Part 7. Phantoms: Legal States That Cannot Be Constructed

Are There Legal States That Can’t Be Built? State s is a phantom state (or phantom architecture) if It is legal (it satisfies the SoP rules) BUT It cannot be constructed, starting with just a bare containment tree, and repeatedly using rules (productions) to add dependency edges A ruleset that allows phantoms is called phantomic Do phantoms exist?

Example: Step-Wise Construction of a State Example ruleset: T  S  P o T  P o T o C  T o C Ruleset has 4 productions: T D (S) T D (P T) T D (P T C) T D (T C) Start with tree, successively add edges allowed by productions Step 3 Step 1 Step 2 f (4) T D (T C) (2) T D (P T) (1) T D (S) This example ruleset allows no phantoms. Note: Phantoms cannot be constructed in a step-wise manner.

Example Phantom #1: The “Cyclic Export” Ruleset & An “Identic” Phantom Consider this rule: E  C  E o E Rule means: An E edge can follow a child C edge, or An E edge can follow two E edges root root OK  Phantom  x y x y y E y = y E o E y Thus, the state is legal. State has only loop (ID) edges. It is an “identic” state. z z C E Phantom doesn’t use the “C” right-hand side

Example Phantom #2 Non-Identic Phantom Consider this rule: R  R o P  R o C Rule means: An R edge can follow an R then a P edge, or An R edge can follow an R then a C edge C P R y x w w R x = w R o P x w R y = w R o C y So, this is legal The R edges are not ID self loops (not identities) Maybe show multi-recursive phantom??

Some Simple Permission Rules Three simple rulesets: R  All where All means every edge Every state is legal and constructive. R  R Every state is legal and they are all phantoms except . R  All  R All states are constructive. However, if we delete production (R D All) while keeping (R D R), there are phantoms.

A Multi-Recursive Ruleset with Phantoms R  R o P o R P R x y This state is a phantom. Follow R then P then R to compute R. So R is legal. But R cannot be constructed from the empty state. Multi-recursive because R depends on itself more than once.

Why Are Most “Serious” Example SoP Rules Constructive? Is there a hidden assumption that causes them to be constructive? Is there an algorithm to check SoP rules for constructivity? No, it is an open question whether such an algorithm exists. But with appropriate restrictions, such an algorithm exists.

Part 8. Abstract Permission Systems (APT)

Abstracting Away From the Graph Basis of SoP Some properties of SoP rulesets have little to do with the underlying structure of the state graph. To confirm this, we will now take an abstract approach, which ignores the graph structure. Any SoP ruleset, with a corresponding tree, can be projected to this abstract form. Essence of this abstraction is: Legality simply means prefixpoint of given function f So, legality properties become properties of pfp’s States are not necessarily graphs

Fixed Points: Terminology When x = f(x) We say x is a fixpoint (fp) or a fixed point of function f When x  f(x) We say x is a prefixpoint (pfp) or a pre fixed point of function f Some authors alternately use the term postfixpoint (post fixed point) instead of prefixpoint

Basis for Abstract Permission Theory Fundamental concepts E Finite set of elements (Abstraction of set of triples) f : 2E  2E Permission function (Maps states to states) Derived concepts Lf (s) =def s  f(s) Legality of state s as prefixpoint Q =def 2E State space (abstraction of subset of triples) States s, t, …  Q Abstraction of graphs (states) s  t Operator on states f =def { } Empty state, contains no triples Monotonicity not yet assumed

Aside: Alternate Terminology We could use the term “well-formed” instead of “legal”, so instead of Lf(s) or L(s) we would write WFf(s) or WF(s).

How to Map SoP Ruleset R with Tree T to Abstract Form Def. Element set E consists of every every triple that can be formed with variables v from the ruleset R and with nodes N in tree T. Def. Permission function f is defined in terms of state s and rules set R as follows: f(s) =def (Based on state s, compute the set of triples specified by sums, i.e., those alled by right hand sides of ruleset R)

Piecewise Legality Def. Element e is legal in state s when it is member of f(s): Lf(e) =def e  f(s) Lemma. State s is legal iff all its elements are legal: Lf(s) =  e  s  Lf(e) Proof. We re-write RHS into LHS:  e  s  Lf(e) =  e  s  e  f(s) = s  f(s) = Lf(s) QED Hence, piecewise legality holds abstractly, independent of graph structure and independent of monotonicity.

Three Definitions of Legality MicroSoft PPT Bug Messes Up Format of this Slide?? Def. State t permits state s when s is a least as large as t and s contains only elements permitted by t: t  s =def t  s  f(t) 3 Legality Definitions 1. Lf (s) = s  f (s) Prefixpoint 2. L (s) =  t  t  s t permits s 3. L*(s) =  * s Constructive We will explore the relationship among these 3 kinds of legality. For most, “serious” example SoP rules: Lf(s) = L(s) = L*(s) If f is monotonic, t  s means you can legally add edges to t to make s

Phantom Architectures An state (an architecture) is a phantom if it is legal, but cannot be constructed. Constructive (s) =def  * s Phantom (s) =def Lf(s) & not constructive(s) where  is the empty state. A ruleset is constructive if all its legal states are constructive (are not phantoms).

When f Is Not Monotonic … Example. s = f Ì t, f(s) = t, f(t) = s, so f(t) Ì f(s) Function f not monotonic because not true that s  t  f(s)  f(t) Observe that Lf(t) = false, L(t) = true, L*(t) = true Lemma. Not true that for all f, Lf(t) = L(t) Proof. In example, Lf(t) is false, but L(t) is true Lemma. Not true that for all f, Lf(t) = L*(t) Proof. In example, Lf(t) is false, but L*(t) is true. In fact, in this case L*(t)  Lf(t) is false. f(s) = t f(t) = s = f Ì f These results are counter intuitive if you are used to dealing with monotonic systems.

Since SoP is monotonic, these results apply. When f is Monotonic … Lemma A. If f is monotonic and there exists t such that t p s, then s is legal. Proof. The definition of t p s is: t  s  f(t) Since f is monotonic, it follows that f(t)  f(s) Hence, t  s  f(t)  f(s) Hence, s  f(s) So by definion of legality, s is legal. QED Lemma B. If f is monotonic and s is constructive, then s is legal. Proof. If s is constructive, i.e., if f p* s then there exist states s1, s2, … sn such that f p s1 p s2 … p sn p s When s = f , s is legal. Otherwise sn p s, in which case, by the previous lemma, s is legal. QED s t f(s) f(t)  Since SoP is monotonic, these results apply.

When f is Monotonic … Theorem. If f is monotonic Lf(s) = L(s) ie (1) s  f (s)   t  t  s  f(t) and (2)  t  t  s  f(t)  s  f (s) Proof. (1) Obvious: Let t be s. (2) Proven in previous lemma. (Follows from monotonicity, and from transitivity of  ) f(s)   f(t)  s   t

SoP Rules are Monotonic, So… Corollary. In SoP systems Lf(s) = L(s) Proof. True because SoP systems are monotonic Non-SoP permission rules are not necessarly monotonic

Does Ruleset R Avoid Phantoms? For a particular f or ruleset R, for all s, does Lf(s) = L*(s)? Is this always true for SoP rulesets? Phantom architecture problem: Give algorithm to decide if ruleset allows phantoms (regardless of size of ruleset or size of tree) A “solution” to the phantom architecture problem is given below

Assume f is Monotonic In the rest of this section on Abstract Permission Theory, we shall assume that f is monotonic. Recall f as defined by any SoP rulesets is monotonic.

Tarski-Knaster Theorem Since f is monotonic, based on  as an ordering operator, the Tarski-Knaster Theorem applies: Theorem. f(f) is a fixpoint. It is a least fixpoint. So, if f is repeatedly applied to empty state f, eventually we find a fixpoint state s = f(f), such that f(s) = s Because s is a least fixpoint, there is no t, t Ì s, such that f(t) =t

Partitioning by Fixpoints Observation. Given monotonic f, the prefixpoints (legal states) are partitioned by f(s) , i.e., PARTi =def { s  f(s) = fpi} where fpi is the i-th fixpoint. So, s and t are in the same partition when f(s) = f(t) fp0 s t fp1 PART0 PART1 …etc… Note: Every prefixpoint s necessarily converges to a fixpoint f(s)

Local Minimum and Maximum MicroSoft Problem: Turn “E” (exists) backwards?? s r t max Def. locmax(s) =def E r  s  r p x and not E t  s  s p t locmin(s) =def E t Ê s  s p t and not E r Ì s  r p s Note that these 3 are equivalent: E r  s  r p x = E t Ê s  s p t = pfp(s) Lemma. locmax(s) Û fp(s) Each partition contains one local max (its fp). Each partition contains one or more local min’s. s r t min Proofs are not hard, but not obvious?? Rename as pfpmax and pfpmin??

The “Shape” of Partitions For monotonic f, there are one or more partitions. Each has a single maximum (fixpoint) and one of more minima. PART0 PART1 min fp0 fp1 f

Permission Within a Partition For monotonic f, if you follow permission edges (forward or backwards), you stay in the same partition: Def. s p0 t =def s p t or s p-1 t Theorem. If s and t are legal, s p0* t Û f(s) = f(t) Proof. (1) s p t  f(s) = f(t) So, s p0* t  f(s) = f(t) (2) f(s) = f(t)  s p* f(s) and f(t) p-1 * t  s p0* t (1a) f(s)  f(t) (1b) f(t)  f(s) f2(s) f(s)  s t f(t) f(t) f(s) Part (2) of proof should be expanded??

Necessary & Sufficient Condition for Phantoms Theorem. For monotonic f, there are phantoms iff there is more than one local minimum. Proof. (1) If there is a local minimum s, besides f, then s is a phantom. (2) Suppose there is no local minimum except f. Then for any legal state s  f, there exists t such that t Ì s and such that t p s. So, f p* s and so s not a phantom. Collollary. If there is more than one fixpoint, there are phantoms. If there is more than one partition, there are phantoms. Is proof clear??

Do f and R exist that minimally cause phantoms? Lemma. There exists monotonic function f such that f has exactly one fp and has a phantom. Lemma. There exists monotonic function f defined by SoP ruleset by R tree T such that f has exactly one fp and has a phantom. Proof. These two lemmas will be proven by giving an example that satisfies them… Moral. Even if you know that a ruleset has only one fp, you still don’t know whether it has a phantom.

Proving Two Lemmas by Giving an Example Proof. Proof is by giving tree T and ruleset R that define f which has 1 fp and 1 phantom. Let T be a trivial tree, consisting of a single node x. Let R be this ruleset: v1  ID È v2, v2  v1 È v2 Tree T can have only these 2 triples (both are ID triples): V1 = (x v1 x), V2 = (x v2 x) Tree T with ruleset R has only these 4 states: f = {}, s1 = {V1}, s2 = {V2}, s1,2 = {V1, V2} State s2 is a phantom. The only fp is s1,2 . s1 s2 which is phantom f Ì s1,2 which is fp f