![Reflection
Trading in proofs for computations
• Say we have a class of problems P, that we can represent by the
inductive type Problem. So we have [[p]] : Prop for p : Problem.
• Say we can also write a problem solver for Problem, that is
solve : Problem → Bool
• that we can prove correct:
∀p : Problem, [[p]] ←→ solve p = true.
• Then we can replace a goal ? : A for A ∈ P by a computation
solve a, if [[a]] = A.
M. Oostdijk, H.G. Proof by Computation in Coq, TCS 2001](https://image.slidesharecdn.com/geuversslides-130122161019-phpapp02/85/Geuvers-slides-29-320.jpg)
![Even more computation in the system?
Unbounded proof search using a fixed point combinator
• f 0 evaluates to
– n, refl where n is the first number for which P n holds (if
such n exists)
– nothings [runs forever] (if no such n exists).
• Theorem: adding Y to a type system in this way is conservative, i.e.
in case f 0 terminates, it indeed finds a solution in the original
system (without Y ).
H.G., E. Poll, J. Zwanenburg, Safe Proof Checking in Type Theory with
Y , CSL 1999.](https://image.slidesharecdn.com/geuversslides-130122161019-phpapp02/85/Geuvers-slides-31-320.jpg)
Geuvers slides
- 1. De Bruijn’s ideas on the Formalization of Mathematics Herman Geuvers Radboud Universiteit Nijmegen & Technische Universiteit Eindhoven Foundation of Mathematics for Computer-Aided Formalization Padova, 9-11 January 2013
- 2. Dick de Bruijn July 9, 1918 - February 17, 2012
- 3. Checking of Mathematical Proofs with a computer Around 1970 five new systems / projects / ideas • Automath De Bruijn • Nqthm Boyer Moore (Austin, Texas) • LCF Milner (Stanford; Edinburgh) • Mizar Trybulec (Bialystok, Poland) • Evidence Algorithm Glushkov (Kiev, Ukrain) In parallel (and before that): Foundational research in type theoy and proof theory: Martin-L¨f, o Girard, (Howard, Curry, Church; Brouwer, Heyting, Kolmogorov) Interaction between Foundations of Math and Formalization of Math.
- 4. This talk • De Bruijn’s ideas on formalization of mathematics • Where we are now • Comments on (minimalist) foundations
- 5. The Automath project AUTOMATH is a language for expressing detailed mathematical thoughts. It is not a programming language, although it has several features in common with existing programming languages. It is defined by a grammar, and every text written according to its rules is claimed to correspond to correct mathematics. It can be used to express a large part of mathematics, and admits many ways of laying the foundations. The rules are such that a computer can be instructed to check whether texts written in the language are correct. These texts are not restricted to proofs of single theorems; they can contain entire mathematical theories, including the rules of inference used in such theories. AUTOMATH, a language for mathematics, N.G. de Bruijn TH-Report 68-WSK-05, November 1968
- 6. The Automath project • Formal language • Express large parts of mathematics, admitting many ways for laying a foundation. • Computer can check correctness. • Deduction rules can be part of the text (i.e. need not be part of the system)
- 7. The role of proofs in mathematics 1. A proof explains: why? Goal: understanding 2. A proof argues: is it true? Goal: verification, convincing Notably for (2), computersupport can be helpfull.
- 8. The (future) role of formalised proofs in mathematics Some translated quotes from de Bruijn • One should keep in mind that the framework of formalised mathematics is not the same as mathematics itself. • A machine that has checked formalised mathematics hasn’t understood anything. • Formalised mathematics is (just a poor) part of mathematics. Nevertheless, through the ages, mathematicians have tried to put down their ideas in such formalisms, free of unclarities or uncertainties. • The final text is the end of the process of mathematical thought, not the process itself.
- 9. The different phases in a mathematical proof 1. finding a proof Everything goes: experiment, wild guesses, simplify, . . . . Is not preserved (goes to the paper bin), but crucial for students to learn to do math. 2. writing down a proof Contains some explanation why the theorem holds and why the proof is the way it is, but mainly proof-steps that together verify the result. 3. present and communicate a proof Explain to others, present in a seminar. Improve, simplify, change, generalise the proof. Computers can play a major role in (2) and (3)
- 10. Why would we believe a proof assistant? A proof assistant is just another program . . . To increase the reliability of a PA: • Describe the rules and the logic of the system. • A small “kernel”. All proofs can be translated to a small number of basic principles. High level steps are defined in terms of smaller ones.
- 11. How can we believe a proof assistant? • Check the checker. Verify the correctness of the PA inside the system itself, or in another system. • The De Bruijn criterion Some PAs generate proof objects that can be checked independently from the system by a simple program that a skeptical user could write him/herself.
- 12. Automath Propositions-as-Types, Proofs-as-Terms De Bruijn: • A proposition is not a type, but for any proposition A we have T (A), the type of proofs of A. • Proofs-as-Terms (PAT) is the crucial novelty. • Proof-terms are checkable (not necessarily computable . . . )
- 13. Automath Propositions-as-Types, Proofs-as-Terms Isomorphism T between formulas and the types of proofs: Γ ⊢logic ϕ iff Γ ⊢type theory M : T (ϕ) M codes (as a λ-term) the derivation of ϕ. Γ contains • declarations x : A of free variables • assumptions, of the form y : T (ψ) • proven lemmas are definitions, recorded as y := p : T (ψ) (y is a name for the proof p of ψ).
- 14. Automath Propositions-as-Types, Proofs-as-Terms Isomorphism T between formulas and the types of proofs: Γ ⊢logic ϕ iff Γ ⊢type theory M : T (ϕ) Consequence: proof checking = type checking A simple typing algorithm suffices to satisfy the De Bruijn criterion. Automath systems had a small kernel, so for them the typing algorithm is relatively simple.
- 15. Automath Logical Framework Automath is a language for dealing with basic mathematical mechanisms like substitution, variable binding, creating and unfolding of definitions etc.
- 16. Automath Logical Framework A user is free to add the logical rules that he/she wishes ⇒ Automath is a logical framework, where the user can do his/her own favourite logic (or any other formal system). Automath is a big restaurant where one can eat in any style. Those who want to eat kosher, can do that, but do not force others to do the same. Only intolerant people will be upset by the fact that there is room for people with a different opinion. Pluralism! Which should not lead to pillarisation . . .
- 17. Automath Logical Framework De Bruijn’s version of the proof-as-terms principle: Γ ⊢L ϕ iff ΓL , Γ ⊢type theorie M : T (ϕ) where L is a logic, ΓL is the context in which the constructions of the logic L are declared. Choice: Which logical constructions do you put in the type theory and which constructions do you declare axiomatically in the context? De Bruijn: Keep the framework as weak as possible (“ A plea for weaker frameworks”)
- 18. Philosofical implications of Automath On Platonism De Bruijn loves to cite Wittgenstein: Don’t ask for the meaning, ask for its use
- 19. Philosofical implications of Automath constructivism vs. formalism
- 20. Beyond Automath Constructive Type Theory Formulas-als-types isomorphism translates proofs in constructive logic to typed λ-terms, seen as functional programs Martin-L¨f: o • foundations for mathematics • inductive types and functions defined by wefounded recursion are the basic principles • computational content of proofs Proof Assistants based on CTT (and also on LCF and Automath): Nuprl (Constable, Cornell), Agda (Gothenburg), Coq (INRIA, France)
- 21. Present state of affairs Is formalising proofs as simple as using LTEX? A Question Why do mathematicians and engineers all use Computer Algebra systems and LTEX, but not Proof Assistants? A
- 22. Present state of affairs Big formalisations • Proof of the Odd Order Theorem (Walter Feit and John G. Thompson), completely machine-checked using Coq. Mathematical Components team lead by Georges Gonthier (MSR Cambridge) at the Inria Microsoft Research Joint Centre. • Flyspeck Project to produce a formal proof of the Kepler Conjecture. Thomas Hales et al. in HOL-light.
- 23. Present state of affairs Freek Wiedijk: The 100 greatest theorems, 88 formalised 1. The Irrationality of the Square Root of 2 ≥ 17 2. Fundamental Theorem of Algebra 4 3. The Denumerability of the Rational Numbers 6 4. Pythagorean Theorem 6 5. Prime Number Theorem 2 6. G¨del’s Incompleteness Theorem o 3 7. Law of Quadratic Reciprocity 4 8. The Impossibility of Trisecting the Angle and Doubling the Cube 1 9. The Area of a Circle 1 10. Euler’s Generalization of Fermat’s Little Theorem 4 11. The Infinitude of Primes 6 12. The Independence of the Parallel Postulate 0 13. Polyhedron Formula 1 ... google: 100 theorems
- 24. The best proof assistants . . . five systems seriously used for matematics: HOL Light 86 HOL ProofPower 42 Isabelle 49 Coq 49 Mizar 57
- 25. Some comments on (minimalist) foundation
- 26. Putting more semantics into the type theory Partial terms in Proof Assistants Four possible approaches (J. Harrison) 1. Give each partial function a convenient value on points outside its domain. (ACL2; Mizar, HOL, Isabelle) 2. Give each partial function some arbitrary value outside its domain. (Coq, Mizar, HOL, Isabelle) 3. Encode the domain of the partial function in its type and make its application to arguments outside that domain a type error. (PVS, Coq, Nuprl) 4. Have a true logic of partial terms. (IMPS)
- 27. Putting more semantics into the type theory Partial terms in Proof Assistants Is 1/− a total function on IR? How to treat 1/0? • Coq standard library: 1/− is total . . . but then one cannot make a model of IR inside Coq. • CoRN: 1/− needs a proof, 1/− : Πx : IR.x#0 → IR . . . , now one can make a model of IR in Coq, but we cannot even write down 1/0. Add domain conditions D, e.g. D(x/y) = y = 0 • First order logic with domain conditions, F. Wiedijk J. Zwanenburg, TPHOL 2003 • A Partial Functions Version of Church’s Simple Theory of Types William M. Farmer, JSL 55 1990.
- 28. Comments on (minimalist) foundation I More computation in the system • Inductive types and (well-founded) recursive functions turn a PA (Coq, Matita, Agda, Nuprl, . . . ) into a programming language. • This allows programming automated theorem proving techniques inside the system. (Via Reflection) • When the power of this was first shown to Per Martin-L¨f (Kloster o Irsee 1998), he strongly opposed to this . . . “These aren’t proofs!”
- 29. Reflection Trading in proofs for computations • Say we have a class of problems P, that we can represent by the inductive type Problem. So we have [[p]] : Prop for p : Problem. • Say we can also write a problem solver for Problem, that is solve : Problem → Bool • that we can prove correct: ∀p : Problem, [[p]] ←→ solve p = true. • Then we can replace a goal ? : A for A ∈ P by a computation solve a, if [[a]] = A. M. Oostdijk, H.G. Proof by Computation in Coq, TCS 2001
- 30. Even more computation in the system? Unbounded proof search using a fixed point combinator • Say P is a decidable property over the natural numbers: ∀x : N, P x = true ∨ P x = false. We want to prove ∃x : N, P x by an unbounded search. • For f : N → ∃x : N, P x and n : N , define F f n := ifP n then n, refl else f (n + 1) • Take f := Y F (so f is a fixed-point of F ). • Now f : N → ∃x : N, P x
- 31. Even more computation in the system? Unbounded proof search using a fixed point combinator • f 0 evaluates to – n, refl where n is the first number for which P n holds (if such n exists) – nothings [runs forever] (if no such n exists). • Theorem: adding Y to a type system in this way is conservative, i.e. in case f 0 terminates, it indeed finds a solution in the original system (without Y ). H.G., E. Poll, J. Zwanenburg, Safe Proof Checking in Type Theory with Y , CSL 1999.
- 32. Back to simple (linear time?) typechecking? Storing a trace of the conversion in the proof-term • λH := the type theory λP with the following special rules Γ⊢t:A H :A=B H conversion ǫ(a) : a = |a| Γ⊢t :B • We construct an expression H to record the conversion trace between A and B, H : A = B. This is just the usual β(διζ)-path extended with an erasure step. • In λH, type-checking is linear H.G., F. Wiedijk A logical framework with explicit conversions. ENTCS 199 2008
- 33. Compatibility with HOL Present day PAs • The kernel of a PA is not small, except for HOL-light. • HOL is much easier to explain to / convince mathematicians of then inductive types Any minimalist foundation should be compatible with (classical) HOL.
- 34. Compatibility with HOL Are Set and Prop the same? • Prop and Set should be distinct. • HOL + Prop=Setis not conservative over HOL. (H.G. 1989, S. Berardi 1989) • To put it more clearly (S. Berardi 1989): HOL + Prop = Set + EXT + Arithmetic ⊢ ⊥ EXT := ∀A, B : Prop, (A ↔ B) → A = B.
- 35. Foundations of Mathematics for Computer-Aided Formalization A number of issues • If LF is the system to use, or do we need a more foundational approach? • Do we want to formalize what mathematicians do or do we want to change what mathematicians do? Hendrik Lenstra: Why avoid LEM? Then you can prove less theorems!? I want to prove more theorems!
- 36. Questions?