Equality and Inequality in the Dataflow Algebra. A. J. Cowling

Transcription

1 Verifiction nd Testing Reserch Group, Deprtment of Computer Science, University of Sheffield, Regent Court, 211, Portobello Street, Sheffield, S1 4DP, United Kingdom Emil: dcs.shef.c.uk Telephone: Fx: Abstrct A fundmentl concept of the dtflow lgebr is the notion tht certin sequences cn be treted s equl, even though they hve different constructions, nd the bsic xioms defining this equlity hve been foundtionl to the development of the lgebr so fr. In the course of this development, though, it hs become pprent tht rigorous formultion of the concept of equlity would require dditionl xioms, in order to express the properties tht re normlly ssumed for n equlity opertion. Also, the definition of equlity in terms of these xioms is not constructive, so tht there hs not been n lgorithm for determining whether or not two rbitrry sequences re in fct equl. This report therefore ddresses these two issues, firstly by defining full set of xioms for equlity, together with mchinery for resoning bout properties of this set of xioms, nd then defining constructive version of the equlity opertion nd showing tht it is equivlent to the xiomtic definition. The report then goes on to consider inequlity in similr fshion, by defining set of xioms for inequlity, showing tht these re complete nd consistent with respect to the denottionl semntics of the lgebr, nd then defining constructive version of the inequlity opertion nd estblishing its properties. Finlly, the report considers the reltionship between equlity nd substitutbility, nd nlyses the ppliction of this reltionship to some of the bsic opertions tht hve been defined for the lgebr. Key Words nd Phrses Forml specifictions, dtflow lgebr, semntic domins, syntx of expressions, semntics of expressions, equlity of terms, substitutbility. 1. Introduction The dtflow lgebr (DFA from now on) hs developed through four stges. The first stge ws minly concerned just with identifying the principles of model tht could cpture spects of the behviour of systems where the sttic structure could be described in terms of dt flow digrms [1], nd s such this stge ws comprtively informl. The second stge ws much more forml, nd involved the definition of n bstrct syntx for the DFA [2], nd the use of this by Nike in the work for his PhD thesis [3]. This stge ws lso chrcterised by the initil development of tools for mnipulting DFA specifictions [4], nd hence the need to introduce forml numbering system for different versions of the DFA nottion, so tht the initil stge ws defined to be version 0, nd this stge version number 1 (to be precise, 1.0.0). It ws t this stge tht the concept of DFA specifictions being structured into three lyers of detil ws formlised. The third stge then involved defining much simpler bstrct syntx for the DFA [5], which renmed the three lyers in specifiction, so tht (in the order in which they need to be developed) they re now referred to s the topologicl lyer, the event lyer nd the computtion lyer. This bstrct syntx lso mde much clerer the structure of the semntic domins involved (known s SeqConst, SeqExp nd Seq) nd the reltionships between them. This stge, which effectively defined version 2 (or, strictly, 2.0.0) of the DFA nottion, lso provided more rigorous definition of the denottionl semntics for the event lyer of the DFA (which ws formerly known s the syntctic lyer), nd corrected some errors tht hd been found in the definitions used in version 1. To complement this, n opertionl semntics ws then lso defined for the event lyer [6]. Most recently, the fourth stge involved correcting n error tht hd been identified in the denottionl semntics tht hd been creted in the third stge [7]. This revision therefore defined version 3 (strictly 3.0.0) of the DFA nottion, nd lso involved constructing new versions of the proofs of the results for soundness nd completeness of the semntics. In the course of this work it ws noted tht both the denottionl semntics nd the opertionl semntics use models tht reflect prticulr forms for the structures of complex sequences, such tht ny sequence cn be expressed in terms of these

2 prticulr forms. This led to n explortion of how the concept of norml forms, s defined in the context of term rewriting systems, could be pplied to the DFA, where the effect of the vrious equlity xioms ws tht the usul definition of norml form hd to be dpted, so tht norml form for the DFA is defined insted to be form such tht ny rbitrry sequence is equl to some sequence in this form. Thus, [8] defines number of such forms, some bsed on the structures used in the denottionl semntics nd others bsed on those used in the opertionl semntics. For ech of these forms it then defines chrcteristic function, which determines whether sequence is in this form; it defines normlistion function, which will convert ny rbitrry sequence into this form; nd it estblishes the normlistion properties of this function, nmely tht its result is lwys in the required form nd is equl to the originl sequence. An importnt ppliction of these concepts is to the definitions of equlity nd inequlity, where the conventionl definitions in terms of the xioms (s given in [5]) suffer from the limittion of not being constructive. These definitions re implictionl in style, mening tht two sequences re defined to be equl if they re in reltion tht is the trnsitive closure of the set of reltions defined by the individul equlity xioms. Consequently, to show whether two sequences re equl one must compute n pproprite composition of these reltions, but the definition provides no support or guidnce for this computtion. By contrst, if constructive definition could be found for equlity then the definition would generte the required composition, which would form wht in constructive logic is referred to s the witness to the proposition tht the two sequences were equl. Such constructive property would then be even more importnt for inequlity, where the implictionl definition is simply in terms of no suitble composition of the reltions existing, wheres constructive definition would provide n lgorithm for finding witness to the proposition tht no such composition could exist, in the form of difference between the two sequences tht could not be eliminted by ppliction of the xioms. Hence, this report is concerned minly with using the concepts of norml forms in order to develop constructive definitions of equlity nd inequlity. The first prt of this involves mking more forml the existing definitions of equlity nd inequlity, nd this is begun in section 2, which introduces dt structures to represent the instnces of the compositions of the bsic equlity reltions tht will constitute the witnesses to the constructive definitions. Section 3 then shows how hed norml form cn be used to define constructive versions of the equlity reltion, nd estblishes the properties of these versions. The second prt of this development involves pplying the sme pproch to inequlity, nd this is begun in section 4, which develops the xioms needed to define it. The vlidity of these xioms with respect to the semntics then hs to be estblished, nd so section 5 develops the mchinery needed for this, while section 6 presents the ctul vlidity proofs. Bsed on these, section 7 then develops constructive version of the inequlity reltion, nd estblishes the properties of these versions. The finl prt of this development is to consider the concept of substitutbility, which is property tht is usully regrded s being ssocited with equlity. This is explored in section 8, which nlyses some key opertions in order to determine which of them possess this property, nd identify the significnce of this in terms of how it might be used to clssify opertions. Finlly, section 9 summrises the conclusions of the work, nd considers further developments tht re required. 2. Equlity nd Inequlity The strting point for trying to define constructive tretment of the notions of equlity nd inequlity hs to be to mke more forml the implictionl tretment tht ws given originlly in section 6 of [5]. This tretment ssumed tht the xioms of the lgebr gve rise to bsic equlity reltion, nd tht the reltion of equlity s this concept is usully understood could be defined simply s the trnsitive closure of this bsic reltion. Before exmining how this needs to be mde more forml, it is therefore worth repeting here the xioms of the lgebr s they were defined there, in the context of defining how the domin Seq is constructed from SeqConst by mens of the equivlence reltion tht is denoted by =. s, s1, s2, s3 : SeqConst, (i) s1 ; (s2 ; s3) = (s1 ; s2) ; s3 (sequencing is ssocitive), (ii) s ; ε = ε ; s = s (the silent ction is the left nd right identities for sequencing), (iii) s1 (s2 s3) = (s1 s2) s3 (lterntion is ssocitive), (iv) s1 s2 = s2 s1 (lterntion is commuttive), (v) s s = s (lterntion is idempotent), (vi) s φ = φ s = s (the forbidden ction is the left nd right identities for lterntion), (vii) s1 ; (s2 s3) = (s1 ; s2) (s1 ; s3) (sequencing distributes over lterntion), (viii) (s1 s2) ; s3 = (s1 ; s3) (s2 ; s3) (on both sides), nd (ix) φ ; s = φ (the forbidden ction is left zero for sequencing). 2

3 In wht follows we will refer to these xioms, long with one to be introduced below, s the bse xioms for equlity. Given these bse xioms, then s specified in section 6 of [5], the informl definition of equlity is tht, given ny two sequences s nd sb in SeqConst, to hve s = sb then one of three properties should hold: () either they should hve the sme construction (ie s sb), or (b) they should be relted directly by one of the bs xioms (i) to (ix) bove, or (c) there should exist chin of vlues s1, s2,..., sn such tht s1 = s1, s1 = s2,... sn-1 = sn nd sn = sb, where for ech of the successive pirs of vlues in this chin wht is denoted here by equlity signifies tht they should be relted directly by one of the bse xioms. The fct tht in this third cse this qulifiction needs to be given for the mening of equlity indictes tht idelly different representtion is required for this bsic reltion of equlity tht comes directly from the bse xioms, point which will be developed further below. Furthermore, of course, s ws pointed out in considering the definition of miniml multi liner form in [8], point tht hd been overlooked completely in this is tht the conventionl notion of equlity not only involves trnsitive closure of this bsic reltion, but lso (becuse of the ssumption tht equlity indictes substitutbility) structurl recursive closure. This mens tht if s1 = sb1 nd s2 = sb2, then it must lso hold tht s1 s2 = sb1 sb2 nd tht s1 ; s2 = sb1 ; sb2. Hence, the informl definition given bove should lso hve included two more cses for the connection between two intermedite vlues in the chin of vlues tht connect two equl objects, viz: (d) s s1 sb1 nd sb sb1 sb2 nd there is pir of chins connecting them, one for s1 = sb1 nd the other for s2 = sb2, where the two chins in the pir re independent of ech other; or (e) s s1 ; s2 nd sb sb1 ; sb2 nd there is pir of chins connecting them, one for s1 = sb1 nd the other for s2 = sb2, where gin the two chins in the pir re independent of ech other. The first step in mking this informl definition rther more forml is therefore to define dditionl xioms to cpture the properties in cluses (), (c), (d) nd (e) bove. Also, for completeness, we should define the commuttivity property for equlity s n xiom s well, nd so the dditionl xioms tht re required re s follows. (x) s1 s2 s1 = s2 (equlity is reflexive), (xi) s1 = s2 s2 = s3 s1 = s3 (equlity is trnsitive), (xii) s1 = s2 s1b = s2b s1 s1b = s2 s2b (substitutbility in lterntion), (xiii) s1 = s2 s1b = s2b s1 ; s1b = s2 ; s2b (substitutbility in sequencing), (xiv) s1 = s2 s2 = s1 (equlity is commuttive). Of these xiom (x), which cptures the reflexivity property since if two sequences re identicl they re the sme sequence, ws lso xiom (x) in [5], nd it too will be included in the set of bse xioms for equlity. Also, it should be noted tht xiom (xi) here does not ctully cpture the notion tht, for ny s1 nd s3, there will exist t lest one s2 such tht one or other of the equlities between s1 nd s2 or s2 nd s3 will be derivble directly from the bse xioms. As such this xiom is still essentilly implictionl rther thn constructive, in tht while it implies tht such chins of intermedite vlues must exist, it does not provide ny wy of clculting wht they must be. Indeed, given n rbitrry pir of vlues s nd sb, the definition implied by these xioms does not even provide wy of clculting whether the chins of vlues referred to in cluses (c), (d) nd (e) of the informl definition do exist. A similr limittion pplies to the concept of inequlity, where potentilly it is even more significnt, s showing tht two elements re unequl involves estblishing positively tht no such intermedite chins cn exist, which is much more chllenging condition thn simply one of trying to find such chins nd filing. To develop these concepts, therefore, we need to crete still more forml definition for the equlity reltion, nd this must cover structurl recursive closure s well s trnsitive closure nd commuttivity. This is done in terms of pir of opertions clled AxEqul nd Equl, corresponding respectively to the bsic reltionship referred to bove nd to its closures (both trnsitive nd structurlly recursive). Thus, ech hs signture SeqConst SeqConst Bool, nd the definitions of them re s follows, where ll the cluses in AxEqul prt from the first lso incorporte xiom (xiv) either implicitly (if the relevnt xiom is inherently commuttive) or explicitly. AxEqul (s, sb) Í (s sb) ( s s1 ; (s2 ; s3) sb (s1 ; s2) ; s3 ) ( s (s1 ; s2) ; s3) sb s1 ; (s2 ; s3) ) ( s sb ; ε ) ( s ε ; sb ) ( sb s ; ε ) ( sb ε ; s ) ( s s1 (s2 s3) sb (s1 s2) s3 ) ( s (s1 s2) s3) sb s1 (s2 s3) ) ( s s1 s2 sb s2 s1 ) ( s sb sb ) ( sb s s ) ( s sb φ ) ( s φ sb ) ( sb s φ ) ( sb φ s ) ( s s1 ; (s2 s3) sb (s1 ; s2) (s1 ; s3) ) ( s (s1 ; s2) (s1 ; s3) sb s1 ; (s2 s3) ) xiom (x) xiom (i) xiom (ii) xiom (iii) xiom (iv) xiom (v) xiom (vi) xiom (vii) 3

4 ( s (s1 s2) ; s3 sb (s1 ; s3) (s2 ; s3) ) ( s (s1 ; s3) (s2 ; s3) sb (s1 s2) ; s3 ) ( s φ ; s1 sb φ ) ( s φ sb φ ; s1 ) xiom (viii) xiom (ix). Equl (s, sb) Í AxEqul (s, sb) xioms (i - x) ( AxEqul (s, sb) ( ( s : SeqConst Equl (s, s) Equl (s, sb) ) xiom (xi) ( s1, s2, sb1, sb2 : SeqConst s s1 s2 sb sb1 sb2 Equl (s1, sb1) Equl (s2, sb2) ) xiom (xii) ( s1, s2, sb1, sb2 : SeqConst s s1 ; s2 sb sb1 ; sb2 Equl (s1, sb1) Equl (s2, sb2) ) ) xiom (xiii). Given these two definitions, then the property tht they cpture formlly the intention of the informl definition for equlity given bove cn be expressed s the following pir of theorems, lthough (becuse they re essentilly vlidting the forml models ginst informl requirements, rther thn verifying properties of the forml models) both the sttements nd the proofs of these theorems re necessrily somewht less forml thn for most of the theorems tht hve been presented previously. The first prt of the property is simply tht the opertion AxEqul correctly cptures the intention of the first two cluses in the informl definition, nd the theorem tht expresses it is s follows. Theorem 1. s, sb : SeqConst AxEqul (s, sb) (s nd sb re equl under one of the bse xioms) In principle the proof is by simple enumertion of the ten possible cses, one for s sb (which is trivil) nd the others for ech of the xioms (i) to (ix). In prctice, though, the xioms cn be treted s groups, becuse of the similrities in the structures of some of them, s follows. Associtivity nd distribution xioms: xioms (i) nd (iii) express the ssocitivity of sequencing nd lterntion respectively, nd xioms (vii) nd (viii) express tht sequencing distributes over lterntion. Hence for ech there re two cses to be considered, one in which s is constructed s the left-hnd expression in the xiom nd sb s the right-hnd expression, nd (to reflect xiom (xiv)) the other where the constructions re the opposite wy round. The corresponding cluses in the definition of AxEqul ech llow for both of these possibilities, nd so the theorem holds for these four xioms. Identity xioms: xioms (ii) nd (vi) express the left nd right identity properties (of ε nd φ) for sequencing nd lterntion respectively. Hence for ech there re four cses to be considered, two for the left identity nd two for the right identity. In ech of these two cses, there will then be one in which s is constructed with the identity element nd the construction of sb is irrelevnt, nd (to reflect xiom (xiv)) the other where the constructions re the opposite wy round. The corresponding cluses in the definition of AxEqul ech llow for ll four of these possibilities, nd so the theorem holds for these two xioms. Commuttivity xioms: xiom (iv) expresses the commuttivity property for lterntion. The essence of commuttivity is tht it does not mtter which wy round the elements being lternted pper, nd so there is only one cse for the constructions of s nd sb to be considered. This cse is expressed directly in the corresponding cluse in the definition of AxEqul, nd so the theorem holds for this xiom. Idempotence xioms: xiom (v) expresses the idempotence property for lterntion. As with either the left or right identities there re two cses to be considered, one in which s is constructed s the lterntion nd the construction of sb is irrelevnt, nd (to reflect xiom (xiv)) the other where the constructions re the opposite wy round. The corresponding cluse in the definition of AxEqul llows for both of these possibilities, nd so the theorem holds for this xiom. Zero xioms: xiom (ix) expresses the left zero property for sequencing. This is similr in structure to either the left or right identities in tht there re two cses to be considered, one in which s is constructed s the sequence nd the other where sb is constructed s the sequence, but in this cse the one tht is not constructed s the sequence must be identicl to the zero: tht is, to the forbidden ction. The corresponding cluse in the definition of AxEqul llows for both of these possibilities, nd so the theorem holds for this xiom. Finlly, the theorem trivilly holds for the cse s sb, which is xiom (x), nd since it holds for ech of the other bse xioms it therefore holds overll. 4

5 The second prt of the property is then tht the opertion Equl correctly cptures the intention of the whole of this informl definition. The theorem tht expresses it needs to be proved by induction over the sizes of the chins described in cluses (c), (d) nd (e) of the informl definition, nd so mechnism needs to be introduced to mesure these sizes. This mechnism needs to be bsed on formlising the structure of these xiom chins, which is done by defining n bstrct dt type tht will be clled AxChin. This dt type hs four constructors, one (clled AChin) which produces primitive chin from pir of elements of SeqConst tht re not identicl but re relted by AxEqul, nd then three (clled TClose, AClose nd SClose) tht ssemble pirs of xiom chins to correspond respectively to the trnsitive closure, structurl closure for lterntion nd structurl closure for sequencing. Reflecting these four kinds of construction, there re therefore two groups of observer opertions for xiom chins: one group consists of the four opertions tht identify how prticulr chin object is constructed, while the other group consists of the opertions tht extrct the different components from ny chin, depending on its method of construction. The properties of these opertions re then defined lgebriclly, s set of xioms tht specify the vlues produced for ech of the possible combintions of observers nd constructors. Along with these, xioms re lso required to express the preconditions for the vrious opertions, nd in prticulr the preconditions for the constructors, which in principle ought to be set so s to ensure tht the constructors lwys ssemble chins tht re vlid (in the sense tht the intermedite elements of SeqConst re connected correctly) nd useful (in the sense tht they never connect identicl elements of SeqConst). In prctice, though, it is necessry to llow for cses such s pir of chins tht connect the sequences s sb nd s sc, where sb = sc, so tht one of the chins will hve to connect s with itself. Hence, the preconditions ctully hve to llow AChin to produce primitive chin tht is null, in the sense of connecting two identicl elements, but then hve to ensure tht such null chins re only used s prmeters to AClose or SClose. The signtures for ech of the constructors re therefore s follows. For the primitive constructor AChin the prmeters must be the two elements of SeqConst, so tht its signture is SeqConst SeqConst AxChin. Ech of the other three then tkes s prmeters two xiom chins, nd so their signtures re AxChin AxChin AxChin. The first group of observers consists of four functions clled IsPrimChin, IsTClose, IsAClose nd IsSClose, nd these ll hve the sme signture, nmely AxChin Boolen. The second group of observers then needs to represent two spects of the construction of n xiom chin. One spect is tht if chin is constructed s ny of the closures then it must hve two components, which we simply cll first nd second, so tht the corresponding observer functions re clled First nd Second nd hve the sme signture, nmely AxChin AxChin. The other spect is tht ny chin, however constructed, links pir of elements of SeqConst, nd so two observer functions re needed to extrct these elements. These two functions re clled Strt nd End, nd they both hve the sme signture, nmely AxChin SeqConst. Two kinds of xioms re needed to define the behviour of these opertions. One kind specifies the preconditions for ech of the opertions, nd the other kind defines the result produced by pplying n observer to chin with prticulr construction. Since mny of the preconditions ctully need to be specified in terms of the observers, it is simplest to define the behviour of the observers first, including their preconditions, nd then the preconditions to the constructors. The xioms needed for the observers re s follows. IsPrimChin (AChin (s, sb)) Í true. IsPrimChin (TClose (c1, c2)) Í flse. IsPrimChin (AClose (c1, c2)) Í flse. IsPrimChin (SClose (c1, c2)) Í flse. IsTClose (AChin (s, sb)) Í flse. IsTClose (TClose (c1, c2)) Í true. IsTClose (AClose (c1, c2)) Í flse. IsTClose (SClose (c1, c2)) Í flse. IsAClose (AChin (s, sb)) Í flse. IsAClose (TClose (c1, c2)) Í flse. IsAClose (AClose (c1, c2)) Í true. IsAClose (SClose (c1, c2)) Í flse. IsSClose (AChin (s, sb)) Í flse. IsSClose (TClose (c1, c2)) Í flse. IsSClose (AClose (c1, c2)) Í flse. IsSClose (SClose (c1, c2)) Í true. 5

6 First (TClose (c1, c2)) Í c1. Second (TClose (c1, c2)) Í c2. First (AClose (c1, c2)) Í c1. Second (AClose (c1, c2)) Í c2. First (SClose (c1, c2)) Í c1. Second (SClose (c1, c2)) Í c2. Strt (AChin (s, sb)) Í s. End (AChin (s, sb)) Í s. Strt (TClose (c1, c2)) Í Strt (c1). End (TClose (c1, c2)) Í End (c2). Strt (AClose (c1, c2)) Í Strt (c1) Strt (c2). End (AClose (c1, c2)) Í End (c1) End (c2). Strt (SClose (c1, c2)) Í Strt (c1) ; Strt (c2). End (SClose (c1, c2)) Í End (c1) ; End (c2). From this it follows tht the preconditions of the observers re s follows. Pre (IsPrimChin (c)) Í true. Pre (IsTClose (c)) Í true. Pre (IsAClose (c)) Í true. Pre (IsSClose (c)) Í true. Pre (First (c)) Í IsPrimChin (c). Pre (Second (c)) Í IsPrimChin (c). Pre (Strt (c)) Í true. Pre (End (c)) Í true. Then, to ensure tht the constructors produce chins tht re vlid, nd useful (except for null primitive chins) the preconditions for them hve to be s follows. Pre (AChin (s, sb)) Í AxEqul (s, sb). Pre (TClose (c1, c2)) Í Strt (c1) / End (c1) Strt (c2) / End (c2) End (c1) Strt (c2) Strt (c1) / End (c2). Pre (AClose (c1, c2)) Í Strt (c1) / End (c1) Strt (c2) / End (c2). Pre (SClose (c1, c2)) Í Strt (c1) / End (c1) Strt (c2) / End (c2). Given this formlistion of this structure, then (s described bove) mesure needs to be defined over it tht cn be used to gurntee tht inductions over this structure must terminte, so tht the role of this mesure is nlogous to tht of SCC for elements of SeqConst. This mesure thus counts the number of pplictions of the xioms tht re represented by n AxChin object, nd so it is represented by function clled AxCount, which hs the signture AxChin Nt, nd is defined s follows. AxCount (c) Í if IsPrimChin (c) then 1 else AxCount (First (c)) + AxCount (Second (c)) fi. An immedite consequence of this definition is tht the vlue of AxCount for ny chin must be greter thn zero, nd so it must be the cse tht: c : AxChin IsPrimChin (c) AxCount (First (c)) < AxCount (c) AxCount (Second (c)) < AxCount (c) 6

7 This therefore ensures tht, in ny proof by induction over the structures of AxChin objects, the recursive pplictions of the induction hypothesis to the components of non-primitive chins must be to chins with smller vlues of AxCount, nd hence the inductions must eventully terminte. Given these definitions, n obvious property tht needs to be shown for ny AxChin object is tht its strt nd end elements must be equl, s defined by the opertion Equl. This property is expressed s the following theorem. Theorem 2. c : AxChin Equl (Strt (c), End (c)) The proof is by induction over the structure of chin, so tht the bse cse for it is primitive chin, nd the three recursive cses re for chins constructed by TClose, AClose nd SClose respectively. The induction hypothesis is therefore tht, for ny nturl number n, the theorem holds for ll chins c such tht AxCount (c) < n, nd the induction step is to show tht the theorem therefore lso holds for ll chins c such tht AxCount (c) = n. Hence, the four cses for the proof re s follows. Bse cse: primitive chin, so tht we hve: IsPrimChin (c) c = AChin (Strt (c), End (c)) AxEqul (Strt (c), End (c)) Equl (Strt (c), End (c)). precondition of AChin Recursive cse (i): trnsitive closure, so tht we hve: IsTClose (c) c1, c2: AxChin c = TClose (c1, c2) Strt (c) Strt (c1) End (c) End (c2) nd End (c1)) Strt (c2) precondition of TClose nd Equl (Strt (c1), End (c1)) Equl (Strt (c2), End (c2)) induction hypothesis Equl (Strt (c1), Strt (c2)) definition of Equl Equl (Strt (c1), End (c2)) definition of Equl Equl (Strt (c), End (c)). Recursive cse (ii): structurl equlity for lterntion, so tht we hve: IsAClose (c) c1, c2: AxChin c = AClose (c1, c2) Strt (c) Strt (c1) Strt (c2) End (c) End (c1) End (c2) nd Equl (Strt (c1), End (c1)) Equl (Strt (c2), End (c2)) induction hypothesis Equl (Strt (c1) Strt (c2), End (c1) End (c2)) definition of Equl Equl (Strt (c), End (c)). Recursive cse (iii): structurl equlity for sequencing, so tht we hve: IsAClose (c) c1, c2: AxChin c = AClose (c1, c2) Strt (c) Strt (c1) ; Strt (c2) End (c) End (c1) ; End (c2) nd Equl (Strt (c1), End (c1)) Equl (Strt (c2), End (c2)) induction hypothesis Equl (Strt (c1) ; Strt (c2), End (c1) ; End (c2)) definition of Equl Equl (Strt (c), End (c)). The induction then strts from the bse cse, where AxCount (c) = 1, nd the inductive step is tht, since the theorem holds for ll chins c with AxCount (c) < n, it must therefore lso hold for ll chins with AxCount = n. Hence the result is proved for successive vlues of n from 1 upwrds, which estblishes the theorem s whole. The converse of this property is then tht, if ny two elements of SeqConst re equl, there must exist some AxChin object tht connects them, nd this is expressed s the following theorem. Theorem 3. s, sb : SeqConst Equl (s, sb) c : AxChin Strt (c) s End (c1) sb The proof is by induction over the number of pplictions of AxEqul in the chin c, where the cses in the induction rise from the structure of Equl, with the bse cse being single ppliction of AxEqul. 7

8 Bse cse: equlity nd no intermedite vlues involved, so tht Equl (s, sb) AxEqul (s, sb) c = AChin (s, sb) Strt (c) s End (c1) sb nd AxCount (c) = 1. Recursive cse (i): trnsitive closure, so tht Equl (s, sb) AxEqul (s, sb) s : SeqConst Equl (s, s) Equl (s, sb) c1, c2 : AxChin Strt (c1) s End (c1) s Strt (c2) s End (c2) sb induction hypothesis nd c = TClose (c1, c2) Strt (c) s End (c1) sb nd AxCount (c1) < AxCount (c) AxCount (c2) < AxCount (c) which ensures tht the conditions for the ppliction of the induction hypothesis hold. Recursive cse (ii): structurl equlity for lterntion, so tht Equl (s, sb) AxEqul (s, sb) s1, s2, sb1, sb2 : SeqConst s s1 s2 sb sb1 sb2 Equl (s1, sb1) Equl (s2, sb2) c1, c2 : AxChin Strt (c1) s1 End (c1) sb1 Strt (c2) s2 End (c2) sb2 induction hypothesis nd c = AClose (c1, c2) Strt (c) s1 s2 s End (c1) sb1 sb2 sb nd AxCount (c1) < AxCount (c) AxCount (c2) < AxCount (c) which ensures tht the conditions for the ppliction of the induction hypothesis hold. Recursive cse (iii): structurl equlity for sequencing. Equl (s, sb) AxEqul (s, sb) s1, s2, sb1, sb2 : SeqConst s s1 ; s2 sb sb1 ; sb2 Equl (s1, sb1) Equl (s2, sb2) c1, c2 : AxChin Strt (c1) s1 End (c1) sb1 Strt (c2) s2 End (c2) sb2 induction hypothesis nd c = SClose (c1, c2) Strt (c) s1 ; s2 s End (c1) sb1 ; sb2 sb nd AxCount (c1) < AxCount (c) AxCount (c2) < AxCount (c) which ensures tht the conditions for the ppliction of the induction hypothesis hold. The induction then strts from the bse cse, where AxCount (c) = 1, nd the inductive step is tht, since the theorem holds for ll chins c with AxCount (c) < n, it must therefore lso hold for ll chins with AxCount = n. Hence the result is proved for successive vlues of n from 1 upwrds, which estblishes the theorem s whole. Given these properties for xiom chins, then they provide the mchinery necessry to prove (s formlly s is possible) the property tht the opertion Equl does ctully cpture the intended definition of equlity, s the properties of tht re expressed in cluses (i) to (v) of the informl definition bove. This property is expressed in the following theorem. Theorem 4. s, sb : SeqConst Equl (s, sb) (s nd sb re equl under trnsitive nd structurl closure of AxEqul) The proof is in two prts, one for the forwrd impliction nd the other for the bckwrd impliction, where both prts re effectively by induction over the number of pplictions of AxEqul in the chins tht connect the relevnt SeqConst objects, s mesured by AxCount. For the forwrd impliction the cses in the induction rise from the structure of Equl, s in the proof of theorem 3, while for the bckwrd impliction the cses rise from the cluses () to (e) of the informl definition of equlity, with cluses () nd (b) being the bse cses nd the other cluses the recursive cses. Hence, for ech direction of the impliction the induction hypothesis is tht the theorem holds for ll AxChin objects c tht connect the relevnt SeqConst objects such tht AxCount (c) < n for some nturl number n, nd the inductive step is then to show tht therefore for this direction of the impliction the theorem lso holds for ll AxChin objects c such tht AxCount (c) = n. 8

9 For the forwrd direction the necessry cses re therefore very similr to those in the proof of theorem 3, s follows. Bse cse: equlity nd no intermedite vlues involved, so tht Equl (s, sb) AxEqul (s, sb) s nd sb re equl by AxEqul without requiring either trnsitive or structurl closure of it nd c : AxChin c = AChin (s, sb) AxCount (c) = 1 theorem 3 Recursive cse (i): trnsitive closure, so tht Equl (s, sb) AxEqul (s, sb) s : SeqConst Equl (s, s) Equl (s, sb) c1, c2, c : AxChin Strt (c1) s End (c1) s Strt (c2) s End (c2) sb c = TClose (c1, c2) theorem 3 AxCount (c1) < AxCount (c) AxCount (c2) < AxCount (c) s nd s re equl under trnsitive nd structurl closure of AxEqul induction hypothesis s nd sb re similrly equl induction hypothesis s nd sb re equl under trnsitive nd structurl closure of AxEqul. Recursive cse (ii): structurl equlity for lterntion, so tht Equl (s, sb) AxEqul (s, sb) s1, s2, sb1, sb2 : SeqConst s s1 s2 sb sb1 sb2 Equl (s1, sb1) Equl (s2, sb2) c1, c2 : AxChin Strt (c1) s1 End (c1) sb1 Strt (c2) s2 End (c2) sb2 c = AClose (c1, c2) theorem 3 AxCount (c1) < AxCount (c) AxCount (c2) < AxCount (c) s1 nd sb1 re equl under trnsitive nd structurl closure of AxEqul induction hypothesis ss2 nd sb2 re similrly equl induction hypothesis s1 s2 nd sb1 sb2 re equl under trnsitive nd structurl closure of AxEqul s nd sb re equl under trnsitive nd structurl closure of AxEqul. Recursive cse (iii): structurl equlity for sequencing, so tht Equl (s, sb) AxEqul (s, sb) s1, s2, sb1, sb2 : SeqConst s s1 ; s2 sb sb1 ; sb2 Equl (s1, sb1) Equl (s2, sb2) c1, c2 : AxChin Strt (c1) s1 End (c1) sb1 Strt (c2) s2 End (c2) sb2 c = SClose (c1, c2) theorem 3 AxCount (c1) < AxCount (c) AxCount (c2) < AxCount (c) s1 nd sb1 re equl under trnsitive nd structurl closure of AxEqul induction hypothesis ss2 nd sb2 re similrly equl induction hypothesis s1 ; s2 nd sb1 ; sb2 re equl under trnsitive nd structurl closure of AxEqul s nd sb re equl under trnsitive nd structurl closure of AxEqul. Then for the bckwrd direction the necessry cses re s follows. Bse cse (i): identity, so tht s sb AxEqul (s, sb) Equl (s, sb) nd c : AxChin c = AChin (s, sb) AxCount (c) = 1 theorem 3. Bse cse (ii): equlity under single ppliction of the xioms, so tht AxEqul (s, sb) Equl (s, sb) nd c : AxChin c = AChin (s, sb) AxCount (c) = 1 theorem 3. Recursive cse (i): equlity under trnsitive closure, requiring more thn one ppliction of the xioms, so tht AxEqul (s, sb) s : SeqConst s nd s re equl under trnsitive nd structurl closure of AxEqul s nd sb re similrly equl AxEqul (s, sb) s : SeqConst Equl (s, s) Equl (s, sb) induction hypothesis Equl (s, sb) nd c1, c2, c : AxChin Strt (c1) s End (c1) s Strt (c2) s End (c2) sb c = TClose (c1, c2) theorem 3 9

10 AxCount (c1) < AxCount (c) AxCount (c2) < AxCount (c) which ensures tht the conditions for the ppliction of the induction hypothesis hold. Recursive cse (ii): structurl equlity for lterntion, which intrinsiclly requires more thn one ppliction of the xioms, so tht AxEqul (s, sb) s1, s2, sb1, sb2 : SeqConst s s1 s2 sb sb1 sb2 s1 nd sb1 re equl under trnsitive nd structurl closure of AxEqul s2 nd sb2 re similrly equl AxEqul (s, sb) s1, s2, sb1, sb2 : SeqConst s s1 s2 sb sb1 sb2 Equl (s1, sb1) Equl (s2, sb2) induction hypothesis Equl (s, sb) nd c1, c2 : AxChin Strt (c1) s1 End (c1) sb1 Strt (c2) s2 End (c2) sb2 c = AClose (c1, c2) theorem 3 AxCount (c1) < AxCount (c) AxCount (c2) < AxCount (c) which ensures tht the conditions for the ppliction of the induction hypothesis hold. Recursive cse (iii): structurl equlity for sequencing, which lso intrinsiclly requires more thn one ppliction of the xioms, so tht AxEqul (s, sb) s1, s2, sb1, sb2 : SeqConst s s1 ; s2 sb sb1 ; sb2 s1 nd sb1 re equl under trnsitive nd structurl closure of AxEqul s2 nd sb2 re similrly equl AxEqul (s, sb) s1, s2, sb1, sb2 : SeqConst s s1 ; s2 sb sb1 ; sb2 Equl (s1, sb1) Equl (s2, sb2) induction hypothesis Equl (s, sb) nd c1, c2 : AxChin Strt (c1) s1 End (c1) sb1 Strt (c2) s2 End (c2) sb2 c = SClose (c1, c2) theorem 3 AxCount (c1) < AxCount (c) AxCount (c2) < AxCount (c) which ensures tht the conditions for the ppliction of the induction hypothesis hold. In ech direction the induction then strts from the bse cse or cses, where AxCount (c) = 1, nd the inductive step is tht, since the theorem holds for ll chins c with AxCount (c) < n, it must therefore lso hold for ll chins with AxCount = n. Hence the result is proved for successive vlues of n from 1 upwrds, which estblishes the theorem s whole. There re then two points to note bout this theorem nd its proof. The first is tht, given the usul understnding of the opertor denoted =, n lterntive formultion of it would be simply the following, which we shll wish to refer to sufficiently often tht we will stte it s theorem in its own right. Theorem 5. s, sb : SeqConst Equl (s, sb) (s = sb) The proof follows immeditely from theorem 4. The second point is then tht, in the proofs themselves, the min reson for needing to introduce the AxChin objects in order to ensure tht the conditions for pplying the induction hypotheses hold is tht the definition of Equl is nondeterministic, in the sense tht where it requires intermedite objects such s s, s1, s2, sb1 or sb2 to exist, these objects re not defined uniquely. Consequently, different choices of them could be mde, nd these would correspond to different sets of xioms chins being introduced into the proof, where these different xioms chins might well hve different vlues for AxCount. Thus, one could not simply try to estblish termintion of the inductions by considering just the objects s nd sb, but insted the rgument needs to fix the choice of the intermedite objects, nd then rgue from the properties of the xiom chins tht connect them. 3. Equlity nd Norml Forms Hving formlised the definition of equlity s in the previous section, the next step is to consider how restricting objects to norml forms might enble this definition to be simplified, nd so led to constructive definition of equlity. For this purpose the focus in this section will be on hed norml form, since it will become pprent tht this form is prticulrly 10

11 suitble for the cretion of such definition. Hence, it is pproprite to begin by repeting here the specifiction of this form tht is contined in the definition of its chrcteristic function IsHNF, which ws given originlly in [8] s follows. IsHNF () Í true. IsHNF (s1 ; s2) Í s1 PA s2 / ε IsHNF (s2). IsHNF (s1 s2) Í s1 / φ s2 / φ s1 / s2 IsHNF (s1) IsHNF (s2) (SeqHeds (s1) SeqHeds (s2)) =. It is lso worth repeting the definition of the function SeqHeds tht is used in this, nd which ws given in [8] s follows. SeqHeds () Í { } where PA SeqHeds (ε) Í { ε } SeqHeds (φ) Í { φ } SeqHeds (s1 s2) Í if SeqHeds (s1) = { φ } then SeqHeds (s2) elsif SeqHeds (s2) = { φ } then SeqHeds (s1) else SeqHeds (s1) SeqHeds (s2) fi SeqHeds (s1 ; s2) Í if SeqHeds (s1) = { ε } then SeqHeds (s2) elsif ε SeqHeds (s1) then ( SeqHeds (s1) { ε } ) ( SeqHeds (s2) { φ } ) else SeqHeds (s1) fi It will then be pprent immeditely tht the first three cluses in this definition could in fct be mlgmted into single cluse, s follows. SeqHeds () Í { } where Act Some importnt properties for this function were given in theorem 60 of [8], nd it is worth restting these here s follows, lthough obviously their proof does not need to be restted. Theorem 6. s : SeqConst : Act SeqHeds (s) ( φ SeqHeds (s) = { φ } s = φ) ( ε # SeqHeds (s) = 1 s = ε) ( PA s ε s φ) The proof is given s the proof of theorem 60 in [8]. There re then some further useful properties of this function, which cn be stted s the following two theorems. Theorem 7. s : SeqConst # SeqHeds (s) 1 The proof is by structurl induction over the three min cses tht correspond to the possible structures of the object s. The induction hypothesis is tht, for ny n > 1, the theorem holds s : SeqConst SCC (s) < n, nd so the induction step is then to show tht therefore the theorem holds s : SeqConst SCC (s) = n. Bse cse: n ction, so tht n = 1. : Act SeqHeds () = { } # SeqHeds (s) = 1. Recursive cse: n object constructed by lterntion, so tht s s1 s2. This gives rise to set of three sub-cses, one for ech of the cluses in the definition of SeqHeds, s follows. Sub-cse: SeqHeds (s1) = { φ } SeqHeds (s) = SeqHeds (s2) nd # SeqHeds (s2) 1 induction hypothesis # SeqHeds (s) 1. 11

12 Sub-cse: SeqHeds (s1) { φ } SeqHeds (s2) = { φ } SeqHeds (s) = SeqHeds (s1) nd # SeqHeds (s1) 1 induction hypothesis # SeqHeds (s) 1. Sub-cse: SeqHeds (s1) { φ } SeqHeds (s2) { φ } SeqHeds (s) = SeqHeds (s1) SeqHeds (s2) nd # SeqHeds (s1) 1 # SeqHeds (s2) 1 ind. hypothesis, twice # (SeqHeds (s1) SeqHeds (s2)) 1 # SeqHeds (s) 1. Hence, the theorem holds for ll three sub-cses for this cse. Recursive cse: n object constructed by sequencing, so tht s s1 ; s2. This gin gives rise to set of three sub-cses, one for ech of the cluses in the definition of SeqHeds, s follows. Sub-cse: SeqHeds (s1) = { ε } SeqHeds (s) = SeqHeds (s2) nd # SeqHeds (s2) 1 induction hypothesis # SeqHeds (s) 1. Sub-cse: SeqHeds (s1) { ε } ε SeqHeds (s1) SeqHeds (s) = ( SeqHeds (s1) { ε } ) ( SeqHeds (s2) { φ } ) nd : Act / ε SeqHeds (s1) # SeqHeds (s1) 2 # ( SeqHeds (s1) { ε } ) 1 # (( SeqHeds (s1) { ε } ) ( SeqHeds (s2) { φ } )) 1 # SeqHeds (s) 1. Sub-cse: SeqHeds (s1) { ε } ε SeqHeds (s1) SeqHeds (s) = SeqHeds (s1) nd # SeqHeds (s1) 1 induction hypothesis # SeqHeds (s) 1. Hence, the theorem holds for ll three sub-cses for this cse, nd hence for ll the cses. The induction then strts from the bse cse, which is single ction, with SCC equl to one, nd the inductive step is tht, since the theorem holds for ll sequences with SCC < n, by the cse nlysis bove it must lso hold for ll sequences with SCC = n. Hence the result is proved for successive vlues of n from 1 upwrds, which estblishes the theorem s whole. Theorem 8. s1, s2 : SeqConst (SeqHeds (s1) SeqHeds (s2)) = s1 / s2 s1 s2 SeqHeds (s1) = SeqHeds (s2) (SeqHeds (s1) SeqHeds (s2)) = SeqHeds (s1) nd # SeqHeds (s1) 1 theorem 7 SeqHeds (s1) so tht s1 s2 (SeqHeds (s1) SeqHeds (s2)) nd (SeqHeds (s1) SeqHeds (s2)) = s1 / s2 by negtion. A corollry of this ltter result is tht, in the definition of IsHNF, the cluse s1 / s2 in the definition for the cse of lterntion is redundnt. Also, this definition requires both s1 nd s2 to be in hed norml form, nd for this form some of the cluses in the definition of SeqHeds re lso redundnt. It is therefore convenient to define simplified form of this function for ppliction to sequences in hed norml form, nd this simplified function is clled HNFHeds. Like SeqHeds it hs signture SeqConst P Act, nd it is defined s follows. HNFHeds () Í { } HNFHeds (s1 s2) Í HNFHeds (s1) HNFHeds (s2) HNFHeds (s1 ; s2) Í HNFHeds (s1). This definition relies on property of SeqHeds for hed norml form which is expressed s the following theorem. 12

13 Theorem 9. s : SeqConst IsHNF (s) ( SeqHeds (s) = { φ } s φ ) ( SeqHeds (s) = { ε } s ε ) The proof is by structurl induction over the three min cses tht correspond to the possible structures of the object s. The induction hypothesis is tht, for ny n > 1, the theorem holds s : SeqConst SCC (s) < n, nd so the induction step is then to show tht therefore the theorem holds s : SeqConst SCC (s) = n. Bse cse: n ction, so tht n = 1. This hs three sub-cses, depending on the vlue of the ction. Sub-cse: PA SeqHeds () = { } SeqHeds (s) { φ } SeqHeds (s) { ε } nd so the precedent conditions of the implictions do not hold. Sub-cse: φ SeqHeds () = { φ } SeqHeds (s) { ε } nd so the first cluse of the theorem holds nd the precedent conditions of the impliction in the second cluse do not hold. Sub-cse: ε SeqHeds () = { ε } SeqHeds (s) { φ } nd so the precedent conditions of the impliction in the first cluse do not hold nd the second cluse of the theorem holds. Hence, the theorem holds for ll three sub-cses for this cse. Recursive cse: n object constructed by lterntion, so tht s s1 s2. For this cse we hve IsHNF (s1 s2) s1 / φ s2 / φ s1 / s2 IsHNF (s1) IsHNF (s2) so tht ( SeqHeds (s1) = { φ } s1 φ ) ( SeqHeds (s2) = { φ } s2 φ ) ind. hypothesis, twice SeqHeds (s1) { φ } SeqHeds (s2) { φ } SeqHeds (s) = SeqHeds (s1) SeqHeds (s2) nd # SeqHeds (s1) 1 theorem 7 1 : Act 1 / φ 1 SeqHeds (s1) nd # SeqHeds (s2) 1 theorem 7 2 : Act 2 / φ 2 SeqHeds (s2) : Act / φ (SeqHeds (s1) SeqHeds (s2)) : Act / φ SeqHeds (s) SeqHeds (s) { φ } nd so the precedent conditions of the impliction in the first cluse of the theorem do not hold. Similrly ( SeqHeds (s1) = { ε } s1 ε ) ( SeqHeds (s2) = { ε } s2 ε ) ind. hypothesis, twice nd s1 / s2 (s1 / ε) (s2 / ε) SeqHeds (s1) { ε } SeqHeds (s2) { ε } nd # SeqHeds (s1) 1 # SeqHeds (s2) 1 theorem 7, twice ( 1 : Act 1 / ε 1 SeqHeds (s1) ) ( 2 : Act 2 / ε 2 SeqHeds (s2) ) : Act / ε (SeqHeds (s1) SeqHeds (s2)) : Act / ε SeqHeds (s) SeqHeds (s) { ε } nd so the precedent conditions of the impliction in the second cluse of the theorem do not hold, either. Hence, the theorem holds for this cse. Recursive cse: n object constructed by sequencing, so tht s s1 ; s2. For this cse we hve IsHNF (s1 ; s2) ( : Act PA s1 ) s2 / ε IsHNF (s2) SeqHeds (s1) = { } / ε ε SeqHeds (s1) SeqHeds (s) = SeqHeds (s1) = { } SeqHeds (s) { ε } nd SeqHeds (s) { φ } so tht the precedent conditions of the implictions in the theorem do not hold. Hence, the theorem holds for this cse, too. Hence, the theorem holds for ll three sub-cses for this cse, nd hence for ll the cses. The induction then strts from the bse cse, which is single ction, with SCC equl to one, nd the inductive step is tht, since the theorem holds for ll sequences with SCC < n, by the cse nlysis bove it must lso hold for ll sequences with SCC = n. Hence the result is proved for successive vlues of n from 1 upwrds, which estblishes the theorem s whole. 13

14 Given this property, we cn show tht for sequence in hed norml form the function HNFHeds is equivlent to the function SeqHeds, which is expressed s the following theorem. Theorem 10. s : SeqConst IsHNF (s) HNFHeds (s) = SeqHeds (s) This proof too is by structurl induction over the three min cses tht correspond to the possible structures of the object s. The induction hypothesis is gin tht, for ny n > 1, the theorem holds s : SeqConst SCC (s) < n, nd so the induction step is then to show tht therefore the theorem holds s : SeqConst SCC (s) = n. Bse cse: n ction, so tht n = 1. : Act HNFHeds () = { } = SeqHeds (s). Recursive cse: n object constructed by lterntion, so tht s s1 s2. For this cse we hve IsHNF (s1 s2) s1 / φ s2 / φ s1 / s2 IsHNF (s1) IsHNF (s2) nd in principle there re then three sub-cses, one for ech of the cluses in the definition of SeqHeds, s follows. Sub-cse: SeqHeds (s1) = { φ } IsHNF (s1) s1 φ theorem 9 nd so this sub-cse cn not rise. Sub-cse: SeqHeds (s1) { φ } SeqHeds (s2) = { φ } IsHNF (s2) s2 φ theorem 9 nd so this sub-cse cn not rise, either. Sub-cse: SeqHeds (s1) { φ } SeqHeds (s2) { φ } SeqHeds (s) = SeqHeds (s1) SeqHeds (s2) = HNFHeds (s1) HNFHeds (s2) ind. hypothesis, twice = HNFHeds (s). Hence, the theorem holds for ll three sub-cses for this cse. Recursive cse: n object constructed by sequencing, so tht s s1 ; s2. For this cse we hve IsHNF (s1 ; s2) ( : Act PA s1 ) s2 / ε IsHNF (s2) SeqHeds (s1) = { } / ε ε SeqHeds (s1) SeqHeds (s) = SeqHeds (s1) = { } = HNFHeds (s1) induction hypothesis = HNFHeds (s). Hence, the theorem holds for ll the cses. The induction then strts from the bse cse, which is single ction, with SCC equl to one, nd the inductive step is tht, since the theorem holds for ll sequences with SCC < n, by the cse nlysis bove it must lso hold for ll sequences with SCC = n. Hence the result is proved for successive vlues of n from 1 upwrds, which estblishes the theorem s whole. Given these properties, we cn then simplify the definition of IsHNF, s follows, nd this simplified definition will be used from now on. IsHNF () Í true. IsHNF (s1 ; s2) Í s1 PA s2 / ε IsHNF (s2). IsHNF (s1 s2) Í s1 / φ s2 / φ IsHNF (s1) IsHNF (s2) (HNFHeds (s1) HNFHeds (s2)) =. This then provides the mchinery needed for nlysing which expressions in the xioms for equlity re in hed norml form, or could be in this form under certin conditions, nd this nlysis is s follows. (i) s1 ; (s2 ; s3) = (s1 ; s2) ; s3. Here the left-hnd side would be in hed norml form if s1 nd s2 were ctions nd s3 ws in hed norml form, but the right-hnd side cn not be in hed norml form, whtever the vlues of s1, s2 or s3, becuse the left-hnd opernd to the outermost sequencing opertion (viz the term (s1 ; s2)) is not n ction. 14

15 (ii) s ; ε = ε ; s = s. Here the first two expressions cn not be in hed norml form, even if s were, becuse in the first expression the second opernd is ε, nd in the second expression the first opernd (viz ε) is not in PA. (iii) s1 (s2 s3) = (s1 s2) s3. Here both sides would be in hed norml form if ll three of s1, s2 nd s3 were, nd none of them ws the forbidden ction, nd they ll hd different vlues of HNFHeds (nd hence were different). (iv) s1 s2 = s2 s1. Similrly, here both sides would be in hed norml form if both of s1 nd s2 were, nd neither of them ws the forbidden ction, nd they hd different vlues of HNFHeds (nd hence were different). (v) s s = s. Here the left-hnd side cn not be in hed norml form, even if s is, becuse the two elements in the lterntion re the sme, nd so must hve the sme vlues of HNFHeds. (vi) s φ = φ s = s. Here the first two expressions cn not be in hed norml form, even if s were, becuse in ech of them one of the opernds is the forbidden ction. (vii) s1 ; (s2 s3) = (s1 ; s2) (s1 ; s3). Here the left-hnd side would be in hed norml form if s1 were n ction nd if s2 nd s3 were both in hed norml form, hd different vlues of HNFHeds, nd neither of them ws the forbidden ction. Even in this cse, though, the right-hnd side cn not be in hed norml form, becuse lthough the two opernds to the outermost lterntion opertion (viz the terms (s1 ; s2) nd (s1 ; s3)) would both be in this form, the vlues of HNFHeds for them both would be the sme (nmely HNFHeds (s1) = { s1 }). (viii) (s1 s2) ; s3 = (s1 ; s3) (s2 ; s3). Here the left-hnd side cn not be in hed norml form, becuse the left-hnd opernd to the outermost sequencing opertion (viz the term (s1 s2)) is not n ction. (ix) φ ; s = φ. Here the left-hnd side cn not be in hed norml form, even if s is, becuse its first opernd (viz φ) is not in PA. (x) s1 s2 s1 = s2. Here both s1 nd s2 could be in hed norml form, since there is no restriction on their constructions. (xi) s1 = s2 s2 = s3 s1 = s3. Here ll of s1, s2 nd s3 could be in hed norml form, since there is no restriction on their constructions. (xii) s1 = s2 s1b = s2b s1 s1b = s2 s2b. Here both s1 s1b nd s2 s2b could be in hed norml form if ech of s1, s1b, s2 nd s2b were in this form, tht none of them were the forbidden ction, nd tht we hd both (HNFHeds (s1) HNFHeds (s1b)) = nd (HNFHeds (s2) HNFHeds (s2b)) =. Also, we would expect intuitively tht s1 = s2 would imply tht HNFHeds (s1) = HNFHeds (s2) nd tht s1b = s2b would imply tht HNFHeds (s1b) = HNFHeds (s2b), since we would expect the property of substitutbility to pply to the opertion HNFHeds, nd indeed more generlly to the opertion SeqHeds s well. In prctice, though, we cn not just ssume tht such properties hold, but must prove tht they do: this is deferred until lter. (xiii) s1 = s2 s1b = s2b s1 ; s1b = s2 ; s2b. Here both s1 ; s1b nd s2 ; s2b could be in hed norml form, provided tht s1 PA, s2 PA, tht neither s1b nor s2b is identicl to ε, nd tht ech of s2 nd s2b is in this form. These conditions would lso hve the consequence tht the precedent condition s1 = s2 would ctully lso imply tht s1 s2. (xiv) s1 = s2 s2 = s1. Here both s1 nd s2 could be in hed norml form, since there is no restriction on their constructions. Hence, the conclusion of this nlysis is tht the only bse xioms for which both sides cn be in hed norml form re xioms (iii), (iv) nd (x), since for ll of the other bse xioms one side or the other cn not be in this form, whtever the vlues of the elements s, s1, s2 or s3 (s pplicble). An immedite consequence of this is tht if two objects in hed norml form re to be equl, then they must hve the sme bsic construction: tht is, either they must both be ctions, or 15