\chapter{Tableaux for First-Order Logic}

\section{Overview}

	\begin{enumerate}[\thesection.1]

	  \item We shall now, once more, turn to proof theory; this time for first-order logic.
		As in the case of propositional logic, there are many different kinds of proof theories for first-order logic: Hilbert calculi, Gentzen calculi, natural deduction calculi, \dots.
		In this chapter, we'll develop a tableau calculus for first-order logic and in the next chapter we're going to prove soundness and completeness.
		As we observed at the end of the previous chapter, the one on semantics, the \emph{I Can't Get No Satisfaction} Theorem, which served as the theoretical foundations for propositional tableaux, also holds for first-order logic: we have for all formulas $\phi$ and sets of formulas $\Gamma$ that:
		\[\Gamma\vDash\phi\text{ iff }\Gamma\cup\{\neg\phi\}\text{ is unsatisfiable}\]
		The idea that we're going to once more exploit is that we can develop a syntactic method for determining whether a set of formulas is satisfiable (viz.\ tableaux).
		By determining in a purely syntactic way whether $\Gamma\cup\{\neg\phi\}$ is satisfiable, we get a proof theory for first-order logic.

	  \item There is, however, an important limitation that we'll have to take into account.
		In propositional logic, the tableau method was purely algorithmic: we could blindly apply the rules and would always, after a finite amount of time, get an answer about the the validity of an inference.
		This gave us a route to the decidability of propositional logic.
		In first-order logic, very unfortunately, things aren't as neat: while we can construct tableaux \emph{sort of} algorithmically, it will no longer be the case that we can blindly apply the rules and after finitely many steps get an answer: valid or invalid.
		The ``local'' reason for this, the reason why this happens with tableaux, is that (as you'll see) first-order tableaux can turn out to be \emph{infinite}.
		An infinite tableau is one with infinitely many nodes.
		But, as we'll see, an infinite tableau can nevertheless be \emph{complete}, in the sense that every rule that can be applied has been applied.
		This might seem surprising coming from propositional logic, where you really could construct every tableau by hand.
		This will no longer be the case in first-order logic: there are tableaux that no human could ever write down.

		\item A more general and ``deeper'' reason why we can't construct tableaux as in propositional logic is that first-order logic is provably \emph{undecidable}:

		\begin{theorem}[Church and Turing 1935/36] There exists no effective algorithm that for every inference after finitely many steps correctly determines whether the premises entail the conclusion in first-order logic.
		\end{theorem}
Proving this theorem is out of reach for the methods of this course. In order to prove it we need to think about what an ``effective algorithm'' is in the first place. You can study the methods in ``Logische Complexiteit'' (KI3V12013). Here we will content ourselves with some observations about why \emph{our} tableau algorithm doesn't lead to decidability, which will let us glimpse at why first-order logic really is undecidable.

	  \item Throughout this chapter, we will restrict ourselves to finite inferences, i.e. inferences with only finitely many premises.\footnote{%
		This is not where the infinitary issues mentioned above come from.}
		And furthermore, we shall limit ourselves (as in the previous chapter) to inferences involving \emph{sentences} only.
		In order to avoid an irreparable overdose of new techniques, we'll introduce first-order tableaux step-by-step:
		in \S\ref{fo_tableaux_simple},
		we'll discuss tableaux for inferences involving only the quantifiers but no identity predicate and no function symbols;
		in \S\ref{fo_tableaux_identity}, we'll add identity; and in \S\ref{fo_tableaux_functions}, we'll add function symbols.
		Without further ado: here we go!

	\end{enumerate}

\section{Simple Tableaux}
\label{fo_tableaux_simple}

	\begin{enumerate}[\thesection.1]

		\item In essence, the tableau method for first-order logic works just like the tableau method for propositional logic: we write down the initial list, expand it via the rules to a complete tableau, check whether it's closed or open, and if it's open, we declare the inference invalid, if the tableau is closed, we declare the inference valid. If you don't remember exactly how this works, refresh your memory using \S6. For reference, here are the rules of propositional logic again:

		\begin{center}

					\begin{prooftree}
					{
					line numbering=false,
					line no sep= 2cm,
					for tree={s sep'=5mm},
					single branches=true,
					close with=\xmark
					}
					[\neg\neg \phi [\phi ] ]
					\end{prooftree}
					%
					\begin{prooftree}
					{
					line numbering=false,
					line no sep= 2cm,
					for tree={s sep'=5mm},
					single branches=true,
					close with=\xmark
					}
					[\phi\land\psi [\phi [\psi ] ] ]
					\end{prooftree}
					%
					\begin{prooftree}
					{
					line numbering=false,
					line no sep= 2cm,
					for tree={s sep'=5mm},
					single branches=true,
					close with=\xmark
					}
					[\neg (\phi\land\psi) [\neg \phi ] [\neg \psi ] ]
					\end{prooftree}
					%
					\begin{prooftree}
					{
					line numbering=false,
					line no sep= 2cm,
					for tree={s sep'=5mm},
					single branches=true,
					close with=\xmark
					}
					[\phi\lor\psi [\phi ] [\psi ] ]
					\end{prooftree}
					%
					\begin{prooftree}
					{
					line numbering=false,
					line no sep= 2cm,
					for tree={s sep'=5mm},
					single branches=true,
					close with=\xmark
					}
					[\neg(\phi\lor\psi) [\neg\phi [\neg\psi ] ] ]
					\end{prooftree}

					\vspace{2ex}

					\begin{prooftree}
					{
					line numbering=false,
					line no sep= 2cm,
					for tree={s sep'=5mm},
					single branches=true,
					close with=\xmark
					}
					[\neg (\phi\to\psi) [\phi [\neg \psi ] ] ]
					\end{prooftree}
					%
					\begin{prooftree}
					{
					line numbering=false,
					line no sep= 2cm,
					for tree={s sep'=5mm},
					single branches=true,
					close with=\xmark
					}
					[\phi\to\psi [\neg \phi ] [\psi ] ]
					\end{prooftree}
					%
					\begin{prooftree}
					{
					line numbering=false,
					line no sep= 2cm,
					for tree={s sep'=5mm},
					single branches=true,
					close with=\xmark
					}
					[\phi\leftrightarrow \psi [\phi [\psi] ] [\neg \phi [\neg \psi] ] ]]
					\end{prooftree}
					%
					\begin{prooftree}
					{
					line numbering=false,
					line no sep= 2cm,
					for tree={s sep'=5mm},
					single branches=true,
					close with=\xmark
					}
					[\neg(\phi\leftrightarrow \psi) [\phi [\neg \psi] ] [\neg \phi [ \psi] ] ]]
					\end{prooftree}

				\end{center}
		To obtain a calculus for first-order logic (without identity and functions), we add to these rules for the quantifiers. But first, we need to introduce an auxilliary concept.

		\item As we said above, we restrict ourselves to inferences with only sentences, i.e. formulas without free variables. It's possible to develop tableaux for formulas with free variables but for the purposes of this course it's more trouble than it's worth. We will, however, be required to think about ``arbitrary'' objects, which we'd typically do using free variables. For this purpose, we extend our language with an infinite number of special constants known as \emph{parameters}. The set of parameters is denoted $\mathsf{Par}$. We'll use $p,q,r,\mathellipsis$ as parameters or, if we run out of (or are likely to run out of) letters, $p_1, p_2,\mathellipsis$. Don't confuse the parameters with the propositional letters, however! Parameters work really just like constants, they can take the place of constants in formulas and they get interpreted like constants in models. So, for example, \[\forall x(P(x)\to \exists y(R(x,y)\land R(y,p)),\] will be a ``formula'' for the purpose of our proof-theory. Similarly, if $\mathcal{M}$ is a model for our language, then for each $p\in \mathsf{Par}$, we assign an interpretation $p^\mathcal{M}\in D^\mathcal{M}$. The definitions of truth in a model are then extended in the obvious way to treat parameters just like constants. So, for example, $P(p)$ will be true in a model $\mathcal{M}$ under assignment $\alpha$ iff $p^\mathcal{M}\in P^\mathcal{M}$.

		\item A small technical digression. Note that officially, the parameters are \emph{not} part of our language, even though we treat them as such. So $P(p)$ is not a formula of $\mathcal{L}$, rather it's a formula of the extended language $\mathcal{L}^+$ which is defined just like $\mathcal{L}$ except that $\mathcal{C}^+=\mathcal{C}\cup \mathsf{Par}$. Clearly, every formula of $\mathcal{L}$ is then also a formula of $\mathcal{L}^+$, i.e. $\mathcal{L}\subseteq\mathcal{L}^+$, but not vice versa. As a result, every model $\mathcal{M}$ for $\mathcal{L}^+$ is also a model for $\mathcal{L}$: if for all formulas $\phi\in\mathcal{L}^+$, we can calculate a truth-value $\llbracket\phi\rrbracket^\mathcal{M}_\alpha$, then we thereby also calculate a truth-value $\llbracket\phi\rrbracket^\mathcal{M}_\alpha$  for all formulas $\phi\in\mathcal{L}$. More pedantically, we can simply treat any model for $\mathcal{M}$ for $\mathcal{L}^+$ as a model for $\mathcal{L}$ by ``forgetting'' the interpretations of the parameters. This was basically just a sketch of the more technical background behind the idea of parameters, which you'll not need to worry too much about here. You'll see in a moment how this will all work.

		\item The new rules for the quantifiers are as follows:

		\begin{center}
\begin{prooftree}
{
line numbering=false,
line no sep= 2cm,
for tree={s sep'=10mm},
single branches=true,
close with=\xmark
}
[\neg \forall x\varphi
	[\exists x\neg\varphi ]
]
\end{prooftree}\hspace{4ex}
\begin{prooftree}
{
line numbering=false,
line no sep= 2cm,
for tree={s sep'=10mm},
single branches=true,
close with=\xmark
}
[\neg \exists x\varphi
	[\forall x\neg \varphi ]
]
\end{prooftree}
\\[4ex]

\begin{prooftree}
{
centered,
line numbering=false,
line no sep= 2cm,
for tree={s sep'=10mm},
single branches=true,
close with=\xmark
}
[\exists x\varphi
	[{(\varphi)[x:=p]^\dagger} ]
]\end{prooftree}\hspace{4ex}
\begin{prooftree}
{
line numbering=false,
line no sep= 2cm,
for tree={s sep'=10mm},
single branches=true,
close with=\xmark
}
[\forall x\varphi
	[{(\varphi)[x:=a]^\ddagger} ]
]
\end{prooftree}
\end{center}

\vspace{2ex}

$\dagger$: where $p\in\mathsf{Par}$ is any parameter not on the branch already.

$\ddagger$: where $a\in\mathcal{C}\cup\mathsf{Par}$ is any \emph{constant or parameter} already on the branch, or an arbitrary ``fresh'' parameter if there are none.

	The rules are read like this:
	\begin{itemize}

			\item If there's a node with a formula to which a rule can be applied but hasn't been applied yet, then we apply the rule by extending every branch that goes through the node as shown by the rule.

	\end{itemize}
	Everything else about the tableau constrution just works like in propositional logic. In particular, a tableau is called complete iff every rule that can be applied has been applied.

	\item We will need to make a few remarks about the new rules. First, look at the rule for $\exists x\phi$. What this rule says is that you have $\exists x\phi$ on a node, then you extend every branch with $(\phi)[x:=p],$ \emph{where $p$ is a new parameter}, i.e. a parameter that hasn't been used yet on the branch. How can it happen that a parameter has already been used on a branch? Easy: if there's \emph{another} existential quantifier around, as in the following example:

\begin{center}
\begin{prooftree}
{
centered,
line numbering=false,
line no sep= 2cm,
for tree={s sep'=10mm},
single branches=true,
close with=\xmark
}
[{\exists x\exists yR(x,y)}
	[{\exists yR(p,y)}
		[{R(p,q)}
		]
	]
]\end{prooftree}
\end{center}
In the first application of the rule, the application to $\exists x\exists yR(x,y)$. we were free to chose any parameter whatsoever, since no parameter was on the branch yet. We chose $p,$ because obviously. But then, in the second application of the rule, this time to $\exists y R(p,y)$, we were limited in our choice; we could chose anything but $p$. So we chose $q$. Note that though there are two existential quantifiers in $\exists x\exists yR(x,y)$, we have to apply the rules step-by-step, as in the example: first, we use the rule to get from $\exists x\exists yR(x,y)$ to $\exists y R(p,y)$, and then we use the rule again to get from $\exists y R(p,y)$ to $R(p,q)$. In the first application of the rule, we've discharged our duties with respect to $\exists x\exists yR(x,y)$, and in the second rule, we've discharged our duties for $\exists y R(p,y)$. So, the tableau in our example is, indeed, complete. To be perfectly clear, this:
\begin{center}
\begin{prooftree}
{
centered,
line numbering=false,
line no sep= 2cm,
for tree={s sep'=10mm},
single branches=true,
close with=\xmark
}
[{\exists x\exists yR(x,y)}
	[{R(p,q)}
	]
]\end{prooftree}
\end{center}
is \emph{not} allowed. Much less are the following moves allowed:
\begin{center}

\begin{prooftree}
										{
										centered,
										line numbering=false,
										line no sep= 2cm,
										for tree={s sep'=10mm},
										single branches=true,
										close with=\xmark
										}
											[{\exists x\exists yR(x,y)}
												[{R(p,p)}
												]
											]
										\end{prooftree}\hspace{4ex}
										\begin{prooftree}
										{
										centered,
										line numbering=false,
										line no sep= 2cm,
										for tree={s sep'=10mm},
										single branches=true,
										close with=\xmark
										}
											[{\exists x\exists yR(x,y)}
												[{\exists yR(p,y)}
													[{R(p,p)}
													]
												]
											]
										\end{prooftree}
\end{center}

Intuitively, the parameter introduced by the $\exists x\phi$ rule is an arbitrary object that satisfies $\phi$, the idea being that if $\exists x\phi$ is true, then there has to be \emph{some} object that satisfies $\phi$; but we don't know anything about that object other than that it satisfies $\phi$, so we pick a fresh parameter for it to guarantee that we don't make any illicit assumptions.

	\item Next, let's talk about the rule for the universal quantifier. What's important about this rule is that it has to be applied for \emph{every} constant or parameter on the branch. So, if we have, for example, $\forall xP(x)$, $Q(a)$, and $R(q,b)$ all together on one branch, we have to apply the rule for $a$, $q$, and $b$, as illustrated below:
	\begin{center}
\begin{prooftree}
{
centered,
line numbering=false,
line no sep= 2cm,
for tree={s sep'=10mm},
single branches=true,
close with=\xmark
}
[{\forall xP(x)}, grouped
	[Q(a), grouped
		[{R(q,b)}, grouped
			[P(a)
				[{P(q)}
					[P(b)]
				]
			]
		]
	]
]\end{prooftree}
\end{center}
This tableau is complete because every rule that can be applied has been applied. But, it might happen, that you first apply rules for the universal quantifier and then continue applying rules which then introduce \emph{new} parameters. In such a case, \emph{also for those} parameters you have to apply the rule. Here's an example:
	\begin{center}
\begin{prooftree}
{
centered,
line numbering=false,
line no sep= 2cm,
for tree={s sep'=10mm},
single branches=true,
close with=\xmark
}
[{\forall xP(x)}, grouped
	[{\exists yR(a,y)}, grouped
		[{P(a)}
			[{R(a,p)}
				[P(p)]
			]
		]
	]
]\end{prooftree}
\end{center}
The point is that first, we applied the rule to $\forall xP(x)$ for the constant $a$ which was the only constant or parameter at this point (when we only had the initial list). But then, we applied the rule for $\exists y R(a,y)$, which introduced a new parameter, $p$, to the branch. At this point, it became possible to apply the rule for $\forall xP(x)$ again, and so we did. So, even though the following \emph{looks} like a good tree, it's not:
	\begin{center}
\begin{prooftree}
{
centered,
line numbering=false,
line no sep= 2cm,
for tree={s sep'=10mm},
single branches=true,
close with=\xmark
}
[{\forall xP(x)}, grouped
	[{\exists yR(a,y)}, grouped
		[{P(a)}
			[{R(a,p)}
			]
		]
	]
]\end{prooftree}
\end{center}
So, my advice for doing tableaux with $\forall$ in them is as follows:  \emph{every time} you introduce a new parameter, check if there's a universal quantifier rule that needs to be (re-)applied to that new parameter. Just an ominous remark at this point: it's this feature of the rule for the universal quantifier that ultimately leads to infinite tableau. But before we discuss this (much later), let's briefly talk about the idea behind the rule. As in propositional logic, every branch in the complete tableau intuitively corresponds to an interpretation that makes all the formulas on it true. In that interpretation, there will be an interpretation for each constant or parameter on that branch living happily in the domain. But if $\forall x\phi$ is on the branch, then for each of these $\phi$ needs to be true if the value of $x$ is set to that thing. That's just what the rule says: for everything we talk about on a branch with $\forall x\phi$ on it, ensure that that thing satisfies $\phi$.

	\item There's one more feature of the universal quantifier rule that we haven't talked about: it says under $\ddagger$ that we should pick an arbitrary ``fresh'' parameter if there are no constants or parameters on the branch. What's meant here is that if there are no constants or parameters on the branch but a universally quantified claim, then do the same as in the case of the existential rule: instantiate formula in question with a fresh parameter that's not yet on the branch. So, for example, the following is such a situation:

\begin{center}
\begin{prooftree}
{
centered,
line numbering=false,
line no sep= 2cm,
for tree={s sep'=10mm},
single branches=true,
close with=\xmark
}
[{\forall xP(x)}, grouped
	[{\forall x(P(x)\to Q(x))}, grouped
		[{P(p)}
			[{P(p)\to Q(p)}
				[\neg P(p)]
				[Q(p)]
			]
		]
	]
]\end{prooftree}
\end{center}
What's the idea here? Well, for one. In a situation like in our example, we need to get the tableau method started: if there are just a bunch of universal quantifiers around, otherwise nothing would happen. But that's just the superficial reason. The ``deeper'' reason is our assumption that the domain of every model is non-empty (cf. 9.2.3 and 9.4.4): in any model there needs to be at least \emph{one} object in the domain, and we introduce a fresh parameter to talk about this object. In 9.4.3--4, we showed and discussed that the law $\forall x\phi\vDash\exists x\phi$ depended on exactly the assumption of non-empty domains. Below, we will see that we can derive $\forall x\phi\vdash\exists x\phi$ precisely because of the requirement to pick an arbitrary ``fresh'' parameter if there are no constants or parameters on the branch.

	\item It's already been implicit, but explicit is better than implicit, so let me just mention that the motivation behind the new rules is the same as in propositional logic, which we can re-formulate for first-order logic as follows:
	\begin{description}

	\item[Down Preservation.] If the formula at the parent node of a rule is true in a model $\mathcal{M}$ under an assignment $\alpha$, then for at least one newly generated branch, all the formulas written according to the rule on that branch are also true in $\mathcal{M}$ under $\alpha$.

	\item[Up Preservation.] If all the formulas on a branch that's been generated by a rule are true in a model $\mathcal{M}$ under an assignment $\alpha$, then also the formula at the parent node of the rule is true.

	\end{description}
These two principles will again together guarantee soundness and completeness. We will verify them in the next chapter.

	\item Provability is now defined as expected: A branch $B$ in a complete tableau is called \emph{closed} iff there is some atomic formula $R(t_1, \mathellipsis, t_n)$, such that  both $R(t_1, \mathellipsis, t_n),\neg R(t_1, \mathellipsis, t_n)\in B$ (note that we're not yet dealing with identity); otherwise the branch is called \emph{open}. A complete tableau is closed iff every branch is closed, and otherwise it's called open. Now just like in propositional logic, we define $\Gamma\vdash\phi$ to mean that the tableau for $\Gamma\cup\{\neg\phi\}$ is closed. But enough talk, let's look at some examples.

	\item \emph{Examples}:

		\begin{enumerate}[(i)]

		\item 			\begin{prooftree}
{
proof statement format={centered},
to prove={\forall xP(x)\vdash \exists xP(x)},
line numbering=false,
for tree={s sep'=10mm},
single branches=true,
close with=\xmark
}
[\forall xP(x), grouped
	[\neg\exists xP(x), grouped
		[\forall x\neg P(x)
			[\neg P(p)
				[P(p), close
				]
			]
		]
	]
]
\end{prooftree}

Note how in this example the requirement to introduce a fresh parameter for a universal quantifier if there's no constant or parameter on the branch yet played a crucial role.

			\item

			\begin{prooftree}
{
proof statement format={centered},
to prove={\exists x(P(x)\land Q(x))\vdash \exists xP(x)\land \exists xQ(x)},
line numbering=false,
for tree={s sep'=10mm},
single branches=true,
close with=\xmark
}
[\exists x(P(x)\land Q(x)), grouped
	[\neg(\exists xP(x)\land \exists xQ(x)), grouped
		[P(p)\land Q(p)
			[P(p)
				[Q(p)
					[\neg\exists xP(x)
						[\forall x \neg P(x)
							[\neg P(p), close]
						]
					]
					[\neg\exists xQ(x)
						[\forall x \neg Q(x)
							[\neg Q(p), close]
						]
					]
				]
			]
		]
	]
]
\end{prooftree}

	\item \begin{prooftree}
{
proof statement format={centered},
to prove={\forall x\forall y(R(x,y)\lor R(y,x))\vdash \forall xR(x,x)},
line numbering=false,
for tree={s sep'=10mm},
single branches=true,
close with=\xmark
}
[{\forall x\forall y(R(x,y)\lor R(y,x))}, grouped
	[{\neg \forall xR(x,x)}, grouped
		[{\exists x\neg R(x,x)}
			[{\neg R(p,p)}
				[{\forall y(R(p,y)\lor R(y,p))}
					[{R(p,p)\lor R(p,p)}
						[{R(p,p)}, close ]
						[{R(p,p)}, close ]
					]
				]
			]
		]
	]
]
\end{prooftree}

\item

			\begin{prooftree}
{
proof statement format={centered},
to prove={\forall xP(x)\lor\forall xQ(x)\vdash \forall x(P(x)\lor Q(x))},
line numbering=false,
for tree={s sep'=10mm},
single branches=true,
close with=\xmark
}
[\forall xP(x)\lor\forall xQ(x), grouped
	[\neg\forall x(P(x)\lor Q(x)), grouped
		[\exists x\neg (P(x)\lor Q(x))
			[\neg (P(p)\lor Q(p))
				[\neg P(p)
					[\neg Q(p)
						[\forall xP(x)
							[P(p), close
							]
						]
						[\forall xQ(x)
							[Q(p), close
							]
						]
					]
				]
			]
		]
	]
]
\end{prooftree}

\item \begin{prooftree}
{
proof statement format={centered},
to prove={\exists x\forall yR(x,y)\vdash \forall y\exists xR(x,y)},
line numbering=false,
for tree={s sep'=10mm},
single branches=true,
close with=\xmark
}
[{\exists x\forall yR(x,y)}, grouped
	[{\neg\forall y\exists xR(x,y)}, grouped
		[{\forall yR(p_1,y)}
			[{\exists y\neg\exists xR(x,y)}
				[{\neg\exists xR(x,p_2)}
					[{\forall x\neg R(x,p_2)}
						[{R(p_1,p_2)}
							[{\neg R(p_1,p_2)}, close
							]
						]
					]
				]
			]
		]
	]
]
\end{prooftree}

\item \begin{prooftree}
{
line numbering=false,
to prove={\forall x(P(x)\to \exists yS(x,y))\vdash \forall x\exists y(P(x)\to S(x,y))},
for tree={s sep'=5mm},
single branches=true,
close with=\xmark
}
[{\forall x(P(x)\to \exists yS(x,y))}, grouped
	[{\neg \forall x\exists y(P(x)\to S(x,y))}, grouped
		[{\exists x\neg\exists y(P(x)\to S(x,y))}
			[{\neg \exists y(P(p)\to S(p, y))}
				[{\forall y\neg (P(p)\to S(p,y))}
					[{\neg (P(p)\to S(p,p))}
						[P(p)
							[{\neg S(p,p)}
								[{P(p)\to \exists yS(p,y)}
									[\neg P(p), close]
									[{\exists yS(p,y)}
										[{S(p, q)}
											[{\neg (P(p)\to S(p, q))}
												[P(p)
													[{\neg S(p,q)}, close]
												]
											]
										]
									]
								]
							]
						]
					]
				]
			]
		]
	]
]
\end{prooftree}

\item \begin{prooftree}
{
proof statement format={centered},
to prove={\vdash\neg \exists x(K(x)\land \forall y(\neg S(y,y)\leftrightarrow S(x,y)))},
line numbering=false,
for tree={s sep'=10mm},
single branches=true,
close with=\xmark
}
[{\neg \neg \exists x(K(x)\land \forall y(\neg S(y,y)\leftrightarrow S(x,y)))}
	[{\exists x(K(x)\land \forall y(\neg S(y,y)\leftrightarrow S(x,y)))}
		[{(K(p)\land \forall y(\neg S(y,y)\leftrightarrow S(p,y)))}
			[{K(p)}
				[{\forall y(\neg S(y,y)\leftrightarrow S(p,y))}
					[{\neg S(p,p)\leftrightarrow S(p,p)}
						[{\neg S(p,p)}
							[{S(p,p)}, close ]
						]
						[{S(p,p)}
							[{\neg S(p,p)}, close ]
						]
					]
				]
			]
		]
	]
]
\end{prooftree}

		\end{enumerate}

		\item Ok, so what about \emph{un}derivability, i.e. $\Gamma\nvdash\phi$? The definition of $\vdash$ automatically gives us $\Gamma\nvdash\phi$ iff the tableau for $\Gamma\cup\{\neg\phi\}$ is open, i.e. there is at least one open branch. Here's an example:
		\begin{center}
\begin{prooftree}
{
line numbering=false,
for tree={s sep'=10mm},
single branches=true,
close with=\xmark
}
[\forall x(P(x)\lor Q(x)), grouped
	[\neg(\forall xP(x)\lor \forall xQ(x)), grouped
		[\neg \forall xP(x)
			[\neg\forall xQ(x)
				[\exists x\neg P(x)
					[\exists x\neg Q(x)
						[\neg P(p)
							[\neg Q(q)
								[P(p)\lor Q(p)
									[P(q)\lor Q(q)
										[P(p), close
										]
										[Q(p)
											[P(q)]
											[Q(q), close]
										]
									]
								]
							]
						]
					]
				]
			]
		]
	]
]
\end{prooftree}
\end{center}
The tableau gives us that $\forall x(P(x)\lor Q(x))\nvdash \forall xP(x)\lor \forall xQ(x)$. Now, remember that for open branches in complete tableau we want to have a model that makes all their members true, the \emph{associated model}. We also get associated models in first-order logic, but it's a bit more complicated to define them.

	\item So let $B$ be an open branch in a complete tableau. We then define the associated model $\mathcal{M}_B$ as follows:
		\begin{enumerate}[(i)]

			\item $D^{\mathcal{M}_B}=\{a\in \mathcal{C}\cup Par: a\text{ occurs on }B\}$

			\item $a^{\mathcal{M}_B}=a$ for all $a\in \mathcal{C}\cup Par$

			\item $R^{\mathcal{M}_B}=\{(a_1, \mathellipsis, a_n): R(a_1, \mathellipsis, a_n)\in B\}$

		\end{enumerate}
	There's something to talk about here. There's no typo here: the objects in the domain of $\mathcal{M}_B$ are really the constants and parameters on $B$ themselves. The model is what's known in the literature as a \emph{term-model}: it's a model build from the expressions of our language. In this weird model, every constant and parameter is just a name for itself. And, given that, predicates are interpreted just like the branch says they should be. Now, if you think back of the associated valuation of a branch in propositional logic (6.3.5), you will note that also there, we basically let the branch tell us what to do. In first-order logic, this is not much different. The only somewhat weird thing is that we let constants (and parameters) denote themselves. But what's \emph{really} so weird about this: constants and parameters are themselves objects (they are things you can write down, etc.), so why shouldn't they be allowed to ``live'' in a model?

	\item \emph{Examples}:

		\begin{enumerate}[(i)]

			\item Let's first look at the example $\forall x(P(x)\lor Q(x))\nvdash \forall xP(x)\lor \forall xQ(x)$ from before:

\begin{center}
\begin{prooftree}
{
%proof statement format={centered},
%to prove={\forall x(P(x)\lor Q(x))\nvdash \forall xP(x)\lor \forall xQ(x)},
line numbering=false,
for tree={s sep'=10mm},
single branches=true,
close with=\xmark
}
[\forall x(P(x)\lor Q(x)), grouped
	[\neg(\forall xP(x)\lor \forall xQ(x)), grouped
		[\neg \forall xP(x)
			[\neg\forall xQ(x)
				[\exists x\neg P(x)
					[\exists x\neg Q(x)
						[\neg P(p)
							[\neg Q(q)
								[P(p)\lor Q(p)
									[P(q)\lor Q(q)
										[P(p), close
										]
										[Q(p)
											[P(q)]
											[Q(q), close]
										]
									]
								]
							]
						]
					]
				]
			]
		]
	]
]
\end{prooftree}
\end{center}

The constants and parameters occurring in the open branch are $p$ and $q$. So, we have $D^{\mathcal{M}_B}=\{p,q\}$. The parameters $p$ and $q$ denote themselves, that is we have $p^{\mathcal{M}_B}=p$ and $q^{\mathcal{M}_B}=q$. The only atomic formulas occurring on the branch are $P(q)$ and $Q(p)$. Correspondingly, we get $P^{\mathcal{M}_B}=\{q\}$ and $Q^{\mathcal{M}_B}=\{p\}$. So, to sum up, our model looks like this:
\begin{itemize}
	\item $D^{\mathcal{M}_B}=\{p,q\}$
	\item $p^{\mathcal{M}_B}=p$
	\item $q^{\mathcal{M}_B}=q$
	\item $P^{\mathcal{M}_B}=\{q\}$
 	\item $Q^{\mathcal{M}_B}=\{p\}$
\end{itemize}
Now it's easily checked that in this model, $\forall x(P(x)\lor Q(x))$ is true: there are two things ($p$ and $q$) and each of them is either $P$ or $Q$ ($p$ is $Q$ and $q$ is $P$). But $\forall xP(x)\lor \forall xQ(x)$ is certainly false: neither is everything $P$ ($p$ is not) nor is everything $Q$ ($q$ is not).

	\item The next cases I'll handle a bit more quickly:

	\begin{prooftree}
{
proof statement format={centered},
to prove={\forall x\forall y(R(x,y)\to R(y,x))\nvdash \forall xR(x,x)},
line numbering=false,
for tree={s sep'=10mm},
single branches=true,
close with=\xmark
}
[{\forall x\forall y(R(x,y)\to R(y,x))}, grouped
	[{\neg \forall xR(x,x)}, grouped
		[{\exists x\neg R(x,x)}
			[{\neg R(p,p)}
				[{\forall y(R(p,y)\to R(y,p))}
					[{R(p,p)\to R(p,p)}
						[{\neg R(p,p)} ]
						[{R(p,p)}, close ]
					]
				]
			]
		]
	]
]
\end{prooftree}

Associated model $\mathcal{M}_B$:

\begin{itemize}
	\item $D^{\mathcal{M}_B}=\{p\}$
	\item $p^{\mathcal{M}_B}=p$
	\item $R^{\mathcal{M}_B}=\emptyset$
\end{itemize}

Note that this is perfectly fine: in a model, $R^\mathcal{M}$ can be empty (i.e. nothing stands in the relation $R$ to anything).

		\item

\begin{prooftree}
{
proof statement format={centered},
to prove={\exists x (P(c)\to P(x))\nvdash \neg (P(c)\to \forall xP(x))},
line numbering=false,
for tree={s sep'=10mm},
single branches=true,
close with=\xmark
}
[{\exists x (P(c)\to P(x))}, grouped
	[{\neg\neg (P(c)\to \forall xP(x))}, grouped
		[{P(c)\to \forall xP(x)}
			[{P(c)\to P(p)}
				[{\neg P(c)}
					[{\neg P(c)}]
					[{P(p)}]
				]
				[{\forall x P(x)}
					[{\neg P(c)}
						[{P(c)}, close]
					]
					[{P(p)}
						[{P(c)}]
					]
				]
			]
		]
	]
]
\end{prooftree}

Associated model of the right-most branch $\mathcal{M}_B$:

\begin{itemize}
	\item $D^{\mathcal{M}_B}=\{p,c\}$
	\item $p^{\mathcal{M}_B}=p$
	\item $c^{\mathcal{M}_B}=c$
	\item $P^{\mathcal{M}_B}=\{p,c\}$
\end{itemize}

		\item

		\begin{prooftree}
{
proof statement format={centered},
to prove={\nvdash \forall x\forall y(R(x,y)\to R(y,x))},
line numbering=false,
for tree={s sep'=10mm},
single branches=true,
close with=\xmark
}
[{\neg\forall x\forall y(R(x,y)\to R(y,x))}
	[{\exists x\neg\forall y(R(x,y)\to R(y,x))}
		[{\neg\forall y(R(p,y)\to R(y,p))}
			[{\exists y\neg(R(p,y)\to R(y,p))}
				[{\neg(R(p,q)\to R(q,p))}
					[{\neg R(p,q)}
						[{R(q,p)}]
					]
				]
			]
		]
	]
]
\end{prooftree}

Associated model of the branch $\mathcal{M}_B$:
\begin{itemize}
	\item $D^{\mathcal{M}_B}=\{p,q\}$
	\item $p^{\mathcal{M}_B}=p$
	\item $q^{\mathcal{M}_B}=q$
	\item $R^{\mathcal{M}_B}=\{(q,p)\}$
\end{itemize}

		\end{enumerate}

	\item Just like in propositional logic, we'll be able to show that the associated model makes all the formulas on the branch true. This will be the completeness lemma for first-order logic: if $B$ is an open branch of a complete tableau, then all formulas in $B$ are true in $\mathcal{M}_B$ under all assignments. For now, it's a good idea to convince yourself that in the above examples, this is indeed the case.

\end{enumerate}

\section{Tableaux With Identity}
\label{fo_tableaux_identity}

	\begin{enumerate}[\thesection.1]

		\item In the following two sections, we will just refine the tableau calculus from the previous section to make it work for our full language, with identity and function symbols. First, we add rules for identity. They are as follows:
	\begin{center}
	\begin{prooftree}
			{
line numbering=false,
line no sep= 2cm,
for tree={s sep'=10mm},
single branches=true,
close with=\xmark
}
[\vdots
	[ {a=a^\dagger}
	]
]
\end{prooftree}\hspace{8ex}
\begin{prooftree}
{
line numbering=false,
line no sep= 2cm,
for tree={s sep'=10mm},
single branches=true,
close with=\xmark
}
[{a=b}, grouped
	[{\sigma^\ddagger[x:=a]}, grouped
		[{\sigma[x:=b]}
		]
	]
]
\end{prooftree}
\end{center}
$\dagger$: $a$ any parameter or constant already on the branch, or an arbitrary fresh one.\\
$\ddagger$: $\sigma$ here is any atomic formula, i.e. a formula of the form $R(t_1, \mathellipsis, t_n)$ or $t_1=t_2$.

These rules, though deceptively simple, require some commentary.

	\item First, the $a=a$ rule. What this rule says is that for each constant or parameter $a$ on the branch, you need to add a node with $a=a$. The purpose of this rule is to allow us to get $\vdash\forall x(x=x)$, since clearly $\vDash\forall x(x=x)$---the denotation of any term is identical to itself in every model. The proof goes as follows:

	\begin{center}
	\begin{prooftree}
{
%proof statement format={centered},
%to prove={\vdash \forall x(x=x)},
line numbering=false,
for tree={s sep'=10mm},
single branches=true,
close with=\xmark
}
[{\neg\forall x(x=x)}, grouped
	[{\exists x\neg x=x}
		[{\neg p=p}
			[{p=p},close]
		]
	]
]
\end{prooftree}
\end{center}

Note that we've closed the branch here because there was an atomic formula, $p=p$, such that both $p=p\in B$ and $\neg p=p\in B$. Now, in principle, the rule works quite like the universal quantifier rule in that you need to make sure you do this for \emph{every} constant or parameter on the branch, also ones that have been created later, when you thought you were already done with this rule. But that's clearly nuts: this would make our proof trees quickly explode in size. This is why we make the following convention: we only apply the rule for $a=a$ if (a) thereby we can close a branch (i.e. if also $\neg a=a$ is on the branch) or (b) we're dealing with an open branch of an otherwise complete tableau. The reason behind convention (a) is clear (I hope), the reason behind (b) will become clear when we discuss associated models.

	\item Turning to the second rule, things get a bit more complicated. It might be useful to talk about the idea first. What the rule relies on is the fact that if two objects $a$ and $b$ are identical and one of them satisfies $\phi$, then also the other object needs to satisfy $\phi$---the two objects are, after all, identical. Here is a simple application of the rule, used to show that $\vdash \forall x\forall y(P(x)\land x=y\to P(y))$:
		\begin{center}
	\begin{prooftree}
{
line numbering=false,
for tree={s sep'=10mm},
single branches=true,
close with=\xmark
}
[{\neg \forall x\forall y(P(x)\land x=y\to P(y))}, grouped
	[{\exists x\neg \forall y(P(x)\land x=y\to P(y))}
		[{\neg \forall y(P(p)\land p=y\to P(y))}
			[{\exists y\neg(P(p)\land p=y\to P(y))}
				[{\neg(P(p)\land p=q\to P(q))}
					[{P(p)\land p=q}
						[\neg P(q)
							[P(p)
								[{p=q}
									[P(q), close]
								]
							]
						]
					]
				]
			]
		]
	]
]
\end{prooftree}
\end{center}
The crucial application of the rule is in the last step here. For this step, it was simply noted that \[P(p)=(P(x))[x:=p]\]\[P(q)=(P(x))[x:=q]\]
Since $p=q$ was on the branch at that point, this allowed us to get from $P(p)$ to $P(q)$, and thus to close the branch. Now, you may think that this is a bit confusing. After all $(P(x))[x:=p]$ and $(P(x))[x:=q]$ is not what's written on the branch, $P(p)$ and $P(q)$ are. How could you have seen that the rule should have been applied like this? Well, the answer is quite simple: what the rule really tells you is that if you have $a=b$ on a branch and some atomic formula with either $a$ in it, say, $R(t_1, \mathellipsis, a,\mathellipsis, t_n)$, then you need to replace that $a$ with $b$, you'll get $R(t_1, \mathellipsis, b,\mathellipsis, t_n)$. This, of course, holds equally well the other way around (replace $b$ with $a$) and with identity claims as in the following example, which shows that $a=b,b=c\vdash a=c$
\begin{center}
\begin{prooftree}
{
proof statement format={centered},
to prove={a=b, b=c\vdash a=c},
line numbering=false,
line no sep= 2cm,
for tree={s sep'=10mm},
single branches=true,
close with=\xmark
}
[{a=b}, grouped
	[{b=c}, grouped
		[a\neq c, grouped
			[{a=c}, close]
		]
	]
]
\end{prooftree}
\end{center}
Note that you really only need to replace terms for each other in \emph{atomic} formulas, not in more complex formulas and, in particular, not in \emph{negated} atomic formulas.

	\item \emph{Examples}: (see next page)

	\begin{enumerate}[(i)]
	{\small
		\item \begin{prooftree}
{
proof statement format={centered},
to prove={a=b\vdash \exists xS(x,a)\to (a=a\land \exists xS(x,b))},
line numbering=false,
line no sep= 2cm,
for tree={s sep'=10mm},
single branches=true,
close with=\xmark
}
[{a=b}, grouped
	[{\neg (\exists xS(x,a)\to (a=a\land \exists xS(x,b)))}, grouped
		[{\exists xS(x,a)}
			[{\neg(a=a\land \exists xS(x,b))}
				[{S(p,a)}
					[{\neg (a=a)}
						[{a=a}, close]
					]
					[{\neg\exists xS(x,b)}
						[{\forall x\neg S(x,b)}
							[{\neg S(p,b)}, close
								%[{\neg S(p,a)}, close ]
							]
						]
					]
				]
				]
		]
	]
]
\end{prooftree}

	\item \begin{prooftree}
{
proof statement format={centered},
to prove={a=b\nvdash \forall x\exists y(P(y)\land x=y)},
line numbering=false,
for tree={s sep'=5mm},
single branches=true,
close with=\xmark
}
[{a=b}, grouped,
	[{\neg \forall x\exists y(P(y)\land x=y)}, grouped
		[{\exists x\neg\exists y (P(y)\land x=y)}
			[{\neg\exists y(P(y)\land p=y)}
				[{\forall y\neg (P(y)\land p=y)}
					[{\neg (P(p)\land p=p)}
						[{\neg (P(a)\land p=a)}
							[{\neg (P(b)\land p=b)}
								[\neg P(p)
									[\neg P(a)
										[\neg P(b)]
										[{p\neq b}
										]
									]
									[{p\neq a}
										[\neg P(b)
										]
										[{p\neq b}]
									]
								]
								[{p\neq p}
									[{p=p}, close]
								]
							]
						]
					]
				]
			]
		]
	]
]
\end{prooftree}
}
\end{enumerate}

	\item What remains to be discussed is how we can define an associated model when identity claims are involved. There is an obvious complication here. In the associated term model we defined above, every term denotes itself. So, in that model, there are only trivial identities. Clearly, $a$ is the same symbols as $a$, so $a^{\mathcal{M}_B}=a^{\mathcal{M}_B}$, meaning that $\mathcal{M}_B\vDash a=a$ (the trivial identity). But if $a$ and $b$ are different constants, then they are different, meaning $a^{\mathcal{M}_B}\neq b^{\mathcal{M}_B}$, giving us $\mathcal{M}_B\nvDash a=b$ for \emph{all} distinct $a$ and $b$. But it can, of course, happen that $a=b$ is on a branch, as in our example (ii) above. What to do?

	\item The solution is that we move slightly away from the notion of a term model and consider models where the elements are \emph{sets} of terms. A term will now denote a \emph{set} of terms, the set of terms that are, according to the branch, identical to the initial term. Here's how this goes. Let $B$ be a branch of a complete open tableau. We first define the relation $\sim_B$ on terms by saying that:

	\begin{itemize}

		\item $a\sim_B b$ iff $a=b\in B$.

	\end{itemize}
In words, $a\sim_B b$ means that $a$ is identical to $b$ according to $B$. For each term (constant or parameter) $a$, we can now consider the set: \[[a]_{\sim_B}=\{b:a\sim_Bb\},\] which contains all the terms $b$ that are identical to $a$ according to $B$. \emph{This} set, called the \emph{equivalence class of $a$},  will be the denotation of $a$ in $\mathcal{M}_B$.

	\item So, here's the definition associated model for an open branch $B$ in a complete tableau with identity:

		\begin{itemize}

			\item $D^{\mathcal{M}_B}=\{[a]_{\sim_B}:a\text{ occurs in }B\}$

			\item $a^{\mathcal{M}_B}=[a]_{\sim_B}$, for all $a\in \mathcal{C}\cup Par$

			\item $R^{\mathcal{M}_B}=\{([a_1]_{\sim_B}, \mathellipsis, [a_n]_{\sim_B}): R(a_1, \mathellipsis, a_n)\in B\}$

		\end{itemize}
		This will do the job.

	\item Let's consider an example. Take the left-most branch in example (10.3.4.ii). There are three constants or parameters that occur in the branch: $a,b,$ and $p$. We have $a=b\in B$ as the only identity claim written on the branch, but we should assume that also $a=a, b=b,$ and $p=p$ are there on the branch as per convention (b) of 10.3.2. So, we can calculate the sets $[\cdot ]_{\sim_B}$ as follows:
	\begin{itemize}

		\item $[a]_{\sim_B}=\{a, b\}$
		\item $[b]_{\sim_B}=\{a, b\}$
		\item $[p]_{\sim_B}=\{p\}$

	\end{itemize}
We now set these identity classes as the interpretations of the terms:
	\begin{itemize}

		\item $a^{\mathcal{M}_B}=[a]_{\sim_B}=\{a, b\}$
		\item $b^{\mathcal{M}_B}=[b]_{\sim_B}=\{a, b\}$
		\item $p^{\mathcal{M}_B}=[p]_{\sim_B}=\{p\}$

	\end{itemize}
Note that $[a]_{\sim_B}=[b]_{\sim_B}$ and so $a^{\mathcal{M}_B}=b^{\mathcal{M}_B}$, which is precisely what we want since this means that $\mathcal{M}_B\vDash a=b$ and $a=b\in B$. The only thing that remains to be determined is the interpretation of $P$. But in this case, that's easy since there is no formula of the form $P(t)\in B$. So, we get $P^{\mathcal{M}_B}=\emptyset$. So, all in all, we get:
\begin{itemize}
	\item $\mathcal{D}^{\mathcal{M}_B}=\{[a]_{\sim_B}, [b]_{\sim_B}, [p]_{\sim_B}\}=\{\{a,b\},\{p\}\}$
	\item $a^{\mathcal{M}_B}=[a]_{\sim_B}=\{a,b\}$
	\item $b^{\mathcal{M}_B}=[b]_{\sim_B}=\{a,b\}$
	\item $p^{\mathcal{M}_B}=[p]_{\sim_B}=\{p\}$
	\item $P^{\mathcal{M}_B}=\emptyset$
\end{itemize}

	\item We're going to conclude our discussion of tableaux with identity by observing a lemma in preparation for our completeness proof in the next chapter. We're proving that lemma here, since it will help us understand how the associated model of a branch with identity claims works:

		\begin{lemma}
		Let $B$ be an open branch of a complete tableau and $\mathcal{M}_B$ the associated model. Then, if $a=b\in B$, then $\mathcal{M}\vDash a=b$.
		\end{lemma}
		\begin{proof}
		Suppose that $a=b\in B$. What we need to show is that the sets $[a]_{\sim_B}$ and $[b]_{\sim_B}$ are identical. This is because $a^{\mathcal{M}_B}=[a]_{\sim_B}$ and $b^{\mathcal{M}_B}=[b]_{\sim_B}$ and $\mathcal{M}\vDash a=b$ iff $a^{\mathcal{M}_B}=a^{\mathcal{M}_B}$. So, let's briefly remind ourselves of the definitions of the two sets:
		\[[a]_{\sim_B}=\{c:a\sim_Bc\}\]
		\[[b]_{\sim_B}=\{c:b\sim_Bc\}\]
		Now, by extensionality, what we need to show is that every element of $[a]_{\sim_B}$ is an element of $[b]_{\sim_B}$ and vice versa. We're only going to prove one of the directions, since the other is completely analogous. So assume that $c\in [a]_{\sim_B}$, i.e. $a=c\in B$. We need to derive that $c\in [b]_{\sim_B}$, i.e. $c=b\in B$. We already know that $a=b\in B$ and we've assumed that $a=c\in B$. But the tableau we're looking at is complete, so every rule that can be applied has been applied, in particular every instance of the second, substitution identity rule. Now note that $a=b$ is the same as $(x=b)[x:=a]$ and we have $a=c\in B$. So by an application of the rule we get $(x=b)[x:=c]\in B$. But now note that $(x=b)[x:=c]$ is nothing else than $c=b$, which is precisely what we needed to show being on the branch.
		\end{proof}

	\end{enumerate}

\section{Tableaux With Functions}
\label{fo_tableaux_functions}

	\begin{enumerate}[\thesection.1]

		\item Finally, we'll discuss how to allow for function symbols in tableaux. Luckily, we don't need to add any new rules. All we need to do is to replace the talk of ``constants or parameters'' with the more general talk of ``ground terms.'' Remember that a ground term is a term that does not contain any variables, i.e. any constant (or parameter) $a$ is a ground term and so are functional combination of those, such as $f(a,g(c,p))$ and the like. The only rules affected by this are the rule for the universal quantifier and the identity rules, so let's just restate them in the new, official form:

\begin{center}
		\begin{prooftree}
{
line numbering=false,
line no sep= 2cm,
for tree={s sep'=10mm},
single branches=true,
close with=\xmark
}
[\forall x\varphi
	[{(\varphi)[x:=t]^\ddagger} ]
]
\end{prooftree}\hspace{8ex}
\begin{prooftree}
			{
line numbering=false,
line no sep= 2cm,
for tree={s sep'=10mm},
single branches=true,
close with=\xmark
}
[\vdots
	[ {t=t^\dagger}
	]
]
\end{prooftree}\hspace{8ex}
\begin{prooftree}
{
line numbering=false,
line no sep= 2cm,
for tree={s sep'=10mm},
single branches=true,
close with=\xmark
}
[{s=t}, grouped
	[{\sigma^\ddagger[x:=s]}, grouped
		[{\sigma[x:=t]}
		]
	]
]
\end{prooftree}
\end{center}
$\dagger$: where $t$ is any \emph{ground term} already on the branch, or an arbitrary ``fresh'' \emph{ground term} if there are none.\\
$\ddagger$: $\sigma$ here is any atomic formula, i.e. a formula of the form $R(t_1, \mathellipsis, t_n)$ or $t_1=t_2$.

	  \item So, there is nothing really different about the proof theory itself,
		i.e.\ the rules for constructing tableaux.
		The only topic on which we really have to say anything is how to interpret function symbols in the associated model of a branch.
		Remember that in a model $\mathcal{M}$, the interpretation of an $n$-ary function symbol $f^n\in\mathcal{F}$ is an $n$-ary function
		$f^\mathcal{M}:(D^\mathcal{M})^n\to D^\mathcal{M}$.
		But what on earth could this function be in our model?
		The solution is as simple as it is revealing about the whole game of associated models.
		First, let's adjust the definition of the associated model for an open branch $B$ in complete tableau to a setting with function terms.
		We define $[t]_{\sim_B}$ to be the set $\{u:t=u\in B\}$ when $t$ occurs in $B$ and $\{t\}$ otherwise:
		\footnote{%
		Why this complicated definition, you ask?
		Well, you'll see in a moment.}
		\[[t]_{\sim_B}=\begin{cases}
			\{u:t=u\in B\} &\text{if }t\text{ occurs in }B\\
			\{t\} &\text{ otherwise}\end{cases}
		\]
	Then, we say:
		\begin{itemize}

			\item $D^{\mathcal{M}_B}=\{[t]_{\sim_B}:t\in\mathcal{T}\}$

			\item $a^{\mathcal{M}_B}=[a]_{\sim_B}$, for $a\in \mathcal{C}\cup Par$

			\item $R^{\mathcal{M}_B}=\{([t_1]_{\sim_B}, \mathellipsis, [t_n]_{\sim_B}): R(t_1, \mathellipsis, t_n)\in B\}$

		\end{itemize}
		Now, for $f^n\in\mathcal{F}$ an $n$-ary function symbol, we need to find a function $f^{\mathcal{M}_B}$ that maps $n$-tuples of equivalence classes of terms
		$([t_1]_{\sim_B},\mathellipsis, [t_n]_{\sim_B})$
		to a single such equivalence class.
		But which one should it be:
		\[f^{\mathcal{M}_B}([t_1]_{\sim_B},\mathellipsis, [t_n]_{\sim_B})=[?]_{\sim_B}\]
		The ``obvious'' answer is that $f^{\mathcal{M}_B}([t_1]_{\sim_B},\mathellipsis, [t_n]_{\sim_B})=[f(t_1, \mathellipsis, t_n)]_{\sim_B}$.
		Why is this obvious?
		First, note that this really defines a function on the terms.
		In particular, for every input we assign one and only one out.
		This crucially hinges on the fact that we've ``enlarged'' $D^{\mathcal{M}_B}$ to include also the equivalence classes of all the terms not in $B$:
		we know that the value for
		$f([t]_{\sim_B})=[f(t)]_{\sim_B}$,
		namely $[f(t)]_{\sim_B}\in D^{\mathcal{M}_B}$ ,
		but we're now also guaranteed that we get a value for $f^{\mathcal{M}_B}([f(t)]_{\sim_B})$, viz. $[f(f(t))]_{\sim_B}\in D^{\mathcal{M}_B}$, and so on.
		The definition guarantees exactly that the formulas on the branch involving the term $f(t_1, \mathellipsis, t_n)$ will be true.
		How so, is best illustrated by means of an example.

	\item \emph{Example}. Let's consider the following derivation for $\nvdash \forall x\forall y(f(x)= f(y)\to x= y)$

	\begin{center}
	\begin{prooftree}
{
line numbering=false,
line no sep= 2cm,
for tree={s sep'=10mm},
single branches=true,
close with=\xmark
}
[{\neg \forall x\forall y(f(x)= f(y)\to x= y)}, grouped
		[{\exists x \neg\forall y(f(x)= f(y)\to x= y)}
			[{\neg\forall y(f(p)= f(y)\to p= y)}
				[{\exists y\neg(f(p)= f(y)\to p= y)}
					[{\neg(f(p)= f(q)\to p= q)}
						[{f(p)=f(q)}
							[{p\neq q}
							]
						]
					]
				]
			]
		]
]
\end{prooftree}
\end{center}
Now let's consider the model $\mathcal{M}_{B}$. We have:
\begin{itemize}

			\item $D^{\mathcal{M}_B}=\{[t]_{\sim_B}:t\in\mathcal{T}\}$

			\item $p^{\mathcal{M}_B}=[p]_{\sim_B}=\{p\}$

			\item $q^{\mathcal{M}_B}=[p]_{\sim_B}=\{q\}$

			\item $f^{\mathcal{M}_B}(p^{\mathcal{M}_B})=[f(p)]^{\mathcal{M}_B}=\{f(p), f(q)\}$

			\item $f^{\mathcal{M}_B}(q^{\mathcal{M}_B})=[f(q)]^{\mathcal{M}_B}=\{f(p), f(q)\}$

		\end{itemize}
		Now this model does exactly what we want it to do. Since $f^{\mathcal{M}_B}(p^{\mathcal{M}_B})=f^{\mathcal{M}_B}(q^{\mathcal{M}_B})$, we have that $\mathcal{M}_B\vDash f(p)=f(q)$. And since $p^{\mathcal{M}_B}\neq q^{\mathcal{M}_B}$, we have $\mathcal{M}_B\vDash p\neq q$.

		\item It is now a nice exercise to show using induction on terms that, in the associated model, the denotation of any ground-term is its equivalence class. In fact, you will do this as an exercise \smiley

		\begin{lemma}
		Let $B$ be an open branch in a complete tableau and $\mathcal{M}_B$ the associated model. Then we have for all ground terms $t\in\mathcal{T}$ that $\llbracket t\rrbracket^\mathcal{M}_\alpha=[t]_{\sim_B}$.
		\end{lemma}
		\begin{proof}
		Exercise 10.8.7. \emph{Hint}: You can basically ignore variables in the base case and disregard the assignment by Corollary 9.2.9.
		\end{proof}

	\end{enumerate}

\section{Infinite Tableaux and Decidability}

	\begin{enumerate}[\thesection.1]

		\item So far, all the tableaux we've been discussing have been \emph{very} well behaved. In fact, the infinitary issues I've mentioned in \S10.1, at least so far, haven't surfaced. But now they will. In fact, we need not look very hard for them. Just try to do the tableau for the simple formula $\neg\exists x\forall yR(x,y)$. You get:
		\begin{center}
{\footnotesize\begin{prooftree}
{
%proof statement format={centered},
%to prove={\nvdash \exists x\forall yR(x,y)},
line numbering=false,
for tree={s sep'=10mm},
single branches=true,
close with=\xmark
}
[{\neg\exists x\forall yR(x,y)}, grouped
	[{\forall x\neg \forall yR(x,y)}
		[{\neg \forall yR(p_1, y)}
			[{\exists y\neg R(p_1,y)}
				[{\neg R(p_1, p_2)}
					[{\neg\forall yR(p_2, y)}
						[{\exists y\neg R(p_2, y)}
							[{\neg R(p_2, p_3)}
								[\vdots]
							]
						]
					]
				]
			]
		]
	]
]
\end{prooftree}}
\end{center}
What's going on here? Well, what happened is that we get a universally quantifier formula $\forall x\neg\forall yR(x,y)$, which we instantiate with a fresh parameter $p_1$, which then lead to an \emph{existentially} quantified formula $\exists y\neg R(p_1, y)$, for which we introduced a fresh parameter, $p_2$, giving us $R(p_1, p_2)$, which then forces us to re-instantiate $\forall x\neg\forall yR(x,y)$, giving us $\exists y\neg R(p_2, y)$, forcing us to introduce $p_3$, and so on. We got caught in what we might call a \emph{quantifier feedback loop}. The possibilities of such loops has profound implications for the proof theory of first-order logic using tableaux.

	\item But before we discuss these implications, let's talk about the fact that we just wrote down an infinite tableau. Well, of course we didn't. What we did was to realize that if we were to continue applying the tableau rules trying to construct the tableau for $\neg\exists x\forall yR(x,y)$, we will never get to an end. So, we can't write down the tableau for that formula. But does that mean that this tableau doesn't \emph{exist}? To appreciate that the mathematical answer is \emph{No!}, we have to re-think what tableaux actually \emph{are}. So far, we've been talking about tableaux as a concrete tree that we write down. But, mathematically speaking, the actual ink-and-paper (or screen-and-pixel) tableau that you write down is not what the tableau \emph{is}. A tableau, for a mathematician, is a special kind of (graph-theoretic) tree, which in turn is a mathematical structure that consists of a set of nodes and a set of edges connecting them. Nothing in this requires the tree to be written down or even be finitely writable in the first-place---it's just a pair of sets. But what about the rules? Well, for a mathematician, the rules we use to construct our tableaux are just an inductive definition of the set of tableaux! And in first-order logic, that's how \emph{we} will need to think of tableaux as well.

	\item Note that the tableau above, our example, shows that $\nvdash\exists x\forall yR(x,y)$, i.e. the formula $\exists x\forall yR(x,y)$ is not derivable. In fact, infinite tableaux can \emph{only} occur in cases where something \emph{isn't} derivable. Why? Well, because if something \emph{is} derivable, then the tableau needs to close (by definition). But if a tableau closes, it does so after finitely many steps: there will be two nodes, one containing an atomic formula the other its negation, which are at some point in the tree---everything that comes after doesn't matter (in first-order logic, we can ``close early''). But how do we know that the tableau we sketched above doesn't close at some point? Well, that we need to prove. But the argument is actually not that hard:

	\begin{itemize}

		\item Note that all the formulas after the initial list are of the form: $\neg \forall yR(p_i, y)$, $\exists y\neg R(p_i, y)$, and $\neg R(p_i, p_{i+1})$. But these statements either begin with an existential quantifier or a negation. So, there can't be an atom and it's negation on the branch.

	\end{itemize}
Further, we need to prove that the tableau is \emph{complete}, i.e. if we were to continue indefinitely to apply rules according to the pattern described, then for each node to which a rule could be applied, at some point it will be applied. Here's the argument:
\begin{itemize}

		\item Note that whenever we introduce a new variable $p_i$, we apply the rule for $\forall x\neg\forall yR(x,y)$ to it,  and whenever we encounter $\neg \forall yR(p_i, y)$ we apply $\neg\forall$-rule to get to $\exists y\neg R(p_i, y)$  and then the $\exists$-rule to get to $\neg R(p_i, p_{i+1})$.  We've just observed that these are all the (kinds) of formulas on the tree, so we know that for each node to which a rule could be applied, at some point it will be applied.

\end{itemize}
This is how we make sense of infinite tableaux.

	\item \emph{Example}. The tableau for the inference from $\forall x\exists yR(x,y)$ to $\exists y\forall xR(x,y)$:

	\begin{center}
{\begin{prooftree}
{
proof statement format={centered},
to prove={\forall x\exists yR(x,y)\nvdash \exists y\forall xR(x,y)},
line numbering=false,
for tree={s sep'=10mm},
single branches=true,
close with=\xmark
}
[{\forall x\exists yR(x,y)}, grouped
	[{\neg\exists y\forall xR(x,y)}, grouped
		[{\forall y\neg \forall xR(x,y)}
			[{\exists yR(p_1,y)}
				[{\neg \forall xR(x,p_1)}
					[{\exists x\neg R(x,p_1)}
						[{R(p_1, p_2)}
							[{\neg R(p_3, p_1)}
								[{\exists yR(p_2, y)}
									[{\neg \forall xR(x, p_3)}
										[{\exists yR(p_3, y)}
											[{\neg \forall xR(x, p_2)}
												[{\vdots}
												]
											]
										]
									]
								]
							]
						]
					]
				]
			]
		]
	]
]
\end{prooftree}}
\end{center}
How do we see that the tableau is open? Well, we note that all the atomic formulas on the (one and only) branch are of the form $R(p_i, p_{2i})$ and $\neg R(p_{2i+1}, p_{i})$. Since there is no natural number $i$ such that $i=2i+1$, we can conclude that we'll never get to $R(s,t)$ and $\neg R(s,t)$---the tableau never closes.

	\item Do we also have associated models for infinite open branches? Why, yes we do! Nothing in the definition of an associated model prevents us from applying the definition to an infinite branch. Here are the models we'd get for our two examples:

	\begin{itemize}

		\item $\nvdash\exists x\forall yR(x,y)$

			\begin{itemize}

				\item $D^{\mathcal{M}_B}=\{p_i:i\in\mathbb{N}\}$

				\item $p_i^{\mathcal{M}_B}=p_i$

				\item $R^{\mathcal{M}_B}=\emptyset$

			\end{itemize}

		\item $\forall x\exists yR(x,y)$ to $\exists y\forall xR(x,y)$

			\begin{itemize}

				\item $D^{\mathcal{M}_B}=\{p_i:i\in\mathbb{N}\}$

				\item $p_i^{\mathcal{M}_B}=p_i$

				\item $R^{\mathcal{M}_B}=\{(p_i, p_{2i}):i\in \mathbb{N}\}$

			\end{itemize}
	\end{itemize}
				In fact, we will be able to prove soundness and completeness for first-order tableaux, which, of course, crucially depends on the existence of associated models.

	  \item This brings me to the last point of this chapter, decidability.
		Soundness and completeness should \emph{not} be confused with decidability.
		What we will be able to show, the soundness and completeness theorem, is that
		$\Gamma\vDash\phi$
		iff the tableau for
		$\Gamma\cup\{\neg\phi\}$
		is closed.
		But that doesn't mean that there's an effective algorithm, which \emph{in a finite amount of time} determines whether $\Gamma\vDash\phi$.
		In fact, we've just seen that our algorithm can ``loop'' and never spit out an answer.
		In such cases, we can still reason to the right answer, but this isn't algorithmic anymore.
		A computer can't figure out that reasoning.
		Now, this shows that the tableau algorithm doesn't decide first-order logic.
		But the fact that one algorithm doesn't work, of course, doesn't mean that \emph{no} algorithm works.
		What we can see, however, is that a certain \emph{kind} of algorithm will not work: one that tries to construct countermodels for invalid inferences.
		The idea to construct countermodels is something that tableaux and truth-tables have in common: in truth-tables, we check whether there's a line in the table that gives us a countermodel and in tableaux we look for a branch to do the job.
		And in propositional logic, this method works: since we only need to consider the interpretations (read: truth-values) of the finitely many  sentence letters in the formula, we can do this checking in a finite amount of time.
		The problem in first-order logic is that countermodels sometimes \emph{need to be} infinite.
		To see this, note that some sets of formulas have only infinite models: an example can be found in Exercise 9.7.11.
		If we want to show that something doesn't follow from such a set, we need an infinite countermodel.
		And we can't possibly search through all of those.

		Now that's a whole class of algorithms that won't work.
		But in order to show that really absolutely no algorithm can possibly work ever, we need to dig deeper.
		The reasoning that establishes \emph{that} is closer related to the paradoxes, like Russel's paradox, but we won't be able to go into that in this course (that's more for ``Logische Complexiteit'').

	\end{enumerate}

\section{Core Ideas}

\begin{itemize}

		\item Tableaux for first-order logic work in a way similar to propositional tableaux. Underlying is always the idea that an inference is valid iff the premises and negation of conclusion are jointly unsatisfiable.
		\item We have three tiers of tableau systems: simple tableaux, tableaux with identity, and tableaux with identity and functions. We successively add rules for those.

		\item There is also a concept of an associated model, which in first-order logic is a \emph{term model}, i.e. a model based on the syntactic strings as the objects in the domain.

		\item First-order tableaux can turn out to be infinite, in which case we need to \emph{prove} that they are open and complete.

		\item The existence of infinite tableaux destroys our hopes for an easy decidability proof.

		\item Alas, first-order logic is actually provably undecidable.

	\end{itemize}

\section{Self Study Questions}

\begin{enumerate}[\thesection.1]
  \item Which of the following statements are correct?
	\begin{enumerate}[(a)]
	  \item The tableau for an inference can only be infinite if the premises don't entail the conclusion.

	  \item It's possible to have a tableau for an inference where each branch contains both a statement and its negation, but the premises don't entail the conclusion.

	  \item You will always be able to make the tableau for a given inference in a finite amount of time.

	  \item You can have a tableau without any parameters on any branch.

	  \item In FOL, if you both a formula and its negation on a branch, then the branch is closed and no rules need to be applied anymore (even if further rules could be applied).

	  \item Parameters are treated like variables, i.e. we assign them a value only under a variable assignment and not as part of the model.

	  \item If you make the complete tableau for an inference and find that it's open, then you get a model that makes the premises true and the conclusion false.

	  \item When you make the tableau for an inference, you start by writing down the initial list, which consists of the premises and the conclusion and then you start applying the rules.

	  \item It's possible that the tableau for an inference whose conclusion is a valid formula of FOL is not closed.

	  \item If you find that all the branches of a tableau for an inference contain both a formula and its negation, then the premises entail the conclusion.
\end{enumerate}
\end{enumerate}

\section{Exercises}

	\begin{enumerate}[\thesection.1]

		\item By constructing appropriate tableaux, show the following:

			\begin{enumerate}[(a)]

				\item $\forall xP(x)\vdash \forall yP(y)$

				\item $\exists x\exists yS(x,y)\vdash \exists y\exists xS(x,y)$

				\item $\neg \exists xP(x)\vdash \forall x(P(x)\to Q(x))$

				\item $[h]$ $\forall xP(x)\vdash \forall x(Q(x)\to P(x)\lor R(x))$

			\end{enumerate}

			\item Construct tableaux to check the following. If the tableau does not close, construct a counter-model from the open branch and check that it works. If the tableau is infinite, see if you can find a simple finite counter-model by trial and error.

				\begin{enumerate}[(a)]

					\item $\forall x(P(x)\to Q(x)), \exists x\neg P(x)\vdash \forall x\neg Q(x)$

					\item $\forall xP(x)\to \forall yQ(y)\vdash \forall x(P(x)\to \forall yQ(y))$

					\item $[h]$ $\exists x(P(x)\to \forall yQ(y))\vdash \exists xP(x)\to \forall yQ(y)$

					\item $[h]$ $\vdash \forall x\exists yS(x,y)\to \exists xS(x,x)$

					\item $\exists x\neg\exists yS(x,y)\vdash \exists x\forall yS(x,y)$

				\end{enumerate}

			\item The tableaux for the following set of formulas is infinite  \[\{\forall x\forall y(f(x)=f(y)\to x=y),  \forall xf(x)\neq x, \exists x\neg\exists yf(y)=x\}.\] Begin the tableaux construction, prove that the tableau is open, and determine the associated model.

			\item Use the tableau method to find models in which the following formulas are false:

			\begin{enumerate}[(a)]

				\item $\exists x\exists y(P(x)\land P(y)\land x\neq y)$

				\item $\forall x\forall y\forall z(P(x)\land P(y)\land P(z)\to x=y\lor x=z\lor y=z)$

				\item $\exists x\exists y(P(x)\land P(y)\land \forall z(P(z)\to x=z\lor y=z))$

			\end{enumerate}

			\item Show the following facts using tableaux with identity:

			\begin{enumerate}[(a)]

				\item $\vdash \forall x\forall y(x=y\to y=x)$

				\item $\exists x(x=a\land P(x))\vdash P(a)$

				\item $P(a)\vdash \forall x(x=a\to P(x))$

				\item $[h]$ $\exists x(P(x)\land \forall y(P(y)\to x=y))\vdash \forall x\forall y(P(x)\land P(y)\to x=y)$

				\item $\vdash \exists x(\exists yP(y)\to P(x))$

			\end{enumerate}

			\item $[h, \nosym]$ It's not possible to write an algorithm that determines whether a formula is \emph{in}valid, that is false in some model, after a finite amount of time. Why?

			\emph{Hardcore version} (Not homework): It's not even possible to find such an algorithm for \emph{contingency}, that is to determine whether a formula is true in some models and false in others. Why?

			\item Prove Lemma 10.4.4.

	\end{enumerate}

\vfill

\hfill \rotatebox[origin=c]{180}{
  \fbox{
	\begin{minipage}{0.5\linewidth}

	  \subsection*{Self Study Solutions}

	  \begin{enumerate}

		\item[10.7.1] (a, d, e, g, j)

	  \end{enumerate}

	\end{minipage}}}

%%% Local Variables:
%%% mode: latex
%%% TeX-master: "../../logic.tex"
%%% End:


%% Template for ENG 401 reports
%% by Robin Turner
%% Adapted from the IEEE peer review template

%
% note that the "draftcls" or "draftclsnofoot", not "draft", option
% should be used if it is desired that the figures are to be displayed in
% draft mode.

% \documentclass[peerreview,onecolumn]{IEEEtran}
\documentclass[peerreview,compsoc,onecolumn]{IEEEtran}
\usepackage[noadjust]{cite} % Tidies up citation numbers.
\usepackage{url} % Provides better formatting of URLs.
\usepackage{booktabs} % Allows the use of \toprule, \midrule and \bottomrule in tables for horizontal lines
\usepackage{graphicx}
\usepackage{hyperref}
\usepackage{bm}
\usepackage{amsmath}
\usepackage{amssymb}
\usepackage[noend]{algpseudocode}
\usepackage{algorithm}
\usepackage{enumitem}
\usepackage{tabularx}
\usepackage{fancyhdr}
\usepackage[flushleft]{threeparttable}

\newcommand{\R}{\mathbb{R}}
\newcommand{\norm}[1]{\left\lVert#1\right\rVert}

\newenvironment{enumargin}[1]{\begin{enumerate}[leftmargin=#1\textwidth , rightmargin=#1\textwidth]}{\end{enumerate}}

\pagestyle{fancy}
\fancyhead[LE,RO]{\small DDogleg Technical Report: Nonlinear Optimization}

\begin{document}
%\begin{titlepage}
% paper title
% can use linebreaks \\ within to get better formatting as desired
\title{DDogleg Technical Report\\ Nonlinear Optimization\\{\Large Revision 2018-1}\\{\footnotesize DDogleg v0.15}}

% author names and affiliations

\author{Peter Abeles}
\date{September 30, 2018}

% make the title area
\maketitle
\tableofcontents
\listoffigures
\listoftables
%\end{titlepage}

\IEEEpeerreviewmaketitle
\begin{abstract}
DDogleg\footnote{DDogleg's name comes from the double dogleg Trust Region method, which is not included with DDogleg.} is a general purposed numerics library. This technical report is focused on describing algorithmic details of nonlinear unconstrained optimization routines found in DDogleg v0.15 and is intended to be used as a reference. A solid understanding of the basic theory of unconstrained optimization is assumed. Theoretical details will only be touched upon with citations for where to find more information. Best practices for implementation, tuning, benchmark results, and justifications for specific implementation decisions are all discussed. API details can be found online at \url{http://ddogleg.org}.

This document should be considered a living work in progress and its release is following the philosophy that it is better to release something than to wait forever for perfection. Corrections and other feedback are welcomed.
\end{abstract}

\section{Optimization Techniques}

\begin{table}[h]
\centering
\caption{Variables and Terminology}
\begin{tabular}{cl}
$x$ & Parameters being optimized. $x \in \R^N$ \\
$x_k$ & Value of parameters at iteration $k$ \\
$p_k$ & Iteration step, the difference between $x_{k+1}-x_k$ \\
$f(x)$ & Scalar cost function being optimized. $f \in \R$ \\
$f_k$ & Short hand for $f(x_k)$ \\
$g(x)$ & Gradient of $f(x)$. $g(x) \in \R^n$ \\
$g_k$ & Short hand for $g(x_k)$ \\
$B(x)$ & Hessian matrix or an approximation. $B(x) \in \R^{N \times N}$ \\
$B_k$ & Short hand for $B(x_k)$ \\
$H(x)$ & Inverse Hessian matrix or an approximation. $H(x) \in \R^{N \times N}$  \\
$H_k$ & Short hand for $H(x_k)$ \\
positive definite & Matrix $B$ is positive definite when $y^T B y > 0$ for all non-zero vectors $y$  \\
$\Delta_k$ & Trust Region size at step $k$. $\Delta_k \in \R^{+}$\\
MAX\_VALUE & The largest possible floating point value
\end{tabular}
\end{table}

This section provides overview of different numerical techniques provided in DDogleg for unconstrained optimization. Techniques described here can often be applied to different specific problems.

\subsection{Trust Region}

\input{trust_region.tex}

\subsection{Scaling}
\label{section:scaling}

Variable scaling can refer to several different parts of the non-linear optimization problem. Here we will discuss scaling of the input variables $x$ and scaling of the Hessian $B_k$ internally. Throughout the literature, correct scaling, in all of its forms, is emphasized as an essential task and that you are a bad person doomed to failure if you skip it.

In reality there are problems where it is essential, but in it does not always help and can sometimes hurt. How can it hurt? When correctly applied, scaling does not change the location of minimums, but will change the path towards a minimum \cite{dennis1996} and can change which variables are emphasized. Scaling should be treated like other tuning parameters and experimented with.

In general, when performing floating point arithmetic \cite{goldberg1991every}, it is advisable to avoid mixing very large (e.g. 1e12) numbers with very small (e.g. 1e-12) numbers to reduce round off errors. Thus it is desirable to have all numbers take on values close to one and have a standard deviation of one.

Another reason to scale variables is to reduce the emphasis on sensitive variables. A sensitive variable is one in which a small change in it's value results in a large error, e.g. $1/x^2$ when $x \approx 0$. This can cause the optimization routine to get stuck since any step causes a large error.

\subsubsection{Input Scaling}

The optimization cost functions should be designed so that the units of all the variables are on average one with a standard deviation of one. This scaling cannot be done by DDogleg automatically because it does not have knowledge of each variable's range.

Further Reading:
\begin{itemize}
\item Chapter 2.2 of \cite{numopt2006} contains an illustration of poor scaling.
\end{itemize}

TODO provide examples in this document.

\subsubsection{Hessian Scaling}

For Hessian Scaling, the Hessian matrix is re-scaled so that the diagonal elements are approximately one. We will discuss Hessian scaling in regards to Trust Region (and Levenberg-Marquardt) methods.

Hessian Scaling is done by applying a diagonal matrix $D$ with positive elements to the Trust Region sub-problem (\ref{eq:trust_region_subproblem}). Changing $p$ into its scalled scaled version $\tilde{p} = Dp$. The trust region is no longer a circle but an ellipse \cite{numopt2006}, resulting in this alternative trust region subproblem:
\begin{equation}
\begin{array}{lr}
\min\limits_{p\in \R^n} m_k(p) = f_k + g^T_k p + \frac{1}{2}p^T B_k p & s.t. \norm{Dp} \le \Delta_k
\end{array}
\end{equation}
As suggested in \cite{numopt2006} this is implemented internally in DDogleg by substituting $Dp$ for $p$, $D^{-1}g_k$ for $g_k$, and $D^{-1}B_k D^{-1}$ for $B_k$.

DDogleg can be configured to automatically compute and apply Hessian scaling at each iteration or to not apply Hessian scaling. Automatic scaling parameters are found using second derivatives $\frac{\partial^2 f}{\partial x^2_i}$ from in the Hessian's diagonal elements. Variables with larger second derivatives are more sensitive, thus their movement should be restricted more. The specific formula used in DDogleg is as follows:
\begin{equation}
D_k^{ii} = \max\left( d_{\bigtriangledown},\min\left( \sqrt{|B_k^{ii}|} , d_{\bigtriangleup} \right)\right)
\end{equation}
where $d_{\bigtriangledown}$ is the minimum allowed scaling value and $d_{\bigtriangleup}$ is the maximum. This approach can handle negative definite $B_k$ and has the desirable property \cite{dennis1996} that the diagonal elements in $\tilde{B}_k = D^{-1}B_k D^{-1}$ will typically be $\tilde{B}_k^{ii} \approx 1$, unless clamped or $B_k^{ii}$ is zero.

\subsection{Schur Complement}
For sparse systems, with a specific structure, the Schur Complement can be used to greatly reduce the computational cost. What would have taken hours or days to solve can be solved in seconds or minutes. Bundle Adjustment is one such problem \cite{triggs1999bundle}. The power of the Schur Complement comes from breaking the system into sub-problems. Since the matrix has a special structure, smaller block diagonal matrices are inverted and sparse fill in \cite{davis2006} is avoided, making it highly efficient.

Let $M \in \R^{N \times N}$ be an invertible square matrix which has been broken up into four submatrices. It can be factorized as follows:
\begin{equation}
M = \begin{bmatrix}
A & B \\
C & D
\end{bmatrix}
=
\begin{bmatrix}
1 & 0 \\
C A^{-1} & 1
\end{bmatrix}
\begin{bmatrix}
A & 0 \\
0 & \bar{D}
\end{bmatrix}
\begin{bmatrix}
1 & A^{-1}B \\
0 & 1
\end{bmatrix}
\end{equation}
It can then be shown that
\begin{equation}
\bar{D} = D - C A^{-1}B
\end{equation}
This is known as the Schur complement of the block A of matrix M. The Schur Complement of block D of matrix M can also be found:
\begin{equation}
\bar{A} = A - B D^{-1}C
\end{equation}
We will discuss the former but either can be used. Which one is preferred is simply the one which can be computed fastest and is dependent on the matrix's structure.

These relationships can then be used to solve the following system:
\begin{equation}
\begin{bmatrix}
A & B \\
C & D
\end{bmatrix}
\begin{bmatrix}
x_1 \\ x_2
\end{bmatrix}
=
\begin{bmatrix}
b_1 \\ b_2
\end{bmatrix}
\end{equation}

\begin{algorithm}{}
\caption{\label{alg:schur_complement}Schur Complement to solve a reduced system}
\begin{algorithmic}[1]
	\State $\bar{D} = D - C A^{-1} B$
	\State $\bar{b}_2 = b_2 - C A^{-1} b_1$
	\State $\bar{D} x_2 = \bar{b}_2$         \Comment{Reduced System}
	\State $A x_1 = b_1 - B x_2$
\end{algorithmic}
\end{algorithm}

For the least squares problem, the Schur Complement is applied to the Jacobian inner product:
\begin{equation}
J^T J =
\begin{bmatrix}
A & B \\
B^T & D
\end{bmatrix}
\end{equation}
Symmetry can be taken advantage of in matrix multiplication and when solving the system, which DDogleg does. The Schur Complement is implemented in DDogleg by having the user compute the Jacobian in two column matrices.
\begin{equation}
J = [ J_1 , J_2 ]
\end{equation}
The rest is handled automatically. See the \emph{SchurJacobian} interface and \emph{ExampleSchurComplementLeastSquares}.

\subsection{Linear Algebra}

Linear algebra and matrix operations are the workhorses that non-linear optimization is built upon. For Trust Region methods, linear solvers are extremely important. A linear solver solves equations of the form:
\begin{equation}
AB = y
\end{equation}
where $A \in \R^{M \times N}$, $B \in \R^N$ is unknown, and $y \in \R^M$. Solving for $B$ is the most expensive operation, potential source of numerical errors, and often the cause of fatal exceptions.

A singular matrix is one in which there is no unique solution to $B$. This can happen when the search hits a region with zero slope over some of the parameters. A slope of zero indicates that changing the parameter does not affect the cost function's value. Not all linear methods can handle this situation, in fact most cannot. Nearly singular systems are a also problem and some solvers are more sensitive than others.

Dense solvers tend to be very robust and typically have built in support to minimize overflow. There are many tools that dense solvers can use to mitigate singular and nearly singular systems. For example, they can dynamically change the order in which they decompose the matrix by pivoting (e.g. LUP and QRP). Methods exist which can even decompose and solve singular systems, (e.g. QRP and SVD). Default solvers in DDogleg attempt to strike a balance between speed and robustness. Thus the default will be Choleksy or QR, but if a request for a robust solver is made then QRP might be used instead. See Table \ref{results:initial_region} for a fairly dramatic example of how changing the solver can improve performance.

Sparse solvers are another story. While by no means new, they are a younger field and orders of magnitude more complex to implement. An example of this is Cholesky decomposition. A minimal dense implementation can be done in around 10 lines of code. A direct sparse equivalent is measured in hundreds of lines of code. Automatic scaling is often omitted in the sparse case making sparse solvers more prone to overflow. Pivoting is difficult for sparse systems because the decomposed structure needs to be known in advance. For the reasons just mentioned, when dealing with large sparse systems, more emphasis is placed on massaging data prior to applying a linear solver.

Fortunately, for a user of DDogleg, almost all of this complexity is hidden from you. For advanced users there is still the option to choose the solver. Potentially enabling you to solve otherwise unsolvable singular/degenerate systems. Any of the solvers in Efficicient Java Matrix Library (EJML) \cite{ejml2018} can be used in DDogleg. Solvers from other libraries can be used too, if you wrap them in the appropriate interface.

If you wish to learn more about the computational side of linear algebra then ``Fundamentals of Matrix Computations'' \cite{watkins2010} and ``Direct Methods for Sparse Linear Systems'' \cite{davis2006} are recommended for dense and sparse systems, respectively.

\section{Unconstrained Minimization}

\begin{table}[h]
\centering
\caption{\label{definitions:UM}Definitions and API for Unconstrained Minimization}
\begin{tabular}{cl}
\textit{FunctionNtoS} & Interface for function $f(x)$ \\
\textit{FunctionNtoN} & Interface for gradient $g(x)$ \\
& Can be computed numerically \\
\textit{UnconstrainedMinimization} & Interface for unconstrained minimization
\end{tabular}
\end{table}

\begin{table}[h]
\caption{\label{summary:UM}Summary of Unconstrained Minimization Methods.}
\centering
\begin{tabular}{lcccccc}
Method & Iteration & Convergence & Singular & Negative-Definite & Dense & Sparse \\[1ex]
\hline
Quasi-Newton BFGS        & $O(N^2)$ & Super Linear & Yes & Yes & Yes &  \rule{0pt}{2.6ex} \\
Trust Region BFGS Cauchy & $O(N^2)$ & Linear       & Yes & Yes & Yes & Yes  \\
Trust Region BFGS Dogleg & $O(N^2)$ & Super Linear & [1] & [1] & Yes & Yes  \\[1ex]
\hline
\multicolumn{6}{l}{
\begin{minipage}{0.6\textwidth}
\centering
\vspace{2mm}
\begin{itemize}[leftmargin=*]
\item \emph{Iteration}: Runtime complexity of update step. $N$ is number of parameters.
\item \emph{Convergence}: how fast it converged.
\item \emph{Singular}: indicates that it can process singular systems.
\item \emph{Negative-Definite}: indicate that it can process negative definite systems
\item \emph{Dense} and \emph{Sparse}: indicate that dense and/or sparse matrices can be processed.
\item {[1]} Switches to Cauchy in this situation.
\end{itemize}
\end{minipage}
 }
\end{tabular}
\end{table}

Unconstrained minimization seeks to find a set of parameters which minimizes a function, e.g.:
\begin{equation}
\min\limits_{x \in \R^N} f(x)
\end{equation}
where $x$ is an $N$-dimensional vector and $f : \R^N \Rightarrow \R $ is a function which outputs a scalar. A global minimum $x^*$ is a minimum such that $f(x^*) \le f(x)$ for all $x$. Local minimums are ones where $f(x^*) \le f(x)$ for all $x \in \mathcal{N}$, where $\mathcal{N}$ is bounded set of subset of $\R^N$. For most non-linear problems the best that can be done is to find a local minimum. A good introduction to the theory on this subject can be found in \cite{numopt2006}.

In DDogleg, solutions to this problem are found using use the gradient and Hessian. Convergence is found by examining the function's rate of change and the gradient, Section \ref{sec:unmin_convergence}. Computing the Hessian is often tedious and computationally expensive so iterative approximations of the Hessian are used, Section \ref{sec:hessian_approx}. The remaining sections discuss specific implementation details of applying general purpose algorithms to this problem.

\subsection{Convergence Test}
\label{sec:unmin_convergence}

All unconstrained minimization algorithms in DDogleg use the same convergence tests. F-Test checks the function's value to see if it has converged. G-Test checks the gradient to see if it zero and is at a local minima. To disable a test assign it a value less than zero.

\begin{center}
\begin{tabular}{lc}
F-Test & $ftol \cdot f(x)  \leq f(x) - f(x+p)$ \\
G-Test & $gtol \leq \norm{g(x)}_\infty$
\end{tabular}
\end{center}

\subsection{Line Search}

Line Search methods are iterative methods where at each iteration they seek to find a step length $\alpha_k$ which provides significant decrease in the cost along the search direction $p_k$ when starting at $x_k$. This can be summarized as:
\begin{eqnarray}
x_{k+1} & = & x_k + \alpha_k p_k \\
f_{k+1} & < & \beta f_k
\end{eqnarray}
where $\beta$ is some how defined to describe the meaning of significant.

In addition to significant decrease, curvature conditions also need to be meet. The strong Wolfe condition is used in some line search algorithms to decide if sufficient decrease and curvature conditions have been meet:
\begin{eqnarray}
f(x_k + \alpha_k p_k) &\le& f(x_k) + c_1 \alpha_k \Delta f^T_k p_k \\
|\Delta f(x_k + \alpha_k p_k)^T p_k| &\le& c_2 |\Delta f_k^T p_k|
\end{eqnarray}
where $0 < c_1 < c_2 < 1$.

In DDogleg, two line search methods are provided Fletcher86 \cite{Fletcher1986} and More94 \cite{More1994}. Both of which explicitly meet the Wolfe condition when selecting a step length. More94 has shown better convergence and is the default option. The implementation of More94 contained in DDogleg is a port of csrch function in MINPACK-2 \cite{MINPACK}.

\subsection{Quasi-Newton}

Quasi-Newton is a description of a general framework where at each iteration an approximation to a full Newton iteration is performed. In DDogleg, Quasi-Newton is done by solving for the search direction $p_k$ using an approximation to the inverse Hessian $B_k^{-1}$ followed by the line search method of your choice which meets the Wolfe condition.
\begin{equation}
p_k = -B_k^{-1}\delta f_k
\end{equation}

For computational efficiency and robustness, the inverse $H_k = B_k^{-1}$ is estimated directly using BFGS. By estimating the inverse matrix we avoid the requirement that $B_k$ be positive definite and a costly $O(N^3)$ matrix decomposition and replace it with an inexpensive $O(N^2)$ update instead.

\subsection{Hessian Approximation}
\label{sec:hessian_approx}

Exact methods of calculating the Hessian can be difficult to derive and expensive to compute. Algorithms which utilize exact Hessians have faster convergence but this is often offset by additional computational cost \cite{numopt2006}. DDogleg uses gradient based methods for estimating the Hessian. DFP \cite{davidonDFP} to estimate the Hessian and BFGS (Broyden-Fletcher-Goldfarb-Shanno) \cite{fletcher1987,numopt2006}\footnote{A quick search failed to assertain the first paper which fully described BFGS. What appears to be a precursor is discussed in \cite{fletcher1987} and \cite{numopt2006} fully describes the method but provides no citations.} to estimate the inverse hessian.

\begin{flalign}
\text{DFP} && B_{k+1} &= (I- \rho_k \gamma_k s_k^T) B_k (I - \rho_k s_k \gamma_k^T) + \rho_k \gamma_k \gamma_k^T && \\
\text{BFGS} && H_{k+1} &= H_k - \frac{H_k \gamma_k \gamma_k^T H_k }{\gamma_k^T H_k \gamma y_k} + \frac{s_k s_k^T}{y_k^T s_k} &&
\end{flalign}
\begin{equation*}
\rho_k=\frac{1}{\gamma_k^T s_k}
\end{equation*}
where $H_k = B_k^{-1}$, $s_k = x_{k+1}-x_k$, and $y_k = \nabla f_{k+1} - \nabla f_k$.

DDogleg does not explicitly provide support for using an exact Hessian. If you wish to use an exact Hessian this can be accomplished with a bit of coding by extending base classes in DDogleg. Search code for where BFGS is being used, extend that class, and override the function where the Hessian is estimated. For example, \textit{UnconMinTrustRegionBFGS} can be used to create your own exact Hessian unconstrained minimization trust region implementation.

\subsection{Trust Region}
Trust Region methods can be directly applied to unconstrained minimization without any change in their framework. Specific implementation details are listed below:
\begin{enumargin}{0.2}
    \item The Hessian is initialized with an identity matrix.
	\item The Hessian and inverse are iteratively approximated using DFP and BFGS.
	\item The Hessian is only updated when the Wolfe condition is meet
	\item Dogleg-BFGS avoids $O(N^3)$ matrix decomposition by computing the inverse Hessian directly with BFGS in $O(N^2)$ time.
\end{enumargin}

Future Work:
\begin{enumargin}{0.2}
	\item Remove the need to compute $B_k$ and $H_k$ by directly computing the Cholesky factors of $B_k$.
\end{enumargin}

\section{Unconstrained Least-Squares}
\begin{table*}[h]
\caption{\label{definitions:UNLS}Definitions and API for Unconstrained Nonlinear Least-Squares}
\centering
\begin{tabular}{cl}
$x$ & Parameter vector which is being optimized and has $n$ elements. $x \in \R^N$ \\
$f(x)$ & Scalar error function being optimized. $f(x) \ge 0$ \\
$f_k$ & Short hand for $f(x_k)$ \\
$F(x)$ & Residual function from $\R^N \rightarrow \R^M$ \\
$J(x)$ & Jacobian of residual function. $J(x) \in \R^{N \times M}$\\
$B(x)$ & Hessian approximation and is set to $B=J^TJ \in \R^{N \times N}$ \\
$g(x)$ & Gradient of $f(x)$, which is $J(x)^T  F(x) \in \R^{N}$ \\
$g_k$ & Short hand for $g(x_k)$ \\
$\alpha$ & Mixing coefficent for Levenberg's and Marquardt's equations \\
\textit{FunctionNtoM} & Interface for residuals $F(x) \in \R^M$ \\
\textit{FunctionNtoMxN} & Interface for Jacobian $J(x) \in \R^{M,N}$ \\
& Can be computed numerically \\
\textit{UnconstrainedLeastSquares} & High level interface for this unconstrained least squares \\
\textit{UnconstrainedLeastSquaresSchur} & Least-Squares using Schur Complement
\end{tabular}
\end{table*}

\begin{table}[h]
\caption{\label{summary:UM}Summary of Unconstrained Least-Squares Methods.}
\centering
\begin{tabular}{lcccccc}
Method & Iteration & Convergence & Singular & Dense & Sparse & Schur \\[1ex]
\hline
Trust Region LS Cauchy & $O(N^3)$ & Linear       & Yes  & Yes  & Yes & Yes \rule{0pt}{2.6ex}  \\
Trust Region LS Dogleg & $O(N^3)$ & Super Linear & [1]  & Yes  & Yes & Yes \\
Levenberg-Marquardt    & $O(N^3)$ & Super Linear & [2]  & Yes  & Yes & Yes \\[1ex]
\multicolumn{6}{l}{
\begin{minipage}{0.6\textwidth}
\centering
\vspace{2mm}
\begin{itemize}[leftmargin=*]
\item \emph{Iteration}: Runtime complexity of update step. $N$ is number of parameters.
\item \emph{Convergence}: how fast it converged.
\item \emph{Singular}: indicates that it can process singular systems.
\item \emph{Negative-Definite}: indicate that it can process negative definite systems
\item \emph{Dense} and \emph{Sparse}: indicate that dense and/or sparse matrices can be processed.
\item \emph{Schur}: If a variant is available that uses the Schur Complement
\item {[1]} Switches to Cauchy in this situation.
\item {[2]} Depends on solver and mixing coefficient, but in most configurations it can handle singular systems.
\end{itemize}
\end{minipage}
 }
\end{tabular}
\end{table}

Unconstrained Least-Squares is a special case of Unconstrained Minimization. It refers to a problem where the function being optimized has the form
\begin{equation}
\label{eq:residual_error}
\min\limits_{x} f(x)=\frac{1}{2}\sum^m_{j=1} r^2_j(x)
\end{equation}
where $r_j(x)$ is a scalar function $j$  which outputs the residual (predicted value subtracted the observed value) error. By definition $f(x) \ge 0$. Matrix notation can also be used to defined (\ref{eq:residual_error}):
\begin{equation}
\min\limits_{x} f(x) =\frac{1}{2} F(x)^T F(x) = \frac{1}{2} \norm{F(x)}^2_2
\end{equation}
where $F(x) = [ r_1(x) , r_2(x) , \cdots , r_m(x) ]^T$. Then the Jacobian is defined as:
\begin{eqnarray}
J(x) &=&  \left[ \begin{array}{c}\nabla r_1(x)^T \\ \nabla r_2(x)^T \\ \vdots \\ \nabla r_m(x)^T \end{array}\right] \\
\nabla r_j(x)^T &=& \left[ \frac{\partial r_j}{\partial x_1},\frac{\partial r_j}{\partial x_2}, \cdots , \frac{\partial r_j}{\partial x_n} \right]^T
\end{eqnarray}
and the Gradient as
\begin{eqnarray}
\nabla f(x) = g(x) &=& \sum^m_{j=1}r_j(x)\nabla r_j(x) \\
&=& J(x)^T F(x)
\end{eqnarray}

\subsection{Convergence Test}

The same convergence tests used in unconstrained minimization are used with least squares:
\begin{center}
\begin{tabular}{lc}
F-Test & $ftol \cdot f(x)  \leq f(x) - f(x+p)$ \\
G-Test & $gtol \leq \norm{g(x)}_\infty$ \\
\end{tabular}
\end{center}

\subsection{Levenberg-Marquardt}

Levenberg-Marquardt (LM) is a Trust Region based algorithm which was created before Trust Region had been formally been defined \cite{numopt2006,fletcher1987,dennis1996}. The main innovation proposed by Levenberg \cite{levenberg1944} is the dampening parameter $\lambda$.
\begin{equation}
\label{eq:levenberg}
(J_k^T J_k + \lambda I) p_k = -g_k
\end{equation}
The dampening parameter enables the solver to handle singular systems. Its value is automatically decreased when the quadratic model is accurate and increased when it is not accurate. Later on Marquardt \cite{marquardt1963} noted that as $\lambda$ increased information in $J_k^T J_k$ is used less, slowing convergence as it becomes a steepest descent search. Instead Marquardt proposed the following adjustment:
\begin{equation}
\label{eq:marquardt}
(J_k^T J_k + \lambda \mbox{diag}(J_k^T J_k)) p_k = -g_k
\end{equation}
This would result in larger steps along the direction with smaller gradient, avoiding slow convergence.

DDogleg's implementation (Algorithm \ref{alg:levenberg_marquardt}) is primarily based upon the description found in \cite{IMM2004} but with the ability to choose a mixture of Levenberg's and Marquardt's formulations. Mixing (\ref{eq:levenberg}) and (\ref{eq:marquardt}) is advantagous because it allows you to avoid the negatives of either approach. If a partial derivative is zero then Marquardt's forumation will produce a singular matrix. While Levenberg's forumation will always produce a positive-definite matrix as long as $\lambda$ is greater than zero. The amount of mixing is specified using $\alpha$. If $\alpha=1$ then (\ref{eq:levenberg}) is used while if $\alpha=0$ then (\ref{eq:marquardt}) is used. Any value between 0 and 1 will result in a mixture of the two equations.

The classes \emph{FactoryOptimization} and \emph{FactoryOptimizationSparse} provide easy to use functions for constructing specific implementations of Levenberg-Marquardt. As inputs they take in a \emph{ConfigLevenbergMarquardt} and a boolean flag called \emph{robust}. If the robust flag is set to true then a solver based on QR with column pivots is used and if false then it used Cholesky decomposition. The robust variant can handle degenerate matrices found in the Marquardt's formulation. DDogleg does not provide support for solving the least squares formation, i.e. $J_k p_k = -F_k$, due to the increase in computational cost and code complexity having no noticeable improvement in convergence in any situation the author is aware of.

Scaling is done using the same methods described in Section \ref{section:scaling}.

\begin{algorithm}{}
\caption{\label{alg:levenberg_marquardt}Levenberg-Marquardt}
\begin{algorithmic}[1]
	\State $k \gets 0$, $\nu \gets 2$
  	\State $B_k = J_k^T J_k$
	\While{$k < k_{\mbox{max}}$ and not $done$}
		\State Solve $\left(B_k + \lambda \left(\alpha I + (1-\alpha)\mbox{diag}(B_k) \right)\right) p_k = -g_k$ \Comment{LM Step}
		\State $\delta_f \gets f(x_k) - f(x_k + p_k)$ \Comment{Actual reduction in score}
		\State $\delta_m \gets m_k(x_k)-m_k(x_k + p_k) = -g^T_k p - \frac{1}{2}p^T J_k^T J_k p$ \Comment{Predicted reduction in score}
		\State $\nu \gets \delta_f / \delta_f$ \Comment{Score reduction ratio}
		\If{ $\delta_f \ge 0$} \Comment{Score get better?}
			\State $\lambda \gets \lambda \cdot \mbox{max}(1/3 , 1-(2\nu-1)^3)$
			\State $\nu = 2$
			\State $p_{k+1} \gets p_k$
			\State $done$ $\gets$ $\mbox{F-Test}$ or $\mbox{G-Test}$ \Comment{Convergence testing}
		\Else
			\State $\lambda \gets \nu \lambda$ \Comment{Emphasize the gradient more}
			\State $\nu = 2\nu$
		\EndIf
		\State $k \gets k + 1$
	\EndWhile
\end{algorithmic}
\end{algorithm}

\subsection{Trust Region}
 Everything previously discussed about Trust Region still applies in the Least Squares case with the following variables defined as:
\begin{eqnarray}
g_k &=& J^T_k F_k  \\
B_k &=& J_k^T J_k
\end{eqnarray}

\bibliographystyle{IEEEtran}
\bibliography{mybib}

\end{document}