerodeone} will proceed by transforming the |
100 | 520 |
initial equational system into one in \emph{solved form} maintaining the invariant |
108 | 521 |
in Lem.~\ref{inv}. From the solved form we will be able to read |
89 | 522 |
off the regular expressions. |
523 |
||
100 | 524 |
In order to transform an equational system into solved form, we have two |
89 | 525 |
operations: one that takes an equation of the form @{text "X = rhs"} and removes |
110 | 526 |
any recursive occurrences of @{text X} in the @{text rhs} using our variant of Arden's |
92 | 527 |
Lemma. The other operation takes an equation @{text "X = rhs"} |
89 | 528 |
and substitutes @{text X} throughout the rest of the equational system |
110 | 529 |
adjusting the remaining regular expressions appropriately. To define this adjustment |
108 | 530 |
we define the \emph{append-operation} taking a term and a regular expression as argument |
89 | 531 |
|
532 |
\begin{center} |
|
92 | 533 |
@{thm append_rexp.simps(2)[where X="Y" and r="r\<^isub>1" and rexp="r\<^isub>2", THEN eq_reflection]}\hspace{10mm} |
534 |
@{thm append_rexp.simps(1)[where r="r\<^isub>1" and rexp="r\<^isub>2", THEN eq_reflection]} |
|
89 | 535 |
\end{center} |
536 |
||
92 | 537 |
\noindent |
108 | 538 |
We lift this operation to entire right-hand sides of equations, written as |
93 | 539 |
@{thm (lhs) append_rhs_rexp_def[where rexp="r"]}. With this we can define |
101 | 540 |
the \emph{arden-operation} for an equation of the form @{text "X = rhs"} as: |
110 | 541 |
% |
542 |
\begin{equation}\label{arden_def} |
|
543 |
\mbox{\begin{tabular}{rc@ {\hspace{2mm}}r@ {\hspace{1mm}}l} |
|
94 | 544 |
@{thm (lhs) Arden_def} & @{text "\<equiv>"}~~\mbox{} & \multicolumn{2}{@ {\hspace{-2mm}}l}{@{text "let"}}\\ |
545 |
& & @{text "rhs' ="} & @{term "rhs - {Trn X r | r. Trn X r \<in> rhs}"} \\ |
|
546 |
& & @{text "r' ="} & @{term "STAR (\<Uplus> {r. Trn X r \<in> rhs})"}\\ |
|
547 |
& & \multicolumn{2}{@ {\hspace{-2mm}}l}{@{text "in"}~~@{term "append_rhs_rexp rhs' r'"}}\\ |
|
110 | 548 |
\end{tabular}} |
549 |
\end{equation} |
|
93 | 550 |
|
551 |
\noindent |
|
101 | 552 |
In this definition, we first delete all terms of the form @{text "(X, r)"} from @{text rhs}; |
110 | 553 |
then we calculate the combined regular expressions for all @{text r} coming |
94 | 554 |
from the deleted @{text "(X, r)"}, and take the @{const STAR} of it; |
555 |
finally we append this regular expression to @{text rhs'}. It can be easily seen |
|
110 | 556 |
that this operation mimics Arden's lemma on the level of equations. To ensure |
557 |
the non-emptiness condition of Arden's lemma we say that a right-hand side is |
|
558 |
\emph{ardenable} provided |
|
559 |
||
560 |
\begin{center} |
|
561 |
@{thm ardenable_def} |
|
562 |
\end{center} |
|
563 |
||
564 |
\noindent |
|
565 |
This allows us to prove |
|
566 |
||
567 |
\begin{lemma}\label{ardenable} |
|
568 |
If @{text "X = \<Union>\<calL> ` rhs"}, |
|
569 |
@{thm (prem 2) Arden_keeps_eq} and |
|
570 |
@{thm (prem 3) Arden_keeps_eq}, then |
|
571 |
@{text "X = \<Union>\<calL> ` (Arden X rhs)"} |
|
572 |
\end{lemma} |
|
573 |
||
574 |
\noindent |
|
95 | 575 |
The \emph{substituion-operation} takes an equation |
576 |
of the form @{text "X = xrhs"} and substitutes it into the right-hand side @{text rhs}. |
|
94 | 577 |
|
578 |
\begin{center} |
|
95 | 579 |
\begin{tabular}{rc@ {\hspace{2mm}}r@ {\hspace{1mm}}l} |
580 |
@{thm (lhs) Subst_def} & @{text "\<equiv>"}~~\mbox{} & \multicolumn{2}{@ {\hspace{-2mm}}l}{@{text "let"}}\\ |
|
581 |
& & @{text "rhs' ="} & @{term "rhs - {Trn X r | r. Trn X r \<in> rhs}"} \\ |
|
582 |
& & @{text "r' ="} & @{term "\<Uplus> {r. Trn X r \<in> rhs}"}\\ |
|
583 |
& & \multicolumn{2}{@ {\hspace{-2mm}}l}{@{text "in"}~~@{term "rhs' \<union> append_rhs_rexp xrhs r'"}}\\ |
|
584 |
\end{tabular} |
|
94 | 585 |
\end{center} |
95 | 586 |
|
587 |
\noindent |
|
110 | 588 |
We again delete first all occurrence of @{text "(X, r)"} in @{text rhs}; we then calculate |
95 | 589 |
the regular expression corresponding to the deleted terms; finally we append this |
590 |
regular expression to @{text "xrhs"} and union it up with @{text rhs'}. When we use |
|
591 |
the substitution operation we will arrange it so that @{text "xrhs"} does not contain |
|
110 | 592 |
any occurrence of @{text X}. |
96 | 593 |
|
100 | 594 |
With these two operation in place, we can define the operation that removes one equation |
595 |
from an equational systems @{text ES}. The operation @{const Subst_all} |
|
96 | 596 |
substitutes an equation @{text "X = xrhs"} throughout an equational system @{text ES}; |
100 | 597 |
@{const Remove} then completely removes such an equation from @{text ES} by substituting |
110 | 598 |
it to the rest of the equational system, but first eliminating all recursive occurrences |
96 | 599 |
of @{text X} by applying @{const Arden} to @{text "xrhs"}. |
600 |
||
601 |
\begin{center} |
|
602 |
\begin{tabular}{rcl} |
|
603 |
@{thm (lhs) Subst_all_def} & @{text "\<equiv>"} & @{thm (rhs) Subst_all_def}\\ |
|
604 |
@{thm (lhs) Remove_def} & @{text "\<equiv>"} & @{thm (rhs) Remove_def} |
|
605 |
\end{tabular} |
|
606 |
\end{center} |
|
100 | 607 |
|
608 |
\noindent |
|
110 | 609 |
Finally, we can define how an equational system should be solved. For this |
107 | 610 |
we will need to iterate the process of eliminating equations until only one equation |
100 | 611 |
will be left in the system. However, we not just want to have any equation |
107 | 612 |
as being the last one, but the one involving the equivalence class for |
613 |
which we want to calculate the regular |
|
108 | 614 |
expression. Let us suppose this equivalence class is @{text X}. |
107 | 615 |
Since @{text X} is the one to be solved, in every iteration step we have to pick an |
108 | 616 |
equation to be eliminated that is different from @{text X}. In this way |
617 |
@{text X} is kept to the final step. The choice is implemented using Hilbert's choice |
|
107 | 618 |
operator, written @{text SOME} in the definition below. |
100 | 619 |
|
620 |
\begin{center} |
|
621 |
\begin{tabular}{rc@ {\hspace{4mm}}r@ {\hspace{1mm}}l} |
|
622 |
@{thm (lhs) Iter_def} & @{text "\<equiv>"}~~\mbox{} & \multicolumn{2}{@ {\hspace{-4mm}}l}{@{text "let"}}\\ |
|
623 |
& & @{text "(Y, yrhs) ="} & @{term "SOME (Y, yrhs). (Y, yrhs) \<in> ES \<and> X \<noteq> Y"} \\ |
|
624 |
& & \multicolumn{2}{@ {\hspace{-4mm}}l}{@{text "in"}~~@{term "Remove ES Y yrhs"}}\\ |
|
625 |
\end{tabular} |
|
626 |
\end{center} |
|
627 |
||
628 |
\noindent |
|
110 | 629 |
The last definition we need applies @{term Iter} over and over until a condition |
630 |
@{text Cond} is \emph{not} satisfied anymore. The condition states that there |
|
631 |
are more than one equation left in the equational system @{text ES}. To solve |
|
632 |
an equational system we use Isabelle/HOL's @{text while}-operator as follows: |
|
101 | 633 |
|
100 | 634 |
\begin{center} |
635 |
@{thm Solve_def} |
|
636 |
\end{center} |
|
637 |
||
101 | 638 |
\noindent |
103 | 639 |
We are not concerned here with the definition of this operator |
640 |
(see \cite{BerghoferNipkow00}), but note that we eliminate |
|
641 |
in each @{const Iter}-step a single equation, and therefore |
|
642 |
have a well-founded termination order by taking the cardinality |
|
643 |
of the equational system @{text ES}. This enables us to prove |
|
104 | 644 |
properties about our definition of @{const Solve} when we ``call'' it with |
645 |
the equivalence class @{text X} and the initial equational system |
|
646 |
@{term "Init (UNIV // \<approx>A)"} from |
|
108 | 647 |
\eqref{initcs} using the principle: |
110 | 648 |
% |
649 |
\begin{equation}\label{whileprinciple} |
|
650 |
\mbox{\begin{tabular}{l} |
|
103 | 651 |
@{term "invariant (Init (UNIV // \<approx>A))"} \\ |
652 |
@{term "\<forall>ES. invariant ES \<and> Cond ES \<longrightarrow> invariant (Iter X ES)"}\\ |
|
653 |
@{term "\<forall>ES. invariant ES \<and> Cond ES \<longrightarrow> card (Iter X ES) < card ES"}\\ |
|
654 |
@{term "\<forall>ES. invariant ES \<and> \<not> Cond ES \<longrightarrow> P ES"}\\ |
|
655 |
\hline |
|
656 |
\multicolumn{1}{c}{@{term "P (Solve X (Init (UNIV // \<approx>A)))"}} |
|
110 | 657 |
\end{tabular}} |
658 |
\end{equation} |
|
103 | 659 |
|
660 |
\noindent |
|
104 | 661 |
This principle states that given an invariant (which we will specify below) |
662 |
we can prove a property |
|
663 |
@{text "P"} involving @{const Solve}. For this we have to discharge the following |
|
664 |
proof obligations: first the |
|
103 | 665 |
initial equational system satisfies the invariant; second that the iteration |
104 | 666 |
step @{text "Iter"} preserves the the invariant as long as the condition @{term Cond} holds; |
103 | 667 |
third that @{text "Iter"} decreases the termination order, and fourth that |
104 | 668 |
once the condition does not hold anymore then the property @{text P} must hold. |
103 | 669 |
|
104 | 670 |
The property @{term P} in our proof will state that @{term "Solve X (Init (UNIV // \<approx>A))"} |
108 | 671 |
returns with a single equation @{text "X = xrhs"} for some @{text "xrhs"}, and |
104 | 672 |
that this equational system still satisfies the invariant. In order to get |
673 |
the proof through, the invariant is composed of the following six properties: |
|
103 | 674 |
|
675 |
\begin{center} |
|
104 | 676 |
\begin{tabular}{@ {}rcl@ {\hspace{-13mm}}l @ {}} |
677 |
@{text "invariant ES"} & @{text "\<equiv>"} & |
|
103 | 678 |
@{term "finite ES"} & @{text "(finiteness)"}\\ |
679 |
& @{text "\<and>"} & @{thm (rhs) finite_rhs_def} & @{text "(finiteness rhs)"}\\ |
|
104 | 680 |
& @{text "\<and>"} & @{text "\<forall>(X, rhs)\<in>ES. X = \<Union>\<calL> ` rhs"} & @{text "(soundness)"}\\ |
681 |
& @{text "\<and>"} & @{thm (rhs) distinct_equas_def}\\ |
|
682 |
& & & @{text "(distinctness)"}\\ |
|
110 | 683 |
& @{text "\<and>"} & @{thm (rhs) ardenable_all_def} & @{text "(ardenable)"}\\ |
104 | 684 |
& @{text "\<and>"} & @{thm (rhs) valid_eqs_def} & @{text "(validity)"}\\ |
103 | 685 |
\end{tabular} |
686 |
\end{center} |
|
687 |
||
104 | 688 |
\noindent |
689 |
The first two ensure that the equational system is always finite (number of equations |
|
108 | 690 |
and number of terms in each equation); the second makes sure the ``meaning'' of the |
691 |
equations is preserved under our transformations. The other properties are a bit more |
|
692 |
technical, but are needed to get our proof through. Distinctness states that every |
|
110 | 693 |
equation in the system is distinct. Ardenable ensures that we can always |
694 |
apply the arden operation. |
|
108 | 695 |
The last property states that every @{text rhs} can only contain equivalence classes |
696 |
for which there is an equation. Therefore @{text lhss} is just the set containing |
|
697 |
the first components of an equational system, |
|
698 |
while @{text "rhss"} collects all equivalence classes @{text X} in the terms of the |
|
110 | 699 |
form @{term "Trn X r"}. That means @{thm (lhs) lhss_def}~@{text "\<equiv> {X | (X, rhs) \<in> ES}"} |
700 |
and @{thm (lhs) rhss_def}~@{text "\<equiv> {X | (X, r) \<in> rhs}"}. |
|
108 | 701 |
|
104 | 702 |
|
110 | 703 |
It is straightforward to prove that the initial equational system satisfies the |
105 | 704 |
invariant. |
705 |
||
110 | 706 |
\begin{lemma}\label{invzero} |
104 | 707 |
@{thm[mode=IfThen] Init_ES_satisfies_invariant} |
708 |
\end{lemma} |
|
709 |
||
105 | 710 |
\begin{proof} |
711 |
Finiteness is given by the assumption and the way how we set up the |
|
712 |
initial equational system. Soundness is proved in Lem.~\ref{inv}. Distinctness |
|
713 |
follows from the fact that the equivalence classes are disjoint. The ardenable |
|
110 | 714 |
property also follows from the setup of the equational system, as does |
105 | 715 |
validity.\qed |
716 |
\end{proof} |
|
717 |
||
110 | 718 |
\begin{lemma}\label{iterone} |
104 | 719 |
@{thm[mode=IfThen] iteration_step_invariant[where xrhs="rhs"]} |
720 |
\end{lemma} |
|
721 |
||
107 | 722 |
\begin{proof} |
110 | 723 |
This boils down to choosing an equation @{text "Y = yrhs"} to be eliminated |
724 |
and to show that @{term "Subst_all (ES - {(Y, yrhs)}) Y (Arden Y yrhs)"} |
|
725 |
preserves the invariant. |
|
726 |
We prove this as follows: |
|
727 |
||
728 |
\begin{center} |
|
729 |
@{text "\<forall> ES."} @{thm (prem 1) Subst_all_satisfies_invariant} implies |
|
730 |
@{thm (concl) Subst_all_satisfies_invariant} |
|
731 |
\end{center} |
|
732 |
||
733 |
\noindent |
|
734 |
Finiteness is straightforward, as @{const Subst} and @{const Arden} operations |
|
735 |
keep the equational system finite. These operation also preserve soundness |
|
736 |
distinctness (we proved soundness for @{const Arden} in Lem.~\ref{ardenable}). |
|
737 |
The property Ardenable is clearly preserved because the append-operation |
|
738 |
cannot make a regular expression to match the empty string. Validity is |
|
739 |
given because @{const Arden} removes an equivalence class from @{text yrhs} |
|
740 |
and then @{const Subst_all} removes @{text Y} from the equational system. |
|
741 |
Having proved the implication above, we can replace @{text "ES"} with @{text "ES - {(Y, yrhs)}"} |
|
742 |
which matches with our proof-obligation of @{const "Subst_all"}. Since |
|
743 |
\mbox{@{term "ES = ES - {(Y, yrhs)} \<union> {(Y, yrhs)}"}}, we can use our assumption |
|
744 |
to complete the proof.\qed |
|
107 | 745 |
\end{proof} |
746 |
||
110 | 747 |
\begin{lemma}\label{itertwo} |
104 | 748 |
@{thm[mode=IfThen] iteration_step_measure[simplified (no_asm), where xrhs="rhs"]} |
749 |
\end{lemma} |
|
750 |
||
105 | 751 |
\begin{proof} |
752 |
By assumption we know that @{text "ES"} is finite and has more than one element. |
|
753 |
Therefore there must be an element @{term "(Y, yrhs) \<in> ES"} with |
|
110 | 754 |
@{term "(Y, yrhs) \<noteq> (X, rhs)"}. Using the distinctness property we can infer |
105 | 755 |
that @{term "Y \<noteq> X"}. We further know that @{text "Remove ES Y yrhs"} |
756 |
removes the equation @{text "Y = yrhs"} from the system, and therefore |
|
757 |
the cardinality of @{const Iter} strictly decreases.\qed |
|
758 |
\end{proof} |
|
759 |
||
104 | 760 |
\begin{lemma} |
761 |
If @{thm (prem 1) Solve} and @{thm (prem 2) Solve} then there exists |
|
762 |
a @{text rhs} such that @{term "Solve X (Init (UNIV // \<approx>A)) = {(X, rhs)}"} |
|
763 |
and @{term "invariant {(X, rhs)}"}. |
|
764 |
\end{lemma} |
|
765 |
||
107 | 766 |
\begin{proof} |
110 | 767 |
In order to prove this lemma using \eqref{whileprinciple}, we have to use a slightly |
768 |
stronger invariant since Lem.~\ref{iterone} and \ref{itertwo} have the precondition |
|
769 |
that @{term "(X, rhs) \<in> ES"} for some @{text rhs}. This precondition is needed |
|
770 |
in order to choose in the @{const Iter}-step an equation that is not \mbox{@{term "X = rhs"}}. |
|
771 |
Therefore our invariant is cannot be just @{term "invariant ES"}, but must be |
|
772 |
@{term "invariant ES \<and> (\<exists>rhs. (X, rhs) \<in> ES)"}. By assumption |
|
773 |
@{thm (prem 2) Solve} and Lem.~\ref{invzero}, the more general invariant holds for |
|
774 |
the initial equational system. This is premise 1 of~\eqref{whileprinciple}. |
|
775 |
Premise 2 is given by Lem.~\ref{iterone} and the fact that @{const Iter} might |
|
776 |
modify the @{text rhs} in the equation @{term "X = rhs"}, but does not remove it. |
|
777 |
Premise 3 of~\eqref{whileprinciple} is by Lem.~\ref{itertwo}. Now in premise 4 |
|
778 |
we like to show that there exists a @{text rhs} such that @{term "ES = {(X, rhs)}"} |
|
779 |
and that @{text "invariant {(X, rhs)}"} holds, provided the condition @{text "Cond"} |
|
780 |
does not hols. By the stronger invariant we know there exists such a @{text "rhs"} |
|
781 |
with @{term "(X, rhs) \<in> ES"}. Because @{text Cond} is not true, we know the cardinality |
|
782 |
of @{text ES} is @{text 1}. This means @{text "ES"} must actually be the equation @{text "X = rhs"}, |
|
783 |
for which the invariant holds. This allows us to conclude that |
|
784 |
@{term "Solve X (Init (UNIV // \<approx>A)) = {(X, rhs)}"} and @{term "invariant {(X, rhs)}"} hold.\qed |
|
107 | 785 |
\end{proof} |
786 |
||
106 | 787 |
\noindent |
788 |
With this lemma in place we can show that for every equivalence class in @{term "UNIV // \<approx>A"} |
|
789 |
there exists a regular expression. |
|
790 |
||
105 | 791 |
\begin{lemma}\label{every_eqcl_has_reg} |
792 |
@{thm[mode=IfThen] every_eqcl_has_reg} |
|
793 |
\end{lemma} |
|
794 |
||
795 |
\begin{proof} |
|
796 |
By the preceeding Lemma, we know that there exists a @{text "rhs"} such |
|
797 |
that @{term "Solve X (Init (UNIV // \<approx>A))"} returns the equation @{text "X = rhs"}, |
|
798 |
and that the invariant holds for this equation. That means we |
|
799 |
know @{text "X = \<Union>\<calL> ` rhs"}. We further know that |
|
109 | 800 |
this is equal to \mbox{@{text "\<Union>\<calL> ` (Arden X rhs)"}} using the properties of the |
110 | 801 |
invariant and Lem.\ref{ardenable}. Using the validity property for the equation @{text "X = rhs"}, |
106 | 802 |
we can infer that @{term "rhss rhs \<subseteq> {X}"} and because the arden operation |
803 |
removes that @{text X} from @{text rhs}, that @{term "rhss (Arden X rhs) = {}"}. |
|
804 |
That means @{term "Arden X rhs"} can only consist of terms of the form @{term "Lam r"}. |
|
805 |
So we can collect those (finitely many) regular expressions and have @{term "X = L (\<Uplus>rs)"}. |
|
806 |
With this we can conclude the proof.\qed |
|
105 | 807 |
\end{proof} |
808 |
||
106 | 809 |
\noindent |
810 |
Lem.~\ref{every_eqcl_has_reg} allows us to finally give a proof for the first direction |
|
811 |
of the Myhill-Nerode theorem. |
|
105 | 812 |
|
106 | 813 |
\begin{proof}[of Thm.~\ref{myhillnerodeone}] |
105 | 814 |
By Lem.~\ref{every_eqcl_has_reg} we know that there exists a regular language for |
815 |
every equivalence class in @{term "UNIV // \<approx>A"}. Since @{text "finals A"} is |
|
110 | 816 |
a subset of @{term "UNIV // \<approx>A"}, we also know that for every equivalence class |
105 | 817 |
in @{term "finals A"} there exists a regular language. Moreover by assumption |
106 | 818 |
we know that @{term "finals A"} must be finite, and therefore there must be a finite |
105 | 819 |
set of regular expressions @{text "rs"} such that |
820 |
||
821 |
\begin{center} |
|
822 |
@{term "\<Union>(finals A) = L (\<Uplus>rs)"} |
|
823 |
\end{center} |
|
824 |
||
825 |
\noindent |
|
826 |
Since the left-hand side is equal to @{text A}, we can use @{term "\<Uplus>rs"} |
|
107 | 827 |
as the regular expression that is needed in the theorem.\qed |
105 | 828 |
\end{proof} |
54 | 829 |
*} |
830 |
||
100 | 831 |
|
832 |
||
833 |
||
834 |
section {* Myhill-Nerode, Second Part *} |
|
39
a59473f0229d
tuned a little bit the section about finite partitions
urbanc
parents:
37
diff
changeset
|
835 |
|
a59473f0229d
tuned a little bit the section about finite partitions
urbanc
parents:
37
diff
changeset
|
836 |
text {* |
112 | 837 |
TO BE DONE |
838 |
||
39
a59473f0229d
tuned a little bit the section about finite partitions
urbanc
parents:
37
diff
changeset
|
839 |
|
54 | 840 |
\begin{theorem} |
112 | 841 |
Given @{text "r"} is a regular expressions, then @{thm Myhill_Nerode2}. |
54 | 842 |
\end{theorem} |
39
a59473f0229d
tuned a little bit the section about finite partitions
urbanc
parents:
37
diff
changeset
|
843 |
|
112 | 844 |
% \begin{proof} |
845 |
% By induction on the structure of @{text r}. The cases for @{const NULL}, @{const EMPTY} |
|
846 |
% and @{const CHAR} are straightforward, because we can easily establish |
|
39
a59473f0229d
tuned a little bit the section about finite partitions
urbanc
parents:
37
diff
changeset
|
847 |
|
112 | 848 |
% \begin{center} |
849 |
% \begin{tabular}{l} |
|
850 |
% @{thm quot_null_eq}\\ |
|
851 |
% @{thm quot_empty_subset}\\ |
|
852 |
% @{thm quot_char_subset} |
|
853 |
% \end{tabular} |
|
854 |
% \end{center} |
|
855 |
% |
|
856 |
% \end{proof} |
|
109 | 857 |
|
858 |
||
112 | 859 |
% @{thm tag_str_ALT_def[where ?L1.0="A" and ?L2.0="B"]} |
109 | 860 |
|
112 | 861 |
% @{thm tag_str_SEQ_def[where ?L1.0="A" and ?L2.0="B"]} |
109 | 862 |
|
112 | 863 |
% @{thm tag_str_STAR_def[where ?L1.0="A"]} |
39
a59473f0229d
tuned a little bit the section about finite partitions
urbanc
parents:
37
diff
changeset
|
864 |
*} |
a59473f0229d
tuned a little bit the section about finite partitions
urbanc
parents:
37
diff
changeset
|
865 |
|
a59473f0229d
tuned a little bit the section about finite partitions
urbanc
parents:
37
diff
changeset
|
866 |
|
54 | 867 |
section {* Conclusion and Related Work *} |
868 |
||
92 | 869 |
text {* |
112 | 870 |
In this paper we took the view that a regular language is one where there |
871 |
exists a regular expression that matches all its strings. Regular |
|
872 |
expressions can be conveniently defined as a datatype in a HOL-based theorem |
|
873 |
prover. For us it was therefore interesting to find out how far we can push |
|
874 |
this point of view. |
|
875 |
||
876 |
Having formalised the Myhill-Nerode theorem means we |
|
877 |
pushed quite far. Using this theorem we can obviously prove when a language |
|
878 |
is \emph{not} regular---by establishing that it has infinitely many |
|
879 |
equivalence classes generated by the Myhill-Nerode relation (this is usually |
|
880 |
the purpose of the pumping lemma \cite{Kozen97}). We can also use it to |
|
881 |
establish the standard textbook results about closure properties of regular |
|
882 |
languages. Interesting is the case of closure under complement, because |
|
883 |
it seems difficult to construct a regular expression for the complement |
|
884 |
language by direct means. However the existence can be easily proved using |
|
885 |
the Myhill-Nerode theorem since clearly |
|
92 | 886 |
|
112 | 887 |
\begin{center} |
888 |
@{term "s\<^isub>1 \<approx>A s\<^isub>2"} if and only if @{term "s\<^isub>1 \<approx>(-A) s\<^isub>2"} |
|
889 |
\end{center} |
|
890 |
||
891 |
\noindent |
|
892 |
holds for any strings @{text "s\<^isub>1"} and @{text |
|
893 |
"s\<^isub>2"}. Therefore @{text A} and @{term "-A"} give rise to the same |
|
894 |
partitions. From the closure under complementation follows also the closure |
|
895 |
under intersection and set difference by some simple set calculations. |
|
896 |
Proving the same result via automata would be quite involved. It includes the |
|
897 |
steps: regular expression @{text "\<Rightarrow>"} non-deterministic automaton @{text |
|
898 |
"\<Rightarrow>"} deterministic automaton @{text "\<Rightarrow>"} complement automaton @{text "\<Rightarrow>"} |
|
899 |
regular expression. |
|
900 |
||
901 |
Our formalisation consists of ??? lines of Isar code for the first |
|
902 |
direction and ??? for the second. While this might be seen as too large |
|
903 |
to count as a concise proof pearl, this should be seen in the context |
|
904 |
of the work done by Constable at al \cite{Constable00} who formalised |
|
905 |
the Myhill-Nerode theorem in Nuprl using automata. They write that |
|
906 |
their four-member team needed something on the magnitute of 18 months |
|
907 |
to formalise the Myhill-Nerode theorem. Our estimate is that we needed |
|
908 |
approximately 3 months for our fomalisation and this included the time |
|
909 |
to find our proof arguments, as we could not find them in the literature. |
|
910 |
So for us the formalisation was not the bottleneck. It is hard for us |
|
911 |
to gauge the size of a formalisation in Nurpl, but from what is shown in |
|
912 |
the Nuprl Math Library their development seems substantially larger. |
|
913 |
||
914 |
Our proof of the first direction is very much inspired by \emph{Brzozowski's |
|
915 |
algebraic mehod} used to convert a finite automaton to a regular |
|
111 | 916 |
expression. The close connection can be seen by considering the equivalence |
917 |
classes as the states of the minimal automaton for the regular language. |
|
918 |
However there are some subtle differences. If we identify equivalence |
|
919 |
classes with the states of the automaton, then the most natural choice is to |
|
920 |
characterise each state with the set of strings starting from the initial |
|
921 |
state leading up to that state. Usually the states are characterised as the |
|
922 |
ones starting from that state leading to the terminal states. The first |
|
923 |
choice has consequences how the initial equational system is set up. We have |
|
112 | 924 |
the $\lambda$-term on our ``initial state'', while Brzozowski has it on the |
111 | 925 |
terminal states. This means we also need to reverse the direction of Arden's |
926 |
lemma. |
|
92 | 927 |
|
112 | 928 |
We briefly considered using the method Brzozowski presented in the Appendix |
929 |
of \cite{Brzozowski64} in order to prove the second direction of the |
|
930 |
Myhill-Nerode theorem. There he calculates the derivatives for regular |
|
931 |
expressions and shows that there can be only finitely many of them. We could |
|
932 |
use as the tag of a string @{text s} the derivative of a regular expression |
|
933 |
generated with respect to @{text s}. Using the fact that two strings are |
|
934 |
Myhill-Nerode related whenever their derivative is the same together with |
|
935 |
the fact that there are only finitely many derivatives for a regular |
|
936 |
expression would give us the same argument. However it seems not so easy to |
|
937 |
calculate the derivatives and then to count them. Therefore we preferred our |
|
938 |
direct method of using tagging-functions involving equivalence classes. This |
|
939 |
is also where our method shines, because we can completely side-step the |
|
940 |
standard argument \cite{Kozen97} where automata need to be composed, which |
|
941 |
is not so convenient to formalise in a HOL-based theorem prover. |
|
111 | 942 |
|
112 | 943 |
While regular expressions are convenient in formalisations, they have some |
944 |
limitations. One is that there seems to be no notion of a minimal regular |
|
945 |
expression, like there is a notion of a minimal automaton for a regular |
|
946 |
expression. |
|
111 | 947 |
|
92 | 948 |
*} |
949 |
||
950 |
||
24 | 951 |
(*<*) |
952 |
end |
|
953 |
(*>*) |