\chapter{Timed Systems and Semantics}\label{chap:2}
\minitoc
\section{Timed Transition Systems}
Transition systems provide a general and convenient method for modeling
systems and have been used frequently to model the behavior of
software and hardware systems. They define graphs where nodes
represent the possible \emph{states} (potentially infinite) of the system, and edges model
\emph{transitions}, that is, state changes. A state encodes all the relevant
information at a certain instant, whereas a transition describes how the system
evolves between two states.

Nowadays, several variants of transition system formalisms have been
proposed. For instance, a labeled transition system is a transition system
where the set of transitions is labeled by \emph{actions}.
In this thesis, we use \emph{Timed Transition Systems} (TTS)
to explicitly model the effect of time passage (besides the actions)
on the states of the system. Formally, it is defined as follows:

\begin{definition}[Timed Transition System]\label{def:tts}
  A timed transition system is a tuple $\TTS$ such that $\mc{Q}$ is
  a set of states, $q_0\in\mc{Q}$ is the initial state, $\Sigma$ is a set of
  actions, $\mb{K}$ is a time domain and $\to\subseteq\mc{Q}\times
  (\Sigma\cup\mb{K})\times\mc{Q}$ is the transition relation.
\end{definition}
Consequently, we distinguish two types of transition:
\begin{itemize}
  \item \emph{action step} $\transit{\sigma}$ for $\sigma\in\Sigma$ and we write
    $q\transit{\sigma}q'$.
  \item \emph{time step} $\transit{d}$ for $d\in\mb{K}$ and we write $q\transit{d}q'$.
\end{itemize}
We write $q\transit{d,\sigma}q''$ if there exists $q'\in\mc{Q}$
such that $q\transit{d}q'\transit{\sigma}q''$. We say that $q'$ is
a time successor of $q$.

Given a TTS $\TTS$, a \emph{run} $\exec$ of $\tts$ (also called
\emph{execution sequence}), is a path that alternates action steps and
time steps, that is:
\begin{displaymath}
  \exec=s_0\sigma_0 s_1\sigma_1 s_2\cdots \text{ such that }
  s_i\in\mc{Q}, \  s_i\transit{\sigma_{i}}s_{i+1},\text{ and }
  i\in\integerpoz,\sigma_i\in\Sigma\cup\mb{K}
\end{displaymath}

We denote by $\texeci$ the total elapsed time until point $i$, that is,
$\sum_{j<i}\sigma_j$ such as $\sigma_j\in\mb{K}$. In the same way, $\texec$ represents
the total elapsed time during $\varrho$, and is defined to be the limit of $\texeci$
if the sequence converges and $\infty$ otherwise.
A run $\exec$ is said to be an \emph{initial run} if $s_0=q_0$.

A state $q\in\mc{Q}$ is called reachable if there exists an initial run
that leads to state $q$. We put $Reach(\tts)$ to denote the set of all
reachable states of $\tts$.
\subsection{Comparing Timed Transition Systems}
In this thesis, we use the concept of (bi)simulation~\cite{bsim}
in order to attest the similarity of timed transition systems.
\begin{definition}[Simulation]\label{def:sim}
  Given two TTS $\TTSbb{1}$ and $\TTSbb{2}$, a simulation relation from
  $\ttsb{1}$ to $\ttsb{2}$ is a binary relation $\mc{R}\subseteq\mc{Q}_1
  \times\mc{Q}_2$ such that:
  \begin{itemize}
    \item $\forall(q_1,q_2)\in\mc{R},\forall\sigma\in\Sigma,\
      q_1\transitb{\sigma}{1}q_1'\Rightarrow\exists q'_2\in\mc{Q}_2
      \text{ such that } q_2\transitb{\sigma}{2}q_2'\wedge
      (q_1',q_2')\in\mc{R}$
    \item $\forall(q_1,q_2)\in\mc{R},\forall d\in\mb{K},\
      q_1\transitb{d}{1}q_1'\Rightarrow\exists q'_2\in\mc{Q}_2
      \text{ such that } q_2\transitb{d}{2}q_2'\wedge
      (q_1',q_2')\in\mc{R}$
  \end{itemize}
\end{definition}
  $\ttsb{2}$ simulates $\ttsb{1}$, denoted by $\ttsb{1}\simu{\mc{R}}\ttsb{2}$
  means that $\ttsb{2}$ can do everything $\ttsb{1}$ does. Notice that if
  $\ttsb{1}\simu{\mc{R}}\ttsb{2}$ and $\ttsb{2}\simu{\mc{R}}\ttsb{1}$,
  we say that $\ttsb{1}$ and $\ttsb{2}$ are bisimilar, denoted by
  $\ttsb{1}\eqv{\mc{R}}\ttsb{2}$.

In some cases, this notion of simulation is refined in order to consider only
a part of a system behavior. This is usually the case when a system
performs \emph{internal} (or \emph{silent}) actions not visible by external
observers. This variant of simulation is called \emph{weak simulation}.

\begin{definition}[Weak Simulation]\label{def:wsim}
  Given two TTS $\TTSbw{1}$ and $\TTSbw{2}$, where $\tau$ actions
  represent silent (unobservable) actions, a weak simulation relation from
  $\ttsb{1}$ to $\ttsb{2}$, denoted $\ttsb{1}\simuw{\mc{R}}\ttsb{2}$,
  is a binary relation $\mc{R}\subseteq\mc{Q}_1
  \times\mc{Q}_2$ such that:
  \begin{itemize}
    \item $\forall(q_1,q_2)\in\mc{R},\
      q_1\transitb{\tau}{1}q_1'\Rightarrow\exists q'_2\in\mc{Q}_2
      \text{ such that } q_2\transitb{\tau^*}{2}q_2'\wedge
      (q_1',q_2')\in\mc{R}$
    \item $\forall(q_1,q_2)\in\mc{R},\forall\sigma\in\Sigma,\
      q_1\transitb{\sigma}{1}q_1'\Rightarrow\exists q'_2\in\mc{Q}_2
      \text{ such that } q_2\transitb{\tau^*\sigma\tau^*}{2}q_2'\wedge
      (q_1',q_2')\in\mc{R}$
    \item $\forall(q_1,q_2)\in\mc{R},\forall d\in\mb{K},\
      q_1\transitb{d}{1}q_1'\Rightarrow\exists q'_2\in\mc{Q}_2
      \text{ such that } q_2\transitb{\tau^*d\tau^*}{2}q_2'\wedge
      (q_1',q_2')\in\mc{R}$
  \end{itemize}
\end{definition}
  We say that $\ttsb{1}$ and $\ttsb{2}$ are observationally equivalent,
  denoted $\ttsb{1}\eqvw{\mc{R}}\ttsb{2}$ , if it exists a weak simulation
  from $\ttsb{1}$ to $\ttsb{2}$ and vice versa.

  In chapter~\ref{chap:6}, we will introduce an even weaker notion of simulation
  that characterizes the degree of closeness (in term of delays)
  between two timed systems.

\subsection{Reactive Timed Systems}
Reactive systems are supposed to execute forever, that is,
they are supposed to act infinitely often. We refer to this characteristic as
the \emph{requirement of progress}~\cite{progress}.
Particularly, a timed system evolves either through an action step or
by letting the time pass (time step).
This evolution imposes thus two requirements of progress:
discrete progress (resp. time progress) meaning that a timed system
should be able to perform action steps (resp. time steps) infinitely
often. In the physical world however, no matter how fast a system can
evolve, it cannot be infinitely fast. This induces the following constraints
on the progress of time:
\begin{enumerate}
  \item Only a finite number of actions can happen in a finite amount of time
  \item Only a bounded number of actions can happen in zero time
\end{enumerate}

\subsubsection{Time Progress (Zeno runs \& Timelocks)}
We distinguish two types of anomalies that infringe the time progress in
a timed system namely \emph{zeno} runs and \emph{timelocks}.
A run $\exec$ is called \emph{zeno} if it is
an infinite run and if $\texec\neq\infty$. Such a run transgresses the
first point of the time progress presented above.
Timelocks are states from which all infinite runs starting from these states
are zeno.
\subsubsection{Discrete Progress (Deadlocks)}
States violating the discrete progress are called \emph{deadlock} states.
Formally, a state is said to be deadlock if no action can be executed from
that state nor from any of its time successors.

Any model of a reactive timed system should properly capture the behavior
of the latter. Particularly, the corresponding model must react infinitely often,
that is, it must not block time or execute an unbounded number of actions in zero
time. In that sense, we can say that deadlocks and timelocks are modeling errors
that needs to be cleared, either during the modeling process (which is tedious
for large scale systems) or by providing verification methods that guarantee
their absence.

\section{Timed Systems Syntax and Semantics}\label{sec:2.2}
\subsection*{Clocks}
In order to represent and measure the dense time domain, we rely on positive
real valued variables, also known as \emph{clocks}. Clocks are
positive real variables increasing synchronously (with the same rate) in a
given system. They are used to express timing constraints to impose
a certain dynamics on the execution of a timed system.

Given a finite set of clocks $\mc{X}$, we define the \emph{valuation} function
$\val:\mc{X}\to\realpoz$ assigning to each clock $x$ a positive real value
$\val(x)$. We put $\Val$ to denote the set of all valuations.
For a valuation $\val\in\Val$ and $d\in\realpoz$, $\val+d$ is the valuation
satisfying $(\val+d)(x)=\val(x)+d$, while for a subset of clocks
$r\subseteq\mc{X}$, $\val[r]$ is the valuation obtained from $\val$ by
resetting clocks of $r$, that is, $\val[r](x)=0$ for $x\in r$ and
$\val[r](x)=\val(x)$ otherwise. We write {\bf 0} for the valuation
that assigns 0 to every clock.

An \emph{atomic clock constraint} is an expression of the form:
\begin{displaymath}
  c:=\true \ | \ x\#k \ |\ x-y\#k \
\end{displaymath}
where $x$ and $y$ are clocks in $\mc{X}$, $\#\in\{<,\le,=,\ge,>\}$,
and $k\in\integer$. A clock constraint is a conjunction of atomic clock
constraint, that is:
\begin{equation}\label{eq:cc}
  c:=\true \ | \ x\#k \ |\ x-y\#k \ | \ c_1\wedge c_2
\end{equation}
with $c_1$ and $c_2$ being atomic clock constraints. We write $\mc{C(X)}$
for the set of clock constraints over $\mc{X}$.
Given a clock constraint $c$ and a valuation $\val$, we say that $\val$
satisfies $c$, denoted $\val\models c$, if all constraints are satisfied
when each $x\in\mc{X}$ is replaced by $\val(x)$.
We also consider the classical \emph{backward}
and \emph{forward} operators on
clock constraints:
\begin{align*}
  &\text{ \bf Backward } :& \val\models\backward c \ \Leftrightarrow \
  \exists d\in\realpoz.\ (\val+d)\models c\\
  &\text{ \bf Forward } \hspace{3.25mm}:& \val\models\forward c \ \Leftrightarrow \
  \exists d\in\realpoz.\ (\val-d)\models c\\
\end{align*}

Additionally, we also use another variant of the backward and forward operators considering
lower bounds $l\in\integerpoz$ and upper bounds $u\in\integerpoz\cup
\{+\infty\}$:

\begin{align*}
  \val\models\backwardp{l}{u} c \ \Leftrightarrow \
  \exists d\in\realpoz, l\le d\le u. \ (\val+d)\models c\\
  \val\models\forwardp{l}{u} c \ \Leftrightarrow \
  \exists d\in\realpoz, l\le d\le u. \ (\val-d)\models c\\
\end{align*}

\subsection{Timed Components Syntax and Semantics}
In this thesis, components are timed automata and systems are compositions of timed automata
with respect to multiparty interactions. The timed automata we use are essentially the ones from
~\cite{AlurD94}, however, slightly adapted to embrace a uniform notation throughout the dissertation.
\begin{definition}[Timed Component]\label{def:tc}
  A component is a tuple $B=(\Loc,\loc_0,\X,\A,\E,\I)$, where:
  \begin{itemize}
    \item $\Loc$ is a finite set of locations, with $\loc_0\in\Loc$ is the
      initial location,
    \item $\mc{X}$ is a finite set of clocks,
    \item $\mc{A}$ is a finite set of actions
    \item $\mc{E}\subseteq\Loc\times(\mc{A}\times\mc{C(X)}\times2^{\mc{X}})
      \times\Loc$ is a finite set of transitions labeled with an action,
      a clock constraint (guard), and a set of clocks to be reset,
    \item $\mc{I}:\Loc\to\mc{C(X)}$ is the function assigning an invariant
      to each location. Notice that invariants are restricted to conjunction
      of atomic clock constraints of the form $x\le k$.
  \end{itemize}
\end{definition}

Throughout this thesis, we consider
\emph{deterministic} timed components, that is, at a given location
$\loc$ and for a given action $a$, there is up to one outgoing transition
from $\loc$ labeled by a.
A transition $e=(\loc,(a,g,r),\loc')\in\mc{E}$ is also denoted by
$\loc\transit{a,g,r}\loc'$. We write $\source(e)$, $\target(e)$, $\action(e)$, $\guard(e)$
and $\reset(e)$ for $\loc$, $\loc'$, $a$, $g$ and $r$, respectively.
We also denote by $\Phi(a,\loc)$ the guard
of the transition labeled by $a$ and outgoing from $\loc$
if it exists, and $\false$ otherwise. It is formalized as follows:
\[\Phi(a,\loc)=\begin{cases}
  g,& \text{ if } \exists e=(\loc,a,g,r,\loc')\in\mc{E}  \\
  \false,& otherwise
\end{cases}\]

\begin{example}
  Figure~\ref{fig:tc} depicts a timed component $B$ where locations
  are represented by circles and transitions are the directed arrows
  from a location to another. The initial location ($\loc_0$ here) is
  represented by a double circle. The component
  $B=(\Loc,\loc_0,\mc{X},\mc{A},\mc{E},\mc{I})$ is defined such that:
  \begin{itemize}
    \item $\Loc=\{\loc_0,\loc_1\}$,
    \item $\mc{X}=\{x\}$,
    \item $\mc{A}=\{a,b\}$,
    \item $\mc{E}=\{e_1,e_2\}$ where
      \begin{itemize}
        \item $e_1=(\loc_0,a,2\le x\le4,\emptyset,\loc_1)$
        \item $e_2=(\loc_1,b,\true,\{x\},\loc_0)$
      \end{itemize}
    \item $\mc{I}$ assigns the following invariants for locations:
      $\Inv{\loc_0}=x\le4$ and $\Inv{\loc_1}=\true$
  \end{itemize}
  Notice that when a clock constraint (respectively an invariant is not
  shown on a transition (respectively location) it is interpreted as $\true$.
  This is the case for transition $e_2$ and location $\loc_2$.
\end{example}
\input{Figures/tc.tex}

\begin{definition}[Standard Semantics]\label{def:std_sem}
The semantics of a timed component $B=(\Loc,\loc_0,\X,\A,\E,\I)$ is given by the timed transition
  system $\TTSs$ where:
  \begin{itemize}
    \item $\mc{Q}=\Loc\times\Val$ denotes the states
      of $B$ with $q_0=(\loc_0,0)$ being the initial state,
    \item $\to\subseteq\mc{Q}\times(\mc{A}\cup\realpos)\times\mc{Q}$
    denotes the set of transitions between states according to the rules:
  \begin{itemize}
    \item $(\loc,\val)\transit{a}(\loc',\val[r])$ if $\loc\transit{a,g,r}
      \loc'$, $\val\models g$, and $\val[r]\models\Inv{\loc'}$
      (action step)
    \item $(\loc,\val)\transit{d}(\loc,\val+d)$ if $\forall d'\in[0,d]$,
      $\val+d'\models \Inv{\loc}$ (time step)
  \end{itemize}
  \end{itemize}
\end{definition}
Notice that since the invariants are restricted to conjunctions of upper bound
atomic constraints, the time step can be simplified to:
\begin{displaymath}
  (\loc,\val)\transit{d}(\loc,\val+d)\text{ if }\val+d\models \Inv{\loc}
\end{displaymath}

In this thesis, we always assume components with $\emph{well formed}$
guards, that is, for a transition $\loc\transit{a,g,r}\loc'$,
$\big(\val\models g\big)\Rightarrow\big(\val\models\Inv{\loc}\wedge\val[r]\models
\Inv{\loc'}\big)$ for any $\val\in\Val$. The rule on action step becomes then:
\begin{displaymath}
  (\loc,\val)\transit{a}(\loc',\val[r])\text{ if } \loc\transit{a,g,r}
      \loc'\text{ and } \val\models g
\end{displaymath}
We define the predicate $\enabled{a}$ characterizing states $(\loc,\val)$
from which an action $a$ is enabled, that is, such that $(\loc,\val)
\transit{a}(\loc',\val')$. It is formalized as follows:
\begin{displaymath}
  \enabled{a}=\bigvee_{\loc\in\Loc}\al{\loc}\wedge\Phi(a,\loc)
\end{displaymath}
where $\al{\loc}$ is $\true$ on states whose location is $\loc$.
In the same way, we define the predicates $\enabledbackward{a}$,
$\enabledbackwardb{a}{l}{u}$, $\enabledforward{a}$ and $\enabledforwardb{a}{l}{u}$
describing, respectively, states from which an action $a$ can be executed after some time step,
some bounded time step, states that are time successors or bounded time sucessors of states
satisfying $\enabled{a}$ (see Figure~\ref{fig:zones}).
These predicates can be formally written as follows:
\begin{align*}
  &\enabledbackward{a}\hspace{1.8mm}=\bigvee_{\loc\in\Loc}\al{\loc}\wedge
  \backward\Phi(a,\loc)  \\
  &\enabledbackwardb{a}{l}{u}=\bigvee_{\loc\in\Loc}\al{\loc}\wedge
  \backwardp{l}{u}\Phi(a,\loc)\\
  &\enabledforward{a}\hspace{1.9mm}=\bigvee_{\loc\in\Loc}\al{\loc}\wedge
  \forward\Phi(a,\loc)\\
  &\enabledforwardb{a}{l}{u}\hspace{1.9mm}=\bigvee_{\loc\in\Loc}\al{\loc}\wedge
  \forwardp{l}{u}\Phi(a,\loc)
\end{align*}
\input{Figures/zone.tex}
A state $(\loc,\val)$ is said \emph{urgent} if time cannot progress from
this state, that is, $\nexists d\in\realpos$ such that $(\loc,\val)\transit{d}
(\loc,\val+d)$. Urgent states of a component B are characterized by the predicate:
\begin{equation}\label{eq:urg}
  \urgent(B)=\bigvee_{\loc\in\Loc}\al{\loc}\wedge urg(\loc)
\end{equation}
where $urg(\loc)$ is a clock constraint characterizing the valuations from
which time cannot progress with respect to the location invariant
$\Inv{\loc}$, that is, assuming that
$\Inv{\loc}=\bigwedge_{i=1}^m x_i\le k_i$ then
$urg(\loc)=\bigvee_{i=1}^m x_i\ge k_i$. Notice that due to well formed
guards, an urgent reachable state satisfies also Expression~\ref{eq:urg} if inequalities
$x_i\ge k_i$ on clocks are replaced by equalities $x_i=k_i$ in the expression
of $urg(\loc)$.

\begin{remark}
  When used in predicate definition, clock constraints are straightforwardly
  applied to clock valuations of states and thus interpreted as $\true$
  or $\false$.
\end{remark}

\begin{definition}[Strongly Non-Zeno Timed Component]\label{def:snz}
  Given a timed component $B$, a \emph{structural loop} of $B$ is a sequence
  of distinct transition $e_1\cdots e_m$ such that $\forall i\in\{1,\cdots,m
  \},\target(e_i)= \source(e_{i+1})$ (the addition $i+1$ is modulo $m$).
  $B$ is called \emph{strongly non-zeno}
  if for every structural loop there exists a clock $x$ and some $0\le (i,j)
  \le m$ such that:
  \begin{itemize}
    \item $x$ is reset in step $i$, that is, $x\in\reset(e_i)$
    \item $x$ is bounded from below in step $j$, that is, $(x<1)\wedge\guard(e_j)
      =\false$
  \end{itemize}
\end{definition}
Intuitively, this definition implies that at least 1 time unit elapses
at each loop of $B$.

\begin{lemma}[\cite{progress}]\label{lm:snz}
  If $B$ is strongly non-zeno then every infinite run of $B$ is non-zeno
\end{lemma}

The following corollary is an immediate consequence of lemma~\ref{lm:snz}.
\begin{corollary}\label{cr:snz}
Given a timed component $B$, if B is strongly non-zeno then it is
  timelock free.
\end{corollary}

Corollary~\ref{cr:snz} highlights an interesting fact of strong non-zenoness.
It discharges from the trouble of checking time progress. In particular, checking
the progress of a timed system is reduced to checking its deadlock freedom.

\begin{definition}[Deadlocks]\label{def:dl}
  Given a timed component $B$. We say that a state $(\loc,\val)$ of $B$ is
  a \emph{deadlock} if and only if no action can be executed from this state
  or any of its time successors, that is:
  \begin{displaymath}
    \neg\Big(\exists a\in\mc{A}. \ (\loc,\val)\transit{a}(\loc',\val')\vee
    \exists d>0. \ (\loc,\val)\transit{d}(\loc,\val+d)\transit{a}(\loc',\val')\Big)
  \end{displaymath}
  Deadlock states are characterized by the following predicate:
  \begin{displaymath}
   \bigvee_{\loc\in\Loc}\al{\loc}\wedge
 \neg\Big(\bigvee_{a\in\mc{A}}
    \backward\big(\enabled{a}\wedge\Inv{\loc}\big)\Big)
  \end{displaymath}
  Because of well formed guards, the above can be simplified into:
  \begin{equation}\label{eq:dl}
    \bigwedge_{a\in\mc{A}}\neg\enabledbackward{a}
  \end{equation}
\end{definition}
A deadlock $(\loc,\val)$ is called an \emph{action-time-lock} when no action can
execute nor time can progress from $(\loc,\val)$, that is:
  \begin{displaymath}
    \neg\Big(\exists a\in\mc{A}. \ (\loc,\val)\transit{a}(\loc',\val')\vee
    \exists d>0. \ (\loc,\val)\transit{d}(\loc,\val+d)\Big)
  \end{displaymath}
  Action-time-locks verifies the following predicate:
  \begin{equation}\label{eq:atl}
    \bigwedge_{a\in\mc{A}}\neg\enabled{a}\wedge\bigvee_{\loc\in\Loc}
    \big(\al{\loc}\wedge urg(\loc)\big)
  \end{equation}
\subsection{Timed Systems}
The common practice in component-based timed systems is to have several components
executing in parallel while their clocks increase synchronously. Moreover,
it is often mandatory to restrict the components behaviors so as to achieve
a given global property. This is usually achieved by coordinating the execution of
actions in components using synchronization mechanisms.
In what follows, components communicate by means
of \emph{multiparty interactions}. A multiparty interaction is a rendez-vous
synchronization between actions of a fixed subset of components. It takes place
only if all the participants agree to execute the corresponding actions. Given
$n$ components $B_i$, with disjoint sets of actions $\mc{A}_i$, an interaction
is a subset of actions $\alpha\subseteq\cup_{1\le i\le n}A_i$ containing at most
one action per component, that is, $\alpha\cap\mc{A}_i$ is either empty or a
singleton $\{a_i\}$. Thus, an interaction $\alpha$ can be put in the form
$\alpha=\{a_i\}_i{\in{I}}$ with $I\subseteq\{1,\cdots,n\}$ and $a_i\in\mc{A}_i$
for all $i\in{I}$. We denote by $\p{\alpha}$, the set of components \emph{participating}
in $\alpha$, that is, $\p{\alpha}=\{B_i\}_{i\in{I}}$.

\begin{definition}[Timed System]\label{def:comp}
  Given $n$ components $\tci{i}$ with $\Loc_i\cap\Loc_j=\emptyset, \ \A_i\cap
  \A_j=\emptyset,\text{ and }\X_i\cap\X_j=\emptyset$ for any $i\neq j$,
  the composition with respect to the interaction set $\gamma$, denoted by
  $S=\gamma(B_1,\cdots,B_n)$, is defined by the timed component
  $(\Loc,\loc_0,\X,\gamma,\E_{\gamma},\I)$ where:
  \begin{itemize}
    \item $\Loc=\Loc_1\times\cdots\times\Loc_n$
    \item $\loc_0=(\loc_{0_1},\cdots,\loc_{0_n})$,
    \item $\mc{X}=\mc{X}_1\cup\cdots\cup\mc{X}_n$,
    \item $\Inv{\loc}=\Invi{\loc_1}{1}\wedge\cdots\wedge\Invi{\loc_n}{n}$, for $\loc=
      (\loc_1,\cdots,\loc_n)$,
    \item $\mc{E}_{\gamma}$ is defined by:
  \end{itemize}
      \begin{myequation}
        \mc{E}_{\gamma}=\left\{
          \substack{\loc\transit{\alpha,g,r}\loc'\\
            \text{ for } \alpha=\{a_i\}_{i\in{I}}\in\gamma}\Big\lvert
        \substack{\loc=(\loc_1,\cdots,\loc_n)\in\Loc, \
        \loc'=(\loc_1',\cdots,\loc_n')\in\Loc \\
        \text{ for } i\not\in{I},\ \loc_i'=\loc_i,\text{ and for }i\in{I},\
        \loc_i\transit{a_i,g_i,r_i}\loc_i'\text{ and } \\
        g=\bigwedge_{i\in{I}}g_i,\  r=\cup_{i\in{I}}r_i} \right\}
      \end{myequation}

\end{definition}

In a composition $S$ of $n$ components $B_i$, an action $a_i$ can execute only as part
of an interaction $\alpha$ such that $a_i\in\alpha$, that is, along with the
execution of all other actions $a_j\in\alpha$. This corresponds to the usual
notion of multiparty interactions.
In practice, we do not explicitly build compositions of timed components as
presented in Definition~\ref{def:comp}. We rather interpret their semantics by
evaluating enabled interactions based on current states of components.
\begin{property}[Semantics of a Composition]\label{pr:std_sem}
  Given a set of components $\{B_1,\cdots,B_n\}$ and an interaction set $\gamma$,
  the semantics of the composite component $S=\gamma(B_1,\cdots,B_n)$
  with respect to the set of interaction $\gamma$, is defined by
  the timed transition system $\TTSg$ where:
  \begin{itemize}
    \item $\mc{Q}_g=\Loc\times\Val$ is the set of global states, where
      $\Loc=\Loc_1\times\cdots\times\Loc_n$ and $\mc{X}=\bigcup_{i=1}^n\mc{X_i}$.
      We write a state $q=(\loc,\val)$ where $\loc=(\loc_1,\cdots,\loc_n)\in\Loc$
      is a global location and $\val=(\val_1,\cdots,\val_n)\in\Val$ is a global
      clock valuation. The initial state is $q_0=(\loc_0,0)$,
    \item $\gamma$ is the set of interactions,
    \item $\to_{\gamma}$ is the set of transitions defined by the rules:
    \begin{itemize}
      \item Interaction step: \\
      \end{itemize}
  \end{itemize}
  \vspace*{-1cm}
  \begin{align*}
    & \alpha=\{a_i\}_{i\in I}\in\gamma,\quad\forall i\in{I}.(\loc_i,\val_i)
    \transitb{a_i}{\gamma}(\loc'_i,\val'_i),\quad\forall i\notin{I}.
    (\loc_i,\val_i)=(\loc'_i,\val'_i)\\
    \cline{1-2}
   &\hspace{4.5cm}(\loc,\val)\transitb{\alpha}{\gamma}(\loc',\val')
 \end{align*}
  \vspace*{-1.5cm}
  \begin{itemize}
    \item[]
      \begin{itemize}
      \item Time step:
    \end{itemize}
  \end{itemize}
  \vspace*{-5mm}
  \begin{align*}
    & d\in\realpos,\quad\forall i\in\{1,\cdots,n\}
    .\val_i+d\models\Invi{\loc_i}{i}\\
    \cline{1-2}
   &\hspace{2cm}(\loc,\val)\transitb{d}{\gamma}(\loc,\val+d)
 \end{align*}
\end{property}

To simplify notations, predicates defined on individual components $B_i$ are
straightforwardly interpreted on global states $(\loc,\val)$ of the composition
by considering the projection $(\loc_i,\val_i)$ of $(\loc,\val)$ on $B_i$.
For instance, $\al{\loc_i}$ evaluates to true on $(\loc,\val)$ iff
$\loc\in\Loc_1,\times\cdots\times\Loc_{i-1}\times\{\loc_i\}\times\Loc_{i+1}\times
\cdots\times\Loc_n$. Similarly, clock constraints of component $B_i$ are applied to clock
valuation functions of the composition
by restricting $\val$ to clocks in $\mc{X}_i$ of $B_i$. This allows to write
the predicate $\enabled{\alpha}$, characterizing states $(\loc,\val)$ from which
an interaction $\alpha=\{a_i\}_{i\in{I}}\in\gamma$ can be executed, as:
\begin{align}\label{eq:en}
  \enabled{\alpha}&=\bigwedge_{i\in{I}}\enabled{a_i},\\
                  &=\bigwedge_{i\in{I}}\bigvee_{\loc_i\in\Loc_i}\al{\loc_i}\wedge
                  \Phi(a_i,\loc_i),\label{eq:en_1}\\
                  &=\bigwedge_{\substack{\loc\in\Loc\\
                  \loc=(\loc_1,\cdots,\loc_n)}}\hspace{-3mm}\Big(\al{\loc}\wedge
                  \bigwedge_{\substack{i\in I\\ a_i\in\alpha }}\Phi(a_i,\loc_i)\Big)
                  \label{eq:en_2}
\end{align}
Expression~\ref{eq:en_1} expresses the predicate $\enabled{\alpha}$ using location of individual
components whereas Expression~\ref{eq:en_2} formalizes it on global location configurations.
Notice that the above formulation of $\enabled{\alpha}$ corresponds to locations
enumeration of all components  of the system. In practice,
we rather consider only a subset of locations $\Loc_{\alpha}\subseteq\Loc$, from
which the execution of $\alpha$ is possible. This corresponds to $\Pi_{i\in{I}}
|\Loc_{a_i}|$ possible configuration, where $\Loc_{a_i}\subseteq\Loc_i$ is a subset
of locations of $B_i$ from which there exists a transition labeled by action $a_i\in\alpha$,
and $|\Loc_{a_i}|$ denotes the cardinality of $\Loc_{a_i}$. The set $\Loc_{\alpha}$ is
reasonably small in practice but can contain (at the worst case) $\Pi_{i\in{I}}|\Loc|$ elements.
The predicates $\enabledbackward{\alpha}$, $\enabledbackwardb{\alpha}{l}{u}$,
$\enabledforward{\alpha}$ and $\enabledforwardb{\alpha}{l}{u}$ are given by:

\begin{align*}
  &\enabledbackward{\alpha}\hspace{1.8mm}=\bigvee_{\substack{\loc\in\Loc\\
  \loc=(\loc_1,\cdots,\loc_n)}}\al{\loc}\wedge \backward\big(\bigwedge_{\substack{
    i\in{I}\\a_i\in\alpha}}\Phi(a_i,\loc_i)\big) \\
  &\enabledbackwardb{\alpha}{l}{u}=\bigvee_{\substack{\loc\in\Loc\\
  \loc=(\loc_1,\cdots,\loc_n)}}\al{\loc}\wedge \backwardp{l}{u}\big(\bigwedge_{
    \substack{i\in{I}\\a_i\in\alpha}}\Phi(a_i,\loc_i)\big) \\
  &\enabledforward{\alpha}\hspace{1.9mm}=\bigvee_{\substack{\loc\in\Loc\\
  \loc=(\loc_1,\cdots,\loc_n)}}\al{\loc}\wedge \forward\big(\bigwedge_{\substack{
    i\in{I}\\a_i\in\alpha}}\Phi(a_i,\loc_i)\big) \\
  &\enabledforwardb{\alpha}{l}{u}=\bigvee_{\substack{\loc\in\Loc\\
  \loc=(\loc_1,\cdots,\loc_n)}}\al{\loc}\wedge \forwardp{l}{u}\big(\bigwedge_{\substack{
    i\in{I}\\a_i\in\alpha}}\Phi(a_i,\loc_i)\big) \\
\end{align*}

Note that in general forward and backward operators do not distribute over conjunction, which
prevent us from further expanding the above predicates, that is,for a clock constraint
$c=c_1\wedge c_2$, we have:
\begin{displaymath}
  \diamond c = \diamond (c_1\wedge c_2) \neq \diamond c_1\wedge \diamond c_2
\end{displaymath}
with $\diamond\in\{\backward,\forward\}$.

The definitions of deadlocks and action-time-locks are also trivially extended
to composition of timed components. Deadlocks can be characterized as follows:
\begin{displaymath}
  \bigvee_{\loc=(\loc_1,\cdots,\loc_i)\in\Loc}\al{\loc}\wedge
  \big[\bigwedge_{\alpha\in\gamma}\neg\backward\big(\enabled{\alpha}\wedge
  \bigwedge_{1\le i\le n}\Invb{i}{\loc_i}\big)\big]
\end{displaymath}
and action-time-locks by:
\begin{displaymath}
  \big(\bigwedge_{\alpha\in\gamma}\neg\enabled{\alpha}\big)\wedge\big(
  \bigvee_{1\le i\le n}\bigvee_{\loc_i\in\Loc_i}\al{\loc_i}\wedge urg(\loc_i)\big)
\end{displaymath}

\subsection{Example}\label{exp:run}
\input{Figures/taskManager.tex}
Figure~\ref{fig:tm} depicts a timed system composed of four components $C$, $T_1$, $T_2$,
and $R$.
Component $C$ represents a  controller that initializes then releases tasks $T_1$ and $T_2$.
Tasks use the shared resource $R$ during their executions.
To implement such behavior, we consider the following interactions between $C$, $R$, and
$T_1$: $\alpha_1=\{init_0, init_1\}$,
$\alpha_3=\{start_0, start_1\}$, $\alpha_5=\{ take, process_1\}$, $\alpha_7 =
\{free, end_1 \}$,
and similar interactions $\alpha_2$, $\alpha_4$, $\alpha_6$, $\alpha_8$ for task $T_2$,
as shown by connections on Figure~\ref{fig:tm}.
The controller is responsible for firing
the execution of each task. First, it non-deterministically initializes one
of the two tasks, i.e., executes $\alpha_1$ or $\alpha_2$, and then
releases it through interaction $\alpha_3$ or $\alpha_4$.
Tasks perform their processing independently of the controller, after being granted an access
to the shared resource ($\alpha_5$ or $\alpha_6$).
When finished, a task releases the resource (interactions $\alpha_7$ or $\alpha_8$) and goes
back to its initial location.
An example of execution sequence of this system is given below. Valuation $v$ of clocks $x$,
$y$, and $z$ are represented as tuples
$(\val(x),\val(y),\val(z))$:
\begin{displaymath}
\small{
\begin{split}
&((\loc_0^1,\loc_0^2,\loc_0^3,\loc_0^4),(0,0,0))\transit{26}_{\gamma}
((\loc_0^1,\loc_0^2,\loc_0^3,\loc_0^4),(26,26,26))\transit{\alpha_1}_{\gamma}
((\loc_1^1,\loc_1^2,\loc_0^3,\loc_0^4),(26,26,26))\transit{\alpha_3}_{\gamma}\\
&((\loc_0^1,\loc_2^2,\loc_0^3,\loc_0^4),(0,26,0))\transit{10}_{\gamma}
((\loc_0^1,\loc_2^2,\loc_0^3,\loc_0^4),(10,36,10))\transit{\alpha_5}_{\gamma}
((\loc_0^1,\loc_3^2,\loc_0^3,\loc_1^4),(0,36,10))\transit{2}_{\gamma}\\&
((\loc_0^1,\loc_3^2,\loc_0^3,\loc_1^4),(2,38,12))\transit{\alpha_2}_{\gamma}
((\loc_1^1,\loc_3^2,\loc_1^3,\loc_1^4),(2,38,12))
\end{split}
}
\end{displaymath}

\section{Timed Systems with Data}
Timed models introduced in the previous section focuses on the timing behavior of a given system.
In order to achieve a higher degree of expressiveness, we extend these models with data
variables. Data allows additional representations of complex behavior. Similarly to clock
variables, they may appear in the guards of transitions as additional conditions and may be
updated when transitions fire.

\begin{definition}[Guards on clocks and Data]\label{def:guard}
  Let $\mc{X}$ be a set of clock variables and $\mc{D}$ be a set of
  data variables. We denote by $\mc{G(X,D)}$ the set of guards induced
  by the following grammar:
  \begin{displaymath}
    g:=g_x \ | \ g_d \ | \ g_1\wedge g_2
  \end{displaymath}
  where $g_x\in\mc{C(X)}$, $g_d$ is a predicate on a subset of data variables
  of $\mc{D}$, and $g_1$, $g_2$ are guards over clocks and/or data variables.
\end{definition}

We extend the notion of valuation to data variables in the following manner:
\begin{itemize}
  \item Valuations assign values to data variable (in addition to clocks),
  \item The satisfaction of a valuation to a constraint is straightforwardly
    extended to data variables,
  \item Data variables are insensitive to the progress of time, that is, for $k\in\mc{D}$ and
    $d\in\realpos$, $(v+d)(k)=(v)(k)$,
  \item Update operations are also defined for data variables using transfer functions

\end{itemize}

We use transfer functions to express update operations on data variables of $\D$. A transfer
function $f:\V(\D)\to\V(\D)$ assigns to each variable $d\in\D$ a new value $f(v)$ based on the
current values of variables of $\D$. Additionally, given a set $\D'\supseteq\D$, applying $f$
on $\D'$ updates variable in $\D$  but does not change the values of variables in
$\D'\setminus\D$.

\begin{definition}[Timed Component with Data]\label{def:tce}
  A timed component with data is a tuple
  $B_d=(\Loc,\loc_0,\X,\D,\A,\E,\{f_e\}_{e\in\E},\I)$ such that:
  \begin{itemize}
    \item $\Loc$, $\loc_0$, $\mc{X}$, $\mc{A}$ and $\mc{I}$ are defined as
      in Definition~\ref{def:tc},
    \item $\mc{D}$ is a finite set of data variables,
    \item $\mc{E}\subseteq\Loc\times(\mc{A}\times\mc{G(X,D)}\times2^{\X})\times\Loc$
    is a finite set of labeled transitions with an action, an extended guard,
      and a set of clocks to be reset. For each transition $e\in\E$, we include the transfer
      function $f_e$ that updates elements of $\mc{D}$.
  \end{itemize}
\end{definition}

\input{Figures/tcd.tex}
\begin{example}
  Component of Figure~\ref{fig:tcd} is an extended timed component with actions $a$, $b$ and $c$.
  The set of data is $\mc{D}=\{k\}$. It is used on the guards of the transitions labeled by
  $a$ and $c$ ($k\le 5$ and $k>5$ respectively). The update operations for both transitions
  are respectively $\{k:=k+10\}$ and $\{k:=k-3\wedge x:=0\}$.
\end{example}
\begin{remark}
  Notice that extending a timed component with data will result in a restriction
  of the behavior of the initial timed components since extending guards to data
  variables will only constrain the execution of transitions. Consequently,
  for a timed component with data $B_d=(\Loc,\loc_0,\X,\D,\A,\E,\{f_e\}_{e\in\E},\I)$,
  the timed component $B=(\Loc,\loc_0,\X,\A,\E,\I)$ represents an abstraction of the latter.
\end{remark}

\begin{definition}[Timed System with Data]\label{def:tce_sem}
  Given $n$ components $B_{d_i}=(\Loc_i,\loc_{0_i},\X_i,\D_i,\A_i,$\\$
  \E_i,\{f_e\}_{e\in\E_i},\I_i)$ with disjoint set of data and an interaction set $\gamma$,
  the composition $S_d=\gamma(B_{d_1},\cdots,B_{d_n})$ with respect to
  the interaction set $\gamma$ is defined by the timed component
  $(\Loc,\loc_0,\X,\D,\gamma,\E_{\gamma},\{f_e\}_{e\in\gamma},\I)$ where:
  \begin{itemize}
    \item $\Loc$, $\loc_0$, $\mc{X}$, $\gamma$ and $\mc{I}$ are defined as
      in Definition~\ref{def:comp}.
    \item $\mc{D}=\mc{D}_1\cup\cdots\cup\mc{D}_n$
    \item $\mc{E}_{\gamma}$ is straightforwardly extended by considering guards
      on data variables and the application of transfer functions on executions of interactions
  \end{itemize}
\end{definition}
The semantics of timed system with data extends the semantics of Property~\ref{pr:std_sem}
in the sense that an interaction takes place if the guards on data variables also evaluates
to $\true$. Also, interactions executions apply the underlying transfer functions of the
corresponding components transitions.
Also, data variables are initialized based on their types. For instance, integer and real
variables are initialized to 0. For other data types, one needs to define their initial
valuation.

In what follows, when referring to timed component or timed system we imply by that
extended timed component or extend timed systems, unless explicitly stated.

\section{Verification of Timed Systems}\label{sec:2.4}
\subsection{Symbolic Reachability}

The semantics of timed systems as presented in Property~\ref{pr:std_sem}
defines states as pairs of locations configurations and clock
valuations. By considering a continuous time domain ($\realpoz$ here), the
resulting timed transition system yields an infinity of states.
Consequently, the usual practice is to rely on a symbolic representation
of states to make this state space finite.
A symbolic state is defined by a pair $(\loc,\xi)$ where $\loc$ is a location
and $\xi$ is a zone, a set of clock valuations defined by clock constraints
(as defined in~\ref{eq:cc}). Consequently, the set of reachable states of a
timed component B (system) can be put on the form:
\begin{displaymath}
  Reach(B)=\bigvee_{j\in{J}}\al{\loc_j}\wedge\xi_j
\end{displaymath}

Given a timed component with data $B_d$ and its abstraction of data $B$, we have
$Reach(B_d)\subseteq Reach(B)$ when considering the projection of states on locations and clocks
only. This means that $Reach(B)$ can be used as an over-approximation
of the reachable state of the timed component with data $B_d$.
\subsection{Compositional Verification}

Standard verification techniques such as model checking are based on explicit
exploration and exhaustive enumeration of all the reachable symbolic states
of a given system. The main issue with this
method is the combinatorial explosion when considering large scale systems.
Compositional verification have been introduced to cope with state explosion
problem, and thus achieves scalability when verifying large scale systems.
This approach is based on the concept of divide-and-conquer in order to
break up the verification
problems into smaller subsequent problems. Compositional verification have been
extensively studied under different manners e.g., assume-guarantee
reasoning~\cite{Lamport77,Owl76},
contract-based verification~\cite{contract1,contract2},
deductive verification
~\cite{deductive}, etc.
In this thesis, we choose to use a deductive compositional verification
method that exploits compositionality for analysis of timed systems
using \emph{invariants}. Invariants are over-approximations of the set
of reachable states of the system as opposed to the exact
reachability analysis in model-checking. The key principle of this
approach is the computation of a global invariant as the conjunction of
other invariants (components invariants, interaction invariants, etc.).

%:\emph{(i)} local invariants of
%the underlying components, \emph{(ii)} an interaction
%invariant deduced from the synchronizations
%(interactions) between components, and \emph{(iii)} an additional invariant
%capturing the
%global timing aspects and relating clocks of different
%components.

Let $S=\gamma(B_1,\cdots,B_n)$ be a system composed of $n$ timed components $B_i$
synchronizing through the interaction
set $\gamma$, and let $\psi$ be a property of interest. Assuming that
$GI(S)$ is the global invariant for this system,
the verification rule of $\psi$ can be intuitively
written as follows:

\begin{align*}
  &\hspace{1cm}GI(S)\Rightarrow\psi\\
    \cline{1-2}
   &\gamma(B_1,\cdots,B_n)\models\square\psi
\end{align*}
where the notation \enquote{$\gamma(B_1,\cdots,B_n)\models\square\psi$} is to
be read as \enquote{$\psi$ holds in every reachable state of the
composition $\gamma(B_1,\cdots,B_n)$}.

Usually when verifying timed systems, the common practice is to verify the system
against some \emph{given property} (safety property, liveness, deadlock, etc.).
These properties allows to assert that a given model satisfies the specifications.
We use satisfiability checking to verify that the global
invariant of a system
implies properties of interest. Particularly, for a system S characterized
by the global invariant $GI(S)$, and
given a property $\psi$, we check the unsatisfiability of
$GI(S)\wedge\neg\psi$.


%!TEX root = forallxyyc.tex
\part{Natural deduction for FOL}
\label{ch.NDFOL}
\addtocontents{toc}{\protect\mbox{}\protect\hrulefill\par}

\chapter{Basic rules for FOL}\label{s:BasicFOL}

The language of FOL makes use of all of the connectives of TFL. So proofs in FOL will use all of the basic and derived rules from Part~\ref{ch.NDTFL}. We will also use the proof-theoretic notions (particularly, the symbol `$\proves$') introduced there. However, we will also need some new basic rules to govern the quantifiers, and to govern the identity sign.

\section{Universal elimination}

From the claim that everything is~$F$, you can infer that any particular thing is~$F$. You name it; it's~$F$. So the following should be fine:
\begin{fitchproof}
	\hypo{a}{\forall x\,\atom{R}{x,x,d}}
	\have{c}{\atom{R}{a,a,d}} \Ae{a}
\end{fitchproof}
We obtained line 2 by dropping the universal quantifier and replacing every instance of `$x$' with `$a$'. Equally, the following should be allowed:
\begin{fitchproof}
	\hypo{a}{\forall x\,\atom{R}{x,x,d}}
	\have{c}{\atom{R}{d,d,d}} \Ae{a}
\end{fitchproof}
We obtained line 2 here by dropping the universal quantifier and replacing every instance of `$x$' with `$d$'. We could have done the same with any other name we wanted.

This motivates the universal elimination rule ($\forall$E):
\factoidbox{
\begin{fitchproof}
	\have[m]{a}{\forall \metav{x}\,\metav{A}(\ldots \metav{x} \ldots \metav{x}\ldots)}
	\have[\ ]{c}{\metav{A}(\ldots \metav{c} \ldots \metav{c}\ldots)} \Ae{a}
\end{fitchproof}}
The notation here was introduced in \S\ref{s:TruthFOL}. The point is that you can obtain any \emph{substitution instance} of a universally quantified formula: replace every instance of the quantified variable with any name you like.

We should emphasize that (as with every elimination rule) you can only apply the $\forall$E rule when the universal quantifier is the main logical operator. So the following is \emph{banned}:
\begin{fitchproof}
	\hypo{a}{\forall x\,\atom{B}{x} \eif \atom{B}{k}}
	\have{c}{\atom{B}{b} \eif \atom{B}{k}}\by{naughy attempt to invoke $\forall$E}{a}
\end{fitchproof}
This is illegitimate, since `$\forall x$' is not the main logical operator in line~1. (If you need a reminder as to why this sort of inference should be banned, reread \S\ref{s:MoreMonadic}.)

\section{Existential introduction}
From the claim that some particular thing is~$F$, you can infer that something is~$F$. So we ought to allow:
\begin{fitchproof}
	\hypo{a}{\atom{R}{a,a,d}}
	\have{b}{\exists x\, \atom{R}{a,a,x}} \Ei{a}
\end{fitchproof}
Here, we have replaced the name `$d$' with a variable `$x$', and then existentially quantified over it. Equally, we would have allowed:
\begin{fitchproof}
	\hypo{a}{\atom{R}{a,a,d}}
	\have{c}{\exists x\, \atom{R}{x,x,d}} \Ei{a}
\end{fitchproof}
Here we have replaced both instances of the name `$a$' with a variable, and then existentially generalised. But we do not need to replace \emph{both} instances of a name with a variable: if Narcissus loves himself, then there is someone who loves Narcissus. So we also allow:
\begin{fitchproof}
	\hypo{a}{\atom{R}{a,a,d}}
	\have{d}{\exists x\, \atom{R}{x,a,d}} \Ei{a}
\end{fitchproof}
Here we have replaced \emph{one} instance of the name `$a$' with a variable, and then existentially generalised. These observations motivate our introduction rule, although to explain it, we will need to introduce some new notation.

Where $\metav{A}$ is a sentence containing the name $\metav{c}$, we can emphasize this by writing `$\metav{A}(\ldots \metav{c} \ldots \metav{c}\ldots)$'. We will write `$\metav{A}(\ldots \metav{x} \ldots \metav{c}\ldots)$' to indicate any formula obtained by replacing \emph{some or all} of the instances of the name \metav{c} with the variable \metav{x}. Armed with this, our introduction rule is:
\factoidbox{
\begin{fitchproof}
	\have[m]{a}{\metav{A}(\ldots \metav{c} \ldots \metav{c}\ldots)}
	\have[\ ]{c}{\exists \metav{x}\,\metav{A}(\ldots \metav{x} \ldots \metav{c}\ldots)} \Ei{a}
\end{fitchproof}
\metav{x} must not occur in $\metav{A}(\ldots \metav{c} \ldots \metav{c}\ldots)$}
The constraint is included to guarantee that any application of the rule yields a  sentence of FOL. Thus the following is allowed:
\begin{fitchproof}
	\hypo{a}{\atom{R}{a,a,d}}
	\have{d}{\exists x\, \atom{R}{x,a,d}} \Ei{a}
	\have{e}{\exists y \exists x\, \atom{R}{x,y,d}} \Ei{d}
\end{fitchproof}
But this is banned:
\begin{fitchproof}
	\hypo{a}{\atom{R}{a,a,d}}
	\have{d}{\exists x\, \atom{R}{x,a,d}} \Ei{a}
	\have{e}{\exists x\, \exists x\, \atom{R}{x,x,d}}\by{naughty attempt to invoke $\exists$I}{d}
\end{fitchproof}
since the expression on line~3 contains clashing variables, and so is not a sentence of FOL.

\section{Empty domains}
The following proof combines our two new rules for quantifiers:
	\begin{fitchproof}
		\hypo{a}{\forall x\, \atom{F}{x}}
		\have{in}{\atom{F}{a}}\Ae{a}
		\have{e}{\exists x\, \atom{F}{x}}\Ei{in}
	\end{fitchproof}
Could this be a bad proof? If anything exists at all, then certainly we can infer that something is~$F$, from the fact that everything is~$F$. But what if \emph{nothing} exists at all? Then it is surely vacuously true that everything is~$F$; however, it does not following that something is~$F$, for there is nothing to \emph{be}~$F$. So if we claim that, as a matter of logic alone, `$\exists x\,\atom{F}{x}$' follows from `$\forall x\,\atom{F}{x}$', then we are claiming that, as a matter of \emph{logic alone}, there is something rather than nothing. This might strike us as a bit odd.

Actually, we are already committed to this oddity. In \S\ref{s:FOLBuildingBlocks}, we stipulated that domains in FOL must have at least one member. We then defined a validity (of FOL) as a sentence which is true in every interpretation. Since `$\exists x\, x=x$' will be true in every interpretation, this \emph{also} had the effect of stipulating that it is a matter of logic that there is something rather than nothing.

Since it is far from clear that logic should tell us that there must be something rather than nothing, we might well be cheating a bit here.

If we refuse to cheat, though, then we pay a high cost. Here are three things that we want to hold on to:
	\begin{ebullet}
		\item $\forall x\,\atom{F}{x} \proves \atom{F}{a}$: after all, that was $\forall$E.
		\item $\atom{F}{a} \proves \exists x\,\atom{F}{x}$: after all, that was $\exists$I.
		\item the ability to copy-and-paste proofs together: after all, reasoning works by putting lots of little steps together into rather big chains.
	\end{ebullet}
If we get what we want on all three counts, then we have to countenance that $\forall xFx \proves \exists x\,\atom{F}{x}$. So, if we get what we want on all three counts, the proof system alone tells us that there is something rather than nothing. And if we refuse to accept that, then we have to surrender one of the three things that we want to hold on to!

Before we start thinking about which to surrender, we might want to ask how \emph{much} of a cheat this is. Granted, it may make it harder to engage in theological debates about why there is something rather than nothing. But the rest of the time, we will get along just fine. So maybe we should just regard our proof system (and FOL, more generally) as having a very slightly limited purview. If we ever want to allow for the possibility of \emph{nothing}, then we will have to cast around for a more complicated proof system. But for as long as we are content to ignore that possibility, our proof system is perfectly in order. (As, similarly, is the stipulation that every domain must contain at least one object.)

\section{Universal introduction}
Suppose you had shown of each particular thing that it is F (and that there are no other things to consider). Then you would be justified in claiming that everything is F. This would motivate the following proof rule. If you had established each and every single substitution instance of `$\forall x\,\atom{F}{x}$', then you can infer `$\forall x\,\atom{F}{x}$'.

Unfortunately, that rule would be utterly unusable. To establish each and every single substitution instance would require proving `$\atom{F}{a}$', `$\atom{F}{b}$', \dots, `$\atom{F}{j_2}$', \dots, `$\atom{F}{r_{79002}}$', \ldots, and so on. Indeed, since there are infinitely many names in FOL, this process would never come to an end. So we could never apply that rule. We need to be a bit more cunning in coming up with our rule for introducing universal quantification.

A solution will be inspired by considering:
$$\forall x\,\atom{F}{x} \therefore \forall y\,\atom{F}{y}$$
This argument should \emph{obviously} be valid. After all, alphabetical variation ought to be a matter of taste, and of no logical consequence. But how might our proof system reflect this? Suppose we begin a proof thus:
\begin{fitchproof}
	\hypo{x}{\forall x\, \atom{F}{x}}
	\have{a}{\atom{F}{a}} \Ae{x}
\end{fitchproof}
We have proved `$\atom{F}{a}$'. And, of course, nothing stops us from using the same justification to prove `$\atom{F}{b}$', `$\atom{F}{c}$', \ldots, `$\atom{F}{j_2}$', \ldots, `$\atom{F}{r_{79002}}$, \dots, and so on until we run out of space, time, or patience. But reflecting on this, we see that there is a way to prove $F\metav{c}$, for any name \metav{c}. And if we can do it for \emph{any} thing, we should surely be able to say that `$F$' is true of \emph{everything}. This therefore justifies us in inferring `$\forall y\,\atom{F}{y}$', thus:
\begin{fitchproof}
	\hypo{x}{\forall x\, \atom{F}{x}}
	\have{a}{\atom{F}{a}} \Ae{x}
	\have{y}{\forall y\, \atom{F}{y}} \Ai{a}
\end{fitchproof}
The crucial thought here is that `$a$' was just some \emph{arbitrary} name. There was nothing special about it---we might have chosen any other name---and still the proof would be fine. And this crucial thought motivates the universal introduction rule ($\forall$I):
\factoidbox{
\begin{fitchproof}
	\have[m]{a}{\metav{A}(\ldots \metav{c} \ldots \metav{c}\ldots)}
	\have[\ ]{c}{\forall \metav{x}\,\metav{A}(\ldots \metav{x} \ldots \metav{x}\ldots)} \Ai{a}
\end{fitchproof}
	\metav{c} must not occur in any undischarged assumption\\
	\metav{x} must not occur in $\metav{A}(\ldots \metav{c} \ldots \metav{c}\ldots)$}
A crucial aspect of this rule, though, is bound up in the first constraint. This constraint ensures that we are always reasoning at a sufficiently general level.
%\footnote{Recall from \S\ref{s:BasicTFL} that we are treating `$\ered$' as a canonical contradiction. But if it were the canonical contradiction as involving some \emph{constant}, it might interfere with the constraint mentioned here. To avoid such problems, we will treat `$\ered$' as a canonical contradiction \emph{that involves no particular names}.}
To see the constraint in action, consider this terrible argument:
	\begin{quote}
		Everyone loves Kylie Minogue; therefore everyone loves themselves.
	\end{quote}
We might symbolize this obviously invalid inference pattern as:
$$\forall x\,\atom{L}{x,k} \therefore \forall x\,\atom{L}{x,x}$$
Now, suppose we tried to offer a proof that vindicates this argument:
\begin{fitchproof}
	\hypo{x}{\forall x\, \atom{L}{x,k}}
	\have{a}{\atom{L}{k,k}} \Ae{x}
	\have{y}{\forall x\, \atom{L}{x,x}} \by{naughty attempt to invoke $\forall$I}{a}
\end{fitchproof}\noindent
This is not allowed, because `$k$' occurred already in an undischarged assumption, namely, on line 1. The crucial point is that, if we have made any assumptions about the object we are working with, then we are not reasoning generally enough to license $\forall$I.

Although the name may not occur in any \emph{undischarged} assumption, it may occur in a \emph{discharged} assumption. That is, it may occur in a subproof that we have already closed. For example, this is just fine:
\begin{fitchproof}
	\open
		\hypo{f1}{\atom{G}{d}}
		\have{f2}{\atom{G}{d}}\by{R}{f1}
	\close
	\have{ff}{\atom{G}{d} \eif \atom{G}{d}}\ci{f1-f2}
	\have{zz}{\forall z(\atom{G}{z} \eif \atom{G}{z})}\Ai{ff}
\end{fitchproof}
This tells us that `$\forall z (\atom{G}{z} \eif \atom{G}{z})$' is a \emph{theorem}. And that is as it should be.

We should emphasise one last point. As per the conventions of \S\ref{s:MainLogicalOperatorQuantifier}, the use of $\forall$I requires that we are replacing \emph{every} instance of the name \metav{c} in $\metav{A}(\ldots \metav{x}\ldots\metav{x}\ldots)$ with the variable \metav{x}. If we only replace \emph{some} names and not others, we end up `proving' silly things. For example, consider the argument:
	\begin{quote}
	Everyone is as old as themselves; so everyone is as old as Judi Dench.
	\end{quote}
We might symbolise this as follows:
$$\forall x\,\atom{O}{x,x} \therefore \forall x\,\atom{O}{x,d}$$
But now suppose we tried to \emph{vindicate} this terrible argument with the following:
\begin{fitchproof}
	\hypo{x}{\forall x\, \atom{O}{x,x}}
	\have{a}{\atom{O}{d,d}}\Ae{x}
	\have{y}{\forall x\, \atom{O}{x,d}}\by{naughty attempt to invoke $\forall$I}{a}
\end{fitchproof}
Fortunately, our rules do not allow for us to do this: the attempted proof is banned, since it doesn't replace \emph{every} occurrence of `$d$' in line $2$ with an `$x$'.

\section{Existential elimination}
Suppose we know that \emph{something} is~$F$. The problem is that simply knowing this does not tell us which thing is~$F$. So it would seem that from `$\exists x\,\atom{F}{x}$' we cannot immediately conclude `$\atom{F}{a}$', `$\atom{F}{e_{23}}$', or any other substitution instance of the sentence. What can we do?

Suppose we know that something is~$F$, and that everything which is~$F$ is also~$G$. In (almost) natural English, we might reason thus:
	\begin{quote}
		Since something is $F$, there is some particular thing which is an~$F$. We do not know anything about it, other than that it's an~$F$, but for convenience, let's call it `Becky'. So: Becky is $F$. Since everything which is $F$ is~$G$, it follows that Becky is~$G$. But since Becky is~$G$, it follows that something is~$G$. And nothing depended on which object, exactly, Becky was. So, something is~$G$.
	\end{quote}
We might try to capture this reasoning pattern in a proof as follows:
\begin{fitchproof}
	\hypo{es}{\exists x\, \atom{F}{x}}
	\hypo{ast}{\forall x(\atom{F}{x} \eif \atom{G}{x})}
	\open
		\hypo{s}{\atom{F}{b}}
		\have{st}{\atom{F}{b} \eif \atom{G}{b}}\Ae{ast}
		\have{t}{\atom{G}{b}} \ce{st, s}
		\have{et1}{\exists x\, \atom{G}{x}}\Ei{t}
	\close
	\have{et2}{\exists x\, \atom{G}{x}}\Ee{es,s-et1}
\end{fitchproof}\noindent
Breaking this down: we started by writing down our assumptions. At line~$3$, we made an additional assumption: `$\atom{F}{b}$'. This was just a substitution instance of `$\exists x\,\atom{F}{x}$'. On this assumption, we established `$\exists x\,\atom{G}{x}$'. Note that we had made no \emph{special} assumptions about the object named by `$b$'; we had \emph{only} assumed that it satisfies `$\atom{F}{x}$'. So nothing depends upon which object it is. And line~$1$ told us that \emph{something} satisfies `$\atom{F}{x}$', so our reasoning pattern was perfectly general. We can discharge the specific assumption `$\atom{F}{b}$', and simply infer `$\exists x\,\atom{G}{x}$' on its own.

Putting this together, we obtain the existential elimination rule ($\exists$E):
\factoidbox{
\begin{fitchproof}
	\have[m]{a}{\exists \metav{x}\,\metav{A}(\ldots \metav{x} \ldots \metav{x}\ldots)}
	\open
		\hypo[i]{b}{\metav{A}(\ldots \metav{c} \ldots \metav{c}\ldots)}
		\have[j]{c}{\metav{B}}
	\close
	\have[\ ]{d}{\metav{B}} \Ee{a,b-c}
\end{fitchproof}
\metav{c} must not occur in any assumption undischarged before line $i$\\
\metav{c} must not occur in $\exists \metav{x}\,\metav{A}(\ldots \metav{x} \ldots \metav{x}\ldots)$\\
\metav{c} must not occur in \metav{B}}
As with universal introduction, the constraints are extremely important. To see why, consider the following terrible argument:
	\begin{quote}
		Tim Button is a lecturer. Someone is not a lecturer. So Tim Button is both a lecturer and not a lecturer.
	\end{quote}
We might symbolize this obviously invalid inference pattern as follows:
$$\atom{L}{b}, \exists x\, \enot\atom{L}{x} \therefore \atom{L}{b} \eand \enot \atom{L}{b}$$
Now, suppose we tried to offer a proof that vindicates this argument:
\begin{fitchproof}
	\hypo{f}{\atom{L}{b}}
	\hypo{nf}{\exists x\, \enot \atom{L}{x}}
	\open
		\hypo{na}{\enot \atom{L}{b}}
		\have{con}{\atom{L}{b} \eand \enot \atom{L}{b}}\ai{f, na}
	\close
	\have{econ1}{\atom{L}{b} \eand \enot \atom{L}{b}}\by{naughty attempt}{}
	\have[\ ]{x}{}\by{to invoke $\exists$E }{nf, na-con}
\end{fitchproof}
The last line of the proof is not allowed. The name that we used in our substitution instance for `$\exists x\, \enot \atom{L}{x}$' on line~$3$, namely `$b$', occurs in line~$4$. The this would be no better:
\begin{fitchproof}
	\hypo{f}{\atom{L}{b}}
	\hypo{nf}{\exists x\, \enot \atom{L}{x}}
	\open
		\hypo{na}{\enot \atom{L}{b}}
		\have{con}{\atom{L}{b} \eand \enot \atom{L}{b}}\ai{f, na}
		\have{con1}{\exists x (\atom{L}{x} \eand \enot \atom{L}{x})}\Ei{con}
	\close
	\have{econ1}{\exists x (\atom{L}{x} \eand \enot \atom{L}{x})}\by{naughty attempt}{}
	\have[\ ]{x}{}\by{to invoke $\exists$E }{nf, na-con1}
\end{fitchproof}
The last line is still not allowed. For the name that we used in our substitution instance for `$\exists x\, \enot \atom{L}{x}$', namely `$b$', occurs in an undischarged assumption, namely line~$1$.

The moral of the story is this. \emph{If you want to squeeze information out of an existential quantifier, choose a new name for your substitution instance.} That way, you can guarantee that you meet all the constraints on the rule for $\exists$E.

\practiceproblems
\problempart
Explain why these two `proofs' are \emph{incorrect}. Also, provide interpretations which would invalidate the fallacious argument forms the `proofs' enshrine:
\begin{multicols}{2}
	\begin{fitchproof}
		\hypo{Rxx}{\forall x\, \atom{R}{x,x}}
		\have{Raa}{\atom{R}{a,a}}\Ae{Rxx}
		\have{Ray}{\forall y\, \atom{R}{a,y}}\Ai{Raa}
		\have{Rxy}{\forall x\, \forall y\, \atom{R}{x,y}}\Ai{Ray}
	\end{fitchproof}
	\begin{fitchproof}
		\hypo{AE}{\forall x\, \exists y\, \atom{R}{x,y}}
		\have{E}{\exists y\, \atom{R}{a,y}}\Ae{AE}
		\open
			\hypo{ass}{\atom{R}{a,a}}
			\have{Ex}{\exists x\, \atom{R}{x,x}}\Ei{ass}
		\close
		\have{con}{\exists x\, \atom{R}{x,x}}\Ee{E, ass-Ex}
	\end{fitchproof}
\end{multicols}

\problempart
\label{pr.justifyFOLproof}
The following three proofs are missing their citations (rule and line numbers). Add them, to turn them into bona fide proofs.
\begin{earg}
\item \begin{fitchproof}
\hypo{p1}{\forall x\exists y(\atom{R}{x,y} \eor \atom{R}{y,x})}
\hypo{p2}{\forall x\,\enot \atom{R}{m,x}}
\have{3}{\exists y(\atom{R}{m,y} \eor \atom{R}{y,m})}{}
	\open
		\hypo{a1}{\atom{R}{m,a} \eor \atom{R}{a,m}}
		\have{a2}{\enot \atom{R}{m,a}}{}
		\have{a3}{\atom{R}{a,m}}{}
		\have{a4}{\exists x\, \atom{R}{x,m}}{}
	\close
\have{n}{\exists x\, \atom{R}{x,m}} {}
\end{fitchproof}

\item \begin{fitchproof}
\hypo{1}{\forall x(\exists y\,\atom{L}{x,y} \eif \forall z\,\atom{L}{z,x})}
\hypo{2}{\atom{L}{a,b}}
\have{3}{\exists y\,\atom{L}{a,y} \eif \forall z\atom{L}{z,a}}{}
\have{4}{\exists y\, \atom{L}{a,y}} {}
\have{5}{\forall z\, \atom{L}{z,a}} {}
\have{6}{\atom{L}{c,a}}{}
\have{7}{\exists y\,\atom{L}{c,y} \eif \forall z\,\atom{L}{z,c}}{}
\have{8}{\exists y\, \atom{L}{c,y}}{}
\have{9}{\forall z\, \atom{L}{z,c}}{}
\have{10}{\atom{L}{c,c}}{}
\have{11}{\forall x\, \atom{L}{x,x}}{}
\end{fitchproof}

\item \begin{fitchproof}
\hypo{a}{\forall x(\atom{J}{x} \eif \atom{K}{x})}
\hypo{b}{\exists x\,\forall y\, \atom{L}{x,y}}
\hypo{c}{\forall x\, \atom{J}{x}}
\open
	\hypo{2}{\forall y\, \atom{L}{a,y}}
	\have{3}{\atom{L}{a,a}}{}
	\have{d}{\atom{J}{a}}{}
	\have{e}{\atom{J}{a} \eif \atom{K}{a}}{}
	\have{f}{\atom{K}{a}}{}
	\have{4}{\atom{K}{a} \eand \atom{L}{a,a}}{}
	\have{5}{\exists x(\atom{K}{x} \eand \atom{L}{x,x})}{}
\close
\have{j}{\exists x(\atom{K}{x} \eand \atom{L}{x,x})}{}
\end{fitchproof}
\end{earg}

\problempart
\label{pr.BarbaraEtc.proof1}
In \S\ref{s:MoreMonadic} problem A, we considered fifteen syllogistic figures of Aristotelian logic. Provide proofs for each of the argument forms. NB: You will find it \emph{much} easier if you symbolize (for example) `No F is G' as `$\forall x (\atom{F}{x} \eif \enot \atom{G}{x})$'.

\

\problempart
\label{pr.BarbaraEtc.proof2}
Aristotle and his successors identified other syllogistic forms which depended upon `existential import'. Symbolize each of these argument forms in FOL and offer proofs.
\begin{earg}
	\item \textbf{Barbari.} Something is H. All G are F. All H are G. So: Some H is F
	\item \textbf{Celaront.} Something is H. No G are F. All H are G. So: Some H is not F
	\item \textbf{Cesaro.} Something is H. No F are G. All H are G. So: Some H is not F.
	\item \textbf{Camestros.} Something is H. All F are G. No H are G. So: Some H is not F.
	\item \textbf{Felapton.} Something is G. No G are F. All G are H. So: Some H is not F.
	\item \textbf{Darapti.} Something is G. All G are F. All G are H. So: Some H is F.
	\item \textbf{Calemos.} Something is H. All F are G. No G are H. So: Some H is not F.
	\item \textbf{Fesapo.} Something is G. No F is G. All G are H. So: Some H is not F.
	\item \textbf{Bamalip.} Something is F. All F are G. All G are H. So: Some H are F.
\end{earg}

\problempart
\label{pr.someFOLproofs}
Provide a proof of each claim.
\begin{earg}
\item $\proves \forall x\,\atom{F}{x} \eif \forall y(\atom{F}{y} \eand \atom{F}{y})$
\item $\forall x(\atom{A}{x}\eif \atom{B}{x}), \exists x\,\atom{A}{x} \proves \exists x\,\atom{B}{x}$
\item $\forall x(\atom{M}{x} \eiff \atom{N}{x}), \atom{M}{a} \eand \exists x\,\atom{R}{x,a} \proves \exists x\,\atom{N}{x}$
\item $\forall x\, \forall y\,\atom{G}{x,y}\proves\exists x\,\atom{G}{x,x}$
\item $\proves\forall x\,\atom{R}{x,x} \eif \exists x\, \exists y\,\atom{R}{x,y}$
\item $\proves\forall y\, \exists x (\atom{Q}{y} \eif \atom{Q}{x})$
\item $\atom{N}{a} \eif \forall x(\atom{M}{x} \eiff \atom{M}{a}), \atom{M}{a}, \enot\atom{M}{b}\proves \enot \atom{N}{a}$
\item $\forall x\, \forall y (\atom{G}{x,y} \eif \atom{G}{y,x}) \proves \forall x\forall y (\atom{G}{x,y} \eiff \atom{G}{y,x})$
\item $\forall x(\enot\atom{M}{x} \eor \atom{L}{j,x}), \forall x(\atom{B}{x}\eif \atom{L}{j,x}), \forall x(\atom{M}{x}\eor \atom{B}{x})\proves \forall x\atom{L}{j,x}$
\end{earg}

\solutions
\problempart
\label{pr.likes}
Write a symbolization key for the following argument, symbolize it, and prove it:
\begin{quote}
There is someone who likes everyone who likes everyone that she likes. Therefore, there is someone who likes herself.
\end{quote}

\problempart
Show that each pair of sentences is provably equivalent.
\begin{earg}
\item $\forall x (\atom{A}{x}\eif \enot \atom{B}{x})$, $\enot\exists x(\atom{A}{x} \eand \atom{B}{x})$
\item $\forall x (\enot\atom{A}{x}\eif \atom{B}{d})$, $\forall x\,\atom{A}{x} \eor \atom{B}{d}$
\item $\exists x\,\atom{P}{x} \eif \atom{Q}{c}$, $\forall x (\atom{P}{x} \eif \atom{Q}{c})$
\end{earg}

\solutions
\problempart
\label{pr.FOLequivornot}
For each of the following pairs of sentences: If they are provably equivalent, give proofs to show this. If they are not, construct an interpretation to show that they are not logically equivalent.
\begin{earg}
\item $\forall x\,\atom{P}{x} \eif \atom{Q}{c}, \forall x (\atom{P}{x} \eif \atom{Q}{c})$
\item $\forall x\,\forall y\, \forall z\,\atom{B}{x,y,z}, \forall x\,\atom{B}{x,x}x$
\item $\forall x\,\forall y\,\atom{D}{x,y}, \forall y\,\forall x\,\atom{D}{x,y}$
\item $\exists x\,\forall y\,\atom{D}{x,y}, \forall y\,\exists x\,\atom{D}{x,y}$
\item $\forall x (\atom{R}{c,a} \eiff \atom{R}{x,a}), \atom{R}{c,a} \eiff \forall x\,\atom{R}{x,a}$
\end{earg}

\solutions
\problempart
\label{pr.FOLvalidornot}
For each of the following arguments: If it is valid in FOL, give a proof. If it is invalid, construct an interpretation to show that it is invalid.
\begin{earg}
\item $\exists y\,\forall x\,\atom{R}{x,y} \therefore \forall x\,\exists y\,\atom{R}{x,y}$
\item $\forall x\,\exists y\,\atom{R}{x,y} \therefore  \exists y\,\forall x\,\atom{R}{x,y}$
\item $\exists x(\atom{P}{x} \eand \enot \atom{Q}{x}) \therefore \forall x(\atom{P}{x} \eif \enot \atom{Q}{x})$
\item $\forall x(\atom{S}{x} \eif \atom{T}{a}), \atom{S}{d} \therefore \atom{T}{a}$
\item $\forall x(\atom{A}{x}\eif \atom{B}{x}), \forall x(\atom{B}{x} \eif \atom{C}{x}) \therefore \forall x(\atom{A}{x} \eif \atom{C}{x})$
\item $\exists x(\atom{D}{x} \eor \atom{E}{x}), \forall x(\atom{D}{x} \eif \atom{F}{x}) \therefore \exists x(\atom{D}{x} \eand \atom{F}{x})$
\item $\forall x\,\forall y(\atom{R}{x,y} \eor \atom{R}{y,x}) \therefore \atom{R}{j,j}$
\item $\exists x\,\exists y(\atom{R}{x,y} \eor \atom{R}{y,x}) \therefore \atom{R}{j,j}$
\item $\forall x\,\atom{P}{x} \eif \forall x\,\atom{Q}{x}, \exists x\, \enot\atom{P}{x} \therefore \exists x\, \enot \atom{Q}{x}$
\item $\exists x\,\atom{M}{x} \eif \exists x\,\atom{N}{x}$, $\enot \exists x\,\atom{N}{x}\therefore  \forall x\, \enot \atom{M}{x}$
\end{earg}

\chapter{Proofs with quantifiers}

In \S\ref{s:stratTFL} we discussed strategies for constructing proofs using the basic rules of natural deduction for TFL. The same principles apply to the rules for the quantifiers. If we want to prove a quantifier sentence $\forall \metav{x}\, \atom{\metav{A}}{\metav{x}}$ or $\exists \metav{x}\, \atom{\metav{A}}{\metav{x}}$. We can work backward by justifying the sentence we want by $\forall$I or $\exists$I and trying to find a proof of the corresponding premise of that rule. And to work forward from a quantified sentence, we apply $\forall$E or $\exists$E, as the case may be.

Specifically, suppose you want to prove $\forall \metav{x}\, \atom{\metav{A}}{\metav{x}}$. To do so using $\forall$I, we would need a proof of $\atom{\metav{A}}{\metav{c}}$ for some name~$\metav{c}$ which does not occur in any undischarged assumption. To apply the corresponding strategy, i.e., to construct a proof of $\forall \metav{x}\, \atom{\metav{A}}{\metav{x}}$ by working backward, is thus to write $\atom{\metav{A}}{\metav{c}}$ above it and then to continue to try to find a proof of that sentence.
\begin{fitchproof}
	\ellipsesline
	\have[n]{n}{\atom{\metav{A}}{\metav{c}}}
	\have{m}{\forall \metav{x}\, \atom{\metav{A}}{\metav{x}}}\Ai{n}
\end{fitchproof}
$\atom{\metav{A}}{\metav{c}}$ is obtained from $\atom{\metav{A}}{\metav{x}}$ by replacing every free occurrence of $\metav{x}$ in $\atom{\metav{A}}{\metav{x}}$ by~$\metav{c}$. For this to work, $\metav{c}$ must satisfy the special condition. We can ensure that it does by always picking a name that does not already occur in the proof constructed so far. (Of course, it will occur in the proof we end up constructing---just not in an assumption that is undischarged at line~$n+1$.)

To work backward from a sentence $\exists \metav{x}\, \atom{\metav{A}}{\metav{x}}$ we similarly write a sentence above it that can serve as a justification for an application of the $\exists$I rule, i.e., a sentence of the form $\atom{\metav{A}}{\metav{c}}$.
\begin{fitchproof}
	\ellipsesline
	\have[n]{n}{\atom{\metav{A}}{\metav{c}}}
	\have{m}{\exists \metav{x}\, \atom{\metav{A}}{\metav{x}}}\Ei{n}
\end{fitchproof}
This looks just like what we would do if we were working backward from a universally quantified sentence. The difference is that whereas for $\forall$I we have to pick a name~$\metav{c}$ which does not occur in the proof (so far), for $\exists$I we may and in general must pick a name~$\metav{c}$ which already occurs in the proof.  Just like in the case of $\eor$I, it is often not clear which $\metav{c}$ will work out, and so to avoid having to backtrack you should work backward from existentially quantified sentences only when all other strategies have been applied.

By contrast, working \emph{forward} from sentences $\exists \metav{x}\, \atom{\metav{A}(\metav{x}})$ generally always works and you won't have to backtrack. Working forward from an existentially quantified sentence takes into account not just $\exists \metav{x}\, \atom{\metav{A}}{\metav{x}}$ but also whatever sentence $\metav{B}$ you would like to prove. It requires that you set up a subproof above $\metav{B}$, wherein $\metav{B}$ is the last line, and a substitution instance $\atom{\metav{A}}{\metav{c}}$ of $\exists \metav{x}\, \atom{\metav{A}}{\metav{x}}$ as the assumption.  In order to ensure that the condition on $\metav{c}$ that governs $\exists$E is satisfied, chose a name $\metav{c}$ which does not already occur in the proof.
\begin{fitchproof}
	\ellipsesline
	\have[m]{m}{\exists \metav{x}\, \atom{\metav{A}}{\metav{x}}}
	\ellipsesline
	\open
	\hypo[n]{n}{\atom{\metav{A}}{\metav{c}}}
	\ellipsesline
	\have[k]{k}{\metav{B}}
	\close
	\have{e}{\metav{B}}\Ee{m,n-k}
\end{fitchproof}
You'll then continue with the goal of proving $\metav{B}$, but now inside a subproof in which you have an additional sentence to work with, namely~$\atom{\metav{A}}{\metav{c}}$.

Lastly, working forward from $\forall \metav{x}\, \atom{\metav{A}}{\metav{x}}$ means that you can always write down $\atom{\metav{A}}{\metav{c}}$ and justify it using $\forall$E, for any name~$\metav{c}$. Of course, you wouldn't want to do that willy-nilly. Only certain names $\metav{c}$ will help in your task of proving whatever goal sentence you are working on. So, like working backward from $\exists \metav{x}\, \atom{\metav{A}}{\metav{x}}$, you should work forward from $\forall \metav{x}\, \atom{\metav{A}}{\metav{x}}$ only after all other strategies have been applied.

Let's consider as an example the argument $\forall x(\atom{A}{x} \eif B) \therefore \exists x\,\atom{A}{x} \eif B$. To start constructing a proof, we write the premise at the top and the conclusion at the bottom.
\begin{fitchproof}
\hypo{1}{\forall x(\atom{A}{x} \eif B)}
\ellipsesline
\have[n]{7}{\exists x\,\atom{A}{x} \eif B}
\end{fitchproof}
The strategies for connectives of TFL still apply, and you should apply them in the same order: first work backward from conditionals, negated sentences, conjunctions, and now also universal quantifiers, then forward from disjunctions and now existential quantifiers, and only then try to apply $\eif$E, $\enot$E, $\lor$I, $\forall$E, or $\exists$I. In our case, that means, working backward from the conclusion:
\begin{fitchproof}
	\hypo{1}{\forall x(\atom{A}{x} \eif B)}
	\open
	\hypo{2}{\exists x\,\atom{A}{x}}
	\ellipsesline
	\have[n][-1]{6}{B}
	\close
	\have[n]{7}{\exists x\,\atom{A}{x} \eif B}\ci{2-(6)}
\end{fitchproof}
Our next step should be to work forward from $\exists x\,\atom{A}{x}$ on line~$2$. For that, we have to pick a name not already in our proof. Since no names appear, we can pick any name, say~`$d$'
\begin{fitchproof}
	\hypo{1}{\forall x(\atom{A}{x} \eif B)}
	\open
	\hypo{2}{\exists x\,\atom{A}{x}}
	\open
	\hypo{3}{\atom{A}{d}}
	\ellipsesline
	\have[n][-2]{5}{B}
	\close
	\have[n][-1]{6}{B}\Ee{2,3-(5)}
	\close
	\have[n]{7}{\exists x\,\atom{A}{x} \eif B}\ci{2-(6)}
\end{fitchproof}
Now we've exhausted our primary strategies, and it is time to work forward from the premise $\forall x(\atom{A}{x} \eif B)$. Applying $\forall$E means we can justify any instance of $A(\metav{c}) \eif B$, regardless of what $\metav{c}$ we choose. Of course, we'll do well to choose $d$, since that will give us $\atom{A}{d} \eif B$. Then we can apply $\eif$E to justify~$B$, finishing the proof.
\begin{fitchproof}
	\hypo{1}{\forall x(\atom{A}{x} \eif B)}
	\open
	\hypo{2}{\exists x\,\atom{A}{x}}
	\open
	\hypo{3}{\atom{A}{d}}
\have{4}{\atom{A}{d} \eif B}\Ae{1}
	\have{5}{B}\ce{4,3}
	\close
	\have{6}{B}\Ee{2,3-5}
	\close
	\have{7}{\exists x\,\atom{A}{x} \eif B}\ci{2-6}
\end{fitchproof}

Now let's construct a proof of the converse. We begin with
\begin{fitchproof}
	\hypo{1}{\exists x\,\atom{A}{x} \eif B}
	\ellipsesline
	\have[n]{7}{\forall x(\atom{A}{x} \eif B)}
\end{fitchproof}
Note that the premise is a conditional, not an existentially quantified sentence, so we should not (yet) work forward from it. Working backward from the conclusion, $\forall x(\atom{A}{x} \eif B)$, leads us to look for a proof of $\atom{A}{d} \eif B$:
\begin{fitchproof}
	\hypo{1}{\exists x\,\atom{A}{x} \eif B}
	\ellipsesline
	\have[n][-1]{6}{\atom{A}{d} \eif B}
	\have[n]{7}{\forall x(\atom{A}{x} \eif B)}\Ai{6}
\end{fitchproof}
And working backward from $\atom{A}{d} \eif B$ means we should set up a subproof with $\atom{A}{d}$ as an assumption and $B$ as the last line:
\begin{fitchproof}
	\hypo{1}{\exists x\,\atom{A}{x} \eif B}
	\open
	\hypo{2}{\atom{A}{d}}
	\ellipsesline
	\have[n][-2]{5}{B}
	\close
	\have[n][-1]{6}{\atom{A}{d} \eif B}\ci{2-(5)}
	\have[n]{7}{\forall x(\atom{A}{x} \eif B)}\Ai{6}
\end{fitchproof}
Now we can work forward from the premise on line~$1$. That's a conditional, and its consequent happens to be the sentence~$B$ we are trying to justify. So we should look for a proof of its antecedent, $\exists x\,\atom{A}{x}$. Of course, that is now readily available, by $\exists$I from line~$2$, and we're done:
\begin{fitchproof}
	\hypo{1}{\exists x\,\atom{A}{x} \eif B}
	\open
	\hypo{2}{\atom{A}{d}}
	\have{3}{\exists x\,\atom{A}{x}}\Ei{2}
	\have{5}{B}\ce{1,3}
	\close
	\have{6}{\atom{A}{d} \eif B}\ci{2-5}
	\have{7}{\forall x(\atom{A}{x} \eif B)}\Ai{6}
\end{fitchproof}

\practiceproblems

\problempart
Use the strategies to find proofs for each of the following arguments and theorems:
\begin{earg}
\item $A \eif \forall x\,\atom{B}{x} \therefore \forall x(A \eif \atom{B}{x})$
\item $\exists x(A \eif \atom{B}{x}) \therefore A \eif \exists x\, \atom{B}{x}$
\item $\forall x(\atom{A}{x} \eand \atom{B}{x}) \eiff (\forall x\,\atom{A}{x} \eand \forall x\,\atom{B}{x})$
\item $\exists x(\atom{A}{x} \eor \atom{B}{x}) \eiff (\exists x\,\atom{A}{x} \eor \exists x\,\atom{B}{x})$
\item $A \eor \forall x\,\atom{B}{x}) \therefore \forall x(A \eor \atom{B}{x})$
\item $\forall x(\atom{A}{x} \eif B) \therefore \exists x\,\atom{A}{x} \eif B$
\item $\exists x(\atom{A}{x} \eif B) \therefore \forall x\,\atom{A}{x} \eif B$
\item $\forall x(\atom{A}{x} \eif \exists y\,\atom{A}{y})$
\end{earg}
Use only the basic rules of TFL in addition to the basic quantifier rules.

\problempart
Use the strategies to find proofs for each of the following arguments and theorems:
\begin{earg}
\item $\forall x\,\atom{R}{x,x} \therefore \forall x\,\exists y\,\atom{R}{x,y}$
\item $\forall x\,\forall y\,\forall z[(\atom{R}{x,y} \eand \atom{R}{y,z}) \eif \atom{R}{x,z}]$ \\
$\therefore \forall x\,\forall y[\atom{R}{x,y} \eif \forall z(\atom{R}{y,z} \eif \atom{R}{x,z})]$
\item $\forall x\,\forall y\,\forall z[(\atom{R}{x,y} \eand \atom{R}{y,z}) \eif \atom{R}{x,z}],$\\ $\forall x\,\forall y(\atom{R}{x,y} \eif \atom{R}{y, x})$ \\ $\therefore \forall x\,\forall y\,\forall z[(\atom{R}{x,y} \eand \atom{R}{x,z}) \eif \atom{R}{y,z}]$
\item $\forall x\,\forall y(\atom{R}{x,y} \eif \atom{R}{y, x})$ \\$\therefore \forall x\,\forall y\,\forall z[(\atom{R}{x,y} \eand \atom{R}{x,z}) \eif \exists u(\atom{R}{y,u} \eand \atom{R}{z,u})]$
\item $\enot \exists x\,\forall y (\atom{A}{x, y} \eiff \lnot\atom{A}{y, y})$
\end{earg}

\problempart
Use the strategies to find proofs for each of the following arguments and theorems:
\begin{earg}
\item $\forall x\,\atom{A}{x} \eif B \therefore \exists x(\atom{A}{x} \eif B)$
\item $A \eif \exists x\, \atom{B}{x} \therefore \exists x(A \eif \atom{B}{x})$
\item $\forall x(A \eor \atom{B}{x}) \therefore A \eor \forall x\,\atom{B}{x})$
\item $\exists x(\atom{A}{x} \eif \forall y\,\atom{A}{y})$
\item $\exists x(\exists y\,\atom{A}{y} \eif \atom{A}{x})$
\end{earg}
These require the use of IP. Use only the basic rules of TFL in addition to the basic quantifier rules.

\chapter{Conversion of quantifiers}\label{s:CQ}

In this section, we will add some additional rules to the basic rules of the previous section. These govern the interaction of quantifiers and negation.

In \S\ref{s:FOLBuildingBlocks}, we noted that $\enot\exists x\metav{A}$ is logically equivalent to $\forall x\, \enot\metav{A}$. We will add some rules to our proof system that govern this. In particular, we add:
	\factoidbox{
	\begin{fitchproof}
		\have[m]{a}{\forall \metav{x}\, \enot\metav{A}}
		\have[\ ]{con}{\enot \exists \metav{x}\, \metav{A}}\cq{a}
	\end{fitchproof}}
and
\factoidbox{
	\begin{fitchproof}
		\have[m]{a}{ \enot \exists \metav{x}\, \metav{A}}
		\have[\ ]{con}{\forall \metav{x}\, \enot \metav{A}}\cq{a}
	\end{fitchproof}}
Equally, we add:
\factoidbox{
	\begin{fitchproof}
		\have[m]{a}{\exists \metav{x}\, \enot \metav{A}}
		\have[\ ]{con}{\enot \forall \metav{x}\, \metav{A}}\cq{a}
	\end{fitchproof}}
and
\factoidbox{
	\begin{fitchproof}
		\have[m]{a}{\enot \forall \metav{x}\, \metav{A}}
		\have[\ ]{con}{\exists \metav{x}\, \enot \metav{A}}\cq{a}
	\end{fitchproof}}

\practiceproblems
\problempart
Show in each case that the sentences are provably inconsistent:
\begin{earg}
\item $\atom{S}{a}\eif \atom{T}{m}, \atom{T}{m} \eif \atom{S}{a}, \atom{T}{m} \eand \enot \atom{S}{a}$
\item $\enot\exists x\,\atom{R}{x,a}, \forall x\, \forall y\,\atom{R}{y,x}$
\item $\enot\exists x\, \exists y\,\atom{L}{x,y}, \atom{L}{a,a}$
\item $\forall x(\atom{P}{x} \eif \atom{Q}{x}), \forall z(\atom{P}{z} \eif \atom{R}{z}), \forall y\,\atom{P}{y}, \enot \atom{Q}{a} \eand \enot \atom{R}{b}$
\end{earg}

\problempart
Show that each pair of sentences is provably equivalent:
\begin{earg}
\item $\forall x (\atom{A}{x}\eif \enot \atom{B}{x}), \enot\exists x(\atom{A}{x} \eand \atom{B}{x})$
\item $\forall x (\enot\atom{A}{x}\eif \atom{B}{d}), \forall x\,\atom{A}{x} \eor \atom{B}{d}$
\end{earg}

\problempart
In \S\ref{s:MoreMonadic}, we considered what happens when we move quantifiers `across' various logical operators. Show that each pair of sentences is provably equivalent:
\begin{earg}
\item $\forall x(\atom{F}{x} \eand \atom{G}{a}), \forall x\,\atom{F}{x} \eand \atom{G}{a}$
\item $\exists x(\atom{F}{x} \eor \atom{G}{a}), \exists x\,\atom{F}{x} \eor \atom{G}{a}$
\item $\forall x(\atom{G}{a} \eif \atom{F}{x}), \atom{G}{a} \eif \forall x\,\atom{F}{x}$
\item $\forall x(\atom{F}{x} \eif \atom{G}{a}), \exists x\,\atom{F}{x} \eif \atom{G}{a}$
\item $\exists x(\atom{G}{a} \eif \atom{F}{x}), \atom{G}{a} \eif \exists x\,\atom{F}{x}$
\item $\exists x(\atom{F}{x} \eif \atom{G}{a}), \forall x\,\atom{F}{x} \eif \atom{G}{a}$
\end{earg}
NB: the variable `$x$' does not occur in `$\atom{G}{a}$'. When all the quantifiers occur at the beginning of a sentence, that sentence is said to be in \emph{prenex normal form}. These equivalences are sometimes called \emph{prenexing rules}, since they give us a means for putting any sentence into prenex normal form.

\chapter{Rules for identity}
In \S\ref{s:Interpretations}, we mentioned the philosophically contentious thesis of the \emph{identity of indiscernibles}. This is the claim that objects which are indiscernible in every way are, in fact, identical to each other. It was also mentioned that we will not subscribe to this thesis. It follows that, no matter how much you learn about two objects, we cannot prove that they are identical. That is unless, of course, you learn that the two objects are, in fact, identical, but then the proof will hardly be very illuminating.

The general point, though, is that \emph{no sentences} which do not already contain the identity predicate could justify an inference to `$a=b$'. So our identity introduction rule cannot allow us to infer to an identity claim containing two \emph{different} names.

However, every object is identical to itself. No premises, then, are required in order to conclude that something is identical to itself. So this will be the identity introduction rule:
\factoidbox{
\begin{fitchproof}
	\have[\ \,\,\,]{x}{\metav{c}=\metav{c}} \by{=I}{}
\end{fitchproof}}
Notice that this rule does not require referring to any prior lines of the proof. For any name \metav{c}, you can write $\metav{c}=\metav{c}$ on any point, with only the {=}I rule as justification.

Our elimination rule is more fun. If you have established `$a=b$', then anything that is true of the object named by `$a$' must also be true of the object named by `$b$'. For any sentence with `$a$' in it, you can replace some or all of the occurrences of `$a$' with `$b$' and produce an equivalent sentence. For example, from `$\atom{R}{a,a}$' and `$a = b$', you are justified in inferring `$\atom{R}{a,b}$', `$\atom{R}{b,a}$' or `$\atom{R}{b,b}$'. More generally:
\factoidbox{\begin{fitchproof}
	\have[m]{e}{\metav{a}=\metav{b}}
	\have[n]{a}{\metav{A}(\ldots \metav{a} \ldots \metav{a}\ldots)}
	\have[\ ]{ea1}{\metav{A}(\ldots \metav{b} \ldots \metav{a}\ldots)} \by{=E}{e,a}
\end{fitchproof}}
The notation here is as for $\exists$I. So $\metav{A}(\ldots \metav{a} \ldots \metav{a}\ldots)$ is a formula containing the name $\metav{a}$, and $\metav{A}(\ldots \metav{b} \ldots \metav{a}\ldots)$ is a formula obtained by replacing one or more instances of the name $\metav{a}$ with the name $\metav{b}$. Lines $m$ and $n$ can occur in either order, and do not need to be adjacent, but we always cite the statement of identity first. Symmetrically, we allow:
\factoidbox{\begin{fitchproof}
	\have[m]{e}{\metav{a}=\metav{b}}
	\have[n]{a}{\metav{A}(\ldots \metav{b} \ldots \metav{b}\ldots)}
	\have[\ ]{ea2}{\metav{A}(\ldots \metav{a} \ldots \metav{b}\ldots)} \by{=E}{e,a}
\end{fitchproof}}
This rule is sometimes called \emph{Leibniz's Law}, after Gottfried Leibniz.

To see the rules in action, we will prove some quick results. First, we will prove that identity is \emph{symmetric}:
\begin{fitchproof}
	\open
		\hypo{ab}{a = b}
		\have{aa}{a = a}\by{=I}{}
		\have{ba}{b = a}\by{=E}{ab, aa}
	\close
	\have{abba}{a = b \eif b =a}\ci{ab-ba}
	\have{ayya}{\forall y (a = y \eif y = a)}\Ai{abba}
	\have{xyyx}{\forall x\, \forall y (x = y \eif y = x)}\Ai{ayya}
\end{fitchproof}
We obtain line 3 by replacing one instance of `$a$' in line 2 with an instance of `$b$'; this is justified given `$a= b$'.

Second, we will prove that identity is \emph{transitive}:
\begin{fitchproof}
	\open
		\hypo{abc}{a = b \eand b = c}
		\have{ab}{a = b}\ae{abc}
		\have{bc}{b = c}\ae{abc}
		\have{ac}{a = c}\by{=E}{ab, bc}
	\close
	\have{con}{(a = b \eand b =c) \eif a = c}\ci{abc-ac}
	\have{conz}{\forall z((a = b \eand b = z) \eif a = z)}\Ai{con}
	\have{cony}{\forall y\,\forall z((a = y \eand y = z) \eif a = z)}\Ai{conz}
	\have{conx}{\forall x\,\forall y \forall z((x = y \eand y = z) \eif x = z)}\Ai{cony}
\end{fitchproof}
We obtain line 4 by replacing `$b$' in line 3 with `$a$'; this is justified given `$a= b$'.

\practiceproblems
\problempart
\label{pr.identity}
Provide a proof of each claim.
\begin{earg}
\item $\atom{P}{a} \eor \atom{Q}{b}, \atom{Q}{b} \eif b=c, \enot\atom{P}{a} \proves \atom{Q}{c}$
\item $m=n \eor n=o, \atom{A}{n} \proves \atom{A}{m} \eor \atom{A}{o}$
\item $\forall x\ x=m, \atom{R}{m,a} \proves \exists x\,\atom{R}{x,x}$
\item $\forall x\,\forall y(\atom{R}{x,y} \eif x=y)\proves \atom{R}{a,b} \eif \atom{R}{b,a}$
\item $\enot \exists x\enot x = m \proves \forall x\,\forall y (\atom{P}{x} \eif \atom{P}{y})$
\item $\exists x\,\atom{J}{x}, \exists x\, \enot\atom{J}{x}\proves \exists x\, \exists y\, \enot x = y$
\item $\forall x(x=n \eiff \atom{M}{x}), \forall x(\atom{O}{x} \eor \enot \atom{M}{x})\proves \atom{O}{n}$
\item $\exists x\,\atom{D}{x}, \forall x(x=p \eiff \atom{D}{x})\proves \atom{D}{p}$
\item $\exists x\bigl[(\atom{K}{x} \eand \forall y(\atom{K}{y} \eif x=y)) \eand \atom{B}{x}\bigr], Kd\proves \atom{B}{d}$
\item $\proves \atom{P}{a} \eif \forall x(\atom{P}{x} \eor \enot x = a)$
\end{earg}

\problempart
Show that the following are provably equivalent:
\begin{ebullet}
\item $\exists x \bigl([\atom{F}{x} \eand \forall y (\atom{F}{y} \eif x = y)] \eand x = n\bigr)$
\item $\atom{F}{n} \eand \forall y (\atom{F}{y} \eif n= y)$
\end{ebullet}
And hence that both have a decent claim to symbolize the English sentence `Nick is the~$F$'.\\

\problempart
In \S\ref{sec.identity}, we claimed that the following are logically equivalent symbolizations of the English sentence `there is exactly one $F$':
\begin{ebullet}
\item $\exists x\,\atom{F}{x} \eand \forall x\, \forall y \bigl[(\atom{F}{x} \eand \atom{F}{y}) \eif x = y\bigr]$
\item $\exists x \bigl[\atom{F}{x} \eand \forall y (\atom{F}{y} \eif x = y)\bigr]$
\item $\exists x\, \forall y (\atom{F}{y} \eiff x = y)$
\end{ebullet}
Show that they are all provably equivalent. (\emph{Hint}: to show that three claims are provably equivalent, it suffices to show that the first proves the second, the second proves the third and the third proves the first; think about why.)

\
\problempart
Symbolize the following argument
	\begin{quote}
		There is exactly one $F$. There is exactly one $G$. Nothing is both $F$ and~$G$. So: there are exactly two things that are either~$F$ or~$G$.
	\end{quote}
And offer a proof of it.
%\begin{ebullet}
%\item  $\exists x \bigl[\atom{F}{x} \eand \forall y (\atom{F}{y} \eif x = y)\bigr], \exists x \bigl[\atom{G}{x} \eand \forall y (\atom{G}{y} \eif x = y)\bigr], \forall x (\enot\atom{F}{x} \eor \enot \atom{G}{x}) \proves \exists x\, \exists y \bigl[\enot x = y \eand \forall z ((\atom{F}{z} \eor \atom{G}{z}) \eif (x = y \eor x = z))\bigr]$
%\end{ebullet}

\chapter{Derived rules}\label{s:DerivedFOL}
As in the case of TFL, we first introduced some rules for FOL as basic (in \S\ref{s:BasicFOL}), and then added some further rules for conversion of quantifiers (in \S\ref{s:CQ}). In fact, the CQ rules should be regarded as \emph{derived} rules, for they can be derived from the  \emph{basic} rules of \S\ref{s:BasicFOL}. (The point here is as in \S\ref{s:Derived}.) Here is a justification for the first CQ rule:
\begin{fitchproof}
	\hypo{An}{\forall x\, \enot \atom{A}{x}}
	\open
		\hypo{E}{\exists x\, \atom{A}{x}}
		\open
			\hypo{c}{\atom{A}{c}}%\by{for $\exists$E}{}
			\have{nc}{\enot \atom{A}{c}}\Ae{An}
			\have{red}{\ered}\ne{nc,c}
		\close
		\have{red2}{\ered}\Ee{E,c-red}
	\close
	\have{dada}{\enot \exists x\, \atom{A}{x}}\ni{E-red2}
\end{fitchproof}
%You will note that on line 3 I have written `for $\exists$E'. This is not technically a part of the proof. It is just a reminder---to me and to you---of why I have bothered to introduce `$\enot \atom{A}{c}$' out of the blue. You might find it helpful to add similar annotations to assumptions when performing proofs. But do not add annotations on lines other than assumptions: the proof requires its own citation, and your annotations will clutter it.
Here is a justification of the third CQ rule:
\begin{fitchproof}
	\hypo{nEna}{\exists x\, \enot \atom{A}{x}}
	\open
		\hypo{Aa}{\forall x\, \atom{A}{x}}
		\open
			\hypo{nac}{\enot \atom{A}{c}}%\by{for $\exists$E}{}
			\have{a}{\atom{A}{c}}\Ae{Aa}
			\have{con}{\ered}\ne{nac,a}
		\close
		\have{con1}{\ered}\Ee{nEna, nac-con}
	\close
	\have{dada}{\enot \forall x\, \atom{A}{x}}\ni{Aa-con1}
\end{fitchproof}
This explains why the CQ rules can be treated as derived. Similar justifications can be offered for the other two CQ rules.

\practiceproblems

\problempart
Offer proofs which justify the addition of the second and fourth CQ rules as derived rules.

\chapter{Proofs and semantics}
We have used two different turnstiles in this book.  This:
$$\metav{A}_1, \metav{A}_2, \ldots, \metav{A}_n \proves \metav{C}$$
means that there is some proof which ends with $\metav{C}$ and whose only undischarged assumptions are among $\metav{A}_1, \metav{A}_2, \ldots, \metav{A}_n$. This is a \emph{proof-theoretic notion}. By contrast, this:
$$\metav{A}_1, \metav{A}_2, \ldots, \metav{A}_n \entails \metav{C}$$
means that no valuation (or interpretation) makes all of $\metav{A}_1, \metav{A}_2, \ldots, \metav{A}_n$ true and~$\metav{C}$ false. This concerns assignments of truth and falsity to sentences. It is a \emph{semantic notion}.

It cannot be emphasized enough that these are different notions. But we can emphasize it a bit more: \emph{They are different notions.}

Once you have internalised this point, continue reading.

Although our semantic and proof-theoretic notions are different, there is a deep connection between them. To explain this connection,we will start by considering the relationship between validities and theorems.

To show that a sentence is a theorem, you need only produce a proof. Granted, it may be hard to produce a twenty line proof, but it is not so hard to check each line of the proof and confirm that it is legitimate; and if each line of the proof individually is legitimate, then the whole proof is legitimate. Showing that a sentence is a validity, though, requires reasoning about all possible interpretations. Given a choice between showing that a sentence is a theorem and showing that it is a validity, it would be easier to show that it is a theorem.

Contrawise, to show that a sentence is \emph{not} a theorem is hard. We would need to reason about all (possible) proofs. That is very difficult. However, to show that a sentence is not a validity, you need only construct an interpretation in which the sentence is false. Granted, it may be hard to come up with the interpretation; but once you have done so, it is relatively straightforward to check what truth value it assigns to a sentence. Given a choice between showing that a sentence is not a theorem and showing that it is not a validity, it would be easier to show that it is not a validity.

Fortunately, \emph{a sentence is a theorem if and only if it is a validity}. As a result, if we provide a proof of $\metav{A}$ on no assumptions, and thus show that $\metav{A}$ is a theorem, i.e., ${}\proves \metav{A}$, we can legitimately infer that $\metav{A}$ is a validity, i.e., $\entails\metav{A}$. Similarly, if we construct an interpretation in which \metav{A} is false and thus show that it is not a validity, i.e., $\nentails \metav{A}$, it follows that \metav{A} is not a theorem, i.e.,  $\nproves \metav{A}$.

More generally, we have the following powerful result:
$$\metav{A}_1, \metav{A}_2, \ldots, \metav{A}_n \proves\metav{B} \textbf{ iff }\metav{A}_1, \metav{A}_2, \ldots, \metav{A}_n \entails\metav{B}$$
This shows that, whilst provability and entailment are \emph{different} notions, they are extensionally equivalent. As such:
	\begin{ebullet}
		\item An argument is \emph{valid} iff \emph{the conclusion can be proved from the premises}.
		\item Two sentences are \emph{logically equivalent} iff they are \emph{provably equivalent}.
		\item Sentences are \emph{satisfiable} iff they are \emph{not provably inconsistent}.
	\end{ebullet}
For this reason, you can pick and choose when to think in terms of proofs and when to think in terms of valuations/interpretations, doing whichever is easier for a given task. The table on the next page summarises which is (usually) easier.

It is intuitive that provability and semantic entailment should agree. But---let us repeat this---do not be fooled by the similarity of the symbols `$\entails$' and `$\proves$'. These two symbols have very different meanings. The fact that provability and semantic entailment agree is not an easy result to come by.

In fact, demonstrating that provability and semantic entailment agree is, very decisively, the point at which introductory logic becomes intermediate logic.

\begin{sidewaystable}\small
\begin{center}
\begin{tabular*}{\textwidth}{p{.25\textheight}p{.325\textheight}p{.325\textheight}}
 & \textbf{Yes}  & \textbf{No}\\
\\
Is \metav{A} a \textbf{validity}?
& give a proof which shows $\proves\metav{A}$
& give an interpretation in which \metav{A} is false\\
\\
Is \metav{A} a \textbf{contradiction}? &
give a proof which shows $\proves\enot\metav{A}$ &
give an interpretation in which \metav{A} is true\\
\\
%Is \metav{A} contingent? &
%give two interpretations, one in which \metav{A} is true and another in which \metav{A} is false & give a proof which either shows $\proves\metav{A}$ or $\proves\enot\metav{A}$\\
%\\
Are \metav{A} and \metav{B} \textbf{equivalent}? &
give two proofs, one for $\metav{A}\proves\metav{B}$ and one for $\metav{B}\proves\metav{A}$
& give an interpretation in which \metav{A} and \metav{B} have different truth values\\
\\
Are $\metav{A}_1, \metav{A}_2, \ldots, \metav{A}_n$ \textbf{jointly satisfiable}?
& give an interpretation in which all of $\metav{A}_1, \metav{A}_2, \ldots, \metav{A}_n$ are true
& prove a contradiction from assumptions $\metav{A}_1, \metav{A}_2, \ldots, \metav{A}_n$\\
\\
Is $\metav{A}_1, \metav{A}_2, \ldots, \metav{A}_n \therefore \metav{C}$ \textbf{valid}?
& give a proof with assumptions $\metav{A}_1, \metav{A}_2, \ldots, \metav{A}_n$ and concluding with \metav{C}
& give an interpretation in which each of $\metav{A}_1, \metav{A}_2, \ldots, \metav{A}_n$ is true and \metav{C} is false\\
\end{tabular*}
\end{center}
\end{sidewaystable}