The Nature of Mathematical Proof (Philosophical Transactions of the Royal Society A)

RSTA_363_1835.qxp 9/20/05 6:53 PM Page 3 RSTA_363_1835.qxp 9/20/05 6:53 PM Page 2 volume 461 Editor Professor ...

Author: Alan Bundy | Michael Atiyah | Angus Macintyre | Donald MacKenzie (Editors)

25 downloads 822 Views 3MB Size Report

This content was uploaded by our users and we assume good faith they have the permission to share this book. If you own the copyright to this book and it is wrongfully on our website, we offer a simple DMCA procedure to remove your content from our site. Start by pressing the button below!

Report copyright / DMCA form

DOWNLOAD PDF

RSTA_363_1835.qxp

9/20/05

6:53 PM

Page 3

RSTA_363_1835.qxp

9/20/05

6:53 PM

Page 2

volume 461

Editor Professor J. M. T. Thompson FRS

number 2062 8 October 2005

Editorial Coordinator Cathy Brennan

Hyperasymptotics for nonlinear ODEs. II. The first Painlevé equation and a second-order Riccati equation A. B. Olde Daalhuis

Editorial Board

Quantum fluid mechanical and electronic structure of a hydrogen-like atom H. H. Chiu

J. M. T. Thompson, Editor, Department of Applied Mathematics and Theoretical Physics, Centre for Mathematical Sciences, University of Cambridge A. J. Coates, Mullard Space Science Laboratory, University College London A. G. Davies, School of Electronic and Electrical Engineering, University of Leeds P. J. Dornan, Department of Physics, Imperial College F. J. Dyson, School of Natural Sciences, Institute for Advanced Study, Princeton R. S. Ellis, Astronomy, California Institute of Technology P. Kohl, University Laboratory of Physiology, University of Oxford J. Howard, Department of Chemistry, University of Durham

How turbulence enhances coalescence of settling particles with applications to rain in clouds

J. C. R. Hunt, Department of Space and Climate Physics, University College London J. E. Marsden, Control and Dynamical Systems, California Institute of Technology A. J. Meadows, Department of Information Science, Loughborough University F. C. Moon, Sibley School of Mechanical Engineering, Cornell University G. Stepan, Department of Applied Mechanics, Budapest University of Technology and Economics I. N. Stewart, Department of Mathematics, University of Warwick M. Tabor, Program in Applied Mathematics, University of Arizona J. F. Toland, Department of Mathematical Sciences, University of Bath H. Zhou, Department of Mechanics, Tianjin University

S. Ghosh, J. Dávila, J. C. R. Hunt, A. Srdic, H. J. S. Fernando & P. R. Jonas

Cluster formation in complex multi-scale systems J. D. Gibbon & E. S. Titi

Wave packet pseudomodes of variable coefficient differential operators L. N. Trefethen

Eddy current coil interaction with a right-angled conductive wedge T. P. Theodoulidis & J. R. Bowler

Asymptotic distribution method for structural reliability analysis in high dimensions S. Adhikari

Bounds for some non-standard problems in porous flow and viscous Green–Naghdi fluids R. Quintanilla & B. Straughan

Re-entrant corner flows of UCM fluids: the initial formation of lip vortices J. D. Evans

Dynamic portfolio selection with nonlinear transaction costs T. Chellathurai & T. Draviam

Integrable discrete differential geometry of ‘plated’ membranes in equilibrium W. K. Schief

A Borg–Levinson theorem for trees B. M. Brown & R. Weikard

Geometry of Ca ˘luga ˘reanu’s theorem Editorial Coordinator: Cathy Brennan

Scope. Phil Trans A concentrates on invited papers, in the form of

M. R. Dennis & J. H. Hannay

(tel: +44 (0)20 7451 2633; fax: +44 (0)20 7976 1837;

issues on Themes and Discussions, concerning any aspect of the

On the granular lubrication theory

[email protected]).

physical sciences and engineering, including mathematics and Earth

Journal Production Manager: Matthew Llewellin Production Editor: Iain Finlayson

sciences. Readers are welcome to propose Themes for consideration

6–9 Carlton House Terrace, London SW1Y 5AG, UK

J. Y. Jang & M. M. Khonsari

Modulations on turbulent characteristics by dispersed particles in gas–solid jets K. Luo, J. Fan & K. Cen

by the editorial board of the journal. For information and details on

Computational design of recovery experiments for ductile metals

paper preparation, please consult the Instructions to Authors

N. K. Bourne & G. T. Gray III

(see www.journals.royalsoc.ac.uk).

A new calculation of the work of formation of bubbles and drops J. Lewins

C O P Y R I G H T © 2005 The Royal Society Except as otherwise permitted under the Copyright, Designs and Patents Act, 1988, this publication may only be reproduced, stored or transmitted, in any form or by any means, with the prior permission in writing of the publisher, or, in the case of reprographic reproduction, in accordance with the terms of a licence issued by the Copyright Licensing Agency. In particular, the Society permits the making of a single photocopy of an article from this issue (under Sections 29 and 38 of the Act) for an individual for the purposes of research or private study.

Eshelby formalism for nano-inhomogeneities H. L. Duan, J. Wang, Z. P. Huang & B. L. Karihaloo

SUBSCRIPTIONS

The Royal Society is an independent academy promoting the natural and applied sciences. Founded in 1660, the Society has three roles, as the UK academy of science, as a learned Society, and as a funding agency. It responds to individual demand with selection by merit, not by field. The Society’s objectives are to:

Phil Trans A (ISSN 1364-503X) is published monthly. Full

•

strengthen UK science by providing support to excellent individuals

details of subscriptions may be obtained on request from the Subscriptions Sales Office 6–9 Carlton House Terrace, London SW1Y 5AG (tel. +44 (0)20 7451 2646; fax +44 (0)20 7976 1837; [email protected]). The Royal Society is Registered Charity No 207043.

USA & Canada

All other countries

•

fund excellent research to push back the frontiers of knowledge

£1174

£1238

£1269

•

attract and retain the best scientists

US$2167

US$2288

US$2346

•

ensure the UK engages with the best science around the world

•

support science communication and education; and communicate and encourage dialogue with the public

•

provide the best independent advice nationally and internationally

•

promote scholarship and encourage research into the history of science

Subscription prices 2006 calendar year

Europe

Printed version plus electronic access

For further information on the Society’s activities, please contact the following departments on the extensions listed by dialling +44 (0)20 7839 5561, or visit the Society’s Web site (www.royalsoc.ac.uk). Research Support (UK grants and fellowships) Research appointments: 2547 Research grants: 2539 Conference grants: 2540 Science Advice General enquiries: 2585 Science Communication General enquiries: 2572 International Exchanges (for grants enabling research visits between the UK and most other countries (except the USA)) General enquiries: 2550 Library and Information Services Library/archive enquiries: 2606

Front cover photograph courtesy of NASA, capturing a view of Hurricane Bonnie 500 miles from Bermuda in September 1992. Reproduced with permission of Earth 2000 Ltd, PO Box 37, Bognor Regis, West Sussex, UK. Inset picture: Representation of the 400-year old Kepler Conjecture, which asserts that no packing of congruent spheres has a density greater than that of the commercially familiar face-centred cubic packing.

Typeset in Europe by the Alden Group, Oxford. Printed by the University Press, Cambridge

Phil. Trans. R. Soc. A (2005) 363, 2331–2333 doi:10.1098/rsta.2005.1660 Published online 12 September 2005

Preface Mathematical proof is one of the highest intellectual achievements of humankind. It contains the deepest, most complex and most rigorous arguments of which we are capable. Until the last half century, mathematical proof was the exclusive preserve of human mathematicians. However, following the logical formalisation of proof and the invention of electronic computers, it has become possible to automate the process of proof. Initially, automatic theorem-proving computer programs were only capable of proving trivial theorems. But with the exponentially increasing speed and storage capacity of computers, and the development of more sophisticated theorem-proving software, it has now become possible to prove open conjectures by mechanical means. These developments have raised questions about the nature of mathematical proof. Some have argued that mathematical proof is an essentially social process in which humans interact and convince each other of the correctness of their arguments. Not only are computer ‘proofs’ hard for humans to understand but computers are unable to take part in this social process, so it is argued that whatever theorem-proving computers do, it is not really mathematics. Some proofs, such as the Four Colour Theorem and Kepler’s Conjecture, have required essential computer assistance to check a large number of cases. Because this computer processing is inaccessible to human mathematicians, many of them have refused to accept these part-mechanical proofs. On the other hand, computer scientists routinely use mechanical proof for the formal veriﬁcation of the correctness of their computer programs. They argue that these veriﬁcation proofs are so long and complicated, and humans so error prone, that only a completely computer-checked proof merits the level of conﬁdence required for a safety- or security-critical application. Also, some mathematicians have found computer systems to be a useful experimental tool, which can do not just numeric calculations, but also symbolic, algebraic manipulation and graphical display of the results. Such tools can be highly suggestive, e.g. of new conjectures or approaches. This has generated ﬁerce argument as to the role of experimentation within mathematics. In October 2004, a group of mathematicians, computer scientists, logicians, sociologists, philosophers and others from many diverse disciplines came together at the Royal Society for a two-day debate on the issues listed above—and many related issues. It was a very well attended meeting and generated a lively and constructive debate. This journal records the debate. It contains not just the papers of the many prestigious speakers, but also a record of the discussions following the talks. Also presented are three position statements from the panel One contribution of 13 to a Discussion Meeting Issue ‘The nature of mathematical proof’.

2331

q 2005 The Royal Society

2332

Preface

discussion ‘Formal versus rigorous proof for veriﬁcation’. It provides a wealth of opposing viewpoints and insightful observations into the nature of mathematical proof. In ‘Computing and the cultures of proving’, Donald MacKenzie outlines a ‘Sociology of mathematics’ by surveying the concepts of proof held by different communities of mathematicians and computer scientists. In particular, he contrasts preferences for mechanised versus non-mechanised proof and formal versus rigorous proofs. Henk Barendregt and Freek Wiedijk develop the dreams of those building automatic, logic-based theorem provers. In ‘The challenge of computer mathematics’ they argue for the inevitability of a collaborative approach to mathematics between humans and machines. In ‘What is a proof ?’, Alan Bundy and colleagues try to ﬁnd a middle way—an account of proof that while logic-based and automatable, more closely emulates rigorous, human-constructed proofs than does the traditional, formal, logical account. Our panel discussion on ‘Formal versus rigorous proof for veriﬁcation’ contrasts different approaches to proof even within the Computer Science community, whose interests are primarily on applications of proof to the veriﬁcation that complex computer systems meet their speciﬁcations. Ursula Martin gives an overview of this research area and its history. From the viewpoint of an industrial user of computer proof, Roderick Chapman discusses some of the pragmatic issues that need to be addressed for it to be used routinely by software engineers. Cliff Jones argues for the use of rigorous, as opposed to formal, proof in veriﬁcation. In ‘Highly complex proofs and implications of such proofs’, Michael Aschbacher estimates that the classiﬁcation of ﬁnite simple groups is tens of thousands of pages long and is certain to contain errors. He argues that there will be other highly useful theorems without short elegant proofs and discusses how mathematics must evolve to address the issues this raises. Paul Cohen relates the history of the logical formalisation of mathematics, highlighting the contributions of Frege, Hilbert, Goedel and Skolem. In ‘Skolem and pessimism about proof in mathematics’, he argues that the Skolem–Lowenheim Theorem dealt a body-blow to Hilbert’s Programme and that a vast majority of complex conjectures are beyond the reach of reasoning. He then discusses the practical consequences of these observations for mathematics. Angus MacIntyre reﬂects on the interaction between mathematics, logic and computer-assisted theorem proving in his paper ‘The mathematical signiﬁcance of proof theory’, but he detects a gulf of understanding between the different communities. E. Brian Davies defends ‘Pluralism in mathematics’, i.e. the view that classical mathematics, constructive mathematics, computerassisted mathematics and various forms of ﬁnitistic mathematics can co-exist. Having been at various times in his life, a pure mathematician, an applied mathematician and a computer scientist, Peter Swinnerton-Dyer also argues for a pluralistic attitude to proof and rigour. In ‘The justiﬁcation of mathematical statements’ he argues that different standards of rigour are appropriate depending on the importance, the unexpectedness, the beauty and the application of the resulting theorem. As both MacKenzie and MacIntyre observed, our meeting on the Nature of Mathematical Proof revealed a number of different cultures with many different views of what constitutes a proof. Despite these culture clashes, most Phil. Trans. R. Soc. A (2005)

Preface

2333

participants enjoyed an enormously stimulating and fruitful discussion, with lots of avenues for further interaction and research. We hope that this will be just the beginning of an exciting multi-disciplinary exploration into the nature of mathematical proof. A. Bundy University of Edinburgh

Phil. Trans. R. Soc. A (2005)

Phil. Trans. R. Soc. A (2005) 363, 2335–2350 doi:10.1098/rsta.2005.1649 Published online 9 September 2005

Computing and the cultures of proving B Y D ONALD M AC K ENZIE School of Social & Political Studies, University of Edinburgh, Adam Ferguson Building, Edinburgh EH8 9LL, Scotland ([email protected]) This article discusses the relationship between mathematical proof and the digital computer from the viewpoint of the ‘sociology of proof ’: that is, an understanding of what kinds of procedures and arguments count for whom, under what circumstances, as proofs. After describing brieﬂy the ﬁrst instance of litigation focusing on the nature of mathematical proof, the article describes a variety of ‘cultures of proving’ that are distinguished by whether the proofs they conduct and prefer are (i) mechanized or nonmechanized and (ii) formal proofs or ‘rigorous arguments’. Although these ‘cultures’ mostly coexist peacefully, the occasional attacks from within one on another are of interest in respect to what they reveal about presuppositions and preferences. A variety of factors underpinning the diverse cultures of proving are discussed. Keywords: mathematical proof; sociology of proof; cultures of proving; computer-system veriﬁcation; formal veriﬁcation

1. Introduction The relationship between mathematical proof and the digital computer is at the heart of a number of major scientiﬁc and technological activities: see ﬁgure 1. Proofs are conducted about computers in at least three areas: some of those software systems upon which human lives depend; key aspects of some microprocessors and some systems upon which national security depends. These ‘formal veriﬁcations’, as proofs about the ‘correctness’ (correspondence to speciﬁcation) of the design of computer hardware or software are called, are themselves normally conducted using computer programs; either automated theorem provers (software especially designed to produce proofs, albeit often with human guidance) or model checkers (which check whether a representation of a system is a ‘model’ for the logical formula expressing the system’s speciﬁcation, in other words an interpretation of the logic in which the formula is true). Mathematicians themselves have also turned to the computer for assistance in proofs of great complication, the most famous such cases being the four-colour theorem and Kepler sphere-packing conjecture. Automated theorem provers are also of considerable interest and importance within artiﬁcial intelligence. They raise, for example, the question of the extent to which a computer can replicate the thought processes of human mathematicians. One contribution of 13 to a Discussion Meeting Issue ‘The nature of mathematical proof’.

2335

q 2005 The Royal Society

2336

D. MacKenzie

computer systems on which lives depend

key aspects of (some) microprocessors

computer systems on which national security depends

mathematical proofs: - about computers - using computers

automated theorem provers and model checkers

artificial intelligence: can a computer be an ‘artificial mathematician’?

mathematical proofs of immense complication of detail

Figure 1. Proof and the computer.

The resultant issues are deep, and have played out in historical episodes that I have discussed elsewhere (MacKenzie 2001). In this paper, I focus on the most intriguing question this area throws up for the sociology of science: is it possible to develop a sociology of mathematical proof, in other words a sociological analysis of what kinds of procedures and arguments count for whom, under what circumstances, as proofs? The question is of interest sociologically because of a certain imbalance in the sociological analysis of science, which has focused predominantly on the natural sciences. Relatively little work has been done on the ‘deductive’ sciences of mathematics and logic, and sociological discussion of deductive proof—which is at the core of those disciplines—is sparse (see MacKenzie 2001 for references to the main existing work). Perhaps, the reader may suspect, there has been little ‘sociology of proof ’ because such sociology is impossible? Perhaps mathematical proof is an absolute matter, not subject to the kind of variation that would make it susceptible to sociological analysis. The history of mathematics, however, reveals substantial variation in the kinds of argument that have been taken as constituting mathematical proof (see the survey by Kleiner 1991). Eighteenth century work in calculus, for example, often relied upon manipulating inﬁnitesimally small quantities or inﬁnite series in ways that became unacceptable in the nineteenth century. Early twentieth century mathematics was driven by dispute over the Phil. Trans. R. Soc. A (2005)

Cultures of proving

2337

acceptability, in proofs involving inﬁnite sets, of the law of the excluded middle. (The law is that for any proposition p, ‘p or not-p’ must be true. Invocation of excluded middle permits non-constructive existence proofs, which demonstrate that a mathematical entity exists by showing that its non-existence would imply a contradiction.) The history of mathematics, therefore, suggests that mathematical proof is not the straightforward, absolute matter than it is often taken to be. In 1987, colleagues and I drew upon this evidence to make a prediction about the effort (by then widely pursued) to apply mathematical proof to computer systems. We noted that this effort involved moving mathematical proof into a commercial and regulatory arena. We speculated that the pressures of that arena would force potential variation in the meaning of proof out into the open, but that disputes about proof would no longer simply be academic controversies. We suggested that it might not be long before a court of law had to rule on what a mathematical proof is (Pela´ez et al. 1987). That prediction was nearly borne out in 1991, when litigation broke out in Britain over the application of mathematical proof to a microprocessor chip called VIPER (veriﬁable integrated processor for enhanced reliability), which had been developed by computer scientists working for the Ministry of Defence’s Royal Signals and Radar Establishment. At stake was whether the chain of mathematical reasoning connecting the detailed design of VIPER to its speciﬁcation was strong enough and complete enough to be deemed a proof. Some members of the computer-system veriﬁcation community denied that it was (Cohn 1989; Brock & Hunt 1990), and, largely for unconnected reasons, sales of VIPER were disappointing. Charter Technologies Ltd, a ﬁrm which had licensed aspects of VIPER technology from the Ministry of Defence, took legal action against the Ministry, alleging, amongst other things, that VIPER’s design had not been proven to be a correct implementation of its speciﬁcation. No ‘bug’ had been found in the VIPER chips; indeed, their design had been subjected to an unprecedented amount of testing, simulation, checking and mathematical analysis. At issue was whether or not this process, as it stood immediately prior to the litigation (considerable subsequent work was done on the VIPER veriﬁcation), amounted to a mathematical proof. Matters of fact about what had or had not been done were not central; the key questions that had been raised by critics were about the status, adequacy and completeness, from the viewpoint of mathematical proof, of particular kinds of argument. With the Ministry of Defence vigorously contesting Charter’s allegations, the case failed to come to court only because Charter became bankrupt before the High Court heard it. Had it come to court, it is hard to see how the issue of what, in this context, mathematical proof consists in could have been avoided. The VIPER controversy has been reported elsewhere (MacKenzie 1991), and a single episode has inevitable idiosyncrasies. Let me turn, therefore, to wider issues of the ‘sociology of proof ’ raised by the domains listed in ﬁgure 1. (a ) Mechanized and non-mechanized proofs; formal and rigorous proofs How might one characterize variations in the kinds of mathematical procedures or arguments that are taken, in the ﬁelds listed in ﬁgure 1, as constituting proofs? One dimension of that variation is very simple: it is whether Phil. Trans. R. Soc. A (2005)

2338

D. MacKenzie

a procedure is conducted, or an argument generated, by a human being or by a machine. Controversy in respect to this dimension has focused above all on machine-performed procedures that are too extensive or too complicated for unaided human beings to check. The dependence of the proof of the four-colour theorem on such procedures led to much debate as to whether it was indeed a genuine proof (see MacKenzie 2001). However, the traditional mathematical preference for proofs performed by human beings (or at least surveyable by human beings) is contested when it comes to veriﬁcation of the design of computer systems. The proponents of automated veriﬁcation have argued that mechanization is preferable to reasoning by unaided human beings, prone as we are to lapses of concentration and wishful thinking. One strand of the criticism of the claim of proof for VIPER, for example, was that key steps in the chain of argument had not been subjected to mechanical checking. A second dimension of variation is also familiar: it is whether an argument is a ‘formal proof ’ or a ‘rigorous argument’. A formal proof is a ﬁnite sequence of ‘well-formed’ (that is, to put it loosely, syntactically correct) formulae leading to the theorem, in which each formula either is an axiom of the formal system being used or is derived from previous formulae by application of the system’s rules of logical inference. These rules will normally be syntactic in form, such as the famous modus ponens: if p and ‘p implies q ’ are formulae in the sequence, then q can be added to the sequence. The steps in a formal proof are thus mechanical applications of inference rules, and their correctness can therefore be checked without understanding the meaning of the formulae involved. Rigorous arguments, in contrast, are those arguments that are accepted by mathematicians (or other relevant specialists) as constituting mathematical proofs, but that are not formal proofs in the above sense. The proofs of ordinary Euclidean geometry, for example, are rigorous arguments, not formal proofs: even if they involve deducing a theorem from axioms (and some involve reasoning that it is not, at least directly, of this form), the steps in the deduction are typically not merely applications of rules of logical inference. This is not simply a reﬂection of the antiquity of Euclidean geometry: articles in modern mathematics journals, whatever their subjects, almost never contain formal proofs. A very simple sketch of a ‘rigorous argument’ proof is provided by the famous ‘mutilated chessboard’ puzzle; see ﬁgure 2. The argument in the caption leaves one in no doubt of the correctness of the conclusion, yet it is not a formal proof (and it would not become a formal proof, in the sense in which the term is used in this paper, even if the everyday terms used in the puzzle were replaced by more precise mathematical equivalents). ‘Rigorous arguments’ are often called ‘informal proofs’. I avoid the latter term, however, because informal proof is often assumed to be inferior to formal proof, while preferences between the two are amongst the issues that a sociology of proof needs to investigate. Instead, I draw the notion of ‘rigorous argument’, in the sense in which the phrase is used here, from a UK Ministry of Defence Procurement Executive Standard governing safety-critical software (Ministry of Defence 1991). What fascinates me as a sociologist of science about the formal veriﬁcation of computer systems is that a document such as a defence procurement standard is driven onto the quintessentially philosophical terrain of having to deﬁne what ‘proof ’ is! Phil. Trans. R. Soc. A (2005)

2339

Cultures of proving

× 31 Figure 2. The mutilated chessboard (from Black 1946). Two diagonally opposite corner squares are excised from a chessboard. Can the remaining 62 squares be covered entirely by 31 dominoes, each of which can cover two squares (and no more than two squares)? The answer is ‘no’. An unmutilated chessboard has an equal number of squares (32) of each colour. The two excised squares must be the same colour, so the mutilated chessboard has two squares more of one colour than of the other. Whenever we lay a domino, it covers one square of each colour. If we can cover 60 squares by laying 30 dominoes, the last two uncovered squares must be the same colour, and the 31st domino therefore cannot cover them.

2. Cultures of proving The two dimensions of mechanized versus non-mechanized proofs, and formal proofs versus rigorous arguments, allow a simple map of ‘cultures of proving’ (a term I draw from Livingston 1999, though he discusses only non-mechanized rigorous arguments). In ﬁgure 3 a variety of disciplines or more specialized cultures are located according to the forms of proof they practice or value. Mainstream automated theorem proving (discussed in detail in MacKenzie 2001) values, above all, mechanized formal proofs. Some departures from formality are found in practice—many automated theorem-proving systems employ ‘decision procedures’ (algorithms that determine whether formulae in particular mathematical domains are theorems) that do not generate formal proofs—but such departures are regarded at best as pragmatic necessities and at worst as reasons for condemnation. One theorem-proving specialist interviewed for the research on which this paper is based said that using unveriﬁed decision procedures was ‘like selling your soul to the Devil—you get this enormous power, but what have you lost? You have lost proof, in some sense’. (For details of the interviews drawn on here, see MacKenzie 2001.) In contrast, in ‘ordinary’ mathematics (the mathematics conducted by most members of university mathematics departments, for example) proof is usually non-mechanized rigorous argument. Computers are, of course, playing an Phil. Trans. R. Soc. A (2005)

2340

D. MacKenzie

formal proof

rigorous argument

mechanized

mainstream automated theorem proving

‘Hard’ artificial intelligence

not mechanized

early logicism; Dijkstra’s calculational proofs

ordinary mathematics IBM ‘Cleanroom’

Figure 3. Cultures of proving.

ever-increasing role in mathematical research but, as noted above, there remains a pervasive sense that, in regard to proof, computerized procedures that human beings cannot check in detail are inferior to arguments that mathematicians can grasp in their entirety. Arguably, the key issue is not mechanization per se but unsurveyability: human-generated proofs that are too extensive realistically to be grasped in full are also seen as problematic. Some computer-system veriﬁcations also fall within the quadrant of nonmechanized rigorous argument. Perhaps the key site of such veriﬁcations was IBM’s ‘Cleanroom’, an approach to the development of high-dependability software inspired by Harlan D. Mills (for details; see MacKenzie 2001). In the Cleanroom, proof was an explicitly human and intersubjective activity, a reﬁnement of the familiar process of software review. A Cleanroom proof was an argument that convinced another human being: speciﬁcally, a designer’s or programmer’s argument that convinced his or her fellow team members or other reviewers of the correctness of his or her design or program, for example by convincing them that account had been taken of all possible cases and that the program or design would behave correctly in each case. The claim, ‘It is obvious’, counted as a proof, if to the reviewing team what was claimed was indeed selfevident. Even the use of mathematical notation was not an essential part of proof, except, in the words of Mills and colleagues, ‘in its effect on the person who is the experimental subject’ (Linger et al 1979). That Cleanroom proof explicitly aimed to produce ‘subjective conviction’ was no argument against it, said its proponents, because that was ‘the only type of reasoned conviction possible’ (Linger et al 1979). Mistakes were always possible, but systematic reasoning made human beings less error-prone, and systematic review by other people reduced mistakes even further. Of course, human beings can perform formal proofs as well as rigorousargument proofs. Prior to the digital computer, formal proofs had to be conducted by hand, as in the ‘logicist’ approach to the foundations of mathematics exempliﬁed most famously by Whitehead & Russell (1910–1913). Phil. Trans. R. Soc. A (2005)

Cultures of proving

2341

What is more surprising is that modern computer science contains a subculture within which formal proof is preferred to rigorous argument but in which proofs are conducted by hand rather than by machine. This culture of ‘calculational proof ’ was inspired by the great Dutch theoretical computer scientist Edsger W. Dijkstra and, like early logicism, it occupies the lower left quadrant of ﬁgure 3. Dijkstra believed that mathematics, including the mathematics of computer science, should be performed formally, that is, ‘by manipulating uninterpreted formulae accordingly to explicitly stated rules’ (Dijkstra & Scholten 1990). To do otherwise was, in Dijkstra’s view, to be ‘medieval’ (Dijkstra 1988). Yet Dijkstra was ‘not an enthusiast for the mechanization’ of proof, commenting: ‘Why delegate to a machine what is so much fun to do yourself?’ (MacKenzie 2001). There is, indeed, a signiﬁcant (and to the outsider, a surprising) current of ambivalence about mechanization in the culture of ´elite, theoretical computer science. The iconic representation of this ambivalence is in the matter of writing. Within this strand of computer science, the fountain pen, to others an archaic technology became something of an icon. Dijkstra’s beautifully handwritten lecture notes and correspondence have become famous. One of Dijkstra’s students even hand-wrote, and published in handwritten form, his PhD thesis (van de Snepscheut 1985), to which Dijkstra contributed a handwritten foreword. The ﬁnal, upper right quadrant in ﬁgure 3 is mechanized rigorous argument. Formal proof has been relatively easy to automate. The application of rules of inference to formulae considered simply as strings of symbols can be implemented on a digital computer using syntactic pattern matching. The automation of generic rigorous argument, on the other hand, has been a far more difﬁcult problem. Some parts of what human mathematicians do, such as algebraic manipulation, can relatively readily be mechanized: there are now widely used commercial programs that automate symbol manipulation in ﬁelds like algebra and calculus. There are, however, as yet no ‘artiﬁcial mathematicians’, in the sense of automated systems capable of handling the full spectrum of rigorous arguments used in different ﬁelds of mathematics. Development in this direction is a hard problem in artiﬁcial intelligence, one that some commentators (such as Penrose 1989) deny will ever be solved fully: for progress in this ﬁeld, see Bundy et al. (2005).

3. Conﬂicts over ‘proof ’ Nearly all the time, the cultures of proving listed in ﬁgure 3 have coexisted peacefully alongside each other, often not interacting much. The institutional locations of the two most populous quadrants, mechanized formal proof and nonmechanized rigorous argument (in its ‘ordinary mathematics’ form) have differed, with the former based in university computer science departments, quasi-university research institutes (such as SRI International) and related industrial sectors. Only a small minority of academic mathematicians (that is, members of university mathematics departments) seem to use automated theorem provers, and almost none have contributed to the development of such systems (see MacKenzie 2001). Phil. Trans. R. Soc. A (2005)

2342

D. MacKenzie

Certainly, the different forms of proving need not be taken to be in conﬂict. It is standard, for example, to take the view that a rigorous-argument proof is a sketch that can be translated into a formal proof. Nevertheless, a subtly different interpretation is possible, and was put forward by the mathematical logician Jon Barwise in a comment on the dispute begun by philosopher James Fetzer’s critique of program veriﬁcation (Fetzer 1988). Barwise noted that Fetzer, as an ‘orthodox’ philosopher, and his critics, as proponents of automated theorem proving, took the canonical notion of proof to be formal proof. In this tacit agreement, said Barwise, both sides ‘stumble over a landmine left by the retreating formalists’; both believed that a ‘real proof ’ was a formal one. ‘[A]t the risk of stepping on the toes of my fellow mathematical logicians’, Barwise argued that it was not. Formal proof was only a model of real proof, indeed a ‘severely impoverished’ model: [T]here are many perfectly good proofs that are not modeled in any direct way by a formal proof in any current deductive system. For example, consider proofs where one establishes one of several cases and then observes that the others follow by symmetry considerations. This is a perfectly valid (and ubiquitous) form of mathematical reasoning, but I know of no system of formal deduction that admits of such a general rule. They can’t, because it is not, in general, something one can determine from local, syntactic features of a proof. [I]t could be that the best proofs (in the sense of being most enlightening or easiest to understand) of a program’s correctness will use methods, like symmetry considerations, that are not adequately modeled in the logician’s notion of formal proof, and so which would not be deemed correct by some automated proof checker designed around the formalist’s model (Barwise 1989, p. 849). Differences of opinion over whether formal proof or rigorous argument constitutes ‘real proof ’ indicates the potential for disagreement between cultures of proving. In practice, however, attacks from one culture of proving upon another are quite rare. They are interesting nevertheless, in what they reveal about the presuppositions of the culture from which the attack comes, rather than about the reality of the culture being attacked. Statements of preference for rigorous-argument over formal proof, or vice versa, usually stop short of denying that the less favoured alternative is proof and of asserting that the corpus of knowledge veriﬁable only by its application is therefore defective and its contents are not theorems. Nevertheless, that denial can be found. In a famous attack upon program veriﬁcation, DeMillo et al (1979) argued, in effect, that because program veriﬁcations were formal proofs, and because what mathematicians did was rigorous argument not formal proof, program veriﬁcations were therefore not proofs and their results not theorems. In 1957, the logician Peter Nidditch came close to the opposite claim, when he argued that what mathematicians do is not fully valid proof: In the whole literature of mathematics there is not a single valid proof in the logical sense. The number of original books or papers on mathematics in the course of the last 300 years is of the order of 106; in these, the number of even close approximations to really valid proofs is of the order of 101. In the relatively few places where a mathematician has seriously tried to give a Phil. Trans. R. Soc. A (2005)

Cultures of proving

2343

valid proof, he has always overlooked at least some of the rules of inference and logical theorems of which he has made use and to which he has made no explicit reference. In addition, in these places, the mathematician has failed to pay sufﬁcient critical attention to purely mathematical points of detail (Nidditch 1957, pp. v, 1, 6). Nidditch’s comment was a critique of ordinary rigorous-argument mathematical proof from the viewpoint of logicism. Dijkstra offered a similar critique from the viewpoint of ‘calculational proof ’. One of his famous, widely circulated, handwritten memoranda, dating from 1988, was caustically entitled ‘Real mathematicians don’t prove’. For Dijkstra, the struggle in computing between formalists and ‘real programmers’ (who, as Dijkstra put it, ‘don’t reason about their programs, for reasoning isn’t macho’) was part of a wider battle pervading ‘the rest of mathematics’ between formalists and ‘informalists’: only they don’t call themselves by that negative name: presumably they present themselves as ‘the real mathematicians’—who constantly interpret their formulae and ‘reason’ in terms of the model underlying that interpretation. By rejecting formalism, with its clear distinction between ‘provability’ and ‘the fuzzy metaphysical notion of “truth’’, mathematics remained according to Dijkstra ‘still a discipline with a sizeable pre-scientiﬁc component, in which the spirit of the Middle Ages is allowed to linger on’. Amongst its ‘medieval characteristics’ was that ‘how to do mathematics is not taught explicitly but only by osmosis, as in the tradition of the guilds’ (Dijkstra 1988). Dijkstra’s ‘calculational’ proofs were themselves attacked by Panagiotis Manolios and J Strother Moore, a leading member of the automated theorem proving community, on the grounds that such proofs were not ‘formal’, but ‘rigorous arguments in a strict format. where the notion of proof is “convincing enough for your fellow mathematicians”’ (Manolios & Moore 2001). Two points about this critique are of interest. First, proof as conducted in ordinary mathematics is here taken as inferior to formal proof, and not as establishing what real proof is (as DeMillo, Lipton and Perlis had argued). Second, Manolios and Moore’s argument can be taken as suggesting that the non-mechanized, formal quadrant of ﬁgure 3 is unstable: that in the absence of the ‘discipline’ imposed by mechanized systems, human beings cannot realistically be expected to produce extensive, entirely formal proofs. Elements of higher-level, rigorousargument reasoning will inevitably creep in. Whether or not this suggestion is valid, it can be noted that mechanized systems have enabled a considerable expansion of the domain of formal proof. In the ﬁrst half of the twentieth century, the notion of formal proof was largely a tool of metamathematics: a way of modelling ‘proof ’ so as to permit precise reasoning about it. It was not a viable practical alternative to rigorous-argument proof in anything other than very limited mathematical domains. In the late twentieth century, however, the advent of automated theorem provers and proofcheckers permitted the formal proof of signiﬁcant parts of mathematics and mathematical logic, including quite difﬁcult theorems like Go ¨del’s incompleteness theorem (Shankar 1994). At least two notions of proof—non-mechanized rigorous argument, and mechanized formal proofs—are now practised on a Phil. Trans. R. Soc. A (2005)

2344

D. MacKenzie

relatively large scale, and are available to be counterposed by those who wish for whatever reason to do so. 4. Disciplines and applications One factor underpinning the cultures of proving listed in ﬁgure 3 is the structure of academic disciplines, in particular the separation between mathematics and philosophy and the resultant sometimes uneasy interstitial situation of logic. While most mathematicians are in practice committed to rigorous-argument proof, formal proof has become the canonical notion of ‘proof ’ in modern philosophy, and Barwise is almost certainly correct in suggesting that most logicians also adhere to this view. Computer science appears heterogeneous in this respect. It is the disciplinary home of mechanized formal proof, and many logicians have found posts in computer science easier to obtain than in their parent discipline, with at least some of them bringing with them a preference for formal proof. However, computer science also generated the celebrated attack on mechanized formal proof by DeMillo et al (1979). Furthermore, commitment to artiﬁcial intelligence can create a preference for rigorous-argument proof. If one’s goal is automated replication of human reasoning, then the mechanization of rigorous argument can be seen as a more appropriate objective than the mechanization of formal proof, for all the latter’s greater technological tractability. However, overall factors of this kind should not be overemphasized: sometimes very speciﬁc factors condition the appropriateness of particular notions of proof. For example, because at the time of the VIPER lawsuit the formal, mechanized proof of the correctness of its design was incomplete, defence of the claim for proof for VIPER was in effect forced implicitly to defend rigorous-argument proof. One such defence was mounted by a leading ﬁgure in the UK software industry, Martyn Thomas, founder of the software house Praxis. ‘We must beware’, he wrote, ‘of having the term “proof ” restricted to one, extremely formal, approach to veriﬁcation. If proof can only mean axiomatic veriﬁcation with theorem provers, most of mathematics is unproven and unprovable. The “social” processes of proof are good enough for engineers in other disciplines, good enough for mathematicians, and good enough for me.... If we reserve the word “proof ” for the activities of the followers of Hilbert [David Hilbert, leader of “formalism” within mathematics], we waste a useful word, and we are in danger of overselling the results of their activities’ (MacKenzie 2001). Although Thomas was in a sense defending proof as conducted by mathematicians, he was not himself a mathematician: he trained as a biochemist before entering the computer industry. Nor are the cultures of proving depicted in ﬁgure 3 homogeneous. Our symposium revealed differences between mathematicians in views of ‘proof ’, and automated theorem proving and formal veriﬁcation likewise have their divides. One such divide, alluded to above, concerns the use in proof of decision procedures that have not themselves been subject to formal veriﬁcation. This is one manifestation of a more general set of divides concerning the attitude to be taken to the fact that automated theorem provers are themselves quite complicated computer programs which may contain faults in design or Phil. Trans. R. Soc. A (2005)

Cultures of proving

2345

implementation. In interviews for this research, designers of automated theorem provers often reported experience of ‘bugs’ in their systems that would have allowed ‘theorems’ that they knew to be false nevertheless to be proven. Such bugs were not large in number, they were corrected whenever they were discovered, and I know of only one case in which a theorem-proving bug caused a false result whose falsity was not detected immediately (it led to a claim of an automated proof of the Robbins conjecture—that Robbins algebras are Boolean—that later had to be withdrawn; see MacKenzie 2001). But no designer seemed able to give an unequivocal guarantee that no such bugs remained. Reactions to the issue varied amongst those interviewed. One interviewee (Alan Robinson, developer of the fundamental theorem-proving procedure of ‘resolution’) suggested that the possibility of unsoundness in the design of theorem provers indicates that the overall enterprise of formal veriﬁcation is ﬂawed, because of what he has come to believe to be the impoverishment of the formal notion of proof: You’ve got to prove the theorem-proving program correct. You’re in a regression, aren’t you?.That’s what people don’t seem to realize when they get into veriﬁcation. They have a hairy great thing they’re in doubt about, so they produce another hairy great thing which is the proof that this one’s OK. Now what about this one which you’ve just [used to perform the proof] ?.I say that serves them jolly well right. That is not the response of program and hardware veriﬁcation ‘insiders’. While paying considerable attention to soundness, they feel that theorem-prover bugs are not important practical worries compared to ensuring that the speciﬁcation of a system expresses what, intuitively, is intended: If you.ask where the risks are, and what are the magnitudes of the risks, the soundness of the logic is a tiny bit, a really tiny bit, and the correctness of the proof tool implementing the logic is slightly larger [but] actually.quite a small risk. As that last quotation reminds us, automated theorem provers are developed not just as an important intellectual exercise in its own right, but to support veriﬁcation in contexts in which hardware or software design faults can be fatal, can compromise national security, or can be very expensive in their consequences. For many years, the most important single source of funding for the development of automated theorem provers was the national security community, in particular the US Defense Advanced Research Projects Agency and National Security Agency. The demands of national security—in particular the desire for a theorem-proving system that prevents a hostile agent in a development team from constructing a spurious ‘proof ’ of security—have inﬂuenced how at least some theorem-provers have been developed (see MacKenzie 2001). A more recent inﬂuence is more generic. A major barrier to the practical use of theorem provers in computer-system veriﬁcation is that their use requires large amounts of highly skilled human input. The theorem provers used in veriﬁcation are automated, not automatic. Human beings guide them, for example by breaking up a desired proof into a structure of lemmas that are within the prover’s capacity, a task that requires a grasp both of what needs to be proved Phil. Trans. R. Soc. A (2005)

2346

D. MacKenzie

and of how the prover goes about constructing proofs. It is often a slow, painstaking and expensive process. In contrast, model checkers and other systems that implement decision procedures are automatic. Human skill may still be needed in order to represent the design of a system and its speciﬁcation in such a way that model checking is feasible, but once that is done a model checker is effectively a ‘push button’ device. The attractiveness in an industrial context of such an approach is obvious. Accordingly, in recent years, the goal of automatic rather than humanguided operation has transformed research efforts in the ﬁeld of automated veriﬁcation. Model checking and decision procedures have become an increasingly dominant focus of attention (Alan Bundy, personal communication). The practical demands of successful industrial application have thus reshaped research in automated veriﬁcation.

5. Conclusion In a world increasingly dependent upon computer systems, the diverse domains summarized in ﬁgure 1 are of obvious practical importance. This article has argued that they also provide fruitful material for the development of a sociology of proof. Alongside the cultures of proving that constitute human-performed mathematics have grown up the other approaches listed in ﬁgure 3, as well as approaches based upon decision procedures (which do not ﬁt within ﬁgure 3’s grid because they involve mechanized procedures that neither produce formal proofs nor resemble rigorous arguments). The health of the domains of research listed in ﬁgure 1 is thus not simply of practical importance. These domains also constitute a set of experiments in the meaning of deductive ‘proof ’. They already have a rich history that demands far more attention from historians of science than it has received. Their future practical fortunes, and the controversies they will surely spark, should also offer fruitful terrain for sociologists of science in the years to come. The writing of this paper was supported by DIRC, the Interdisciplinary Research Collaboration on the Dependability of Computer-Based Systems (UK Engineering and Physical Sciences Research Council grant GR/N13999). The original interviewing was supported by the UK Economic and Social Research Council under the Program in Information and Communication Technologies (A35250006) and research grants R000234031 and R00029008; also by the Engineering and Physical Sciences Research Council under grants GR/J58619, GR/H74452 and GR/L37953. I owe the example of the mutilated chessboard to Alan Robinson.

References Barwise, J. 1989 Mathematical proofs of computer system correctness. Notices Am. Math. Soc. 36, 844–851. Black, M. 1946 Critical thinking: an introduction to logic and scientiﬁc method. New York: Prentice-Hall. Brock, B. & Hunt, W. A. 1990 Report on the formal speciﬁcation and partial veriﬁcation of the VIPER microprocessor. Austin, Texas: Computational Logic, Inc. Bundy, A., Jamnik, M. & Fugard, A. 2005 What is a proof? Phil. Trans. R. Soc. A (doi:10.1098/ rsta.2005.1651.) Phil. Trans. R. Soc. A (2005)

Cultures of proving

2347

Cohn, A. 1989 The notion of proof in hardware veriﬁcation. J. Automated Reasoning 5, 127–139. (doi:10.1007/BF00243000.) Ministry of Defence 1991 Interim defence standard 00–55: the procurement of safety critical software in defence equipment. Glasgow: Ministry of Defence, Directorate of Standardization. DeMillo, R., Lipton, R. & Perlis, A. 1979 Social processes and proofs of theorems and programs. Commun. ACM 22, 271–280. (doi:10.1145/359104.359106.) Dijkstra, E. W. 1988 Real mathematicians don’t prove. Handwritten memo, EWD1012 (Austin, Texas, January 24). Dijkstra, E. W. & Scholten, C. S. 1990 Predicate calculus and program semantics. New York: Springer. Fetzer, J. 1988 Program veriﬁcation: the very idea. Commun. ACM 31, 1048–1063. (doi:10.1145/ 48529.48530.) Kleiner, I. 1991 Rigor and proof in mathematics: a historical perspective. Math. Mag. 64, 291–314. Linger, R. C., Mills, H. D. & Witt, B. I. 1979 Structured programming: theory and practice. Reading, MA: Addison-Wesley. Livingston, E. 1999 Cultures of proving. Soc. Stud. Sci. 29, 867–888. MacKenzie, D. 1991 The fangs of the VIPER. Nature 352, 467–468. (doi:10.1038/352467a0.) MacKenzie, D. 2001 Mechanizing proof: computing risk, and trust. Cambridge, MA: MIT Press. Manolios, P. & Moore, J. S. 2001 On the desirability of mechanizing calculational proofs. Inf. Proc. Lett. 77, 173–179. (doi:10.1016/S0020-0190(00)00200-3.) Nidditch, P. H. 1957 Introductory formal logic of mathematics. London: University Tutorial Press. ´ez, E., Fleck, J. & MacKenzie, D. 1987 Social research on software. Paper presented to Pela workshop of the Economic and Social Research Council, Programme on Information and Communication Technologies, Manchester, December. Penrose, R. 1989 The emperor’s new mind: concerning computers, minds and the laws of physics. Oxford University Press. Shankar, N. 1994 Metamathematics, machines and Go ¨del’s proof. Cambridge University Press. van de Snepscheut, J. L. A. 1985 Trace theory and VLSI design. Berlin: Springer. Whitehead, A. N. & Russell, B. 1910–13 Principia mathematica. Cambridge University Press.

Discussion D. B. A. EPSTEIN (Department of Mathematics, University of Warwick, UK ). Is it feasible (in some technical sense) to formalize a typical mathematical proof? Can one estimate the complexity of the process of formalization? Can one prove for example that it is NP-hard (to formalize)? This requires formalization of the question itself. D. MACKENZIE. It does appear to be feasible in practice to formalize many typical mathematical proofs, at least the simpler such proofs. However, the process generally has to be guided by human beings: today’s automatic systems are usually quite unable to handle any other than relatively simple cases. The computational complexity of theorem proving is undoubtedly part of the reason. The underlying formal results are well beyond my competence as a sociologist, but I believe that amongst complexity-theory results in mathematical domains relevant to automated theorem-proving are (a) that the problem of checking whether formulae in propositional logic are tautologies is NP-complete, and (b) that the complexity of the decision problem in Presburger arithmetic is worse than exponential. Both results suggest constraints on the usefulness of Phil. Trans. R. Soc. A (2005)

2348

D. MacKenzie

‘brute force’ searches for proofs. However, since complexity-theory constraints do not stop human beings proving ‘hard’ theorems, it remains possible that progress in automated reasoning techniques may lead to systems with far greater capacities than those of the present. S. COLTON (Department of Computing, Imperial College London, UK ). Does mainstream mathematicians’ seemingly genuine difﬁculty (or inability) to introspect on the processes they use to generate theorems and proofs add to the reason why automating rigorous argument is difﬁcult for artiﬁcial intelligence? D. MACKENZIE. Again, I should emphasize that I am not a technical specialist in this area, but I suspect the answer to Colton’s question is ‘yes’. One way of designing automated theorem provers to circumvent the ‘combinatorial explosion’ generated by ‘brute force’ searches would be to guide the search for proofs by incorporating the ‘heuristics’ used by human mathematicians. Attempts to do this do not, however, seem to have been consistently successful. A. V. BOROVIK (School of Mathematics, University of Manchester, UK ). The culture of (traditional) mathematics is that of openness; proofs of theorem are supposed to be open to everyone to check. Can we trust proofs produced by a commercial company on behalf of another company and kept out of the public domain? D. MACKENZIE. In brief, no! However, the practical consequences of this may be less than might be imagined. Many of the beneﬁts of subjecting designs to ‘formal veriﬁcation’ come from the very effort to do so, for example in the way it typically brings design faults to light. The ﬁnished product of formal veriﬁcation—the ‘proof object’—may thus be less important than the process of constructing it. It might also be naı¨ve to think that many such proof objects will be subject to detailed scrutiny by people not directly involved, even if the proof objects are publicly available. Many proof objects are far from ‘readable’ in the way in which a traditional mathematical proof is readable. Nevertheless, proofs of safety-critical systems clearly should be in the public domain, and it may not be utopian to hope that eventually it will be common for them to be checked by automated proof-checking systems different from those on which they were produced. J. G. HENDERSON (Program Notes Ltd, Pinner, Middlesex, UK ). Is mathematical proof becoming an ‘act of faith’ within our culture? e.g. whilst I ‘believe’ the fourcolour theorem to be true—as a software engineer, I have yet to see the computer program’s design and code for it! D. MACKENZIE. Any complex society, such as ours, involves an extensive division of labour in which much has to be taken on trust. Few of us pause to check the soundness of the aerodynamic design of an airliner before we board it or verify the correctness of the implementation of the cryptographic protocols before submitting our credit card number to a website! There is a sense in which we normally have no practical alternative but to trust that such things have been thoroughly checked by appropriate experts. Cutting-edge research mathematics is often going to be comprehensible to only a limited number of specialists: there are many proofs (for example, the proof of Fermat’s last theorem) that even Phil. Trans. R. Soc. A (2005)

Cultures of proving

2349

many professional mathematicians outside the relevant specialist area will struggle to understand. Increased specialization within mathematics almost certainly means that the number of such cases is far greater now than a century or two centuries ago, and in those cases non-specialist mathematicians may indeed have no practical alternative but to trust that the scrutiny of putative proofs by their specialist colleagues has been thorough. I do not see it as a ‘problem’: to my mind, it is an inevitable consequence of specialization. G. WHITE (Computer Science, Queen Mary, University of London, UK ). What constitutes ‘formal’? There are calculations which prove theorems, but which can only be proved to be rigorous by informal argument. For example, the twodimensional notations for traced monoidal categories (Joyal et al. 1996). And one is surely only tempted to think that there is a unitary concept of ‘formal’ if one tacitly identiﬁes the formal with the foundational—an extremely problematic assumption. D. MACKENZIE: The word ‘formal’ is a contested one, and it can certainly be used in senses other than that in my paper. I believe that it is also the case that when mathematicians and logicians seek to prove theorems about matters such as the soundness, completeness and consistency of formal systems, the proofs they produce are, in the terminology of the paper, often (indeed usually) ‘rigorous argument’ proofs, not formal proofs. R. CHAPMAN (SPARK Team, Praxis, Bath, UK ). When the presenter revealed the source of his deﬁnitions of ‘formal proof ’ and ‘rigorous argument’ to be the MoD Interim Def-Stan 00–55, why did people laugh? D. MACKENZIE. I suspect the reason for laughter was the way in which a fundamental ‘philosophical’ issue (the nature of ‘proof ’) appeared in an apparently bureaucratic document such as a defence procurement standard. It is, of course, part of the fascination of this area that a document such as a procurement standard has to venture into the quintessentially philosophical terrain of having to say what ‘proof ’ is. R. POLLACK (School of Informatics, University of Edinburgh, UK ). Donald MacKenzie showed a 2!2 matrix of different ‘proof cultures’. I pointed out that MacKenzie’s cultures had many subcultures. In particular I objected to MacKenzie’s use of the phrase ‘automated proof ’ for the culture of formal proofs using computers, as a major group does not use automated search for proofs as its main approach, but machine checking of proofs developed by human users interactively with machine support. D. MACKENZIE. I plead guilty: Pollack is correct in regard to subcultures. In a brief paper, it is impossible to do them justice. I hope I have done a little better in D. MacKenzie, Mechanizing proof: computing, risk, and trust (Cambridge, MA: MIT Press, 2001). In regard to terminology, I distinguish between ‘automated’ proof (for example, ‘automated theorem prover’) and fully ‘automatic’ proof. As I use the word, ‘automated’ proof includes the large and important category identiﬁed by Pollack: proofs which are developed on computerized systems, and checked by such systems, but in which proof construction is guided, often in detail, by human beings. Perhaps ‘semi-automated’ would thus be a better term, but the ﬁeld uses the term ‘automated theorem prover’, not ‘semi-automated’, Phil. Trans. R. Soc. A (2005)

2350

D. MacKenzie

and I followed the ﬁeld’s usage. As I noted in response to Epstein’s question, the capacities of ‘semi-automated’, human-guided systems are currently much greater than those of fully automatic systems. M. ATIYAH (Department of Mathematics and Statistics, University of Edinburgh, UK). In both mathematics and physical science there is a hierarchical structure, involving a fundamental level and a higher level. In physics or chemistry we have quantum mechanics with the Schrodinger equation, but for most of chemistry or solid state physics one cannot in practice deduce everything from the foundations. In mathematics we have formal proof, but usual mathematical proof (‘rigorous reasoning’) cannot be reduced to formal proof. In both physics and mathematics we have to live with these imperfections. D. MACKENZIE: Atiyah is right, and his analogy is elegant and apposite. I would note, however, that the situation he describes is changing and will continue to change. The growing capacities of ‘semi-automated’ proving systems mean that although many areas, especially of current research mathematics, remain intractable, vastly larger numbers of rigorous argument proofs have now been reduced to formal proofs than was the case 30 years ago. Interestingly, though, the outcome of this effort supports the defence of rigorous-argument proof that I think underpins Atiyah’s comment. The semi-automated formalization of rigorous-argument proofs only very seldom uncovers serious mistakes in ‘usual mathematical proof ’, at least in the context of well-trodden mathematical terrain. Such proof thus seems quite robust, and it need not be conceded that reliance upon it is an ‘imperfection’, at least in the sense of having deleterious practical consequences. The practical beneﬁts of automatic or semi-automated proof-checking may therefore lie not primarily in mathematics, but in computer systems development, where conventional practices are far from robust in the sense of being capable of reliably producing systems free from serious ﬂaws. Additional reference Joyal, A., Street, R. & Verify, D. 1996 Traced monoidal categories. Math. Proc. Camb. Phil. Soc. 119, 447–468.

Phil. Trans. R. Soc. A (2005)

Phil. Trans. R. Soc. A (2005) 363, 2351–2375 doi:10.1098/rsta.2005.1650 Published online 12 September 2005

The challenge of computer mathematics B Y H ENK B ARENDREGT

AND

F REEK W IEDIJK

Radboud University Nijmegen, 6500 GL Nijmegen, The Netherlands ([email protected]) Progress in the foundations of mathematics has made it possible to formulate all thinkable mathematical concepts, algorithms and proofs in one language and in an impeccable way. This is not in spite of, but partially based on the famous results of Go ¨del and Turing. In this way statements are about mathematical objects and algorithms, proofs show the correctness of statements and computations, and computations are dealing with objects and proofs. Interactive computer systems for a full integration of deﬁning, computing and proving are based on this. The human deﬁnes concepts, constructs algorithms and provides proofs, while the machine checks that the deﬁnitions are well formed and the proofs and computations are correct. Results formalized so far demonstrate the feasibility of this ‘computer mathematics’. Also there are very good applications. The challenge is to make the systems more mathematician-friendly, by building libraries and tools. The eventual goal is to help humans to learn, develop, communicate, referee and apply mathematics. Keywords: computer mathematics; formalized proofs; proof checking

1. The nature of mathematical proof Proofs in mathematics have come to us from the ancient Greeks. The notion of proof is said to have been invented by Thales (ca 624–547 BC). For example, he demonstrated that the angles at the bases of any isosceles triangle are equal. His student Pythagoras (ca 569–475 BC) went on to prove, among other things, the theorem bearing his name. Pythagoras started a society of followers, half religious, half scientiﬁc, that continued after he passed away. Theodorus (465–398 BC), a memberpﬃﬃof the society, philosopher Plato (428–347 ﬃ p ﬃﬃﬃ p ﬃﬃﬃ pﬃﬃﬃ taught pﬃﬃﬃﬃﬃthe pﬃﬃﬃﬃﬃ BC) the irrationality of 2, 3, 5, 6, . , 15; 17. Plato emphasized to his students the importance of mathematics, with its proofs that show non-obvious facts with a clarity such that everyone can understand them. In Plato’s dialogue, Meno a slave, was requested by Socrates (469–399 BC) to listen and answer, and together, using the maieutic method, they came to the insight that the size pﬃﬃﬃ of the long side of an isosceles rectangular triangle is, in modern terminology, 2 times the size of the shorter side. Not much later the subject of mathematics was evolved to a sufﬁcient degree that Plato’s student Aristotle (384–322 BC) could reﬂect about this discipline. He described the axiomatic method as follows. Mathematics consists of objects and of valid statements. Objects are deﬁned from previously deﬁned objects; in order to be able to get started one has the primitive One contribution of 13 to a Discussion Meeting Issue ‘The nature of mathematical proof’.

2351

q 2005 The Royal Society

2352

H. Barendregt and F. Wiedijk

objects. Valid statements are proved from other such statements; in order to get started one has the axioms. Euclid (ca. 325–265 BC) wrote just a few decades later his monumental Elements describing geometry in this axiomatic fashion. Besides that, the Elements contain the ﬁrst important results in number theory (theory of divisibility, prime numbers, factorization) and even Eudoxos’ (408–355 BC) account of treating ratios (that was later the inspiration for Dedekind (1831–1916) to give a completely rigorous description of the reals as cuts of rational numbers). During the course of history of mathematics proofs increased in complexity. In particular, in the 19th century some proofs could no longer be followed easily by just any other capable mathematician: one had to be a specialist. This started what has been called the sociological validation of proofs. In disciplines other than mathematics the notion of peer review is quite common. Mathematics for the Greeks had the ‘democratic virtue’ that anyone (even a slave) could follow a proof. This somewhat changed after the complex proofs appeared in the 19th century that could only be checked by specialists. Nevertheless, mathematics kept developing and having enough stamina one could decide to become a specialist in some area. Moreover, one did believe in the review by peers, although occasionally a mistake remained undiscovered for many years. This was the case, e.g. with the erroneous proof of the Four Colour Conjecture by Kempe (1879). In the 20th century, this development went to an extreme. There is the complex proof of Fermat’s Last Theorem by Wiles. At ﬁrst the proof contained an error, discovered by Wiles himself, and later his new proof was checked by a team of twelve specialist referees.1 Most mathematicians have not followed in detail the proof of Wiles, but feel conﬁdent because of the sociological veriﬁcation. Then there is the proof of the Classiﬁcation of the Finite Simple Groups. This proof was announced in 1979 by a group of mathematicians lead by Gorenstein. The proof consisted of a collection of connected results written down in various places, totalling 10 000 pages. In the proof one relied also on ‘wellknown’ results and it turned out that not all of these were valid. Work towards improving the situation has been performed, and in Aschbacher (2004) it is announced that at least this author believes in the validity of the theorem. Finally there are the proofs of the Four Colour Theorem, Appel & Haken (1977a,b) and Robertson et al. (1996), and of Kepler’s Conjecture, Hales (in press). All these proofs use a long computation performed on a computer. (Actually Aschbacher (2004) believes that at present also the proof of the Classiﬁcation of the Finite Simple Groups relies on computer performed computation.) The situation is summed up in table 1. A very different development, defended by Zeilberger and others, consists of admitting proofs where the result is not 100% certain, but say 99.9999999999%. Examples of these proofs concern the primality of large numbers, see Miller (1976) and Rabin (1980). In this situation the question arises whether there has been a necessary devaluation of proofs. One may fear that the quote of Benjamin Peirce 1

One of these referees told us the following. ‘If an ordinary non-trivial mathematical paper contains an interesting idea and its consequences and obtains ‘measure 1’, then Wiles’ proof can be rated as having measure 156.’ Phil. Trans. R. Soc. A (2005)

Challenge of computer mathematics

2353

Table 1. Theorems and their veriﬁcation veriﬁable by

theorems

lay person/student competent mathematician specialist group of specialists computer

pﬃﬃﬃ 2 is irrational. There are inﬁnitely many primes fundamental theorem of algebra Fermat’s last theorem classiﬁcation of the ﬁnite simple groups four colour theorem, Kepler’s conjecture

(1809–1880) ‘Mathematics is the science which draws necessary conclusions’ may not any longer hold. Scientiﬁc American even ventured an article called ‘The Death of Proof ’, see Horgan (1993). The Royal Society Discussion Meeting ‘The Nature of Mathematical Proof’ (18–19 October 2004) had a more open-minded attitude and genuinely wanted to address the question. We will argue below that proofs remain alive and kicking and at the heart of mathematics. There is a sound methodology to ensure the full correctness of theorems with large proofs, even if they depend on complex computations, like the Four Colour Theorem, or on a sociological veriﬁcation, like the Classiﬁcation of the Finite Simple Groups. (a ) Phenomenology From where does the conﬁdence come that is provided by a proof in mathematics? When a student asks the teacher: ‘Sir, am I allowed to do this step?’, the answer we often give is ‘When it is convincing, both for you and me!’. Mathematics is rightly considered as the most exact science. It is not too widely known to outsiders that this certainty eventually relies on a mental judgement. It is indeed the case that proofs and computations are a warranty for the exactness of mathematics. But both proofs and computations need a judgement that the performed steps are correct and applicable. This judgement is based on a trained form of our intuition. For this reason Husserl (1901), and also Go¨del (1995), and notably Bernays in Wang (1997, p. 337, 10.2.7), emphasize the phenomenological character of the act of doing mathematics. (b ) Computation versus intuition In Buddhist psychology one distinguishes discursive versus intuitive knowledge. In order to explain this a contemporary example may be useful. Knowing physics one can calculate the range of angles a bike rider may use while making a right turn. This is discursive knowledge; it does not enable someone to ride a bike. On the other hand, a person who knows how to ride a bike ‘feels’ the correct angles by intuition, but may not be able to compute them. Both forms of knowledge are useful and probably use different parts of our brain. For the mental act of doing mathematics one may need some support. In fact, before the Greek tradition of proofs, there was the Egyptian–Chinese– Babylonian tradition of mathematics as the art of computing. Being able to use computational procedures can be seen as discursive knowledge. This aspect is often called the ‘algebraic’ side of mathematics. On the other hand, proofs often Phil. Trans. R. Soc. A (2005)

2354

H. Barendregt and F. Wiedijk

rely on our intuition. One speaks loosely about the intuitive ‘geometric’ side of mathematics. A computation like 13 338!3 145 727Z41 957 706 726 needs do be done on paper or by some kind of computer (unless we are an idiot savant; this computation is related to the famous ‘Pentium bug’ appearing in 1994). Symbolic manipulations, like multiplying numbers or polynomials, performing symbolic integrations and arbitrary other algebraic computations may not be accompanied by intuition. Some mathematicians like to use their intuition, while others prefer algebraic operations. Of course knowing both styles is best. In the era of Greek mathematics at ﬁrst the invention of proofs with its compelling exactness drew attention away from computations. Later in the work of Archimedes (287–212 BC) both computations and intuition did excel. The story repeated itself some two millennia later. The way in which Newton (1643–1727) introduced calculus was based on the solid grounds of Euclidean geometry. On the other hand, Leibniz (1646–1716) based his calculus on inﬁnitesimals that had some dubious ontological status (do they really exist?). But Leibniz’ algebraic approach did lead to many fruitful computations and new mathematics, as witnessed by the treasure of results by Euler (1707–1783). Inﬁnitesimals did lead to contradictions. But Euler was clever enough to avoid these. It was only after the foundational work of Cauchy (1789–1857) and Weierstrass (1815–1897) that full rigour could be given to the computational way of calculus. That was in the 19th century and mathematics bloomed as never before, as witnessed by the work of Gauss (1777–1855), Jacobi (1804–1851), Riemann (1826–1866) and many others. During the last third of the 20th century the ‘schism’ between computing and proving reoccurred. Systems of computer algebra, being good at symbolic computations, were at ﬁrst introduced for applications of mathematics in physics: a pioneering system is Schoonschip, see Veltman (1967), which helped win a Nobel prize in physics. Soon they became useful tools for pure mathematics. Their drawback is that the systems contain bugs and cannot state logically necessary side-conditions for the validity of the computations. On the other hand, systems for proof-checking on a computer have been introduced, the pioneer being Automath of de Bruijn, see Nederpelt et al. (1994). These systems are able to express logic and hence necessary side conditions, but at ﬁrst they were not good at making computations. The situation is changing now, as will be seen below. (c ) Computer science proofs Programs are elements of a formal (i.e. precisely deﬁned) language and thereby they become mathematical objects. It was pointed out by Turing (1949) that one needs a proof to show that a program satisﬁes some desired properties. This method was reﬁned and perfected by Floyd (1967) and Hoare (1969). Not all software has been speciﬁed, leave alone proven correct, as it is often hard to know what one exactly wants from it. But for parts of programs and for some complete programs that are small but vital (like protocols) proofs of correctness have been given. The methodology of (partially) specifying software and proving that the required property holds for the program is called ‘Formal Methods’. Phil. Trans. R. Soc. A (2005)

Challenge of computer mathematics

2355

Proofs for the correctness of software are often long and boring, relying on nested case distinctions, contrasting proofs in mathematics that are usually more deep. Therefore the formal methods ideal seemed to fail: who would want to verify the correctness proofs, if they were longer than the program itself and utterly uninspiring. Below we will see that also this situation has been changed. 2. Foundations of mathematics A foundation for mathematics asks for a formal language in which one can express mathematical statements and a system of derivation rules using which one can prove some of these statements. In order to classify the many objects that mathematicians have considered an ‘ontology’, describing ways in which collections of interest can be deﬁned, comes in handy. This will be provided by set theory or type theory. Finally, one also needs to provide a model of computation in which algorithms performed by humans can be represented in one way or another. In other words, one needs logic, ontology and computability. (a ) Logic Not only did Aristotle describe the axiomatic method, he also started the quest for logic. This is the endeavour to chart the logical steps needed in mathematical reasoning. He started a calculus for deductions. The system was primitive: not all connectives (and, or, implies, not, for all, exists) were treated, only monadic predicates, like P(n) being ‘n is a prime number’, and not binary ones, like R(n, m) being ‘n!m’, were considered. Nevertheless, the attempt to ﬁnd rules sufﬁcient for reasoning was quite daring. The quest for logic, as needed for mathematical reasoning, was ﬁnished 2300 years later in Frege (1879). Indeed, Go¨del (1930) showed that Frege’s system was complete (mathematically this was done already by Skolem 1922; but the result itself was not mentioned there). This means that from a set of hypotheses G a statement A can be derived iff in all structures A in which the hypotheses G hold, also the conclusion A holds. A particular nice version of logic was given by Gentzen in 1934 (see his collected papers, Gentzen 1969). This system is presented in table 2. Some explanations are in order. The signs /, &, n, u, c, d stand for ‘implies’, ‘and’, ‘or’, ‘true’, ‘for all’ and ‘exists’, respectively. lA stands for ‘not A’ and is deﬁned as A/t, where t stands for a (‘the’) false statement (like 0Z1). G stands for a set of statements and GwA stands for ‘from the set G the statement A is derivable’. A rule like GwA&B ; GwA has to be read as follows: ‘If A & B is derivable from G, then so is A.’ (i) First-, second- and higher-order logic The logic presented is ﬁrst-order logic. It speaks about the element of a structure A (a set with some given operations and relations on it) and can quantify over the elements of this structure. In second-order logic one can Phil. Trans. R. Soc. A (2005)

2356

H. Barendregt and F. Wiedijk Table 2. Predicate logic natural deduction style elimination rules

introduction rules

GwAGwA/ B ; GwB

G; AwB : GwA/ B

GwA&B GwA

GwA&B ; GwB

GwAn B G; AwC G; BwC ; GwC Gwc x:A GwA½x dt

t is free in A;

Gwd x:A G; AwC GwC

x ;C ;

GwA GwB : GwA&B GwA GwAn B GwA Gwc x:A

GwB : GwAn B x ;G:

GwA½x dt : Gwd x:A

Gwt ; GwA

Gwu:

start rule

double-negation rule

GwA A 2G;

Gw llA : GwA

quantify over subsets of the structure A, i.e. over PðAÞ. Then there is higherorder logic that can quantify over each P n ðAÞ. In ﬁrst-order logic, one can distinguish the difference between continuity and uniform continuity of a given function (say on R). cx 2Rc eO 0d dO 0c y 2R:jx Kyj! d0 jf ðxÞKf ðyÞj! e; versus ceO 0d dO 0c x; y 2R:jx Kyj! d0 jf ðxÞKf ðyÞj! e: Here ceO0. has to be translated to ce:½eO 00 .. In second-order logic one may express that an element x of a group G has torsion (a power of x is the unit element e) without having the notion of natural number: cX 2PðGÞ:x 2X & ½cy 2X:ðx,yÞ 2X0 e 2X: This states that e belongs to the intersection of all subsets of G that contain x and that are closed under left-multiplication by x. Phil. Trans. R. Soc. A (2005)

Challenge of computer mathematics

2357

In higher-order logic, one may state that there exists a non-trivial topology on R that makes a given function f continuous dO 2§2 ðRÞ:O is a non trivial topology & c O 2O:f K1 ðOÞ 2O: Here O is a non-trivial topology stands for O sPðRÞ & R 2O& cX 2PðOÞ:½: sX /gX 2O & cX; Y 2O:X h Y 2O: (ii) Intuitionistic logic Not long after the ﬁrst complete formalization of (ﬁrst-order) logic was given by Frege, Brouwer criticized this system of ‘classical logic’. It may promise an element when a statement like dk:PðkÞ; has been proved, but nevertheless it may not be the case that a witness is found, i.e. one may not know how to prove any of Pð0Þ; Pð1Þ; Pð2Þ; Pð3Þ; .: For example, this is the case for the statement PðxÞ dðx Z 0 & RHÞn ðx Z 1 & lRHÞ; where RH stands for the Riemann Hypothesis that can formulated in (Peano) Arithmetic. The only possible witnesses are 0 and 1. By classical logic RHnlRH holds. In the ﬁrst case one can take xZ0 and in the second case xZ1. Therefore one can prove dx.P(x). One, however, cannot provide a witness, as P(0) can be proved only if the RH is proved and P(1) can be proved only if the RH is refuted. At present neither is the case. One may object that ‘tomorrow’ the RH may be settled. But then one can take another open problem instead of the RH, or an independent statement, for example a Go ¨del sentence G stating that ‘G’ is not provable; or the Continuum Hypothesis 2a0 Z a1 (if we are in set theory). A similar criticism can be addressed to provable statements of the form AnB. These can be provable, while neither A nor B can be proved. Brouwer analysed the situation and concluded that the law of excluded middle, AnlA is the cause of this unsatisfactory situation. He proposed to do mathematics without this ‘unreliable’ logical principle. In Heyting (1930) an alternative logic was formulated. For this logic one can show that wAn B5 wA or wB; and similarly wd x:PðxÞ5 wPðtÞ; for some expression t: Phil. Trans. R. Soc. A (2005)

2358

H. Barendregt and F. Wiedijk

Gentzen provided a convenient axiomatization of both classical and intuitionistic logic. In table 2 the system of classical logic is given; if one leaves out the rule of double negation one obtains the system of intuitionistic logic. (b ) Ontology Ontology is the philosophical theory of ‘existence’. Kant remarked that existence is not a predicate. He probably meant that in order to state that something exists we already must have it. Nevertheless, we can state that there exists a triple (x, y, z) of positive integers such that x2Cy2Zz2 (as Pythagoras knew), but not such that x3Cy3Zz3 (as Euler knew). Ontology in the foundations of mathematics focuses on collections of objects O, so that one may quantify over it (i.e. stating cx2O.P(x), or dx2O.P(x)). Traditional mathematics only needed a few of these collections: number systems and geometric ﬁgures. From the 19th century on a wealth of new spaces was needed and ample time was devoted to constructing these. Cantor (1845–1918) introduced set theory that has the virtue of bringing together all possible spaces within one framework. Actually this theory is rather strong and not all postulated principles are needed for the development of mathematics. An interesting alternative is type theory in which the notion of function is a ﬁrst class object. (i) Set theory Postulated are the following axioms of ‘set existence’:

These axioms have as intuitive interpretation the following. N is a set; if a, b are sets, then {a, b} is a set;.; if P is a property over sets, then {x2ajP(x)} is a set; if for every set x there is given a unique F(x) in some way or another, then {F(x)jx2a} is a set. We will not spell out the way the above axioms have to be formulated and how P and F are given, but refer the reader to a textbook on axiomatic set theory, see e.g. Kunen (1983). Also there are the axioms of ‘set properties’: a Z b5cx:½x 2a5 x 2b

ðextensionalityÞ

ca:½½dx:x 2a0dx:½x 2a & ldy:y 2x &y 2a ðfoundationÞ: The axiom of extensionality states that a set is completely determined by its elements. The axiom of foundation is equivalent with the statement that every predicate P on sets is well-founded: if there is a witness x such that P(x) holds, then there is a minimal witness x. This means that P(x) but for no y2x one has P(y). Another way to state foundation:ca ldf 2ðN/ aÞc n 2N:f ðnC 1Þ 2f ðnÞ. Phil. Trans. R. Soc. A (2005)

Challenge of computer mathematics

2359

(ii) Type theory Type Theory, coming in several variants, forms an alternative to set theory. Postulated are inductively deﬁned data types with their recursively deﬁned functions. Moreover types are closed under function spaces and products. A type may be thought of as a set and that an element a belongs to type A is denoted by a:A. The difference with set theory is that in type theory an element has a unique type. Inductive types are given in the following examples (boolean, natural numbers, lists of elements of A, binary trees with natural numbers at the leafs).

These deﬁnitions should be read as follows. The only elements of bool are true, false. The elements of nat are freely generated from 0 and the unary ‘constructor’ S, obtaining 0, S(0), S(S(0)),.. One writes for elements of nat 1ZS(0), 2ZS(1),.. A typical element of list_nat is h1; 0; 2i Z consð1; consð0; consð2; nilÞÞÞ: A typical tree is

A typical element of A!B is ha, biZpair(a, b), where a:A, b:B. Given types A, B, one may form the ‘function-space’ type A-OB. There is the primitive operation of application: if f: A-OB and a:A, then f(a):B. Conversely there is abstraction: if M:B ‘depends on’ an a:A (like a2CaC1 depends on a:nat) one may form the function fd(a1M):(A-OB). This function is denoted by la:A.M (function abstraction). For example this can be used to deﬁne composition: if f:A-OB, g:B-OC, then ˆ gfdla: A.g(f(a)):A-OC. Next to the formation of function space types there is the dependent cartesian product. If B is a type that depends on an a:A, then one may form Pa:A.B. One has (here B[ adt] denotes the result of substitution of t in B for a) f:ðPa:A:BÞ;t:A0fðtÞ:B½adt: A typical example is BZAn for n:nat. If f:(Pn:nat.An), then f(2n): A . Type theories are particularly convenient to express intuitionistic 2n

Phil. Trans. R. Soc. A (2005)

2360

H. Barendregt and F. Wiedijk

mathematics. Type theories differ as to what dependent cartesian products and what inductive types are allowed, whether or not they are predicative,2 have ‘powersets’, the axiom of choice. See Martin-Lo ¨f (1984), Aczel & Rathjen (2001), Barendregt & Geuvers (2001) and Moerdijk & Palmgren (2002). In Feferman (1998, ch. 14), a type-free system (which can be seen as a system as a type system with just one type) is presented for predicative mathematics. (c ) Computability Mathematical algorithms are much older than mathematical proofs. They have been introduced in Egyptian–Babylonian–Chinese mathematics a long time before the notion of proofs. In spite of that, reﬂection over the notion of computability through algorithms has appeared much later, only about 80 years ago. The necessity came when Hilbert announced in 1900 his famous list of open problems. His 10th problem was the following. Given a Diophantine equation with any number of unknown quantities and with rational integral numerical coefﬁcients: to devise a process according to which it can be determined by a ﬁnite number of operations whether the equation is solvable in rational integers.3

By a number a steps over a time interval of nearly 50 years, the ﬁnal one by Matijasevic using the Fibonacci numbers, this problem was shown to be undecidable, see Davis (1973). In order to be able to state such a result one needed to reﬂect over the notion of algorithmic computability. Steps towards the formalization of the notion of computability were done by Skolem, Hilbert, Go ¨del, Church and Turing. At ﬁrst Hilbert (1926; based on work by Grassmann, Dedekind, Peano and Skolem) introduced the primitive recursive functions over N by the following schemata (ﬁgure 1).4 It was shown by Sudan (1927) and Ackermann (1928) that not all computable functions were primitive recursive. Then Go¨del (based on a suggestion of Herbrand) introduced the notion of totally deﬁned computable functions,5 based on what is called nowadays Term Rewrite Systems, see Terese (2003). This class of total computable functions can also be obtained by adding to the primitive

2

In predicative sytems a subset of an inﬁnite set X can only be deﬁned if one does not refer to the class of all subsets of X. For example fn 2N jniseveng is allowed, but not fn 2N jc X 4N :PðX; nÞg: By ‘rational integers’ Hilbert just meant the set of integers Z. This problem is equivalent to the problem over N . The solvability of Diophantine equations over Q is still open. 4 This deﬁnition scheme was generalized by Scott (1970) to inductive types. For example over the binary trees introduced above one can deﬁne a primitive recursive function mirror as follows. 3

mirrorðleafðnÞÞZ leafðnÞ; mirrorðbranchðt1; t2ÞÞZ branchðmirrorðt2Þ; mirrorðt1ÞÞ: It mirrors the tree displayed above. 5 Previously called (total) recursive functions. Phil. Trans. R. Soc. A (2005)

Challenge of computer mathematics

2361

Figure 1. The primitive recursive functions.

recursive schemata the scheme of minimalization (‘my.’ stands for ‘the least y such that.’), Kleene (1936).

Finally, it was realized that it is more natural to formalize computable partial functions. This was done by Church (1936) using lambda calculus, and Turing (1936) using what are now called Turing machines. The formalized computational models of Turing and Church later gave rise to the so-called imperative and functional programming styles. The ﬁrst is more easy to be implemented, the second more easy to use and to show the correctness of the programs. Both the computational models of Church and Turing have a description about as simple as that of the ﬁrst-order predicate calculus. More simple is the computational model given in Scho ¨nﬁnkel (1924) that is also capturing all partial computable functions. It is a very simple example of a Term Rewrite System (ﬁgure 2). The system is based on terms built up from the constants K, S under a binary operation (application). Various forms of data (natural numbers, trees, etc.,) can be represented as K, S expressions. Operations on this represented data can be performed by other such expressions. (d ) The compactness of the foundations The study of the foundations of mathematics has achieved the following. The triple activity of deﬁning, computing and reasoning can be described in each case by a small set of rules. This implies that it is decidable whether a (formalized) putative proof p (from a certain mathematical context) is indeed a proof of a given statement A (in that context). This is the basis of the technology of computer mathematics. For more on the relation between the foundational studies and computer mathematics, see Barendregt (2005).

3. Computer mathematics pﬃﬃﬃ In systems for Computer Algebra one can deal with mathematical objects like 2 with full precision. The idea is that this number is represented as a symbol, say a, and that with this symbol one computes symbolically. One has a2K2Z0 but pﬃﬃﬃ aC1 cannot be simpliﬁed. Thispcan ﬃﬃﬃ be done, since the computational rules for 2 are known. In some sense 2 is a ‘computable object’. There are many Phil. Trans. R. Soc. A (2005)

2362

H. Barendregt and F. Wiedijk

Figure 2. CL combinatory logic.

other computable objects like expressions dealing with transcendental functions (ex, log x) and integration and differentiation. In systems for computer mathematics, also called Mathematical Assistants, one can even represent non-computable objects. For example the set S of parameters for which a Diophantine equation is solvable. Also these can be represented on a computer. Again the non-computable object is represented by a symbol. This time one cannot simply compute whether a given number, say 7, belongs to S. Nevertheless, one can state that it does and in some cases one may prove this. If one provides a proof of this fact, then that proof can be checked and one can add 72S to the database of known results and use it in subsequent reasoning. In short, although provability is undecidable, being a proof of a given statement is decidable and this is the basis of systems for computer mathematics. It has been the basis for informal mathematics as well. One may wonder whether proofs veriﬁed by a computer are at all reliable. Indeed, many computer programs are faulty. It was emphasized by de Bruijn that in case of veriﬁcation of formal proofs, there is an essential gain in reliability. Indeed a verifying program only needs to see whether in the putative proof the small number of logical rules are always observed. Although the proof may have the size of several Megabytes, the verifying program can be small. This program then can be inspected in the usual way by a mathematician or logician. If someone does not believe the statement that a proof has been veriﬁed, one can do independent checking by a trusted proof-checking program. In order to do this one does need formal proofs of the statements. A Mathematical Assistant satisfying the possibility of independent checking by a small program is said to satisfy the de Bruijn criterion. Of particular interest are proofs that essentially contain computations. This happens on all levels of complexity. In order to show that a linear transformation A on a ﬁnite dimensional vector space has a real eigenvalue one computes detðAKlI Þ Z pðlÞ; and determines whether p(l) has a real root. In order to show that a polynomial function F vanishes identically on some variety V, one computes a Groebner basis to determine whether F is contained in the ideal generated by the equations deﬁning V, see Buchberger & Winkler (1998). Although it is shown that provability in general is undecidable, for interesting particular cases the provability of statements may be reduced to computing. These form the decidable cases of the decision problem. This will help computer mathematics considerably. Tarski (1951) showed that the theory of real closed ﬁelds (and hence elementary geometry) is decidable. An essential improvement was given by Collins (1975). In Buchberger (1965) a method to decide membership of ﬁnitely generated ideals in certain polynomial rings was developed. For polynomials over R this can be done also by the Tarski–Collins Phil. Trans. R. Soc. A (2005)

Challenge of computer mathematics

2363

method, but much less efﬁciently so. Moreover, ‘Buchberger’s algorithm’ was optimized by e.g. Bachmair & Ganzinger (1994). In order to show that the Four Colour Theorem holds one checks 633 conﬁgurations are ‘reducible’, involving millions of cases, see Robertson et al. (1996). How can such computations be veriﬁed? All these cases can be stylistically rendered as f (a)Zb that needs to be veriﬁed. In order to do this one ﬁrst needs to represent f in the formal system. One way to do this is to introduce a predicate Pf (x, y) such that for all a, b (say natural numbers) one has f ðaÞ Z b5 wPf ða; bÞ: Here ‘w’ stands for provability. If e.g. aZ2, then aZ SðSð0ÞÞ, a representation of algorithms are represented the object 2 in the formal system.6 In these languages as so called ‘logical programs’, as happened also in Go¨del (1931). In other formal theories, notably those based on type theory, the language itself contains expressions for functions and the representing predicate has a particularly natural form Pf ðx; yÞ dðFðxÞ Z yÞ: This is the representation of the algorithm in the style of functional programming. Of course this all is not enough. One also needs to prove that the computation is relevant. For example in the case of linear transformations one needs a formal proof of Pf ðA; 0Þ4 A has an eigenvalue: But once this proof is given and veriﬁed one only needs to check instances of Pf ða; bÞ for establishing f (a)Zb. are two ways of doing this. In the ﬁrst one the computation trace is There produced and annotated by steps in the logical program Pf (respectively, functional program F). This produces a very long proof (in the order of the length of computation of f (a)Zb) that can be veriﬁed step by step. Since the resulting proofs become long, they are usually not stored, but only the local steps to be veriﬁed (‘Does this follow from that and that?’). One therefore can refer to these as ephemeral proofs. On the other hand, there are systems in which proofs are fully stored for later use (like extraction of programs from them). These may be called petriﬁed proofs. In systems with such proofs one often has adopted the Poincare´ Principle. This principle states that for a certain class of equations tZs no proofs are needed, provided that their validity can be checked by an algorithm. This puts some strain on the de Bruijn criterion requiring that the verifying program be simple. But since the basic steps in a universal computational model are simple, this is justiﬁable. 6

For substantial computations one needs to introduce decimal (or binary) notation for numbers and prove that the operations on them are correctly deﬁned. In the history of mathematics it was al-Khowa`rizmı` (780–850) who did not introduce algorithms as the name suggests, but proved that the well-known basic operations on the decimal numbers are correct.

Phil. Trans. R. Soc. A (2005)

2364

H. Barendregt and F. Wiedijk

4. The nature of the challenge (a ) State of the art: effort and space Currently there are not many people who formalize mathematics with the computer, but that does not mean that the ﬁeld of computer mathematics is not yet mature. The full formalization of all of undergraduate university mathematics is within reach of current technology. Formalizing on that level will be labour-intensive, but it will not need any advances in proof assistant technology. To give an indication of how much work is needed for formalization, we estimate that it takes approximately one work-week (ﬁve work-days of eight work-hours) to formalize one page from an undergraduate mathematics textbook. This measure for some people is surprisingly low, while for others it is surprisingly high. Some people think it is impossible to formalize a non-trivial theorem in full detail all the way down to the axioms, and this measure shows that they are wrong. On the other hand, it takes much longer to formalize a proof than it takes to write a good informal version of it (this takes about half a workday per page: which is a factor of ten smaller). One can also compare the formal version of a mathematical proof with the corresponding informal—‘traditional’—way of presenting that proof. In Wiedijk (2000) it is experimentally found that a ﬁle containing a full formalization of a mathematical theory is approximately four times as long as the LaTeX source of the informal presentation. We call this factor the de Bruijn factor, as de Bruijn claimed that this ratio is a constant, which does not change when one proceeds in formalizing a mathematical theory. Some researchers actually believe that the factor decreases as the theory grows. (b ) State of the art: systems In ﬁgure 3 some contemporary systems for computer mathematics that are especially suited for the formalization of mathematical proof are presented. On the left in this diagram there are the four ‘prehistoric’ systems that started the subject in the early seventies (three of those systems are no longer actively being used and have their names in parentheses). These systems differed in the amount of automated help that they gave to their users when doing proofs. At one extreme there was the Automath system of de Bruijn, that had no automation whatsoever: all the details of the proofs had to be provided by the user of the system himself (it is surprising how far one still can go in such a system). At the other extreme there was the nqthm system—also known as the Boyer–Moore prover—which fully automatically tries to prove the lemmas that the user of the system puts to it. In between these two extremes there was the LCF system, which implemented an interesting compromise. The user of this system was in control of the proof, but could make use of the automation of socalled tactics which tried to do part of the proof automatically. As will be apparent from this diagram the LCF system was quite inﬂuential. The seven systems in this diagram are those contemporary Proof Assistants in which a signiﬁcant body of mathematics has been formalized. To give some impression of the ‘ﬂavour’ of those systems we have put a superﬁcial characterization in the right margin. See http://www.cs.ru.nl/wfreek/digimath/ for the Phil. Trans. R. Soc. A (2005)

Challenge of computer mathematics

2365

Figure 3. Some systems for computer mathematics.

Table 3. Foundational bases for systems of computer mathematics systems

basis

Mizar Coq, NuPRL HOL, Isabelle PVS ACL2

set theory intuitionistic type theory higher order logic higher order logic with predicate subtypes primitive recursive arithmetic

web-addresses with information on these systems. The ontologies on which these systems are based are stated in table 3. All of these systems (with the exception of Automath and Mizar) were primarily motivated by computer science applications. Being able to prove algorithms and systems correct is at the moment the main driving force for the development of Proof Assistants. This is an extremely exciting area of research. Currently, people who have experience with programming claim to ‘know’ that serious programs without bugs are impossible. However, we think that eventually the technology of computer mathematics will evolve into a methodology that will change this perception. Then a bug free program will be as normal as a ‘bug free’ formalized proof is for us who do formal mathematics. When one starts applying the technique to mathematics, one may be struck when ﬁnishing a formalization. Usually one needs to go over a proof when it is ﬁnished, to make sure one really has understood everything and made no mistakes. But with a formalization that phase is not needed anymore. One can even ﬁnish a proof before one has fully understood it! The feeling in that case is not unlike trying to take another step on a staircase which turns out not to be there. Phil. Trans. R. Soc. A (2005)

2366

H. Barendregt and F. Wiedijk Table 4. Formalized mathematics theorem

system

Hahn–Banach theorem law of quadratic reciprocity Go ¨del’s ﬁrst incompleteness theorem correctness of Buchberger’s algorithm fundamental theorem of Galois theory fundamental theorem of calculus fundamental theorem of algebra Bertrand’s postulate prime number theorem four colour theorem Jordan curve theorem textbook on continuous lattices

Mizar, ALFa, Isabelle nqthm, Isabelle nqthm, Coq ACL2, Agdaa, Coq Legoa many systems Mizar, HOL, Coq HOL, Coq Isabelle Coq HOL Mizar

a The ALF and Lego systems are Proof Assistants from the Automath/Coq/NuPRL tradition that are no longer in use. Agda is the successor of ALF: it is related to Automath but not to LCF.

On the other hand, when one returns from formalization to ‘normal’ programming, it feels as if a safety net has been removed. One can then write down incorrect things again, without being noticed by the system! A currently less successful application of Proof Assistants, but one which in the long run will turn out to be even more important than veriﬁcation in computer science, is the application of Proof Assistants to mathematics. The QED manifesto, see Boyer et al. (1994), gives a lucid description of how this might develop. We believe that when later generations look back at the development of mathematics one will recognize four important steps: (i) the Egyptian–Babylonian–Chinese phase, in which correct computations were made, without proofs; (ii) the ancient Greeks with the development of ‘proof ’; (iii) the end of the nineteenth century when mathematics became ‘rigorous’; (iv) the present, when mathematics (supported by computer) ﬁnally becomes fully precise and fully transparent. To show what current technology is able to do, in table 4 we list some theorems that have been formalized already. Clearly the technology has not yet reached ‘the research frontier’, but the theorems that can be formalized are not exactly trivial either. The formalizations that are listed in this table are much like computer programs. To give an indication of the size of these formalizations: the Isabelle formalization of the Prime Number Theorem by Avigad and others consists of 44 ﬁles that together take 998 kb in almost thirty thousand lines of ‘code’. (c ) What is needed? Today no mathematician uses a Proof Assistant for checking or developing new work. We believe that in the coming decennia this will change (although we do not know exactly when this will be). We now will list some properties that a system for computer mathematics should have before this will happen. Phil. Trans. R. Soc. A (2005)

Challenge of computer mathematics

2367

(i) Mathematical style In the current proof assistants the mathematics does not resemble traditional mathematics very much. This holds both for the statements as well as for the proofs. As an example consider the following statement: lim f ðxÞ C gðxÞ Z lim f ðxÞ C lim gðxÞ:†

x/x0

x/x0

x/x0

In the HOL system this statement is called LIM_ADD, and there it reads7

This does not match the LaTeX version of the statement. (The technical reason for this is that as HOL does not support partial functions, the limit operator is represented as a relation instead of as a function.) In the Mizar library the statement is called LIMFUNC3:37, and there it reads (where for clarity we replaced the condition of the statement, which states that the limits actually exist, by an ellipsis):

Again this does not resemble the informal version of the statement. (Here the reason is that Mizar does not support binders, and therefore the limit operator cannot bind the limit variable. Therefore the functions f and g have to be added instead of the function values f(x) and g(x).) Clearly unless a system can accept this statement written similar to

mathematicians will not be very much inclined to use it.8 While in most current systems the statements themselves do not look much like their informal counterparts, for the proofs it is even worse. The main exceptions to this are the Mizar language, and the Isar language for the Isabelle system. We call these two proof languages mathematical modes. As an example, the following is what a proof looks like in the actual 7

Here ‘!’ stands for ‘c’ and ‘\’ stands for ‘l’. Structurally this last version is what one would like to write, but typographically it still is not ideal. Perhaps one day it will be possible to use in a proof assistant a mathematical style like in † above or, at least, the LaTeX source for it.

8

Phil. Trans. R. Soc. A (2005)

2368

H. Barendregt and F. Wiedijk

Coq system.9

Not even a Coq specialist will be able to understand what is going on in this proof without studying it closely with the aid of a computer. It will be clear why we think that having a mathematical mode is essential for a system to be attractive to working mathematicians. As an example of what a mathematical mode looks like, in ﬁgure 4 there is the Coq proof rephrased using the Mizar proof language.10 (ii) Library The most important part of a proof assistant is its library of pre-proved lemmas. If one looks which systems are useful for doing formal mathematics, then those are exactly the systems with a good library. Using an average system with a good library is painful but doable. Using an excellent system without a library is not. The bigger the library, the more mathematics one can deal with in a reasonable time. As an example, in Nijmegen we formalized a proof of the Fundamental Theorem of Algebra (see Geuvers et al. 2001) and it took a team of three people two years. At the same time Harrison formalized the same theorem all by himself (as described in Harrison 2001) and it only took him a few days. The main 9

In this proof ‘limit_in1 f D l x0’ is the Coq notation for limx/x0 f ðxÞZ l where x ranges over the set D 4R. 10 Actually, this is a mixture of Mizar and Coq. The proof language is Mizar, but the statements are written in Coq syntax. We do this to be able to follow the Coq script very closely.

Phil. Trans. R. Soc. A (2005)

Challenge of computer mathematics

2369

Figure 4. A proof in mathematical mode.

difference which explains this huge difference in effort needed, is that he already had an extensive library while in Nijmegen we had not.11 (iii) Decision procedures One might imagine that the computer can help mathematicians ﬁnd proofs. However automated theorem proving is surprisingly weak when it comes to ﬁnding proofs that are interesting to human mathematics. Worse, if one takes an existing informal textbook proof, and considers the gaps between the steps in that proof as ‘proof obligations’, then a general purpose theorem prover often will 11

Another difference was that in Nijmegen we formalized an intuitionistic proof, while Harrison formalized a classical proof. But when analysing the formalizations, it turned out that this was not the main reason for the difference in work needed.

Phil. Trans. R. Soc. A (2005)

2370

H. Barendregt and F. Wiedijk

not even be able to ﬁnd proofs for those. For this reason Shankar, whose group is developing PVS, emphasized that rather than the use of general automated theorem provers the decision procedures, which specialize on one very speciﬁc task, are important as they will always be able to solve problems in a short time. In fact Shankar claims that the big success of PVS is mainly due to the fact that it has the best decision procedures of all the systems, and combines those well. Our view on automating computer mathematics is that a proof is something like an iceberg. When considering all details of the proof, a human mathematician will not even be consciously aware of the majority of those, just like an iceberg is 90% under water. What is written in papers and communicated in lectures is only the 10% of the proof (or even less) which is present in the consciousness of the mathematician. We think that the automation of a system for computer mathematics should provide exactly those unconscious steps in the proof. (There is a risk of having the computer provide too many steps so that we will not understand anymore what it is doing, and then we will not be able to guide the proof any longer.) One should make a distinction between unconscious steps and decidable ones. Some unconscious steps may be guided in undecidable areas by heuristic tactics. Also, some decision procedures have horrendous complexity, so it is not necessarily the case that they will ‘solve problems in a short time’. However, we like to emphasize that the main function of automation in proof assistants should be taking care of unconscious steps, and that decision procedures are an important part of that. (iv) Support for reasoning with gaps The manner in which proof assistants are generally being used today is that the whole formalization is completed all the way to the axioms of the system. This is for a good reason: it turns out that it is very difﬁcult to write down fully correct formal statements without having the computer help ‘debug’ the statements by requiring to formalize the proofs. If one starts a formalization by ﬁrst writing down a global sketch of a theory, then when ﬁlling in the actual formal proofs, it often turns out that some of those statements are not provable after all! If one just wants to use a Proof Assistant to order one’s thoughts, or to communicate something to another mathematician, then fully working out all proofs is just not practical. In that case one would like to just give a sketch of the proof inside the formal system, as described in Wiedijk (2004). Related to this is the technique called proof planning, see for instance Bundy (1991). Still, the current Proof Assistants do not support this way of working very well. In Lamport (1995) a proof style is described in which proofs are incrementally developed by reﬁning steps in the proof into more detailed steps. Although that paper does not talk about proofs in the computer, and although we are not sure that the speciﬁc proof display format that is advocated in that paper is optimal, it is clear that this style of working should be supported by systems for computer mathematics, in order to be accepted by the mathematical community. 5. Romantic versus cool mathematics After the initial proposals of the possibility of computer mathematics many mathematicians protested on emotional grounds. ‘Proofs should be survey-able Phil. Trans. R. Soc. A (2005)

Challenge of computer mathematics

2371

in our mind’, was and still is an often heard objection. We call this the romantic attitude towards mathematics. There is another style, cool mathematics, that is, veriﬁed by a computer. The situation may be compared to that in biology. In romantic biology, based on the human eye, one is concerned with ﬂowers and butterﬂies. In cool biology, based on the microscope, an extension of our eyes, one is concerned with cells. There is even super-cool molecular biology, based on electron microscopes. By now we know very well that these latter forms of biology are vital and essential and have a romanticism of their own. Similarly, we expect that cool proofs in mathematics will eventually lead to romantic proofs based on these. In comparison with biology there is also super-cool mathematics, checked by a computer, with a program this time not checked by the human mind, but checked by a computer in the cool way. This kind of boot-strap has been used for a compiled (hence faster) version of Coq, see Barras (1996, 1999). A fully formalized proof in Coq of the Four Colour Theorem has been veriﬁed, see Gonthier (2004). Moreover a full proof in HOL of the Jordan curve theorem has been produced by Tom Hales as part of his work towards a full formalization of his proof of the Kepler conjecture. Both informal proofs need a long computer veriﬁcation. These kinds of theorems with a long proof seem exceptional, but they are not. From the undecidability of provability it follows trivially that there will be relatively short statements with arbitrarily long proofs.12 We foresee that in the future cool proofs will have romantic consequences and moreover that computer mathematics will have viable applications. The authors thank Mark van Atten, Wieb Bosma, Femke van Raamsdonk and Bas Spitters for useful input.

References Ackermann, W. 1928 Zum Hilbertschen Aufbau der reellen Zahlen. Mathematische Annalen 99, 118–133. (doi:10.1007/BF01459088.) Aczel, P. & Rathjen M. (2001). Notes on constructive set theory. Technical report, Institut MittagLefﬂer. http://www.ml.kva.se/preprints/meta/AczelMon_Sep_24_09_16_56.rdf.html. Appel, K. & Haken, W. 1977a Every planar map is four colorable. Part I. Discharging. Illinois J. Math. 21, 429–490. Appel, K. & Haken, W. 1977b Every planar map is four colorable. Part II. Reducibility. Illinois J. Math. 21, 491–567. Aschbacher, M. 2004 The status of the classiﬁcation of the ﬁnite simple groups. Math. Monthly 51, 736–740. Bachmair, L. & Ganzinger, H. 1994 Buchberger’s algorithm: a constraint-based completion procedure. constraints in computational logics (Munich, 1994). Lecture Notes in Computer Science, vol. 845, pp. 285–301. Berlin: Springer. Barendregt, H. In press. Foundations of mathematics from the perspective of computer veriﬁcation. In Mathematics, computer science, logic—a never ending story. New York: Springer. Barendregt, H. & Geuvers, H. 2001 Proof-assistants using dependent type systems. In Handbook of automated reasoning (ed. Alan Robinson & Andrei Voronkov), pp. 1149–1238. Amsterdam: Elsevier Science Publishers B.V. Barras, B. 1996 Veriﬁcation of the interface of a small proof system in Coq. In Proceedings of the 1996 Workshop on Types for Proofs and Programs (ed. E. Gimenez & C. Paulin-Mohring), pp. 28–45. Aussois, France: Springer. 12

n

Indeed if every theorem of length n would have a proof of length 22 , then theorem-hood would be decidable by checking all the possible candidate proofs. Phil. Trans. R. Soc. A (2005)

2372

H. Barendregt and F. Wiedijk

Barras, B. 1999 Auto-validation d’un syste`me de preuves avec familles inductives. The`se de doctorat, Universite´ Paris 7. Boyer, R. et al. 1994 The QED manifesto. In Automated deduction—CADE 12, LNAI 814 (ed. A. Bundy). pp. 238–251. Berlin: Springer, http://www.cs.ru.nl/wfreek/qed/qed.ps.gz. Buchberger, B. 1965 An algorithm for ﬁnding a basis for the residue class ring of a zero-dimensional polynomial ring. Dissertation, University of Innsbruck. Buchberger, B. & Winkler, F. 1998 Gro ¨bner bases and applications. Cambridge: Cambridge University Press. Bundy, A. 1991 A science of reasoning. In Computational logic: essays in honor of Alan Robinson (ed. J.-L. Lassez & G. Plotkin), pp. 178–198. Cambridge, MA: MIT Press. Also available from Edinburgh as DAI Research Paper 445. Church, A. 1936 An unsolvable problem of elementary number theory. Am. J. Math. 58, 345–363. Collins, G. E. 1975 Quantiﬁer elimination for real closed ﬁelds by cylindrical algebraic decomposition, Automata theory and formal languages (Second GI Conference, Kaiserslautern, 1975) Lecture Notes in Computer Science, vol. 33. Berlin: Springer pp. 134–183. Davis, M. 1973 Hilbert’s tenth problem is unsolvable. Am. Math. Monthly 80, 233–269. Feferman, S. 1998 In the light of logic. Oxford: Oxford University Press. Floyd, R. W. 1967 Assigning meanings to programs Mathematical Aspects of Computer Science, Proceedings of Symposia in Applied Mathematics. Providence, RI: American Mathematical Society pp. 19–32 Frege, G. 1879 Begriffsschrift und andere Aufsa ¨tze. Hildesheim: Georg Olms. Zweite Auﬂage. Mit E. Husserls und H. Scholz’ Anmerkungen herausgegeben von Ignacio Angelelli, Nachdruck. Gentzen, G. 1969 The collected papers of Gerhard Gentzen. In Studies in logic and the foundations of mathematics (ed. M. E. Szabo). Amsterdam: North-Holland. Geuvers, H., Wiedijk, F. & Zwanenburg, J. 2001 A constructive proof of the fundamental theorem of algebra without using the rationals. In Types for proofs and programs (ed. Paul Callaghan, Zhaohui Luo, James McKinna & Robert Pollack) Proceedings of the International Workshop TYPES 2000, LNCS 2277, pp. 96–111. Berlin: Springer. Go¨del, K. 1930 Die Vollsta¨ndigkeit der Axiome des logischen Funktionalkalku ¨ls. Monatshefte fu ¨r Mathematik und Physik 37, 349–360. (doi:10.1007/BF01696781.) ¨ ber formal unentscheidbare Sa Go¨del, K. 1931 U ¨tze der Principia Mathematica und verwandter Systeme. Monatshefte fu ¨r Mathematik und Physik 38, 173–198. (doi:10.1007/BF01700692.) Translated and commented in Go ¨del (1986) Another English version based on course notes by Kleene and Rosser is in Go ¨del (1965). Go¨del, K. 1965 On undecidable propositions of formal mathematical systems. In The undecidable: basic papers on undecidable propositions, unsolvable problems and computable functions (ed. Martin Davis), pp. 41–74. New York: Raven Press. From mimeographed notes on lectures given by Go ¨del in 1934. Go¨del, K. 1995 In Collected works III: unpublished essays and lectures (ed. S. Feferman et al.). Oxford: Oxford University Press. Go¨del, K. 1986 Collected works, vol. 1. New York: The Clarendon Press/Oxford University Press. Publications 1929–1936, Edited and with a preface by Solomon Feferman. Gonthier, G. 2004 The four color theorem in Coq Talk at the TYPES 2004 conference, December 15–18, 2004, Campus Thale`s, Jouy-en-Josas, France 2004. Hales, T. In press. A proof of the Kepler conjecture. Ann. Math. http://www.math.pitt.edu/ wthales/kepler03/fullkepler.pdf. Harrison, J. 2001 Complex quantiﬁer elimination in HOL. In TPHOLs 2001: Supplemental Proceedings (ed. Richard J. Boulton & Paul B. Jackson), pp. 159–174. Edinburgh: Division of Informatics, University of Edinburgh. Published as Informatics Report Series EDI-INF-RR0046. http://www.informatics.ed.ac.uk/publications/report/0046.html. Heyting, A. 1930 Die formalen Regeln der intuitionistischen Logik Sitzungsberichte der Preussischen Akademie von Wissenschaften. Physikalisch-mathematische Klasse 1930 pp. 42–56. Phil. Trans. R. Soc. A (2005)

Challenge of computer mathematics

2373

Hilbert, D. 1926 Uber das Unendliche. Mathematische Annalen 95, 161–190. (doi:10.1007/ BF01206605.) Hoare, C. A. R. 1969 An axiomatic basis for computer programming. Commun. ACM 12, 576–583. (doi:10.1145/363235.363259.) Horgan, J. 1993 The death of proof. Sci. Am. 269, 92–103. Husserl, E. 1901 Untersuchungen zur Pha ¨nomenologie und Theorie der Erkenntnis. Halle: Max Niemeyer. Kempe, A. B. 1879 On the geographical problem of the four colors. Am. J. Math. 2, 193–200. Kleene, S. C. 1936 Lambda-deﬁnability and recursiveness. Duke Math. J. 2, 340–353. (doi:10.1215/ S0012-7094-36-00227-2.) Kunen, K. 1983 Set theory Studies in logic and the foundations of mathematics, 102. Amsterdam: North-Holland. An introduction to independence proofs, Reprint of the 1980 original. Lamport, L. 1995 How to write a proof. Am. Math. Monthly 102, 600–608. Martin-Lo¨f, P. 1984 Intuitionistic type theory Studies in proof theory. Lecture notes 1. Naples: Bibliopolis. Notes by Giovanni Sambin. Miller, G. 1976 Riemann’s hypothesis and tests for primality. J. Comp. Syst. Sci. 13, 300–317. Moerdijk, I. & Palmgren, E. 2002 Type theories, toposes and constructive set theory: predicative aspects of AST. Ann. Pure Appl. Logic 114, 155–201. (doi:10.1016/S01680072(01)00079-3.) Nederpelt, R. P., Geuvers, J. H. & de Vrijer, R. C. 1994 Twenty-ﬁve years of Automath research Selected papers on Automath. Stud. Logic Found. Math., 133. Amsterdam: North-Holland pp. 3–54. Rabin, M. O. 1980 Probabilistic algorithm for testing primality. J. Number Theor. 12, 128–138. (doi:10.1016/0022-314X(80)90084-0.) Robertson, N., Sanders, D. P., Seymour, P. & Thomas, R. 1996 A new proof of the four-colour theorem. Electron. Res. Announc. Am. Math. Soc. 2, 17–25. (doi:10.1090/S1079-6762-96-00003-0.) http:// wwwams.org/era/1996-02-01/S1079-6762-96-00003-0/home.html. ¨ ber die Bausteine der Mathematische Logik. Mathematische Annalen 92, Scho ¨nﬁnkel, M. 1924 U 305–316. (doi:10.1007/BF01448013.) Scott, D. 1970 Constructive validity Symposium on Automatic Demonstration (Versailles, 1968), Lecture Notes in Mathematics, vol. 125. Berlin: Springer pp. 237–275. ¨ ber ganzzahlige Lo Skolem, T. 1922 U ¨sungen einer Klasse unbestimmter Gleichungen.: Norsk Matematisk Forenings skrifter. Sudan, G. 1927 Sur le nombre transﬁni uu. Bulletin mathe´matique de la Socie´te´ Roumaine des Sciences 30, 11–30. Tarski, A. 1951 Decision method for elementary algebra and geometry. Berkeley: University of California Press. Terese (ed) 2003. Term Rewrite Systems. Cambridge: Cambridge University Press. Turing, A. M. 1936 On computable numbers, with an application to the Entscheidungsproblem. Proc. Math. Soc. Ser. 2 42, 230–265. Turing, A. M. 1949 Checking a large routine Report of a Conference on High Speed Automatic Calculating machines. Paper for the EDSAC Inaugural Conference, 24 June 1949 1949 pp. 67–69. Veltman, M. 1967 SCHOONSCHIP, A CDC 6600 program for symbolic evaluation of algebraic expressions. Technical Report, CERN. Wang, H. 1997 A logical journey, from Go ¨del to philosophy. Cambridge, MA: MIT Press (Bradford Books). Wiedijk, F. 2000 The de Bruijn factor 2000 http://www.cs.ru.nl/wfreek/notes/factor.ps.gz. Wiedijk, F. 2004 Formal proof sketches. In Types for proofs and programs: Third International Workshop, TYPES 2003, Torino, Italy, April 30–May 4, 2003, Revised Selected Papers, LNCS 3085 (ed. Stefano Berardi, Mario Coppo & Ferruccio Damiani).

Phil. Trans. R. Soc. A (2005)

2374

H. Barendregt and F. Wiedijk

Discussion N. SHAH (British Society of History of Mathematics, Durham, UK). Automated reasoning systems either use logic or intuitionistic type theory. Which (in the speaker’s opinion) will win out? D. H. BARENDREGT. Intuitionistic type theory also uses logic, just a more explicit one. You probably ask whether the classical logic of some systems will win or not from the intuitionistic one used in others. Good question! I think that when the technology will gain momentum, then the classical systems will be in the majority, but that on the long term the intuitionistic ones will win. After all they also can be in a classical mode by assuming the excluded third. A. BUNDY (School of Informatics, University of Edinburgh, UK ). If the mathematicians in the audience accept your argument then they will start to use automatic theorem provers. How long will it take before this becomes commonplace? D. H. BARENDREGT. Pessimists think in 50 years; optimists in 10 years. A. V. BOROVIK (School of Mathematics, University of Manchester, UK ). What are advantages of deterministic proof checkers over simpler and quicker nondeterministic procedures? If a non-deterministic procedure conﬁrms the validity of the statement with probability of error less than one in ten, after repeating it 100 times we have the probability of error in the non-deterministic judgement being less than one in ten to the power of one hundred, which is smaller than the probability of hardware error in the computer. D. H. BARENDREGT. For practical purposes I do dare to step in an airplane with that low chance of falling down. So it is a matter of aesthetics. Nevertheless, the method of proof-checking applies to the correctness of your non-deterministic procedure as well. A. J. MACINTYRE (School of Mathematical Sciences, Queen Mary, University of London, UK ). The Isabelle proof of the Prime Number Theorem is based on the elementary proof. This proof is regarded by mathematicians as less illuminating than the complex variable proof. When will Isabelle be able to do the latter proof ? Is the ‘library’ for a Master’s Programme realistic without this? D. H. BARENDREGT. We need more formalized libraries and in order to get these more certiﬁed tools. When this will happen depends on how hard we as community work. Complex variables should deﬁnitely be in the ‘library’ of a certiﬁed Master’s. P. H. HINES (retired ). ‘Romantic’ proof inspires other mathematicians. But cool/computer proof does not. D. H. BARENDREGT. Cool proofs have a romantic ﬂavour of their own. Some centuries ago biologists got excited about ﬂowers and bees. This is still the case. But now they also get excited about genome sequences. M. ATIYAH (Department of Mathematics & Statistics, University of Edinburgh, UK ). I can understand how a computer could check a proof, or even develop in detail a proof which was only outlined. It would do what a competent research Phil. Trans. R. Soc. A (2005)

Challenge of computer mathematics

2375

student could undertake. But in the real mathematical world the proof, or even the formulation of a theorem, is rarely known in advance, even in outline. It is hard to see how a computer can assist in such an ill-deﬁned process. D. H. BARENDREGT. The human provides the intuition. Then wants to check that intuition by constructing proofs. At ﬁrst the proofs are sketchy. It is at this phase that the mathematical assistants can help.

Phil. Trans. R. Soc. A (2005)

Phil. Trans. R. Soc. A (2005) 363, 2377–2391 doi:10.1098/rsta.2005.1651 Published online 14 September 2005

What is a proof ? B Y A LAN B UNDY 1 , M ATEJA J AMNIK 2

AND

A NDREW F UGARD 1

1

School of Informatics, University of Edinburgh, Appleton Tower, Crichton Street, Edinburgh EH8 9LE, UK ([email protected]) 2 University of Cambridge Computer Laboratory, J. J. Thomson Avenue, Cambridge CB3 0FD, UK To those brought up in a logic-based tradition there seems to be a simple and clear deﬁnition of proof. But this is largely a twentieth century invention; many earlier proofs had a different nature. We will look particularly at the faulty proof of Euler’s Theorem and Lakatos’ rational reconstruction of the history of this proof. We will ask: how is it possible for the errors in a faulty proof to remain undetected for several years—even when counter-examples to it are known? How is it possible to have a proof about concepts that are only partially deﬁned? And can we give a logic-based account of such phenomena? We introduce the concept of schematic proofs and argue that they offer a possible cognitive model for the human construction of proofs in mathematics. In particular, we show how they can account for persistent errors in proofs. Keywords: mathematical proof; automated theorem proving; schematic proof; constructive omega rule

1. Introduction To those brought up in a logic-based tradition there seems to be a simple and clear deﬁnition of proof. Paraphrazing Hilbert (Hilbert 1930): A proof is a sequence of formulae each of which is either an axiom or follows from earlier formulae by a rule of inference.

Let us call a proof in this format Hilbertian. But formal logic and its Hilbertian view of proof is largely a twentieth century invention. It was invented to help avoid erroneous proofs and to enable proofs about proofs, for instance Go¨del’s proof of the incompleteness of arithmetic (Go¨del 1931). Formal logic has since become the basis for automated theorem proving. Prior to the invention of formal logic, a proof was any convincing argument. Indeed, it still is. Presenting proofs in Hilbertian style has never taken off within the mathematical community. Instead, mathematicians write rigorous proofs, i.e. proofs in whose soundness the mathematical community has conﬁdence, but which are not Hilbertian. One contribution of 13 to a Discussion Meeting Issue ‘The nature of mathematical proof ’.

2377

q 2005 The Royal Society

2378

A. Bundy and others

Figure 1. Euler’s Theorem in the case of the cube. In a cube there are 8 vertexes, 12 edges and 6 faces. So VKECFZ8K12C6Z2.

To see that rigorous proofs are not Hilbertian, consider erroneous proofs. The history of mathematics is full of erroneous proofs. The faults in some of these proofs have remained undetected or uncorrected for many years. However, Hilbertian proofs can be readily checked. We merely need to ask of each formula in the proof: ‘is it an axiom?’ or ‘does it follow from earlier formulas by a rule of inference?’. Such checking can be readily automated—and, indeed, it often has been. But even in the age before computers, postgraduate students could have carried out the necessary checks as an apprentice exercise. Mathematical proofs are subjected to a lot of checking, so we can conclude that proofs containing persistent errors are unlikely to be Hilbertian. If a Hilbertian proof contained an error, it would surely be quickly detected and corrected. This may lead us to ask, what are the alternatives to Hilbertian proof presentation? Can these alternative presentations help us to understand how a fault can lie undetected or uncorrected for a long time? Could we formalize these alternative presentations? Could we automate such mathematical reasoning? We will present an alternative method of proof presentation that we call schematic proof. Schematic proof is partly inspired by Lakatos’s rational reconstruction of the history of Euler’s Theorem (Lakatos 1976). It has been automated in two projects at Edinburgh, using the constructive u-rule (Baker 1993, Jamnik 2001). We argue that schematic proofs offer a possible cognitive model for the human construction of proofs in mathematics. In particular, we show how they can account for persistent errors in proofs. They also help explain a key role for examples in the construction of proofs and a paradox in the relative obviousness of different, but related, theorems. 2. Lakatos’s discussion of Euler’s Theorem Euler’s Theorem1 states that, in any polyhedron, VKECFZ2, where V is the number of vertexes, E is the number of edges and F is the number of faces. This theorem is illustrated in the case of the cube in ﬁgure 1. In (Lakatos 1976), Imre Lakatos gives a rational reconstruction of the history of Euler’s Theorem. This history is set in a ﬁctitious classroom of extremely bright students and a teacher. The students adopt different roles in the history of the evolution of mathematical methodology. The teacher leads them through this 1

More properly, this would be called ‘Euler’s Conjecture’, since he proposed, but did not prove it.

Phil. Trans. R. Soc. A (2005)

2379

What is a proof? (i)

(ii)

(iii)

Figure 2. Cauchy’s ‘proof ’ applied to the cube. In step (i), one face of the cube is removed and the remaining faces are stretched onto the plane. In step (ii), these faces are triangulated to break them into triangles. In step (iii), these triangles are removed one by one. Two cases of step (iii) can arise and are illustrated. The ﬁgures are adapted from Lakatos (1976).

history. To initiate the discussion, the teacher presents a ‘proof’ of Euler’s Theorem due to Cauchy, which we reproduce in ﬁgure 2. Later, the teacher and the students discover various counter-examples to the Theorem. They use these counter-examples to analyse the faulty proof and propose a wide variety of different methods for dealing with the conﬂict between alleged proofs and counter-examples. These methods involve reﬁning deﬁnitions, correcting proofs, modifying conjectures, etc. Lakatos’s mission was to show how the methodology of mathematics had evolved: becoming more sophisticated in its handling of proofs and refutations. Our mission is different: we will analyse the proof method underlying Cauchy’s faulty proof and show how errors can arise from the use of this proof method. (a ) Cauchy’s ‘proof ’ of Euler’s Theorem Lakatos’s account of Cauchy’s ‘proof ’ is illustrated in ﬁgure 2 for the case of the cube. The general ‘proof ’ is given in theorem 2.1. Theorem 2.1. For any polyhedron, VKECFZ2, where V is the number of vertexes, E is the number of edges and F is the number of faces. Cauchy’s ‘proof ’. Given a polyhedron, carry out the following steps. (i) Remove one face and stretch the other faces onto the plane. Note that F has diminished by 1, but that V and E are unchanged. So we are required to prove that VKECFZ1. (ii) Triangulate the remaining faces by drawing diagonals. Note that each new diagonal increases both E and F by 1, but leaves V unchanged. So VKECF is unaffected. (iii) Remove the triangles one by one. There are two cases to consider, illustrated by step (iii) in ﬁgure 2. In the ﬁrst case, we remove an edge, so that both E and F decrease by 1. In the second case, we remove two edges and a vertex, so that both V and F decrease by 1, but E decreases by 2. In either case, VKECFZ1 is unaffected. Phil. Trans. R. Soc. A (2005)

2380

A. Bundy and others

Figure 3. The hollow cube: a counter-example to Cauchy’s ‘proof ’. The hollow cube is a cube with a cubical hole in the middle. The values of V, E and F are all doubled. So VKECFZ16K24C12Z4.

Finally, we are left with one triangle. In a triangle, VZ3, EZ3 and FZ1, so VKECFZ1, as required. & (b ) A counter-example to Euler’s Theorem Many people found Cauchy’s ‘proof ’ convincing. However, as Lakatos illustrates, eventually many counter-examples were found. The simplest is the hollow cube, illustrated in ﬁgure 3. Lakatos reports the reaction to this counter-example as a debate about whether the hollow cube is really a polyhedron. He offers two possible deﬁnitions of polyhedron, providing two opposite answers to this question. Deﬁnition 1. A polyhedron is a solid whose surface consists of polygonal faces. Under this deﬁnition, the hollow cube is a polyhedron. Deﬁnition 2. A polyhedron is a surface consisting of a system of polygons. Under this deﬁnition, the hollow cube is not a polyhedron. It is interesting to ask how it is possible for Cauchy to have offered a proof about polyhedra, when the question of their deﬁnition was still open.2 This could not happen in Hilbertian proofs: deﬁnitions are axioms and must come ﬁrst. What kind of proof might allow us to keep the deﬁnitions open? 3. Schematic proofs Note that the proof of theorem 2.1 is a procedure: given a polyhedron, a series of operations is speciﬁed, whose application will reduce the polyhedron to the triangle. The value of VKECF is tracked during these operations. The actual number of operations to be applied will vary depending on the input polyhedron. This is very unlike a Hilbertian proof, which is not procedural and in which the same number of proof steps is used for all examples. Independently of (Lakatos 1976), the Mathematical Reasoning Group at Edinburgh became interested in the constructive u-rule. We subsequently realized that this rule generates just the kind of proof used above to prove theorem 2.1. We call this kind of proof schematic. Schematic proofs are procedures that, given an example, generate a proof, which is speciﬁc to that example. The number of steps in each proof depends on the example. 2

Nor is it yet closed, since terms such as surface, system, etc. have still to be deﬁned.

Phil. Trans. R. Soc. A (2005)

What is a proof?

2381

(a ) The constructive u-rule The u-rule for the natural numbers 0, 1, 2, . is fð0Þ; fð1Þ; fð2Þ; . ; cx$fðxÞ i.e. we can infer that f(x) for all natural numbers x provided we can prove f(n) for nZ0, 1, 2, .. The u-rule is clearly not a very practical rule of inference, since it requires the proof of an inﬁnite number of premises to prove its conclusion. A Hilbertian proof using it would consist of an inﬁnite sequence of formulas. Its use is usually conﬁned to theoretical discussions. It was ﬁrst described in a published work by Hilbert (1931). The constructive u-rule is a reﬁnement of the u-rule that can be used in practical proofs. It has the additional requirement that the f(n) premises be proved in a uniform way, i.e. that there exists a recursive program, prooff, which takes a natural number n as input and returns a proof of f(n) as output. We will write this as prooff(n): f(n). The recursive program prooff formalizes our notion of schematic proof. Applied to the domain of polyhedra, rather than natural numbers, it could be used to formalize Cauchy’s ‘proof ’ of Euler’s Theorem given in theorem 2.1 in §2a. (b ) Implementation of the constructive u-rule To demonstrate its practicality as a rule of inference, we have implemented the constructive u-rule within two automated theorem-proving systems. In outline, these automated theorem-provers use the following procedure. (i) Start with some proofs for speciﬁc examples, e.g. prooff(3): f(3), prooff(4): f(4). (ii) Generalize these proofs of examples to obtain a recursive program: prooff. (iii) Verify, by induction, that this program constructs a proof for each n. prooff ð0Þ : fð0Þ; prooff ðnÞ : fðnÞwprooff ðn C 1Þ : fðn C 1Þ: At ﬁrst sight it may appear that step (iii) replaces a Hilbertian, object-level induction with an isomorphic meta-level induction. Siani Baker’s work (Baker 1993), however, shows that the meta-level induction is not isomorphic to the object-level one; often it is much simpler. Her work revealed many examples in which the object-level proof required generalization or intermediate lemmas, but the meta-level proof did not, i.e. the meta-level proof was inherently simpler. Note that Cauchy’s ‘proof’ omits the ﬁnal veriﬁcation step (iii) in the above procedure. He is trusting that his program for reducing polyhedra to triangles will work for all polyhedra. As we have seen, it does not. This helps explain the error in his proof. Both of our implementations of the constructive u-rule were for the natural numbers: Siani Baker’s for simple arithmetic theorems (Baker 1993) and the second author’s for a form of diagrammatic reasoning (Jamnik 2001), as described in Roger Nelsen’s book ‘Proofs without words’ (Nelsen 1993). Both our Phil. Trans. R. Soc. A (2005)

2382

A. Bundy and others

Figure 4. Schematic proof of the associativity of C. s(n) is the successor function for natural numbers, intuitively meaning nC1. sm(0) means s applied m times to 0. Addition is deﬁned recursively using two equations: the base case 0CyZy and the step case s(x)CyZs(xCy). Cs is rewriting, left to right, using this step case; Cb is rewriting using the base case. Note that the number of applications of Cs depends on m.

implementations included the ﬁnal veriﬁcation step, so were guaranteed to produce only correct schematic proofs. An example schematic proof from Baker’s work is given in ﬁgure 4. Rather than describe the program in a programming language, we try to capture the inﬁnite family of proofs that it outputs, using ellipses to indicate those steps and expressions that occur a variable number of times. An example proof from the second author’s work is shown in ﬁgure 5. Her program, Diamond, was shown proofs for two numbers and then generalized these into a program for generating the proof for any number. 4. The relative difﬁculty of proofs Proof by induction is the Hilbertian alternative to schematic proofs of theorems about recursive data-types, such as the natural numbers. We have also investigated the automation of inductive proofs (Bundy 2001). However, evidence arising from these investigations suggests that humans do not use inductive proof when assessing the truth or falsity of conjectures. This is perhaps not surprising, since the formalization of mathematical induction is a relatively modern development.3 Schematic proof is an alternative candidate model of the mechanism humans use to prove conjectures over inﬁnite domains. To illustrate the evidence against inductive proof as a cognitive model, consider the rotate-length theorem on lists: cl 2listðtÞ$rotðlenðl Þ; l Þ Z l;

ð4:1Þ

where l is a list of elements of type t, len is a unary function that takes a list l and returns its length and rot is a binary function that takes a number n and list l and rotates the ﬁrst n elements of l from the front to the back. The recursive deﬁnitions of len and rot are given in ﬁgure 6. Also deﬁned, is a binary function ! O, which takes two lists and appends them together. ! O is an auxiliary function in the deﬁnition of rot. The most straightforward induction rule for 3

It is usually attributed to Richard Dedekind in 1887, although informal uses of induction date back as far as Euclid. Phil. Trans. R. Soc. A (2005)

What is a proof?

2383

Figure 5. A proof without words. The diagram gives a proof of the theorem n2Z1C3C/C(2nK1). The diagram can be viewed as describing both the left and right hand sides of the equation. The whole square represents n2. Each of the L-shapes represents one of the odd numbers summed on the right-hand side.

lists is

Fð½ Þ c h 2t$c t 2listðtÞ$FðtÞ/ Fð½hjtÞ ; cl 2listðtÞ$FðlÞ

where [ ] is the empty list, [hjt] places an h at the front of a list t, t is an arbitrary type and list(t) is the type of lists of elements of type t. Having absorbed the deﬁnitions, most people will readily agree that the rotatelength theorem, stated in equation (4.1) is true. However, its inductive proof is surprisingly difﬁcult. It cannot be proved directly from the recursive deﬁnitions in ﬁgure 6. The proof requires the use of auxiliary lemmas, the generalization of the theorem and/or the use of a more elaborate form of induction. For instance, one way to prove the rotate-length theorem is ﬁrst to generalize it to ck 2listðtÞ$c l 2listðtÞ$rotðlenðl Þ; l ! O kÞ Z k ! O l: ð4:2Þ Although people will also readily agree that equation (4.2) is also true, they ﬁnd this assessment a little more difﬁcult than that of equation (4.1). So, if people are using induction to assess conjectures such as equations (4.1) and (4.2), even if unconsciously, then we are faced with a paradox: what appears to be a fairly easy assessment of equation (4.1), entails what appears to be the harder assessment of equation (4.2). Moreover, the inductive proof is quite difﬁcult, requiring, for instance, the generalization of the initial conjecture and the speculation and proof of a couple of intermediate lemmas (or some alternative but similarly complex processes) (Bundy 2001, §§ 6.3.3 and 6.2.2). This phenomenon is not rare. On the contrary, we have found lots of similar examples, where an intuitively obvious conjecture has only a complex inductive proof, requiring generalization, lemmas, non-standard inductions or a mixture of these. The intermediate generalizations, lemmas, etc. are often harder to assess than the original conjecture. The schematic proof of the rotate-length theorem is given in ﬁgure 7. This does not require any generalizations or intermediate lemmas and is fairly straightforward. The schematic proof can be viewed as evaluating the theorem on a generic list using the recursive deﬁnitions. In informal experiments, when we have asked subjects what mechanism they used to assess the truth/falsity of this theorem, they report a process that resembles this schematic proof,4 making it a candidate for a cognitive model. 4

For instance, Aaron Sloman, personal communication.

Phil. Trans. R. Soc. A (2005)

2384

A. Bundy and others

Figure 6. The recursive deﬁnitions of some functions. Each deﬁnition consists of one or more base and step cases. The base cases deﬁne the function for one or more initial values. The step cases deﬁne the function for constructed values in terms of the parts from which they are constructed.

5. Schematic proofs as a cognitive model We hypothesize that schematic proofs provide a cognitive model of some mathematical proofs. We are soon to start a project to test this hypothesis. It appears to provide a good ﬁt to procedural-style proofs, such as Cauchy’s ‘proof ’ of Euler’s Theorem and some informal justiﬁcations of inductive conjectures. It gives an account of how certain kinds of errors might occur: if the ﬁnal veriﬁcation step is omitted, then it is a matter of luck whether a schematic proof will produce a sound proof for every example. If the number of possible examples is inﬁnite or very large, it may take some considerable time before someone comes across an example for which the schematic proof fails. It may be difﬁcult to tell why the schematic proof fails on this example and how to repair it. The constructive u-rule provides a logic-based, formal account of schematic proof, as an alternative to the standard Hilbertian account. This gives us a sound mathematical basis to investigate rigorous,5 as opposed to Hilbertian proof. It ﬁlls a gap in MacKenzie’s classiﬁcation of proofs (this volume) by providing an example of a rigorous but mechanizable style of proof. To conﬁrm our hypothesis, we will have to carry out a series of psychological experiments to compare human mathematical performance with our implementations and formal accounts of schematic proof. Here is an outline of the kind of experiment we might perform. (i) Present theorems and near-miss non-theorems to human mathematicians. (ii) Ask for both their judgement of the truth/falsity of each example, together with a justiﬁcation of that decision. (iii) Investigate how subjects explore and absorb the meaning of recursive deﬁnitions. Do they try examples instances? Do they reason inductively? We may provide a computational tool that will support subjects’ exploration and keep a record of these explorations as experimental data. (iv) Try to model these justiﬁcations and explorations computationally. 5

Rigorous proofs are sometimes called ‘informal’, but this is a misleading description since, as we have seen, they can be formalized. Phil. Trans. R. Soc. A (2005)

What is a proof?

2385

Figure 7. A schematic proof of the rotate-length theorem. ! Os , lens and rots refer to rewriting using the step cases of the deﬁnitions of these functions. Similarly, ! Ob , lenb and rotb refer to rewriting using the base cases. Note that the number of times these rules are applied depends on n, the length of the list. However, only rewriting with the recursive deﬁnitions is required.

(v) Decide whether schematic proof or a Hilbertian proof provides a better explanation of these justiﬁcations or whether neither is a good ﬁt and there is a third possibility.6 It may be that subjects’ preferences vary according to their reasoning style. We may want to apply some pre-tests to classify the subjects’ reasoning styles. There has been some previous work on building computational models for how students recognize patterns in numbers and construct functions to generate the numbers (Haverty et al. 2000). This work could provide guidance on our experimental design, for instance, asking the students to speak aloud during the experiment, then analysing the resulting protocols for clues about internal processing. We also plan to conduct an investigation of some historical proofs, especially those that were later found to be faulty, to see if schematic proof can offer an explanation of the mechanism used and help explain why errors were made that were hard to detect or correct. 6. Discussion In this section, we discuss some related work. (a ) Comparison to type theory There are superﬁcial similarities between the proposals here, to use the constructive u-rule to produce schematic proofs and the formal representation of proofs in constructive type theory (Martin-Lo ¨f 1984). Both, for instance, associate, with each theorem, an object that can be interpreted as both a program and a proof. However, there are also signiﬁcant differences. 6

Another potential candidate is a mechanism we have investigated for reasoning with ellipsis (Bundy & Richardson 1999).

Phil. Trans. R. Soc. A (2005)

2386

A. Bundy and others

Firstly, the object associated with a theorem in type theory can be interpreted both as a program constructed by the proof and as a veriﬁcation proof of the correctness of that program and of the theorem. Moreover, the type theory proof proves the whole theorem. On the other hand, the program associated with a theorem by the constructive u-rule is not a general proof of the theorem; it is a program which will generate a putative proof for each instance of the theorem. Note that members of this family of proofs can contain different numbers of steps. Secondly, the program in type theory is generated by the process of proving the theorem. Its correctness is guaranteed by the soundness of type theory. The program in the constructive u-rule is generated by inductive generalization from a few example proofs of these theorem instances. As we have shown, its correctness is not guaranteed; an additional meta-level proof is required to establish this. This meta-level proof has no counterpart in type theory. (b ) Rigorous proof as Hilbertian proof highlights Many accounts of rigorous proof implicitly or explicitly adopt the position that a rigorous proof is essentially a Hilbertian proof, but with steps missing; possibly, 90% or more of the steps. This is probably a valid account of many humanconstructed proofs. We must then ask how errors may arise in such proofs and how these errors may lie undetected. It is not the case that mathematicians ﬁrst produce the Hilbertian proofs and then summarize them for publication by eliding 90%C of the steps. Firstly, this explanation is at variance with accounts of proof discovery. Secondly, the few attempts to turn rigorous proofs into Hilbertian proofs often reveal errors. For instance, Jacques Fleuriot’s formalization of Newton’s proofs of Kepler’s Laws, using the Isabelle prover and non-standard analysis (Fleuriot 2001), revealed an error in Newton’s manipulation of inﬁnitesimal numbers. Even Hilbert himself was not immune. Laura Meikle’s Isabelle formalization of Hilbert’s Grundlagen (Meikle & Fleuriot 2003), revealed that Hilbert had appealed to the semantics of the geometry domain rather than just the axioms and rules of the formal theory. Thirdly, rigorous proofs often prove unreasonably hard to check. We have argued that checking Hilbertian proofs should be routine: even Hilbertian proofs with many missing steps. At the time of writing, putative proofs of both the Poincare´ Conjecture and the Kepler Conjecture are undergoing extensive checking. Human accounts of proof discovery suggest that mathematicians ﬁrst form a plan, which they then unpack until they are satisﬁed of the truth of each proof step. This process of proof discovery can also be automated using the technique of proof planning (Bundy 1991). However, in our automation of proof planning, the plan is unpacked into a Hilbertian proof. Humans stop short of this level of unpacking. It would be interesting to investigate how they decide when to stop. A possibility worth investigation is that schematic proof is used at the leaves of the proof plan, i.e. that the proof plan is unpacked until the remaining subgoals can be checked against a few well-chosen examples. This would explain how errors could be introduced into the proof plan. It also unites our two rival accounts of rigorous proof. Phil. Trans. R. Soc. A (2005)

What is a proof?

2387

7. Conclusion The standard Hilbertian account of mathematical proof fails to model some historically important proofs, to account for the possibility of undetected and uncorrected error and to account for the relative difﬁculty of proofs. Schematic proof provides an alternative account of proof that does address these issues. Schematic proofs are based on the constructive u-rule, which provides a formal, logic-based foundation. This, for instance, enables us to automate the construction and application of schematic proofs. Schematic proof provides a link to computer program veriﬁcation, in which an invariant formula, analogous to VKECF, is shown to be preserved by successive computational operations. Just like Cauchy, programmers who do not verify their programs run the risk that their systems will fail on unforeseen inputs. The process of forming schematic proofs by generalizing from examples provides a key role for examples in the construction of proofs. This may go some way to explain why humans ﬁnd models, diagrams, etc. so valuable during proof discovery. We are now planning to conduct some psychological investigations into the extent to which schematic proofs can account for the mechanisms of human proof discovery. The research reported in this paper was supported by EPSRC grants GR/S01771 and GR/S31099 (Bundy), an EPSRC Advanced Research Fellowship GR/R76783 (Jamnik) and a Swedish Institute Guest Scholarship and EPSRC/MRC Neuroinformatics Studentship EP/C51291X/1 (Fugard). We are grateful to Ju ¨rgen Zimmer for help with (Hilbert 1930) and to Torkel Franzen for discussions about the u rule.

References Baker, S. 1993 Aspects of the constructive omega rule within automated deduction. Ph.D. thesis, University of Edinburgh, UK. Bundy, A. 1991 A science of reasoning. In Computational logic: essays in honor of Alan Robinson (ed. J.-L. Lassez & G. Plotkin), pp. 178–198. Cambridge, MA: MIT Press. Bundy, A. 2001 The automation of proof by mathematical induction. In Handbook of automated reasoning (ed. A. Robinson & A. Voronkov), vol. 1, pp. 845–911. Amsterdam: Elsevier. Bundy, A. & Richardson, J. 1999 Proofs about lists using ellipsis. In Proc. 6th Int. Conf. on Logic for Programming and Automated Reasoning, LPAR, number 1705 (ed. H. Ganzinger, D. McAllester & A. Voronkov). Lecture Notes in Artiﬁcial Intelligence, pp. 1–12. Berlin: Springer. Fleuriot, J. 2001 A combination of geometry theorem proving and nonstandard analysis, with application to Newton’s Principia. Distinguished dissertations. Berlin: Springer. ¨ ber formal unentscheidbare sa Go ¨del, K. 1931 U ¨tze der Principia Mathematica und verwandter systeme i. Monatsh. Math. Phys. 38, 173–198. (doi:10.1007/BF01700692.) (English translation in Heijenoort 1967). Haverty, L. A., Koedinger, K. R., Klahr, D. & Alibali, M. W. 2000 Solving inductive reasoning problems in mathematics: not-so-trivial pursuit. Cogn. Sci. 24, 249–298. (doi:10.1016/S03640213(00)00019-7.) Heijenoort, J. V. 1967 From Frege to Go ¨del: a source book in Mathematical Logic, 1879–1931. Harvard, MA: Harvard University Press. Hilbert, D. 1930 Die Grundlebung der elementahren Zahlenlehre. Mathematische Annalen 104, 485–494. (doi:10.1007/BF01457953.) Hilbert, D. 1931 Beweis des Tertium non datur—Nachrichten von der Gesellschaft der Wissenschaften zu Go ¨ttingen. Mathematisch–Physikalische Klasse, pp. 120–125. Phil. Trans. R. Soc. A (2005)

2388

A. Bundy and others

Jamnik, M. 2001 Mathematical reasoning with diagrams: from intuition to automation. Stanford, CA: CSLI Press. Lakatos, I. 1976 Proofs and refutations: the logic of mathematical discovery. Cambridge, UK: Cambridge University Press. Martin-Lo¨f, Per. 1984 Intuitionistic type theory. Studies in proof theory. Lecture Notes, vol. 1. Naples: Biblopolis. Meikle, L. I. & Fleuriot, J. D. 2003 Formalizing Hilbert’s Grundlagen in Isabelle/Isar Theorem. In Proving in Higher Order Logics: 16th International Conference, TPHOLs 2003. Springer Lecture Notes in Computer Science, vol. 2758, pp. 319–334. Berlin: Springer. Nelsen, R. 1993 Proofs without words: exercises in visual thinking. Washington, DC: Mathematical Association of America.

Discussion S. COLTON (Department of Computing, Imperial College London, UK ). In the (admittedly few) times I have undertaken research mathematics, half of the time, I have progressed in the style of Fermat, Goldbach and Euler, i.e. I have noticed a pattern, then proved that the pattern is no coincidence. However, half the time, the theorem statement emerged at the same time that I ﬁnished the proof, because when I started, I did not know exactly what I wanted to prove. I worry that in asking the question ‘What is proof?’, this emphasizes a distinction between theorem and proof, whereas often, they should not be differentiated. I was wondering what your thoughts were about this. A. BUNDY. I strongly agree that the development of the theorem and the development of the proof often proceed in parallel. Indeed, in axiomatic theories, the development of the theory and the deﬁnition of the concepts also sometimes proceeds in parallel with proof and theorem development. In automatic theorem proving this mutability of deﬁnitions, theorem and theory is usually neglected: the theory and theorem are taken as given and ﬁxed. I have always been interested in the potential for interaction between axioms, deﬁnitions, theorems and proofs and hope to investigate this further in my future research. For instance, I previously conducted joint research with Raul Monroy on the automatic detection and correction of false conjectures, using a failed proof attempt to guide the correction process. Currently, I have a project with Fiona McNeill that uses failures in proof to change the underlying representation of the theory. I have a project proposal to build a proof management system that will assist users to manage a large corpus of proofs, including adapting the proofs to accomodate changes in axioms and deﬁnitions. E. B. DAVIES (Department of Mathematics, King’s College London, UK ). In some areas of mathematics almost the entire interest consists in ﬁnding appropriate generalizations of simple examples, guided by what is possible and what seems natural, beautiful and simple. Different mathematicians have frequently been led to quite different generalizations of the same theorem. Checking the correctness of the proofs is not the interesting part of the subject. Do you have any comments? A. BUNDY. More generally, I think that mathematical reasoning consists of the interaction between a heterogeneous collection of processes: theory development, conjecture making, counter-example ﬁnding, formalization of informal problems, Phil. Trans. R. Soc. A (2005)

What is a proof?

2389

calculation, as well as proof discovery. Among these processess, proof discovery has received a disproportionate amount of attention from the automated reasoning community. In my group’s research, we have tried to investigate a wider range of mathematical processes. For instance, Simon Colton has built the HR system for theory development, including the formation of concepts and conjectures by generalization from examples. T. ANDERSON (CSR, School of Computing Science, University of Newcastle, UK ). Must we consign mathematics to the dustbin until computers have conﬁrmed the validity of the theorems and proofs? A. BUNDY. What an extraordinary idea! Firstly, Lipton has argued in this meeting that the correctness of a proof is conﬁrmed by a social process of interaction between mathematicians. We might want to integrate our computer systems into this social process so that they played a complementary role to the human mathematicians, but that requires solving very hard problems about the accessibility of and interaction with computer proof. Secondly, automated theorem proving is not yet capable of dealing with most state-of-the-art mathematics, but needs augmenting with human guidance, which calls for skills that are in short supply. Thirdly, even if the propensity of humans to err means we cannot be 100% conﬁdent of the correctness of a proof, a human-generated proof could still form the starting point for a computer veriﬁcation—indeed, most interative proof case studies have taken this form. Fourthly, human mathematicians ﬁnd mathematics fun. Why would they stop having fun? I think we need to ﬁnd niches where automated mathematical reasoning systems can play a useful complementary role to human mathematicians, e.g. in checking very large or complicated, but elementary proofs, in computer-aided teaching tools, in paper writing and refereeing aids, etc. We can also use automated reasoning as a modelling mechanism to try to understand human reasoning. N. SHAH (British Society of History of Mathematics, Durham, UK ). Professor Bundy mentioned that Newton’s Principia had a ﬂaw. The ﬂaw was addressed (as I understand it), by Berkeley and the axiom of the ﬁrst and last ratio. A. BUNDY. Bishop Berkeley addressed some general worries about the consistency of reasoning with inﬁnitesimals. As a result of such criticisms, the use of inﬁnitesimals in calculus was replaced by the epsilon/delta arguments of real analysis. Interestingly, work by the logician Abraham Robinson and others in the 1960s provided a consistent theory of inﬁnitesimal and inﬁnite numbers, called non-standard analysis, within which the arguments about inﬁnitesimals in the Principia and elsewhere can be formulated without the risk of paradoxes. Jacques Fleuriot’s mechanization of parts of the Principia, as mentioned in my paper, was based on Robinson’s non-standard analysis. The particular ﬂaw Fleuriot discovered in Newton’s ‘proof’ of Kepler’s laws of planetary motion, was not found by Berkeley, nor, to the best of our knowledge, by anyone else in the 318 years since the Principia was published, even though Newton himself was aware of this kind of ﬂaw (dividing both sides of an equation by an inﬁnitesmal). This illustrates how the nit-picking detail required in computer proofs can help uncover problems that a human’s more cursory reading will skim over without noticing. Phil. Trans. R. Soc. A (2005)

2390

A. Bundy and others

N. SHAH. Historically, mathematicians are interested in the intention behind the maths, and so long as their proof submitted can be repaired if wrong, mathematicians are not going to be convinced by proof reasoning people that the i’s dotted/t’s crossed are the most important thing. A. BUNDY. One of the most surprising lessons I have learnt from this meeting is the tolerance of mathematicians for minor errors in proofs. The clearest example of this was Michael Aschbacher’s estimate of the probablity of error in the classiﬁcation of ﬁnite groups as pZ1. His conclusion was not to reject the proof, but to assume that any error could be readily repaired, if necessary by adding a few more categories in the classiﬁcation. I interpret this stance as evidence of the hierarchical nature of proofs: if the high-level structure is right then any error in the low-level detail can probably be repaired. My research group has exploited this hierarchical structure in our work on proof plans: a hierarchical way of describing computer proofs, which can be used to guide the automated search for a proof and to automatically repair failed proof attempts. Despite this tolerance for minor error, I am guessing that mathematicians would still welcome a tool that could detect, and maybe even repair, such errors. M. ATIYAH (Department of Mathematics & Statistics, University of Edinburgh, UK ). I think I have to defend Newton! Any error in his work on planetary orbits must surely have been of a minor kind, easily rectiﬁable. His results have been rederived by modern methods innumerable times and experimentally conﬁrmed, so it is not signiﬁcant if such a minor lapse actually went undetected until recent times. A. BUNDY. This remark surely provides further evidence of the point made by the last questioner and in my response to it. Indeed, Newton’s error was of a minor kind. It was rectiﬁed by Fleuriot, who was able to replace the faulty step with a correct sub-proof. My Principia example was not meant to be a criticism of Newton. Rather, I was using it to illustrate both how hard it can be to detect minor errors, even in one of the world’s oldest and most well-known mathematics books, and how a computer proof can help us detect and repair such errors. A more serious example arises from the more recent work of Fleuriot and his student Laura Meikle (a student helper at this meeting). They automated Hilbert’s Grundlagen, which was an attempt to formalize Euclidean Geometry without the use of geometric intuition. But the detailed computer reconstruction showed that Hilbert had used geometric intuition, although again the missing formal steps could be provided. However, although the errors were minor, their presence was not, since it undermined the raison d’etre of Hilbert’s work. R. POLLACK (School of Informatics, University of Edinburgh, UK ). Questioners objected that the error in Newton’s Principia was minor, and after all, the theorem was correct, so nothing much was gained by Fleuriot discovering and ﬁxing the error. But at the same time, questioners insisted on the importance of the deep understanding captured in the proof: this is trying to have your cake and eat it at the same time. A. BUNDY. It all depends on what you mean by ‘deep’. You could argue that the deep understanding arises from the high-level structure of the proof, which Phil. Trans. R. Soc. A (2005)

What is a proof?

2391

captures the essential intuition behind the proof, rather than the detailed lowlevel proof steps within which the error was found. On the other hand, many of the paradoxes that arose from the informal use of inﬁnitesimals arose from just such faulty low-level proof steps. Any ‘deep understanding’ of the cause of these paradoxes would require the investigation of exactly these low-level steps.

Phil. Trans. R. Soc. A (2005)

Phil. Trans. R. Soc. A (2005) 363, 2393–2394 doi:10.1098/rsta.2005.1652 Published online 6 September 2005

Panellist position statement: some industrial experience with program veriﬁcation B Y R ODERICK C HAPMAN Praxis High Integrity Systems ([email protected]) As the only obvious ‘industrial’ member of the panel, I would like to introduce myself and the work I am involved with. Praxis is a practising software engineering company that is well known for applying so-called ‘Formal Methods’ in the development of highintegrity software system. We are also responsible for the SPARK programming language and veriﬁcation tools (John Barnes with Praxis High Integrity Systems 2003). SPARK remains one of the very few technologies to offer a sound veriﬁcation system for an industrially usable imperative programming language. Despite the popular belief that ‘no one does formal methods’, we (and our customers) regularly employ strong veriﬁcation techniques on industrial-scale software systems. I would like to address three main points:

1. What can and do we prove about programs? ‘Proof’ of computer programs is often seen as an arduous ‘all or nothing’ exercise only advocated by particularly sadistic university professors. Not so. SPARK offers a range of analyses that verify simple program properties (such as freedom from aliasing and data-ﬂow errors) up to full veriﬁcation of partial correctness with respect to some suitable speciﬁcation. In the middle of this spectrum we have veriﬁcation of ‘no run-time errors’ (such as division-by-zero or the ubiquitous ‘buffer overﬂow’) and the veriﬁcation of ‘interesting’ safety and security invariants. A particular project will often mix and match these levels of veriﬁcation, where they are needed most, depending on safety and/or security requirements. These analyses scale up reasonably well. Proof of the absence of run-time errors has been performed on programs of the order of 100 000 lines of code. Partial correctness proofs have been developed for signiﬁcant portions of 20 000 line programs (King et al. 2000). These are still one or two orders of magnitude below what is needed for ‘Grand Challenge’ size programs, but at least we have some starting point. Completeness of the proof system remains an important issue. For run-time error proof, the theorem prover automatically discharges about 95% of veriﬁcation conditions (VCs) for well-written programs. This also gives us a useful quality metric—if the theorem prover does not hit 95%, then your One contribution of 13 to a Discussion Meeting Issue ‘The nature of mathematical proof’.

2393

q 2005 The Royal Society

2394

R. Chapman

program is probably too complex or badly structured and should be re-written. Improving this completeness remains a fundamental research goal. 2. Development process and engineering behaviour When engineers are ﬁrst exposed to the SPARK and its proof technology, they typically ﬁnd it hard going. SPARK requires (indeed forces) a clarity and precision of expression that most programmers are unaccustomed to. Secondly, the availability of proof alters the normal software development process. In particular, code is not manually reviewed or tested until it has passed a deﬁned level of automatic analysis. For example, a project might require over 95% of VCs automatically discharged prior to code review. This (eventually) changes the engineers’ behaviour—producing elegant, provable code becomes the norm. This investment in time ‘up front’ pays off later owing to the lower defect rate that results. SPARK has sometimes been described as ‘talent normalization’ facility—poor programmers must pull their socks up, while the ‘gurus’ are forced to reign in their dark magical skills and produce code that someone else (or a machine) can actually understand. Secondly, trying to produce code so rigorously often discovers defects in speciﬁcations and requirements. You can ‘get stuck’ with SPARK—ﬁnding that a program is impossible to implement as speciﬁed or ﬁnding VCs that cannot be discharged. Subtle ambiguities and contradictions in speciﬁcations and requirements can be discovered this way. Finding such defects prior to any dynamic analysis (e.g. testing) also generates a signiﬁcant saving of time and effort. 3. Social acceptance To apply strong software veriﬁcation technology, suppliers need to convince many stakeholders of its usefulness. Customers, government agencies, regulators, engineers, educators, the public and many more need to be convinced that such technology is cost-effective, scalable and produces a better product. Legal precedents for the liability of software producers and even the existence of any best-practice at all in software engineering remain elusive. In a few industries (e.g. UK military aerospace) some success has been reported—most SPARK users carry out useful proof of non-trivial programs and the various stakeholders seem convinced of its worth. In other domains, many hearts and minds are still to be won. References High Integrity Software: The SPARK approach to safety and security. (2003). MA, USA: AddisonWesley. See also www.sparkada.com. King, S., Hammond, J., Chapman, R. & Pryor, A. 2000 Is proof more cost effective than testing? IEEE Trans. Software Eng. 26, 675–686. (doi:10.1109/32.879807.)

Phil. Trans. R. Soc. A (2005)

Phil. Trans. R. Soc. A (2005) 363, 2395–2396 doi:10.1098/rsta.2005.1653 Published online 6 September 2005

Panelist position statement: reasoning about the design of programs B Y C LIFF B. J ONES University of Newcastle upon Tyne ([email protected])

I have long been involved in using formal notation to explain computer systems and to record our understanding. My views are, therefore, more concerned with the extent to which what one does when one reasons about software can be compared with normal mathematics than whether or not software theorem provers can help mathematicians. All scientists and engineers build models which capture essential abstractions of complex systems; at different times we might focus on different facets of a system. Not only does one seek brevity and abstraction, one also seeks a tractable notation which facilitates reasoning about—or calculation of properties of—the subject system. It is often the case that rather deeper results are required to justify the use of a particular reasoning style. I became involved in what is often termed ‘formal methods’ (for computing) when it became clear that programming languages were becoming too complex to handle via informal methods. (Working on ﬁnal testing of a major compiler for PL/I in IBM convinced me that quality cannot be achieved by any post-hoc technique—even though we designed automatic test tools which were ahead of their time.) The major beneﬁt of writing a formal description of a computer system or programming language is that it helps simplify the design or ‘architecture’; messy interactions of features are spotted long before effort to implement them uncovers the problems (which if detected late are likely to be patched in even more messy ways). My view of the role of proof (or as I want to propose, ‘rigorous argument’) is similar to this description of the usefulness of abstract speciﬁcations. In all but the most trivial cases, whenever I have been faced with a challenge to prove an extant program satisﬁes its speciﬁcation, I have failed! What I have been able to do is to start again with a formal speciﬁcation and systematically develop a new program. The new program might use concepts from the one I had tried to understand; it might also embody new ideas, which were prompted by the abstractions. Comparison between the original program and the redeveloped one will often uncover errors in the former while the latter is complete with a design rationale which can help others understand it. My position is that any process, that starts only after a sloppy design phase, is doomed. This is true if that post facto process is testing, model checking or even proving. It is the ‘scrap and rework’ involved in removing errors which wastes effort in software development. Formalism pays off when it can be used to detect One contribution of 13 to a Discussion Meeting Issue ‘The nature of mathematical proof’.

2395

q 2005 The Royal Society

2396

C. B. Jones

ﬂaws before further work is based on such mistakes. Formal development methods for computer systems like VDM (Jones 1990) or B (Abrial 1996) use a ‘posit and prove’ style which ﬁts well with engineering practice; an individual design decision is made and justiﬁed before further work is based on it. Numerous examples could be listed where steps of data reiﬁcation or operation decomposition provide real insight into the design of a program. (One of my own current research goals is to devise a method of ‘atomicity reﬁnement’.) Having been one of the ﬁrst to use the term ‘rigorous argument’ in connection with this sort of development, I would like to say why I think it closely resembles the sort of outline proofs praised by mathematicians. One can characterize ‘rigour’ as being capable of formalization. In program design, a step of data reiﬁcation might be justiﬁed by recording a ‘retrieve function’; if doubt arises, in say a review of a design step, the author can be pressed to add more detail; in the extreme, one might push this to a fully formal proof. Unlike the position of my co-panelist’s original paper, I see this as being rather like the social process in mathematics. There is of course a place for mechanical proof checkers or automatic theorem provers if they can be made sufﬁciently usable. Jean-Raymond Abrial—for example—has a tool which will automatically discharges the vast majority of ‘proof obligations’ in a careful development using B. But it takes good (mathematical) taste to break the development in just the right way to achieve this. I would also add that changes are the norm in software and automatic tools are useful in tracing their impact. Nor in my opinion does the above exhaust the similarities to mathematical proof. The late Ole-Johan Dahl made the point that program proving would never take off unless we built up bodies of theorems about our basic tools (abstract data objects and frequently used control constructs): this is like the task of developing an interesting mathematical theory. Beyond that, there is the justiﬁcation of the methods themselves: initial forms of data reiﬁcation proofs relied on a homomorphism from representation to abstraction; there were interesting cases involving non-determinism where VDM’s rules were not complete; ﬁnding and justifying complete rules was an important meta result. Finally, I should like to add a word about ‘separation of concerns’. It is obvious that a proof about a program in a (Baroque) programming language is dubious. But a clearly recorded semantics for a safe subset of such a language can offer a way of dividing a huge task into two more tractable steps: the semantics should be used as a basis for the compiler design/veriﬁcation and used to provide assumptions when reasoning about programs in the language. References Abrial, J.-R. 1996 The B-Book: Assigning programs to meanings. Cambridege University Press. Jones, C. B. 1990 Systematic software development using VDM. Prentice Hall International.

Phil. Trans. R. Soc. A (2005)

Phil. Trans. R. Soc. A (2005) 363, 2397–2399 doi:10.1098/rsta.2005.1654 Published online 6 September 2005

Panelist position statement: logic and models in computer science B Y U RSULA M ARTIN Queen Mary University of London ([email protected])

Modern computing products are among the most complex engineering artefacts so far created. For example, Microsoft’s Windows operating system has around 100 million lines of code, predicted to grow by 33% a year. Intel’s Itanium 2 processor has around 400 million transistors, with Moore’s law predicting a doubling in that number every 18 months. Ensuring the correctness of such large and complex systems demands increasing resource—for example veriﬁcation is claimed to take 50% of the cost of chip design, rising to 70% in some companies. The damage to users and the companies themselves, caused by widely publicised ﬂaws such as the Pentium division bug or Internet Explorer security loopholes, means companies like Intel and Microsoft are devoting increased attention to veriﬁcation both in research and product divisions. These techniques build on years of earlier research into appropriate mathematical theories for modelling processes and devices (Jones 2003). Pioneers like von Neumann, Goldstine and Turing in the 1940s understood that computing could be viewed as a branch of logic; in the 1960s Hoare and Floyd developed logics for reasoning about assertions and programs; in the 1970s Scott and Strachey developed the rigorous notions of semantics that allowed us to understand what a program did independently of the particular machine architectures it was running on and Milner laid the foundations of the theories we need to study distributed and interacting processes. The inﬂuence of this work is seen in the design of modern programming languages like Java and the takeup of logic-based veriﬁcation techniques: today, articles in trade magazines like EE Times routinely mention ‘assertions’ or ‘model checking’, which until a few years ago were the preserve of academic specialists. Effective machine support is essential if these ideas are to be applied in practice (MacKenzie 2001). Milner and Gordon were among the ﬁrst to develop the theorem proving tools that made it practical to apply these theoretical ideas to obtain correctness proofs in domains, where calculation or veriﬁcation by hand would be totally infeasible. These tools build up formal proofs from axioms and rules and are particularly valuable when large numbers of cases of rather similar results need to be veriﬁed, as useful tactics for semi-automation may be devised even if the theory is undecidable. Clarke devised model checking, which provided counterexamples when such correctness proofs failed and has proved particularly useful for systems modelled as ﬁnite-state automata. One contribution of 13 to a Discussion Meeting Issue ‘The nature of mathematical proof’.

2397

q 2005 The Royal Society

2398

U. Martin

Current applications of theorem proving are far from the dreams of the early pioneers, of running fully veriﬁed software on fully veriﬁed hardware: the companies involved are making pragmatic business decisions about how best to incorporate useful techniques into their existing well-developed design infrastructure. For example at Microsoft Ball and others (Ball et al. 2004) have developed theorem provers and model checkers to verify device drivers—the tricky code that makes peripherals, like monitors or printers, work correctly (usually). Windows contains thousands of drivers—in their tests of 30 properties of the Microsoft Windows Parallel Port device driver, the prover was called 487 716 times: on average, these queries contained 19 unique atoms and 40 instances of Boolean operators per query and in the worst case, one query contained 658 unique atoms and another contained 96 691 instances of the Boolean operators. At Intel, Harrison (Aagaard & Harrison 2000) used theorem proving in a version of Gordon’s HOL system to verify the ﬂoating point division of the IA-64 against the IEEE standard. The IA-64 reﬁnes the hardware’s division in software and his work necessitated developing theories of real arithmetic and analysis in HOL, in order to verify large numbers of special cases according to edge effects on registers and the like; this in turn involved treating various Diophantine equations that determined where the bad cases lay. In both cases, once the underlying mathematical theories are established and the infrastructure set up in the theorem prover, it may be used over and over again to derive results about particular cases which are important for the matter at hand but unlikely to be of great mathematical signiﬁcance. This context provides a way of addressing questions of different kinds mathematical approach. As an analogy let us consider applying the theory of dynamical systems to determine stability of a ﬁghter aircraft: (i) The theory of dynamical systems is well-developed, building on the foundations of Newton and Liebniz to provide precise deﬁnitions and theorems, for example conditions for solutions to exist, to be stable and so on. Even so, this development took several hundred years with surprises along the way, for example Poincare’s discovery of chaotic phenomena. (ii) To investigate a particular system, for example to establish that it is stable, we use practical engineering knowledge to determine an appropriate model. For established disciplines like aircraft design our choice of model may be codiﬁed as fairly rigorous protocols and standards, based on the theories of dynamical systems and control engineering, which are well-established as a lingua franca in the community. (iii) To establish properties of the model we run tests on it, for example computing eigenvalues of a linear system to verify stability, most likely with machine assistance in a program such as MatLab to ensure accurate answers. The results of these tests are unlikely to be of general importance in the theory—they act as routine calculations. If this process produces an unsatisfactory answer it may arise from problems at any of the three stages: incorrect computation of the eigenvalues, poor choice of a model or possibly, though unlikely, from a hitherto unnoticed ﬂaw in the underlying theory of differential equations. Phil. Trans. R. Soc. A (2005)

Panelist position statement

2399

The development of veriﬁcation described above follows this pattern in outline, but by contrast we have a great variety of mathematical models and veriﬁcation tools under consideration, much less of a consensus about how or where to apply them or about a uniﬁed approach to education and standards. It seems to me that this should be viewed as a remarkable opportunity, rather than a weakness. The dream of some of the early workers in mechanised proof was that this would transform mathematics. It has not yet done so and maybe never will, but it has made possible the machine veriﬁcation of routine yet unwieldy mathematical results that are needed to model computational phenomena (Martin 1999). By the standards of computer science, the development of classical mathematics is a slow process, yet it has a humbling depth and richness which we can aspire to in developing our present theories and the software tools that support them, so that they can bring to computational systems the power that calculus has brought to physics and engineering. By the standards of mathematics, modern computer science may seen to have identiﬁed a ridiculous variety of theories that may sometimes appear rather shallow, yet it has enormous challenges to meet in modelling, understanding and predicting next generation networks and devices. There is plenty of exciting work ahead for everyone. References Aagaard, M. & Harrision, J. (eds) 2000 Theorem proving in higher order logics, 13th international conference, TPHOLs 2000, Portland, Oregon, USA, August 14–18, 2000, Proceedings. Lecture notes in computer science, vol. 1869. Berlin: Springer. Ball, T., Cook, B., Levin, V. & Rajamani, S. K. 2004 SLAM and static driver veriﬁer: technology transfer of formal methods inside Microsoft. In Integrated formal methods, 4th international conference, IFM 2004, canterbury, UK, April 4–7, 2004, Proceedings (ed. E. A. Boiten, J. Derrick & G. Smith) Lecture notes in computer science, vol. 2999, pp. 1–20. Berlin: Springer. Jones, C. B. 2003 The early search for tractable ways of reasoning about programs. IEEE, Ann. Hist. Comput. 25, 26–49. (doi:10.1109/MAHC.2003.1203057.) MacKenzie, D. 2001 Mechanizing proof: computing, risk, and trust. Cambridge, Mass.: MIT Press. Martin, U. 1999 Computers, reasoning and mathematical practice. In Computational logic. Proceedings of the NATO Advanced Study Institute on Computational Logic, Marktoberdorf, Germany, 29 July–10 August 1997. NATO ASI Series, Computer and systems sciences, vol. 165, pp. 301–346. Berlin: Springer.

Phil. Trans. R. Soc. A (2005)

Phil. Trans. R. Soc. A (2005) 363, 2401–2406 doi:10.1098/rsta.2005.1655 Published online 9 September 2005

Highly complex proofs and implications of such proofs B Y M ICHAEL A SCHBACHER Department of Mathematics, California Institute of Technology, Pasadena, CA 91125, USA ([email protected]) Conventional wisdom says the ideal proof should be short, simple, and elegant. However there are now examples of very long, complicated proofs, and as mathematics continues to mature, more examples are likely to appear. Such proofs raise various issues. For example it is impossible to write out a very long and complicated argument without error, so is such a ‘proof ’ really a proof ? What conditions make complex proofs necessary, possible, and of interest? Is the mathematics involved in dealing with information rich problems qualitatively different from more traditional mathematics? Keywords: complex; proof; simple group; classiﬁcation

Conventional wisdom says the ideal mathematical proof should be short, simple and elegant. However, there are now examples of very long, complicated proofs, and as mathematics continues to mature, more examples are likely to appear. I have some experience with one such effort: the Classiﬁcation of the ﬁnite simple groups. I’m going to use the Classiﬁcation theorem and its proof as a basis for discussion, but I’m not going to state the theorem or go into details about the proof. Rather I’ll treat the Classiﬁcation and its proof as a black box, in that I’ll begin by listing some features of the theorem and its proof, and later use them to help illustrate some of the points I hope to make. First, the proof of the Classiﬁcation is very long and complicated. As a guess, the proof involves perhaps 10 000 pages in hundreds of papers, written by hundreds of mathematicians. It would be difﬁcult to establish exactly which papers are actually a necessary part of the proof, and I know of no published outline. At least this last difﬁculty will be eliminated by a program in progress, whose aim is to carefully write down in one place a complete and somewhat simpliﬁed version of most of the proof. Still there has not been as much improvement and simpliﬁcation of the original proof as one might expect. Second, the theorem is very useful. One cannot do serious ﬁnite group theory without the Classiﬁcation, and it has made possible numerous applications of ﬁnite group theory in other branches of mathematics. One can speculate that a proof of the complexity of the Classiﬁcation would be unlikely to evolve in the absence of such strong incentives. One can also speculate that such theorems can only be proved via some kind of evolutionary process: the extent of the problem One contribution of 13 to a Discussion Meeting Issue ‘The nature of mathematical proof’.

2401

q 2005 The Royal Society

2402

M. Aschbacher

and possible paths to a solution only become visible after a large amount of preliminary investigation and experimentation. Third, at ﬁrst glance the Classiﬁcation is a prototypical classiﬁcation theorem: It considers a class C of objects (in this case the class of ﬁnite simple groups), supplies a list L of objects in the class and proves that each member of C is isomorphic to exactly one member of L. But also fourth, the collection L of examples is large, varied, and of great interest, and each member has a rich structure. The Classiﬁcation does more than just show L and C are equal; its proof supplies a wealth of detailed information about the structure of members of L. Such information is a prerequisite for applying the Classiﬁcation. Thus after a bit more thought, the Classiﬁcation is more than just a ‘classiﬁcation theorem’. Fifth, the proof is inductive and depends upon a good knowledge of the structure of members of L. That is to say one considers a minimal counter example to the Classiﬁcation: an object G of minimal order subject to G in C but not in L. Then all proper simple ‘sections’ of G in C are in L, and most arguments are based on strong information about such sections, available in the inductive context. As an aside, it is worth noting that there exists no theorem which says: Each sufﬁciently large member of C is in L. If we’ve made mistakes, so that the theorem is false and there is some H in CKL, then it might be possible to repair the theorem by adding H to L and making minor modiﬁcations to the inductive ‘proof ’. This would be true if the structure of H is much like that of the members of L. But if H has a very different structure, one could imagine that such a modiﬁcation might not be possible. Now I’d like to draw some implications from the example. I began with the observation that the ideal proof is short, simple, and elegant. The proof in our example has none of these desirable qualities. That hasn’t stopped mathematicians from appealing to the theorem, but it does raise various questions. First, because of the complexity of the proof and the absence of a deﬁnitive treatment in the literature, one can ask if the theorem has really been proved. After all, the probability of an error in the proof is one. Indeed, presumably any attempt to write down a proof of such a theorem must contain many mistakes. Human beings are not capable of writing up a 10 000 page argument which is entirely free of errors. Thus if we demand that our proofs be error free, then the Classiﬁcation can’t be proved via techniques currently available. However in practice, mathematicians seem only to take this idealized notion of a proof as a model toward which to strive. The real standard would appear to be an argument which deals carefully with all fundamental difﬁculties, and which organizes and does due diligence to the small details, so that there are few gaps or minor errors, and those that exist can be ﬁlled in or repaired without much difﬁculty by the reader. I suspect most professional mathematicians feel that, after some (high) minimal standard of rigor has been met, it is more important that the proof convey understanding than that all formal details appear without error. This suggests we should consider a bit more carefully the role ‘proof ’ plays in mathematics. At Caltech, pure mathematics is part of the ‘Division of Physics, Mathematics, and Astronomy’. This gives me a little insight into the difference between how mathematicians and physicists view the notion of ‘proof’. For the physicist, the truth of a theory or hypothesis is established by testing it against Phil. Trans. R. Soc. A (2005)

Highly complex proofs and implications

2403

physical data. My sense is that most physicists feel proofs are nice, but not all that important. On the other hand, for the mathematician, truth is established via proofs, since that portion of a particular mathematical universe visible via ‘experiment’ may be too small to be representative of the total universe. But the process of producing a proof does more: It leads to a deeper understanding of the mathematical universe the mathematician is considering. Moreover, proofs and ﬁelds of mathematics evolve over time. The ﬁrst proof of a theorem is usually relatively complicated and unpleasant. But if the result is sufﬁciently important, new approaches replace or reﬁne the original proof, usually by embedding it in a more sophisticated conceptual context, until the theorem eventually comes to be viewed as an obvious corollary of a larger theoretical construct. Thus proofs are a means for establishing what is real and what is not, but also a vehicle for arriving at a deeper understanding of mathematical reality. By concensus of the community of group theorists, the Classiﬁcation has been accepted as a theorem for roughly 25 years, despite the fact that, for at least part of that period, gaps in the proof were known to exist. At this point in time, all known gaps have been ﬁlled. The most signiﬁcant of these (involving the so-called ‘quasithin groups’) was only recently removed in the lengthy two volume work of Aschbacher and Smith. During the 25 years, the proof of the Classiﬁcation has not evolved as much as one might expect. Some simpliﬁcations and conceptual improvements to certain parts of the argument have emerged, and there is a program in progress to write down the proof more carefully in one place. Dependence on computer aided proofs for the existence and uniqueness of the so-called sporadic groups has been almost entirely eliminated. But for the most part the proof still has the same shape and complexity. To set the stage for one explanation of these facts, and to further explore why the proof of the Classiﬁcation (and by extension other proofs) should be so complicated, I present a quote from the biologist John Hopﬁeld talking about the core curriculum at Caltech: Physics was .often presented as the paradigm for how science should be done. The idea was that a science should require as little actual knowledge as possible, and that all conclusions should follow from a very small set of facts and equations. Biology is an information-rich subject. Complex structures and behaviors are intrinsic to (and the essence of ) biology and other information rich sciences. John Hopﬁeld

I believe the Classiﬁcation is an example of mathematics coming to grips with a complex information rich problem using both Hopﬁeld’s physics paradigm and his biology paradigm. The hypothesis of the theorem is simple and easily understood by anyone who has taken a decent undergraduate course in abstract algebra. The conclusion also appears at ﬁrst glance to be at least moderately simple. However, when one looks more closely, one ﬁnds that it takes some effort and sophistication to deﬁne many of the examples. Moreover, the utility of the theorem stems from two facts: First. it seems to be possible to reduce most questions about ﬁnite groups to questions about simple groups. Second, the explicit description of the groups on the list L supplied by very effective Phil. Trans. R. Soc. A (2005)

2404

M. Aschbacher

representations of most of the groups, make it possible to obtain a vast amount of detailed information about the groups. Fact one makes it possible to avoid the untenable complexity and relative lack of structure of the general ﬁnite group. The reduction from the general ﬁnite group to the ﬁnite simple group corresponds to a reduction from a universe with relatively little structure and much complexity (such as the universe of biology) to a universe with a lot of structure and manageable complexity. But for those who use the theorem, those changes are hidden in the proof. However consumers must still grapple with the complexity inherent in the simple groups themselves. This is where fact two comes in. More and more in modern mathematics, particularly in problems in discrete mathematics coming from ﬁelds like information theory, computer science, or biology, one must deal with objects with little classical mathematical structure, but under hypotheses placing strong constraints on the objects which are difﬁcult to exploit in the absence of structure. Many such problems can be translated into the domain of group theory, where suitable information about simple groups can be used to obtain a solution. Further, I speculate that the Classiﬁcation is itself an early example of this kind of result. A priori it is difﬁcult to make use of the hypothesis that a group is simple: the assumption does not automatically supply a nice representation of the group. The variety of examples in L suggest this must be true. Instead, one must exploit detailed information about the members of L in the inductive setting of the minimal counter example, operating more in the paradigm of biology than in the paradigm of physics or classical mathematics. It is my sense that there is an overabundance of information in the problem, which makes possible many different proofs, depending on how one utilizes the information. Producing a good proof in such a situation may be less a result of a clever idea or a new, better point of view, than of optimal organization of a very large set of data, and good technique. My guess is that we will begin to encounter many more such problems, theorems, and proofs in the near future. As a result we will need to re-examine what constitutes a proof, and what constitutes a good proof. Elegance and simplicity should remain important criteria in judging mathematics, but the applicability and consequences of a result are also important, and sometimes these criteria conﬂict. I believe that some fundamental theorems do not admit simple elegant treatments, and the proofs of such theorems may of necessity be long and complicated. Our standards of rigor and beauty must be sufﬁciently broad and realistic to allow us to accept and appreciate such results and their proofs. As mathematicians we will inevitably use such theorems when it is necessary in the practice our trade; our philosophy and aesthetics should reﬂect this reality. This work was partially supported by NSF-0203417.

Discussion P. H. A. SNEATH (Infection, Immunity and Inﬂammation, University of Leicester, UK ). In biology one must often make a large number of assumptions before one Phil. Trans. R. Soc. A (2005)

Highly complex proofs and implications

2405

can formulate a theorem, and then the proof may be very simple. The question is whether it is really a proof. To give an example from bacteriology, how does one identify a strain of the typhoid bacillus, Salmonella typhi, and prove the identity? In principle one collects many strains that have certainly come from cases of typhoid fever, and determines numerous properties of these accurately. One then sets up a model in which the species S. typhi can be likened to a swarm of bees in a multidimensional space. An unknown strain is identiﬁed as S. typhi if it lies within the swarm. But after making these and other assumptions (including that the variation is haphazard,—effectively ramdom,—and that the swarm is perhaps distributed multivariate normally—but not multivariate logistically) the proof is simple. One can obtain the probability that the unknown bacillus is a typhoid bacillus from the well-known properties of the normal distribution. Further, the results are robust; a few mistakes do not greatly damage the conclusions. But it is evident the prior assumptions are the critical factor, because one can scarcely check the identity by infecting a volunteer. M. ASCHBACHER. Sneath gives an example where a biological process is modeled by a mathematical system. As I interpret it, he then asks: Is a proof of a theorem in the mathematical system, also a ‘proof’ of a ‘theorem’ about biology? It would seem to me that the notions of ‘theorem’ and ‘proof’ (at least as understood by mathematicians) are particular to mathematics. As Sneath suggests, the information the mathematical theorem gives about the biological problem, is only as good as the ﬁt of the mathematical model to the original problem. Even if the ﬁt is good, it is not clear to me that translations of theorems and proofs in the mathematical setting to the biological setting can be called ‘theorems’ and ‘proofs’ without straining the meaning of those words to the breaking point. On the other hand theorems in the mathematical setting do give biological information when the model is good. A. BUNDY (School of Informatics, University of Edinburgh, UK ). How can we account for the unreasonable robustness of proofs? Naively, we might expect most errors in proofs to be fatal, but many are readily ﬁxed. Why is this? M. A SCHBACHER Some proofs are robust and others are not. I think mathematicians operate on at least two levels: the formal and the intuitive. Consider an area of mathematics where formal machinery is in place, which has been worked out fairly carefully and in detail, and in addition the intuition of the community of specialists in the area is in tune with that machinery. In such a situation, theorems advanced by capable members of the community are usually unlikely to have large, irreparable errors, or at least it is unlikely that such errors will not be discovered by the community. The intuition of the community (and the individual) will normally lead them to those places in the proof where serious errors are likely to occur. In such a situation the individual mathematician usually ﬁnds serious errors in his or her proof, before the proof sees the light of day, and the community identiﬁes ﬂawed mathematics before it gains wide acceptance. On the other hand, problems can arise when untested, unfamiliar machinery is applied, or when the community encounters a situation where counter intuitive phenomena are involved. M. ATIYAH (School of Mathematics & Statistics, University of Edinburgh, UK ). An analogy has been made between evolutionary biology, in which complex Phil. Trans. R. Soc. A (2005)

2406

M. Aschbacher

organisms emerged as a result of long random processes and natural selection, and complex mathematical problems such as the classiﬁcation of ﬁnite simple groups; I think this is not a correct analogy. Finite simple groups did not emerge from some random choice of axiom systems, they were a product of the human mind, though reﬂecting the notion of symmetry in the natural world. M. ASCHBACHER I think the analogy I’d draw is between the evolution of biological organisms and certain proofs. At some level, both the complex organism and the complex proof are examples of complex adaptive systems. True, proofs do not emerge entirely randomly. But for a long period of time, each individual mathematician working on his or her small part of the problem, almost certainly has no serious global strategy. As a group, the community’s approach will be inﬂuenced by mathematical precedents, but in time new ideas will emerge which alter the accepted paradigms. Subgroups will concentrate on subproblems, and develop highly specialized mathematics to deal with their subproblem. Eventually enough structure emerges from the union of these specialties to suggest a global strategy. Finally a proof is achieved, but not a proof anyone could have foreseen when the process began. Moreover if different people had been involved, or if the same people had looked at things a bit differently, then a totally different proof might have resulted. A. IRELAND (Department of Computer Sciences, Heriot-Watt University, UK ). To a large extent computer science is concerned with the systematic management of large and complex evolving artefacts (systems). Yesterday we heard from computer scientists and artiﬁcial intelligence practitioners on computer assisted reasoning. As a working mathematician, were there any ideas presented yesterday that you feel may assist you in managing the complexity of your evolving proofs? M. ASCHBACHER I suspect that for the most part, one can’t do much to manage complex proofs. In the case of the classiﬁcation of the ﬁnite simple groups, at a fairly late stage in the game (about 1970), Danny Gorenstein began to speculate on a global strategy for a proof. In effect he called attention to certain subproblems, which appeared to be approachable, or almost approachable, and he put forward a somewhat vague vision of how to attack some of the subproblems, and how his various modules might be assembled into a proof. While his program was sometimes a bit far from what eventually emerged, in other instances he was fairly prescient. In any event, Gorenstein focused attention on the problem of classifying the ﬁnite simple groups, in the process making the effort more visible. He also gave it some structure and served as a clearing house for what had been done, and was being done. In short, Gorenstein managed the community of ﬁnite simple group theorists, and to a lesser extent, managed part of the development of the proof itself. But he was only able to accomplish even these limited goals at a fairly late stage in the game: The last 10 years of an effort which was reasonably intense for about 25 years, and in some sense went on for almost a century. That is to say, a long period of learning and experimentation was necessary before it was possible to develop a global idea of how a proof might proceed. Finally, these observations are really only about the sociology of the community searching for the proof, rather than about strategies and techniques for dealing with complex mathematics, beyond the obvious approach of partitioning a big problem into smaller pieces. Phil. Trans. R. Soc. A (2005)

Phil. Trans. R. Soc. A (2005) 363, 2407–2418 doi:10.1098/rsta.2005.1661 Published online 12 September 2005

Skolem and pessimism about proof in mathematics B Y P AUL J. C OHEN Department of Mathematics, Stanford University, Bldg. 380, 450 Serra Mall, Stanford, CA 94305-2125, USA ([email protected]) Attitudes towards formalization and proof have gone through large swings during the last 150 years. We sketch the development from Frege’s ﬁrst formalization, to the debates over intuitionism and other schools, through Hilbert’s program and the decisive blow of the Go¨del Incompleteness Theorem. A critical role is played by the Skolem– Lowenheim Theorem, which showed that no ﬁrst-order axiom system can characterize a unique inﬁnite model. Skolem himself regarded this as a body blow to the belief that mathematics can be reliably founded only on formal axiomatic systems. In a remarkably prescient paper, he even sketches the possibility of interesting new models for set theory itself, something later realized by the method of forcing. This is in contrast to Hilbert’s belief that mathematics could resolve all its questions. We discuss the role of new axioms for set theory, questions in set theory itself, and their relevance for number theory. We then look in detail at what the methods of the predicate calculus, i.e. mathematical reasoning, really entail. The conclusion is that there is no reasonable basis for Hilbert’s assumption. The vast majority of questions even in elementary number theory, of reasonable complexity, are beyond the reach of any such reasoning. Of course this cannot be proved and we present only plausibility arguments. The great success of mathematics comes from considering ‘natural problems’, those which are related to previous work and offer a good chance of being solved. The great glories of human reasoning, beginning with the Greek discovery of geometry, are in no way diminished by this pessimistic view. We end by wishing good health to present-day mathematics and the mathematics of many centuries to come. Keywords: proof; predicate; calculus; axiom system; model; Skolem paradox

1. Introduction I should like to thank the organizers of the conference for inviting me to express my ideas on the nature of mathematical proof. What I have to say may be somewhat anachronistic, in that I shall review a debate that raged almost a century ago, but which has been quiescent lately. Nevertheless, in light of what has occurred, I believe that one can come to some reasonable conclusions about the current state of mathematical proof. Most of the references to the older One contribution of 13 to a Discussion Meeting Issue ‘The nature of mathematical proof ’.

2407

q 2005 The Royal Society

2408

P. J. Cohen

literature are to be found in the excellent collection ‘From Frege to Go ¨del’, edited by Jean van Heijenoort (1971). The title of my talk alludes to both the work of Thoralf Skolem, and, perhaps even more, to the conclusions he came to at a rather early stage of the development of mathematical logic. The work is, of course, the famous Lowenheim–Skolem Theorem, for which Skolem gave a simpliﬁed proof, and which is undoubtedly the most basic result about general axiomatic systems. It can be given various formulations, but the form which Skolem himself attributes to Lowenheim is that ‘every ﬁrst order expression is either contradictory or satisﬁable in a denumerably inﬁnite domain’ (Skolem 1970). As Skolem showed, there is a natural extension to the case of countably many such expressions. ‘Contradictory’ here is deﬁned by reference to the rules of the predicate calculus, i.e. normal mathematical reasoning. The startling conclusion that Skolem drew is the famous Skolem Paradox, that any of the usual axiom systems for set theory will have countable models, unless they are contradictory. Since I will not assume that my audience are all trained logicians, I point out that though the set of reals from the countable model is countable seen from outside, there is no function ‘living in the model’ which puts it in one-to-one correspondence with the set of integers of the model. This fact and other considerations led Skolem to this viewpoint: I believed that it was so clear that axiomatization in terms of sets was not a satisfactory ultimate foundation of mathematics, that mathematicians would, for the most part, not be very much concerned by it.

The view that I shall present differs somewhat from this, and is in a sense more radical, namely that it is unreasonable to expect that any reasoning of the type we call rigorous mathematics can hope to resolve all but the tiniest fraction of possible mathematical questions. The theorem of Lowenheim–Skolem was the ﬁrst truly important discovery about formal systems in general, and it remains probably the most basic. It is not a negative result at all, but plays an important role in many situations. For example, in Go ¨del’s proof of the consistency of the Continuum Hypothesis, the fact that the hypothesis holds in the universe of constructible sets is essentially an application of the theorem. In Skolem’s presentation of the basic theorem, it reads like a plausible, natural theorem in mathematics, unencumbered by the jargon prevalent both in many papers of the time, and, above all, in the contemporary philosophical debates concerning the foundations of mathematics. As the reader can verify by referring to van Heijenoort’s reference book, all of Skolem’s writings on logic and set theory have a clarity and simplicity which is striking. Even now it is truly rewarding to read these papers and reﬂect on them. Now, no discussion of proof can fail to refer to the Incompleteness Theorem of Go¨del. The result states that no reasonable system of mathematics can prove its own consistency, where the latter is stated as a theorem about proofs in its own formal system, and hence can be construed as a result in combinatorics or number theory. The Incompleteness Theorem is a theorem of mathematics, and not a philosophical statement. Thus, in this sense, it is unassailable, but, in another sense, since it refers to such a speciﬁc question, it is not really relevant to the question which I am addressing in this talk, namely the extent to which problems in mathematics can reasonably be expected to be settled by Phil. Trans. R. Soc. A (2005)

Skolem and pessimism about proof

2409

mathematical reasoning. It is, of course, the ﬁrst, and perhaps the only, proved statement supporting the basic pessimism of Skolem’s viewpoint. Let me begin by recalling some facts concerning the development of the axiomatic method, which I am sure are familiar to all of you. With the publication of Frege’s epic work ‘Begriffschrift’ in 1879, the notion of a formal system was given a deﬁnitive form. Important related work was done by Boole, and Pierce, and later Peano presented a similar approach, but with Frege’s work, for the ﬁrst time in the history of human thought, the notion of logical deduction was given a completely precise formulation. Frege’s work not only included a description of the language (which we might nowadays call the ‘machine language’), but also a description of the rules for manipulating this language, which is nowadays known as predicate calculus. Now the Greeks had introduced the axiomatic method, and Leibnitz had speculated about a universal deductive mechanism. Thus, as with many great discoveries, the precise formulation, of what is meant by a formal system, grew gradually in the collective unconscious, and so perhaps did not appear to many people at the time as a breakthrough. Certainly no radically new ideas were introduced, nor any particularly difﬁcult problems overcome. But this was a major landmark. For the ﬁrst time one could speak precisely about proofs and axiomatic systems. The work was largely duplicated by others, e.g. Russell and Whitehead, who gave their own formulations and notations, and even Hilbert made several attempts to reformulate the basic notion of a formal system. The variety of such attempts relates to the problem of clearly distinguishing between the axioms which are assumed as the starting point of a theory and the methods of deduction which are to be used. The Go ¨del Completeness Theorem, which many people regard as implicit in Skolem’s work, explicitly shows that there is no ambiguity in the rules of deduction. This is in marked contrast to the Incompleteness Theorem, which shows that no reasonable axiom system can be complete. Alongside these developments, there raged a lively debate, continuing almost to the onset of World War 2, about the ultimate validity of mathematics. This debate saw the emergence of formalism, logicism and intuitionism as competitors for the correct foundation of mathematics. I will brieﬂy discuss these competing philosophies, noting at the outset that each seems to focus on proofs rather than models. In this respect Skolem’s ideas were in sharp contrast to those of most of his contemporaries. I believe that today the situation is rather the reverse, due in part to my own work, showing how many models of set theory can be constructed using the notion of forcing (Cohen 1966). Indeed, Skolem even foresaw, in his 1922 paper, the construction of new models of set theory, for there he states: ‘It would in any case be of much greater interest if one could prove that a new subset of Z could be adjoined without giving rise to contradictions; but this would probably be very difﬁcult.’ As I said, his interest in models was perhaps ahead of his time, so let me discuss now some of the common viewpoints on foundations.

First, I would mention the belief of Hilbert that the beautiful structure of mathematics, erected in the course of centuries, was in some sense sacrosanct, not to be challenged. Indeed, he felt that mathematical knowledge was our birthright, and that in principle human reasoning could decide all mathematical questions. He felt it necessary to defend, at all costs, mathematics from the Phil. Trans. R. Soc. A (2005)

2410

P. J. Cohen

attacks of such as Kronecker and Brouwer. In his 1904 article he summarizes the viewpoints of Kronecker, Helmholtz, Christoffel, Frege, Dedekind and Cantor, ﬁnding deﬁciencies in their viewpoints, and offering his own treatment as an alternative. I am not very impressed by his efforts in this paper, but greatly admire the tenacity with which he defends the inviolability of mathematical reasoning. Perhaps he himself realized the difﬁculties of giving any completely satisfactory foundation, and so retreated, if I may use the expression, to a more modest position, that at least if we regard mathematics as a formal game played with symbols we should be able to show that the game is consistent, This became known as the Hilbert Program, and though many attempts were made not too much was accomplished, the reasons for which became clear when Go ¨del proved his Incompleteness Theorem. The Program survived in some form, under the name of Proof Theory, and we shall later refer to Gentzen’s outstanding result in that discipline. Hilbert’s goal was informally outlined, since what was meant by a consistency proof was not entirely explicit. In his basic belief that beyond any doubt mathematics was referring to an existing reality, and that it must be made secure from all philosophical attacks, he undoubtedly enjoyed the support of the vast majority of mathematicians. Second, there arose a school that questioned methods of proof involving what may be called non-constructive reasoning. Foremost proponents were Brouwer and Weyl, both very distinguished mathematicians. The objections strike at the use of the classical predicate calculus, rejecting for example the use of Excluded Middle and related non-constructive proofs of existence. The school of Intuitionism probably never obtained much support among working mathematicians, but it has repeatedly resurfaced in various forms, for example in the work of Errett Bishop on constructive analysis. In some forms, the school may even reject the use of formal systems entirely, on the grounds that they are irrelevant for mathematical reasoning. A recurring concern has been whether set theory, which speaks of inﬁnite sets, refers to an existing reality, and if so how does one ‘know’ which axioms to accept. It is here that the greatest disparity of opinion exists (and the greatest possibility of using different consistent axiom systems).

2. Questions concerning the predicate calculus The formulation, by Frege and others, of mathematics as a formal system, must certainly be regarded as a milestone in the history of human thought. In a way it is a most curious achievement, in that it merely codiﬁed what was generally known. However, as a completed structure, reducing mathematical thought to what we today would call a machine language, and thereby eliminating any vagueness, it was a historic step. Perhaps Frege and the early workers did not completely separate the formalization of logical thinking and the rules of logical deduction. Today we clearly do so, and these rules are known as the predicate calculus. Concerning the predicate calculus itself, there is no controversy, though the intuitionists and others would restrict its use. The work of Lowenheim and Skolem, and the Completeness Theorem of Go¨del, indeed show that one has an invariant, natural notion. Let me state these results now. Phil. Trans. R. Soc. A (2005)

Skolem and pessimism about proof

2411

First, I review the formulation of the language. One has symbols for relations (of various arities) between objects. We have the logical connectives, the quantiﬁers, and some helpful symbols such as parentheses, commas and subscripts, and ﬁnally the symbols for individual variables and constants. The rules for manipulation of the connectives are sometimes called the Boolean or propositional calculus. Much more powerful, in the sense that they contain the crux of mathematical reasoning, are the quantiﬁers. These are the existential quantiﬁer (‘there exists’) and the universal quantiﬁer (‘for all’). The rules of propositional calculus are elementary and well known. The key step in mathematical thinking is that if a statement asserts that there exists an x such that a certain property A(x) holds then we invent a name for such an object, and call it a constant, and can then form sentences with it. Conversely, if a universal statement asserts that A(x) holds for all x then we can deduce A(c) for all constants. For example, if we have a constant positive real number a, and we know square roots exist for general positive reals, then we invent the symbol b for a square root of A. Viewed this way, the rules become extremely transparent, if one takes care to avoid clash of constants and the like. The fundamental discovery of Lowenheim– Skolem, which is undoubtedly the greatest discovery in pure logic, is that the invention (or introduction) of ‘constants’ as in predicate calculus, is equivalent to the construction of a ‘model’ for which the statements hold. More precisely, if the use of predicate calculus does not lead to a contradiction on the basis of a set S of sentences, then repeated use of the rules will result in a model for the system S. Moreover, the method ensures that we get a countable model if S is countable. And thus we get to the Skolem ‘Paradox’ that if a ﬁrst-order system of axioms is consistent then it has a countable model, because all current systems of set theory have countably many primitives. As an aside, I remark that the work received amazingly little attention. Indeed Skolem remarks that he communicated these results to mathematicians in Gottingen, and was surprised that, despite this revealed ‘deﬁciency’ in the axiomatic method, there still existed, in his opinion, an unwarranted faith that the axiomatic method can capture the notion of mathematical truth. This is the pessimism to which I refer in the title. Later I shall refer to an even deeper pessimism, which has found little expression in the literature. Skolem wrote in a beautiful, intuitive style, totally precise, yet more in the spirit of the rest of mathematics, unlike the fantastically pedantic style of Russell and Whitehead. Thus, Hilbert even posed as a problem the very result that Skolem had proved, and even Go ¨del, in his thesis where he proved what is known as the Completeness Theorem, does not seem to have appreciated what Skolem had done, although in a footnote he does acknowledge that ‘an analogous procedure was used by Skolem’. A possible explanation lies in the fact that Skolem emphasized models, and was amazingly prescient in some of his remarks concerning independence proofs in set theory. A discussion of the priority question can be found in the notes to Go ¨del’s Collected Works (Go ¨del 1986). Go ¨del was undoubtedly sincere in his belief that his proof was in some sense new, and in view of his monumental contributions I in no way wish to ﬁnd fault with his account. What is interesting is how the more philosophical orientation of logicians of the time, even the great Hilbert, distorted their view of the ﬁeld and its results. When Go ¨del showed, in his Incompleteness Theorem, that the Hilbert Phil. Trans. R. Soc. A (2005)

2412

P. J. Cohen

Program was doomed, Hilbert (as far as I can ﬁnd out from the records) did not even invite him to present his results in Gottingen. Go ¨del did not have a permanent position, and it was only due to the perspicacity of American mathematicians, who understood the signiﬁcance of his work, that he was eventually appointed to the Institute for Advanced Study at Princeton. So what are the disputes involving the rules of logic, given that the Completeness Theorem seems to say that they account for all correct reasoning in ﬁrst-order logic? I will not attempt to categorize the various schools in this dispute, nor their philosophical principles. But I think that one can safely say that the differences involve the notion of constructivity, and the restriction to existence proofs based on constructive reasoning. Many people devoted their efforts to developing various parts of mathematics in a constructive manner. I think that for many the crucial issue is already present in the most basic part of mathematics, number theory. Since classical set theory is non-constructive almost by deﬁnition, in that it speaks of inﬁnite sets, one hardly expects constructive ideas to be successful here. (Of course Go ¨del, in his epoch-making proof of the consistency of the Continuum Hypothesis and the Axiom of Choice, does use a notion of ‘constructibility’, but this is in an extended sense involving reference to ordinals, and thus is entirely natural within set theory.) In number theory, most results are constructively obtained, even if it may require some work to see this. Let me give what I believe to be the ﬁrst example of a truly non-constructive proof in number theory, so that the reader, if not a logician, will be exposed to some of the subtleties involved. This is the famous theorem of Skolem’s compatriot, Thue, extended by Siegel, and in a sense deﬁnitively completed by Roth. It says that an algebraic number can have only ﬁnitely many ‘good’ approximations by rational numbers. There is no need to specify the meaning of ‘good’ here, the basic idea being that the error in the approximation should be less than a certain function of the denominator of the approximating rational. The theorem has as a consequence that certain polynomial equations in two variables have only ﬁnitely many integral solutions. Now, all the classical proofs are totally ‘elementary’ (though ingenious), and are constructive except in the very last lines of the proof. Thue showed that there could not be two approximations p/q and p 0 /q 0 , where both q and q 0 are greater than a number c (constructively given), and q 0 greater than a constructively given power of q. Now he draws the conclusion that there can be only ﬁnitely many good approximations, since if p/q is given there is a bound for all other approximations p 0 /q 0 . This is a perfectly correct deduction, but if one does not know one solution one is in no position to bound the others. This is a most difﬁcult problem, and, though Baker’s work has yielded constructive estimates in some cases, one seems far from constructive bounds in general. Since the time of Thue, other examples have been found, though perhaps no more than a dozen. Of course one has no proof that constructive bounds do not exist. Even if one is uncertain about the exact limits of the notion, one can, and does, ask whether there are general recursive bounds, or better primitive recursive ones. Since I do not share the intuitionist ideology, or any of its variants, I will not raise the objections that they would raise, but clearly every mathematician must feel a certain unease about the above proof. It is simply desirable to have a more constructive proof. Phil. Trans. R. Soc. A (2005)

Skolem and pessimism about proof

2413

There are people who are more extreme, and who claim that any inductive proof (such as the above) based on predicates with too many quantiﬁer changes (so that no instance is immediately veriﬁable) should not be allowed. The most extreme view, held by at least one mathematician at a respectable university, is that eventually a contradiction will be found even in elementary number theory. Let me say brieﬂy why I cannot accept such limitations on the use of the predicate calculus. The reason lies in the very procedures of the predicate calculus, because in a sense every statement is proved by contradiction. The form of the proof may vary, but, in essence, the Completeness Theorem says that if a set of statements does not lead to a contradiction it is satisﬁable. So, to show that something is valid, i.e. that it is necessarily satisﬁed, one must show that the assumption of its negation leads to a contradiction. Since I shall refer to this procedure again later, let me emphasize in slightly more detail what the rules are. Using elementary rules one can bring every statement into prenex form. Something of prenex form will be of one of the forms ‘for all x, A(x)’ or ‘there exists x such that A(x)’, where A itself may have other quantiﬁers, and constants which have been introduced before. In the case of ‘for all x, A(x)’ one can add to the list from which one is trying to deduce a contradiction all ‘A(c)’. In the case of ‘there exists x such that A(x)’ one adds correspondingly ‘A(c)’ for a new constant. If there is a contradiction derivable from our original assumption, then it will be revealed after ﬁnitely many applications of these rules of procedure, and at that point the contradiction will be obtainable by propositional calculus, as all the prenex quantiﬁers will have been stripped off. More speciﬁcally, as Skolem points out explicitly, we look at all the original undeﬁned relations, and substitutions got by using the constants introduced at the various stages, and we will eventually be unable to assign consistently truth-values to the quantiﬁer-free formulas produced by our procedure. Conversely, and this is only slightly harder to see, if we can always ﬁnd truth assignments that work, we are in effect constructing a model of the original set of sentences. There are technical details involving revisiting requirements over and over, but these are not difﬁcult. I refer the reader to Skolem’s original paper for an intuitive explanation. Now it is clear to me that if a contradiction is obtained the original statement must be ‘false’. Of course the intuitionist might argue that this is not good enough, that one wants more than a proof of contradiction from classical logic. I can only reply that in the usual, everyday mathematics, as practiced by the vast majority of mathematicians, all proofs proceed by contradiction. This may be surprising at ﬁrst sight, but thinking about the above sketch of the Completeness Theorem will show that this is exactly what is done in all proofs. In my ﬁnal comment, where I shall present a ‘pessimistic’ view, it is important that one understands the method allowed by the predicate calculus. 3. Consistency questions During the period of the great debate, between 1910 and 1920, there emerged the Formalist School associated with Hilbert. My impression is that Hilbert shared the viewpoint of ‘naive’ mathematicians, that is, that existing mathematics, with its notion of proof, corresponded to a real world. And yet, in a sense formalism Phil. Trans. R. Soc. A (2005)

2414

P. J. Cohen

asserts the opposite. Hilbert wished to secure mathematics from the attacks of intuitionists and others, and therefore proposed as a minimal program to prove that formalized mathematics was consistent. No doubt this appeared at the time to be a reasonable goal, and one could even have hoped that the consistency proof might be done within elementary combinatorial mathematics (from this point of view mathematics could be construed as a combinatorial game). An accompanying idea was more daring, namely that such a combinatorial analysis might even result in a decision procedure, i.e. a method of deciding whether a given statement could be proved or not, or, even more ambitiously, for deciding the truth value of the statement in question. This hope was of course shattered by the Go¨del Incompleteness Theorem, which asserts that no reasonably complex system can prove its own consistency, unless it is inconsistent, in which case everything is provable and the system is useless. My main thesis here, which I shall discuss at the end of my lecture, is that the premise of the Hilbert program is more profoundly untrue. I claim that mathematics can prove only an incredibly small proportion of all true statements. But for now I discuss some technical issues in Proof Theory. The proof of Incompleteness can be formulated in different, essentially equivalent, ways. In particular, it is closely related to the notion of recursive or computable function, and motivated the large subject of recursive function theory, so that one cannot regard Go¨del’s result as purely negative. A technical subject, Proof Theory, arose, with one of its goals to understand the ﬁne detail of unprovability of consistency. For a given theory, one seeks a combinatorial principle which is natural and allows one to prove consistency. The ﬁrst, and still most striking, results are those of Gentzen (1969), who analysed the consistency strength of elementary number theory (ﬁrst-order Peano arithmetic). Since elementary number theory would seem to be need in any kind of combinatorial analysis, it may seem silly to use number theory to prove number theory is consistent. However, Gentzen’s elegant work is not circular, and can be formulated so as to yield precise information about proofs in elementary number theory. Let me sketch the idea of his proof, in my own version which I intend to publish some day. Let us consider (in number theory) a proof P of a contradiction. In our discussion of the rules of deduction, we said that there are various possibilities, all equivalent. Now we must make matters precise. It is most natural to regard the proof as a division of cases. This means that, in various stages of the proof, we consider a division into A and not A, and regard the proof as a tree, such that starting from the top of the tree, quoting the axioms of number theory, and allowing for the division into branches, we arrive at a situation where, allowing for invention and substitution of constants as described, we have a contradiction in every branch, among the statements involving constants alone. We also allow Boolean manipulations in the usual way. Thus a proof of a contradiction becomes a tree, with a contradiction in every branch. Now, the branch structure is important, because of the structure of the axioms of number theory. The key axiom is the Axiom of Induction. Really this is a countable set of axioms, with one instance for each property A(n) involving only one free variable n. Such an instance states that one of three possibilities holds: either A(0) is false Phil. Trans. R. Soc. A (2005)

Skolem and pessimism about proof

2415

or for some n, A(n) is true and A(nC1) is false or A(n) is true for all n. Clearly this branching is an essential feature of induction. The idea behind Gentzen’s proof is to go from P to another proof P 0 of contradiction, with a simpler tree structure. How to simplify the proof ? Well, in any induction branching as above, the easiest branch to investigate is the third, since it says that something is true for all n and does not assert the existence of any particular constant. Brieﬂy, we go down the tree and wait till we encounter a particular integer, say 5, where A(5) occurs. But then induction up to 5 is obvious and can be replaced by ﬁve cases of the induction hypothesis. This has to be done carefully. However, one sees that in at least one branch no constants are created, except particular numerals such as 5 or 7. In this way the use of the induction axiom can be eliminated in at least one case. Now, assuming that this reduction from P to P 0 is deﬁned, the question is whether the new proof of a contradiction is simpler. The set of all ﬁnite trees can be ordered in a simple manner, namely, starting from the ﬁrst node of a tree, we compare two trees by comparing the branches of the trees, assuming by induction that tree whose depth is one less have already been ordered. We use the usual lexicographic ordering. Now, if we deﬁne things correctly, we can show that indeed the order of the tree goes down each time we eliminate a single use of induction. This ordering is a well-ordering, and it corresponds to the ordinal e0, which can also be deﬁned as the limit of un as n goes to u, where u1 is u, and unC1 is uun . From Go¨del’s Theorem it follows that either we cannot formulate this kind of induction in the system, or we can, but we cannot prove it. The latter is the case, and in this way we reach a plausible combinatorial principle just out of reach of elementary number theory, and one from which one can prove the consistency of elementary number theory in an elementary way. Proof Theory has gone on to seek analogous principles for more complex systems, e.g. fragments of set theory. 4. Set theory, the ultimate frontier At about the same time as Frege was developing the ﬁrst universal formal system, Cantor was developing the foundations of mathematics as based on set theory. More precisely, it can be said that Cantor realized that set theory was a legitimate area of study, perhaps not realizing that it was the basis of all mathematics. In any event, Frege made an attempt to axiomatize a universal ‘set theory’, and made a mistake by allowing the existence of the set of all sets, thereby getting a contradiction. One normally attributes to Zermelo the ﬁrst axiomatization of set theory, in more or less the form that we consider today. However, the system was still vaguely deﬁned, and again it was Skolem who pointed out the deﬁciencies (Fraenkel did so too, in a less precise way). This gives the system now known as Zermelo–Fraenkel set theory. The development of set theory has been largely separate from that of the rest of mathematics, except perhaps for considerations around the Axiom of Phil. Trans. R. Soc. A (2005)

2416

P. J. Cohen

Choice. Nevertheless, mathematicians have as a rule regarded the problems of set theory as legitimate mathematical questions. The Continuum Hypothesis, despite the independence results, remains an object of speculation for set theorists. It is in set theory that we encounter the greatest diversity of foundational opinions. This is because even the most devoted advocates of the various new axioms would not argue that these axioms are justiﬁed by any basic ‘intuition’ about sets. Let me give some examples of the scope of such axioms. One may vary the rank of sets allowed. Conventional mathematics rarely needs to consider more than four or ﬁve iterations of the power set axiom applied to the set of integers. More iterations diminish our sense of the reality of the objects involved. One can attempt to vary the properties allowed in the comprehension axiom, while dodging the Frege problem. Axioms of inﬁnity assert the existence of large cardinals whose existence cannot be proved in the Zermelo–Fraenkel system. The earliest example is that of inaccessible cardinals, and more recently one has considered much larger cardinals whose existence has remarkable consequences even for real analysis. These kinds of axioms can be extended indeﬁnitely, it seems, and, despite the interest of their consequences, the reality of the cardinals involved becomes more and more dubious. The same can be said for more exotic axioms, of determinacy type, despite the remarkable connections now known between their consistency strength and that of large cardinals. So we come now to one of the most basic questions. Does set theory, once we get beyond the integers, refer to an existing reality, or must it be regarded, as formalists would regard it, as an interesting formal game? In this sense, we are going beyond the scope of the conference, which concerns proof. Rather we are questioning the very sense of some things which are proved. I think that for most mathematicians set theory is attractive, but lacking the basic impact of arithmetic. There is almost a continuum of beliefs about the extended world of set theory. A typical argument for the objective reality of set theory is that it is obtained by extrapolation from our intuitions of ﬁnite objects, and people see no reason why this has less validity. Moreover, set theory has been studied for a long time with no hint of a contradiction. It is suggested that this cannot be an accident, and thus set theory reﬂects an existing reality. In particular, the Continuum Hypothesis and related statements are true or false, and our task is to resolve them. A counter-argument is that the extrapolation has no basis in reality. We cannot search through all possible sets of reals to decide the continuum hypothesis. We have no reason at all to believe that these sets exist. It is simply an empirical fact that no contradiction has been found. Clearly both points of view have their strengths and weaknesses. Through the years I have sided more ﬁrmly with the formalist position. This view is tempered with a sense of reverence for all mathematics which has used set theory as a basis, and in no way do I attack the work which has been done in set theory. However, when axiom systems involving large cardinals or determinacy are used, I feel a loss of reality, even though the research is ingenious and coherent. In particular, a strong defect of the ﬁrst view, for Phil. Trans. R. Soc. A (2005)

Skolem and pessimism about proof

2417

me, is the idea that if mathematics refers to a reality then human thought should resolve all mathematical questions. This leads me to my ﬁnal section, on the ultimate pessimism. 5. The ultimate pessimism deriving from Skolem’s views Skolem, in his papers, was so struck by the existence of non-isomorphic models of all but the most trivial axiom systems that he was led to doubt the relevance of any mathematical axiom system to the philosophical questions concerning foundations of mathematics. For example, he pointed out the existence of countable models of set theory. He seems to have been the ﬁrst clearly to emphasize models rather than methods of proof. Whether or not he believed in an absolute model of set theory, which was beyond all attempts to describe it by axioms, is not clear to me. But certainly he was aware of the limitations on what could be proved. In a remarkable passage, he even discusses how new models of set theory might be constructed by adding sets having special properties, although he says he has no idea how this might be done. This was exactly the starting point of my own work on independence questions, although I was totally unaware that Skolem had considered the same possibility. It always seemed to me that it was futile to adopt the proof-theoretic approach and analyse the structure of proofs. Even if the formalist position is adopted, in actual thinking about mathematics one can have no intuition unless one assumes that models exist and that the structures are real. So, let me say that I will ascribe to Skolem a view, not explicitly stated by him, that there is a reality to mathematics, but axioms cannot describe it. Indeed one goes further and says that there is no reason to think that any axiom system can adequately describe it. Where did the conﬁdence, expressed so vividly by Hilbert, that all questions must be resolved, come from? One view that has struck me, ever since my earliest encounters with mathematics, originates with the Greeks, and Euclid in particular. Here for the ﬁrst time we see the power of the human intellect being brought to bear not only on mathematics, but also on physics and astronomy. What a fantastic thrill it must have been to live through this era and enjoy the escape from superstition and primitive beliefs, and the sudden bright light dawning of the triumph of reason alone! We have all felt this thrill, encountering, at an early age, Euclid and the wonderful beauty and completeness of his geometric system. Just a hundred years ago even the Pythagoras Theorem was regarded as a marvel of deductive reasoning, and books were published containing many proofs. But let us recall Skolem’s theorem. How does one actually proceed in a proof ? After a ﬁnite stage one invents symbols for the objects that are known to exist under a certain assumption A. Also one makes ﬁnitely many substitutions of the constants into universal statements, and repeats this in some dovetailing procedure. Then one sees if there is a propositional contradiction in what is now known about those ﬁnitely many constants. For example, suppose one wish to disprove (and thereby prove the negation of) some statement about primes. If one is working in number theory, one will be able to divide into cases, according to the principle of induction outlined above. But, in essence, all one can do is run Phil. Trans. R. Soc. A (2005)

2418

P. J. Cohen

a check on ﬁnitely many integers derived from the hypothesis. With luck, we reach a contradiction, and thereby prove something. But suppose one asks an unnatural statement about primes, such as the twin primes question. Perhaps on the basis of statistical considerations, we expect the primes to satisfy this law. But the primes seem rather random, and in order to prove that the statistical hypothesis is true we have to ﬁnd some logical law that implies it. Is not it very likely that, simply as a random set of numbers, the primes do satisfy the hypothesis, but there is no logical law that implies this? Looked at from the point of view of the Skolem construction, it would seem that we can run checks, but they may be hopelessly weak in determining the truth. Now, one can ask, how does the introduction of higher axioms of inﬁnity (perhaps having analytic implications) affect whether the statement can be proved. Indeed, doesn’t the Go¨del Incompleteness Theorem show exactly that the consistency of a given system, which is a combinatorial, or number-theoretic, statement, gets resolved by passing to a higher inﬁnity? Will not the use of more and more complicated set-theoretic axioms resolve more and more arithmetic statements? My response is twofold. One, the above is a rather idealistic hope. The only statements of arithmetic, resolved by higher set theory, which are known today, are basically consistency statements or close relatives. In a sense the higher systems almost assume the principles we want proved. There is no intuition as to why the consideration of the higher inﬁnite should bring us closer to solving questions about primes. Secondly, how far can we go by extending set-theoretic axioms? As said before, one rapidly gets removed from intuition, and we have no idea at the outset how to relate the axioms to primes. Therefore, my conclusion is the following. I believe that the vast majority of statements about the integers are totally and permanently beyond proof in any reasonable system. Here I am using proof in the sense that mathematicians use that word. Can statistical evidence be regarded as proof ? I would like to have an open mind, and say ‘Why not?’. If the ﬁrst ten billion zeros of the zeta function lie on the line whose real part is 1/2, what conclusion shall we draw? I feel incompetent even to speculate on how future generations will regard numerical evidence of this kind. In this pessimistic spirit, I may conclude by asking if we are witnessing the end of the era of pure proof, begun so gloriously by the Greeks. I hope that mathematics lives for a very long time, and that we do not reach that dead end for many generations to come. References Cohen, P. J. 1966 Set theory and the continuum hypothesis. New York: Addison-Wesley. Gentzen, G. 1969 Collected papers of Gerhard Gentzen (ed. M. E. Szabo). Amsterdam: NorthHolland. Go¨del, K. 1986 Kurt Go ¨del: collected works (ed. S. Feferman et al.), vol. 1. Oxford: Oxford University Press. Skolem, Th. 1970 Selected works in logic by Th. Skolem (ed. J. E. Fenstak). Oslo: Scandinavian University Books. van Heijenoort, J. (ed.) 1971 From Frege to Go ¨del. Cambridge, MA: Harvard University Press.

Phil. Trans. R. Soc. A (2005)

Phil. Trans. R. Soc. A (2005) 363, 2419–2435 doi:10.1098/rsta.2005.1656 Published online 6 September 2005

The mathematical signiﬁcance of proof theory B Y A NGUS M ACINTYRE Queen Mary, University of London, London, UK ([email protected]) Returning to old ideas of Kreisel, I discuss how the mathematics of proof theory, often combined with tricks of the trade, can occasionally be useful in extracting hidden information from informal proofs in various areas of mathematics. Keywords: proof; provability; mere truth; unwinding; fully formalized proof

1. Notions of proof, prior to proof theory (a ) Proofs in mathematics I take the basic subject matter of these Proceedings to be mathematical proofs, as presented in the style traditional for the last two hundred years, i.e. in books or journals, in a variety of languages (usually natural languages with extra formalism speciﬁc to mathematics). Mathematical knowledge is communicated and certiﬁed between specialists using such proofs. There are other less formal methods of demonstration, in conversations or seminars, and there are surely situations, say in low-dimensional topology, where one might use various gestures to communicate the basic idea (and this would sufﬁce for experts). Proofs in this sense presuppose earlier proofs, and a proof is supported by a complex scaffolding, some of it erected thousands of years ago. Progress in the subject depends not only on the emergence of proofs of new results, or new proofs of old results, but also on artistry in the structuring of proofs. Proofs have to be learned, remembered at least in broad outline and later fruitfully combined with other proofs and ideas, to go further. Many remarks at the meeting had to do with the issues of visualizability and memorability, and it was clear that these are central issues for mathematicians, but much less so for computer scientists right now. (b ) Proofs of novel complexity We are talking here of traditional, informal proofs. Several talks from this Discussion Meeting (notably those of Aschbacher (2005) and MacPherson) bear on speciﬁc contemporary proofs of novel complexity. At issue is the reliability of such proofs. This is not the ﬁrst time in the history of mathematics that such concerns have been prominent, but I do not think that we face anything that deserves to be called a crisis. It seems to me likely that we will see in the near future other proofs of the kind described by McPherson, and that we will simply One contribution of 13 to a Discussion Meeting Issue ‘The nature of mathematical proof’.

2419

q 2005 The Royal Society

2420

A. Macintyre

become accustomed to them. Aschbacher predicts that we will see before long other classiﬁcations with the complexity of that for ﬁnite simple groups. In some cases there is a component of computer assistance, without which one would not have a proof at all. In such cases, generally, there is a trace of dissatisfaction in the mathematical community at the presence of the large-scale computational component, and a hope that another proof will be found free of such components. As McPherson reports, the mathematical editors of Annals of Mathematics were unable to convince themselves of the correctness of the computer component of Hales’ proof, and delegated the responsibility for checking that component to the computer science community. One hopes that this kind of situation will not become the norm. After all, in principle there seems no great purely mathematical difﬁculty in proving the correctness of the algorithms used by Hales. Presumably the problem is rather that the algorithms are not presented in a mathematically perspicuous way. Given a clear presentation, can these correctness proofs be more than simple inductive proofs? It may be that the anxiety comes rather from fear of dependence on correctness of hardware. There are presumably quite general methods for establishing probabilities of failure of devices of this kind, not at all speciﬁc to computers assisting mathematical activity. For example, depending on one’s point of view, one may fear more such failure in a military or transportation situation than in a mathematical proof. Some of us may even fear a systematic failure in our own hardware. Another situation, discussed at this meeting, concerns the classiﬁcation theory of ﬁnite simple groups, where it has not been unreasonable to doubt that there has been a complete proof at all, or at least to be unsure as to when a proof has ﬁnally been obtained. Here the issue is not at all the presence of computational assistance in the proof. One is dealing rather with a large-scale proof with many highly technical, conventional modules, not all of which had been thoroughly checked at the time of the announcement of the classiﬁcation. What is needed here is a map of the proof, with clear evidence that each region is under control. It seems to me unlikely that, for either of the cases above, much would be gained by further formalizing or automation of the proofs. (c ) Idealized proofs With the development of mathematical logic over the last 150 years, a new idealized notion of proof emerged, that of a fully formalized proof on the basis of axioms. Whatever was controversial in the so-called foundational debates of the period from Frege to Godel, one could not deny, unless one were an intuitionist with a Brouwerian epistemology, that one had an algorithm for translating the majority of conventional mathematical statements into the semantics of one of the formalisms deriving from that debate, and that moreover one could go onto translate (again mechanically in principle) classical informal proofs into formal proofs of some accepted formal system (Principia, ZFC, or ﬁrst-order Peano, etc.). I personally doubt that these translations are faithful to the creative processes of mathematics, and I deny that they constitute a case that set theory, in some form a common feature of almost all the axiomatic systems involved, is thereby established as ‘the’ foundation for mathematics. But I do believe that over a wide range these translations do map informal proofs to formal proofs, and that one can exploit this, even if one remains queasy about set theory, as foundation or otherwise. Phil. Trans. R. Soc. A (2005)

Mathematical signiﬁcance of proof theory

2421

That there is a long way to go from an informal proof to a formal ‘Hilbertian’ proof is clear, and probably few major theorems of the last 200 years have ever been fully formalized in this way. There is, however, a third possibility, namely the use of systems like Isabelle, which yield completely formalized proofs mechanically, and have instructions corresponding quite closely to the informal instructions, lemmas, deﬁnitions and other strategies of ordinary proofs. Good accounts are given in Constable’s (1998) and Avigad’s (2004). Mackenzie (2005) gives an illuminating account of new uses of the term ‘proof’, in connection with the broad enterprise of computer veriﬁcation. Moreover, as I had known from my own experience, there is considerable legal interest in issues of identity of these modern proofs. Philosophers and proof theorists have touched on the issue of a general theory of identity of proofs, but I personally regard this discussion as premature. I make some remarks on this later. (d ) Hilbert’s formalism Via the above loose translation, proofs themselves became the subject matter of a part of mathematics, and one could, at least if one were Hilbert, imagine signiﬁcant mathematical proofs about proofs and provability. It was clear that formal proofs are ﬁnite combinatorial entities like numerals, and thus one expected proofs about them to involve inductions, perhaps even very simple inductions. Only later would one realize that there are important arguments about proofs that require distinctly nonclassical combinatorics and inductions. On the one hand, it must have been clear from the outset that one needs sufﬁciently strong axioms to prove certain commonplace things. For example, no one ever seriously thought that one can derive much number theory from the axioms for commutative rings, and indeed one can prove this by the kind of model theory Hilbert used in the foundations of geometry (Shepherdson 1964). Hilbert had the imagination to see that one could not exclude, on the basis of anything known at the time, that one could prove the formal consistency of strong mathematical systems in very weak ones, such as primitive recursive arithmetic. Interesting as this mathematical possibility was, it has certainly been overemphasized, and this has distracted attention from more rewarding aspects of proof theory. The goal of my talk is to give a simple account, aimed at nonspecialists, of the signiﬁcance for working mathematicians of the proof theory initiated by Hilbert. The account will be very selective, and indeed will involve neither recent proof theory nor a detailed account of classical proof theory. (e ) Incompleteness From my present perspective, the First Godel Incompleteness theorem is almost a peripheral result in proof theory. It is better regarded as a result in the theory of provability or computability, rather than having anything to do with the ﬁne structure of formalized proofs. The results are of striking generality, and have little to do with the individual deductive or semantic mechanisms of particular formal axiomatic systems, and indeed the essence of the First Incompleteness theorem is surely to be found in such abstract discussions of recursion theory as Smullyan’s (1961). Even the Second Incompleteness theorem can be suggestively analysed axiomatically, in terms of appropriate algebraic structures, and modal logic, as has been done in the theory of the provability Phil. Trans. R. Soc. A (2005)

2422

A. Macintyre

predicate in such works as (Boolos 1993), and had been done in less generality much earlier by Hilbert and Bernays (1934, 1939). The Second Incompleteness theorem gets interesting twists in the case of strengthenings of ZFC, where one shows, e.g. that one cannot prove the existence, in a system S say, of a certain large cardinal, because that would allow one to prove the formal consistency of S in S. This is certainly a useful check on alleged proofs of existence, but little more. Inevitably, people have tried to miniaturize the Godel machinery to get insights on PZNP, but with limited success. Of course new information has been uncovered, notably the failure of bounded arithmetic with total exponentiation to prove even consistency of the feeble system Q (Paris & Wilkie 1987). Note that in contrast this system proves Matejasevic’s theorem, and e.g. the prime number theorem. (f ) Completeness Godel’s Completeness theorem of 1930 has a different ﬂavour. This is sensitive to the formal system used, though the method is very general, extending to all sorts of logics, some useful for computer science. The usual method of proof is to show that if something is not provable, then there is a structure, built from the syntax of the language using a relation of provable equivalence, in which the formula comes out false. One is not constructing a proof, or doing anything with the ﬁne structure of proofs. Rather one is arguing by contradiction. Moreover, one knows, by the general technology of Incompleteness, that there are unprovable formula whose negation has no recursive model. It is noteworthy that two distinguished mathematicians, Herbrand and Skolem, were somehow blocked from (the simple proof of) the Completeness theorem by ideological constraints around the notion of truth. In this connection, one should read Cohen (2005), where he gives a related, but ultimately different, perspective on Skolem’s role. (g ) How Incompleteness evolved Developments subsequent to Godel, reﬁning the form of deﬁnition of the basic notions of recursion theory, and culminating in Matejasevic’s theorem (Davis et al. 1976), show that the incompleteness phenomena go right down to sentences expressing the unsolvability of diophantine equations. This is at least startling, to see how set theoretic principles affect what one can prove about diophantine equations. Note that the diophantine incompleteness known now involves highdimensional varieties, but it cannot be excluded, on the basis of present knowledge, that it goes right down to curves. This is a deplorable possibility (Shafarevic’s gloomy joke) as it would have negative implications for major conjectures in arithmetic. One of the most beautiful descendants of the First Incompleteness theorem is Higman’s (1961), characterizing the ﬁnitely generated subgroups of ﬁnitely presented groups. This result is surely signiﬁcant for group theory, but depends on methods that originated in proof theory. (h ) Unprovability theory The work of Godel and Cohen on the Continuum Hypothesis (CH) and the Axiom of Choice (AC) is not really proof theory, though it is certainly of the ﬁrst Phil. Trans. R. Soc. A (2005)

Mathematical signiﬁcance of proof theory

2423

importance for provability in systems of set theory. Cohen’s work is of even greater importance, as having provided a ﬂexible general method for constructing models of set theory. It has revived a ﬂagging subject, and led to 40 years of spectacular activity (in combination with other methods). In the cases of both Cohen and Godel, one got much more than mere independence from their proofs. I cannot resist mentioning a couple of cases where these results are relevant to mathematics apparently remote from set theory. Serre had in the 1950s, after his famous work on homotopy groups (Serre 1953), raised the issue as to whether one might really need the axiom of choice to prove the kind of statements he had proved. Serre had noted the use of Choice in connection with a homology/ cohomology ‘duality’. Kreisel clariﬁed the matter to Serre’s satisfaction, thus. Over some weak system, the statements are formally equivalent to arithmetical statements, where the quantiﬁers range over only integers (ﬁnite ordinals, elements of u). Serre’s proof was, by inspection, in ZFC. Now, if there were a model M of ZF in which the statement failed, it would also fail in the model of constructible elements of M, because of its syntactic form, and so it would fail in a model of the axiom of choice. But Serre had a proof that it held in any model of ZFC. So it holds in all models of ZF, so there is a proof from these axioms, by Godel. Note that there is a recipe for translating Serre’s proof into one not using ZFC, but Serre probably had no need to see this proof. An important point here is the need to pay attention to the syntactic form of the assertion. This is always going to be relevant for interesting results. A related example would use CH instead, showing that it cannot have any signiﬁcance as far as provability of arithmetical results in ZFC is concerned. Examples of the use of this (worth knowing, though the method is not currently in use) are in Ax & Kochen (1965). I do not know if anyone has ever worried about using the negation of AC or CH in number theory, but from the details of Cohen’s method one sees that these are also eliminable, because Cohen’s method does not extend the integers of models of set theory. My second example also concerns the axiom of choice, this time its role in Deligne’s monumental (Deligne 1980). At some point Deligne would get by more easily if he had an embedding of the p-adic numbers in the complexes (something which clearly exists by the axiom of choice). Deligne declares that AC is repugnant to him, and explicitly notes that all he needs in his subsequent proof is the embedding of any ﬁnitely generated subﬁeld of the p-adics in the complexes. The proof of this involves just the basic combinatorics of elementary ﬁeld theory, and certainly does not use AC. One should note, too, that the construction of the p-adics does not use the axiom of choice). On the other hand Deligne somehow has to survey his extremely complex proof, and convince himself that this is all he need. The latter is not in doubt, but tedious (even in principle) to demonstrate formally. Now, Kreisel’s argument would have sufﬁced for Deligne’s purposes, provided two things: 1. The conclusion he wanted is arithmetical; 2. His proof is in ZFC. Phil. Trans. R. Soc. A (2005)

2424

A. Macintyre

Both aspects are delicate. Deligne’s most general conclusion is about constructible sheaves, and is perhaps not arithmetical. But his applications to nonprojective varieties are certainly arithmetical, so that at least for these Kreisel’s argument would apply provided the whole proof was done in ZFC. It is probable that in all cases Deligne’s argument can be adapted, by working in a suitable L[A]. Such an exercise seems worthwhile. That his proof is in ZFC seems clear to me, but remarks in (Browder 1976) attributed to Manin suggest that some experts have not been quite sure about this. Deligne is, of course, right in suspecting that some trace of AC is needed to embed the p-adics in the complexes. Cherlin and I checked (unpublished) that in Solovay’s famous model (Solovay 1970) there is no such embedding, by showing that the embedding would have to be continuous. (i ) Provability theory Another aspect of provability theory not often given the same prominence as the Godelian phenomenon is that there are many cases now where one has a complete, intelligible (and sometimes recursive) set of axioms for a natural mathematical domain, usually geometrical. Examples are algebraically closed ﬁelds, real closed ﬁelds, p-adic ﬁelds, and various ﬁelds with analytic functions. Easy arguments use this fact to give nontrivial uniformities and/or recursive bounds sometimes not evident to the original provers of the theorems. Moreover, the bounds and algorithms coming from this area are generally relevant for computer science, though perhaps not for automated deduction. A recurring issue at our meeting was Hales’s proof of Kepler’s Conjecture. It is important to stress that the point at which Hales needs computer assistance is for a proof of a statement in high-dimensional semi-algebraic geometry, one of the most important subjects where one has a Completeness theorem. In principle one can effectively ﬁnd a proof of Hales’s semi-algebraic result, if it is true, from purely algebraic axioms. Unfortunately, one knows that in the general case the waiting time for a proof is unrealistically long. However, logicians and computer scientists have uncovered much information on this topic, and it may be worthwhile to see if any of the accumulated insights are useful in cross-checking the Hales result or in shortening its proof. An essential point in the above, and in most of what follows, is the unsystematic nature of the applications. One has to know a fair bit of the subject matter, and understand the proofs therein, before one can apply logical principles to get something interesting. In particular, most of the applications are done without recourse to any axiomatic system with general objectives. We turn now to genuine proof theory, and not just provability theory. 2. Proof theory (a ) The fundamental theorems Modern proof theory begins with the e-theorem of Hilbert, and becomes applicable in the work of Herbrand (1930) and Gentzen (1969). This work is of permanent importance (it seems to me) in the face of the Godelian phenomenon. Phil. Trans. R. Soc. A (2005)

Mathematical signiﬁcance of proof theory

2425

The importance for computer science can hardly be disputed. I am concerned here rather with the relevance to existing mathematical proofs. Herbrand’s work was not readily assimilated, but it is now at the base of the proof theory of computer science (where more general notions of proof or veriﬁcation are en vogue). The essential feature of his method is that provability from universal axioms of an cd sentence implies that a ﬁnite disjunction of quantiﬁer-free instantiations is proved. This is almost trivial model theoretically in ﬁrst-order logic, but the formal version can be extended to general shapes of axioms, provided one passes to suitable extensions by function symbols, and has proved both powerful and suggestive. A typical case is the following (from page 120 of Girard (1987)): 2.1 Let A be a formula in prenex form, for instance A Zdx c yd z c tR½x; y; z; t; with R quantiﬁer-free. let f and g be two new function letters with f unary and g binary. The A is provable in predicate calculus iff there are terms U1,.,Un, W1, .,Wn (using the letters f and g) such that R½U1 ; f ðU1 Þ; gðU1 ; W1 Þn .n R½Un ; f ðUn Þ; Wn ; gðUn ; Wn Þ is a propositional tautology. Model-theoretically, with the axiom of choice assumed, this is utterly trivial, and easily generalized. But the theorem has nothing to do with the axiom of choice. It is purely combinatorial and tells one that one cannot have a predicate calculus proof without having provability of a formal Herbrand disjunction. It is noteworthy that in applications (see for example Luckhardt’s work discussed later) the mere knowledge that some disjunction should be looked for has been helpful in obtaining hidden bounds in proofs. Of course, the combinatorics of the Herbrand terms is in general beyond control, and indeed the proof theory of such terms is still not at a point where applications of this aspect have been obtained. The work on uniﬁcation, arising from resolution, may be regarded as a special case, but little positive has been obtained. Gentzen’s work on cut-elimination and the subformula property, has been pushed much further by both mathematical logicians and computer scientists. The work of both, and their followers, has allowed applications of proof theory to mathematics. This is not the place to go into an account of the sequent calculus, and an explicit statement of what is cut-elimination. It is surely better to quote Girard (1987), p. 95: Roughly speaking, a cut-free proof is a proof from which all formulas which are ‘too general’ have been banished. General formulas in a proof carry the ideas of the proof: it is only because we have general formulas that we can have short and intelligible proofs; when, in the Hauptsatz, we eliminate all these general formulas, we increase the length and obscurity of the proof: for that reason, cut-free proofs are unlikely objects for mathematical practice. Their interest lies somewhere else: these proofs are very interesting to study, because their general properties are very important. Phil. Trans. R. Soc. A (2005)

2426

A. Macintyre

Of course, this is not precise, but it is suggestive. For the formal details of the Hauptsatz, and all sorts of interesting asides, one can consult Girard’s frequently intemperate (Girard 1987). For an account of the connections between the two methods, see Girard (1987), p. 122. Much nonsense has been pronounced about Gentzen’s work, even by extremely distinguished people. Consistency is not really the main issue at all. He did reveal ﬁne structure in the unprovability of consistency of PA, as a consequence of much deeper general methodology. It is not a question of proving the consistency of induction on u by something evidently stronger. The real point is that the ordinal e0 has a very simple primitive recursive representation, and yet we cannot prove in PA the principle of induction for a speciﬁc quantiﬁerfree predicate on e0. This principle is almost as clear intuitively as that for induction on u for simple predicates. Gentzen showed, by what remain deep mathematical ideas, that this principle proves the consistency of PA, and, moreover, opened the way for later people to observe that one can give a satisfying answer to the question of the nature of the provably total functions of PA (in the technical sense of Bucholz & Wainer (1987)). They have to be recursive, but obtainable by a scheme of recursion on an ordinal less than e0. This led to an intelligible form for such functions (Kreisel–Wainer hierarchy), and later reﬁnements to subsystems of PA (and a research programme related to PZ NP). Kreisel spotted the phenomenon, and made the basic observations, which had a strong inﬂuence on major work such as that of Ketonen and Solovay. Many later workers identiﬁed similar behaviour for other systems (including higherorder systems, e.g. Godel’s T). In summary, Gentzen laid bare the ﬁne structure of provability in predicate calculus, and then in some very speciﬁc and important systems (such as PA), going much deeper than Godel. But of course one had to start afresh in seeking similar analyses for stronger (or, much later, weaker systems) whereas one had the Godel analysis for all natural systems. It is to be stressed that much of the later heroic work of this nature has not given any spin-off in terms of hidden information. This development provoked Kreisel’s memorable question: What more do we know when we have proved (or have a proof of) a sentence A in system S, rather than mere truth (if the system is a conventionally motivated one)? A typical answer is that depending on the syntactic form of the sentence, we may get rate of growth information on witnesses for its existential quantiﬁers. This is certainly potentially valuable. (b ) Complex methods in arithmetic Godel proved that passage to second-order arithmetic (in the axiomatic sense) increases our stock of provable ﬁrst-order formulas (e.g. consistency statements). But this alone left open the possibility that proofs of arithmetical statements via complex analysis (doable in second-order arithmetic) could be replaced by ﬁrst-order proofs. An example, of doubtful signiﬁcance, is the elementary proof of the prime number theorem. I do not know what new information one gets from that over a classical complex analysis proof. Phil. Trans. R. Soc. A (2005)

Mathematical signiﬁcance of proof theory

2427

Moreover, the elementary proof generalizes, to Dirichlet situations, with difﬁculty, and beyond that not at all. So it is a concrete question as to whether there is a more subtle Godel phenomenon in analytic number theory. One has to formulate the question sensibly, of course. The model theory of sine on the reals codes second-order arithmetic, and so suitably interpreted proves consistency of PA or indeed second-order arithmetic. This is not what is intended! Rather, is there something in all the interesting, mainstream proofs, using complex analysis, which allows one to reproduce them (no doubt with loss of beauty and intelligibility) in ﬁrst-order arithmetic (say PA)? The fact is that there is. The ﬁrst examples are due to Kreisel in the early 1950s (Kreisel 1951, 1952). The lack of detail in his discussions has been noted by Feferman in a very useful article (Feferman 1996), but to me the matter has always been clear enough. I have not seen the need to bring in general purpose formal systems and prove the conservative nature of Konig’s Lemma, though there is a point to this. It is equally obvious that other more ad hoc methods work. As discussed by both Luckhardt and Feferman in ‘Kreiseliana’ (Odifreddi 1996), Kreisel sketched an argument for the effective content of Littlewood’s famous result showing that the difference between pi(x) and li(x) changes sign inﬁnitely often. Here there are some little formal-logical tricks, which, when used by one familiar with Littlewood’s proof, provide bounds (not very sharp, of course, but this was never the issue). It seems to me that this proof of Littlewood is readily converted to one in bounded arithmetic plus total exponentiation, and this alone would yield iterated exponential bounds, with the length of the tower coming from a careful analysis of the inductions used in the proof. (c ) Isabelle We have recently been told that the prime number theorem has been done in the system Isabelle. I guessed, on hearing this, correctly, that it must be the elementary proof, i.e. the least suggestive one. It turns out that Isabelle does not have a complex number library. But then, is it doing number theory, nearly 200 years since complex analysis began to show in number theory? I do not wish to quibble here. But there is an important point. The proof formalized is one which is certainly doable in bounded arithmetic plus exponentiation, and one gets the impression that Isabelle can code this sort of thing almost routinely. But it does not deal naturally with geometric or topological arguments, and thereby is well out of step with modern number theory. It is regrettable that one did not really have time at the meeting to get an extended statement of the goals of this kind of automatic theorem proving. Barendregt introduced the basics (and referred to the prime number theorem) but we must wait for a subsequent meeting to get a clear sight on the goals of this proof enterprise. My impression is that those making the most serious contributions to the enterprise of this kind of automatic theorem proving are not making any grand claims, and readily acknowledge that one is rather a long way from having a ‘library’ useful either for basic education in complex analysis or for more advanced algorithmic purposes. Phil. Trans. R. Soc. A (2005)

2428

A. Macintyre

(d ) From mere truth to effective bounds Sometimes one has a problem posed by high-level practitioners, such as Weil’s on whether one could obtain bounds in Hasse’s Norm theorem. I came to this question by noting, to my surprise, that Serre (1997), settled for a general recursive argument to decide when something is a norm. I worked out primitive recursive bounds by going through (partially with Kreisel) an analysis of class ﬁeld theory, with its appeal to both analysis and cohomology. Both caused me lots of pain, particularly the use of Herbrand quotients in cohomology, where crucial information gets cut away. (It is notable that the function ﬁeld case of class ﬁeld theory is much more explicit than the numberﬁeld case.) When I had ﬁnished, it was pointed out to me that Siegel, in a late paper, had given much better bounds, via geometry of numbers, just using the fact that the theorem was true, but without appealing to any particular proof. Thus there is a lesson here. Sometimes one does not need to do deconstruction on a proof to get constructive information about what has been proved, or is true. (e ) Unwinding Kreisel has been the main contributor to ‘unwinding’. This is the activity of taking an informal mathematical proof, giving an analysis of where it is proved (i.e. in which formal axiomatic system), and doing some thought experiments on that proof to give sharper information on what is being proved (usually more than the original prover thought). The thought experiments involve varied means, which Kreisel compared to the means of applied mathematics. It is not easy, and perhaps not even worthwhile, to formalize/systematize them. It is, on the other hand, at least healthy for mathematics if some people know these techniques very well, and look out for areas in which to apply them. (f ) Texts on unwinding There are a number of interesting texts about this approach, not uniformly appreciative. There are the papers of Feferman and Luckhardt in ‘Kreiseliana’, and the recent lectures of Avigad (2004) at ASL 2004 on proof mining. These cover the majority of the applications. It is fair to say that there are not many applications after 50 years. But then, there are few applications of topos theory, or model theory of sheaves, to geometry. That is no reason to abandon the teaching of such material. In both cases, applications will come only when the material is familiar to people who know also the intended area of application. Without this combination of expertise, nothing is to be expected. The commentators on unwinding list all of Kreisel’s efforts and the recent papers refer also to the work of Kohlenbach. Neither refers to the paper by Kreisel & Macintyre (1982), concerning the conditional proofs giving effective estimates in ﬁniteness theorems in number theory from the assumption of effective estimates in Roth’s theorem. Even granted that the promised sequel to that paper has not been written, this seems a bit strange. Contrary to the title, we did not advocate the informal method of algebraization as a replacement for unwinding methods more closely linked to proof theory. We did, however, wish to point out, for the particular situation of Siegel’s theorem, there are serious limitations of the methods based only on proof theory, and that one does better Phil. Trans. R. Soc. A (2005)

Mathematical signiﬁcance of proof theory

2429

by an ad hoc treatment based partially on algebraizing (which may involve axiomatizing) the complicated mix of methods that go into the proofs of the Finiteness theorems. The treatment in Serre’s (1997) was congenial to us, and we ﬁtted our analysis to it. From the perspective of this paper, the mathematical signiﬁcance of proof theory is that it provides methods, which can, if used with discretion, reorganize informal proofs so that they yield more information. Thus, I disregard the other side of the matter that there are some beautiful and difﬁcult theorems in proof theory, serious mathematics with no applications in mind. And, above all, I pass over in silence any thought that proof theory has signiﬁcance for foundations of mathematics. That mathematics can be formalized, and that much of it can be axiomatized, is a basic discovery, essential to know, but not deep knowledge.

3. Unwinding (a ) Examples Kreisel has brought unwinding to bear on: 1. 2. 3. 4. 5.

analytic number theory; number of solutions to diophantine problems; bounding solutions to diophantine problems; bounds in Hilbert’s 17th Problem; bounds in polynomial ideals.

Girard has brought proof theory to bear on proofs of van der Waerden’s theorem using dynamical systems (and this might be relevant even for primes in arithmetic progression, etc.). Luckhardt has applied Kreiselian tricks, involving the Herbrand formalism, to the issue of number of solutions in Roth’ theorem. Kohlenbach has used serious proof theory on problems in modern approximation theory. There is no time here (especially in the context of a Discussion Meeting) to go through details of each case (Feferman does run through the differences between cases) though I will say a little. Avigad’s lectures and Kohlenbach’s papers (Kohlenbach 2001; Kohlenbach & Olivia 2003a,b) provide the most systematic account I know. I personally am partial to the fulminating account given by Girard. I stress only the diversity of the problems, and the common feature that one is not dealing with a fully formalized proof here, but an informal conception of a full formalization of such a proof, to which one applies the general technology of the proof theory of Herbrand, Gentzen, Godel, Kreisel and others. As said before, the difference from other points of view here is that one concentrates on seeing what more logic can reveal from the mere existence of a proof in a particular system. There is nothing in the method that casts light on the use of computational auxiliaries. Phil. Trans. R. Soc. A (2005)

2430

A. Macintyre

(b ) Fully formalized proofs Avigad has an interesting article which contains a reasoned account of Isabelle and the like. There is no question of these systems existing to ﬁnd new mathematical theorems. Rather they are designed to provide intelligible intermediaries, proofs of existing results presented not in the impenetrable armour of Hilbertian proof (as if they could be!) but rather in some natural evolving formalism that corresponds to low-level mathematical communication (but using higher-level instructions!!). This still leaves the question as to why they communicate the obscure proof and not the clear one. (c ) Girard unwinding What I want to communicate in this meeting on the nature of proof is merely that one can apply the technical tools of mathematical logic to extract hidden and valuable information from complex proofs. These proofs need not be fully formalized, but a sine qua non of the method is an ability to understand in what, preferably weak, system the informal proof has a formal counterpart. For this you need to understand the proof. For example, if you use compactness or completeness, you should know something about the logical complexity of the predicates to which you apply these principles. Here you have to unwind the proof, or perhaps modify slightly, and then unwind. In effect, you have to be aware of a small number of systems in which the bulk of current mathematics can be carried out (ZFC is far too strong), and then you need to know some speciﬁcs of their proof theory. With this repertoire, you are in a position to extract useful information from informal proofs. However, it does not seem crucial right now to be expert on ordinal aspects of the theories, though one can well imagine that abstract invariants of proofs can at some point be valuable. It is a somewhat startling fact that one can, as Girard does, use cutelimination on a portion of an informal proof. This is possible, because he has a clear view of a formal system in which that part of the proof can be formalized, and he understands perfectly the algebra of cut-elimination, so can apply it ‘in a higher order way’. Essentially he restructures the proof to a formal induction in arithmetic. What does Girard do? He begins with the memorable proof, by Furstenberg and Weiss, using dynamical systems, of the van der Waerden theorem on arithmetic progressions. From the mere truth of that theorem one gets the existence of a function W(p, k) such that given any partition of the set 0,.,W(p, k)K1 into k classes then one of the classes contains an arithmetic progression of length p. Of course, there are then many such functions, and the question is whether W can be chosen to have better properties, e.g. in terms of computability or rate of growth. That W can be chosen recursive is general nonsense and essentially useless. That W can be chosen to have growth rate around that of the Ackermann function has been known for a long time, and can be read off from any elementary proof. After the unwinding efforts I will describe below, Shelah (1988) showed that W can be chosen primitive recursive, and indeed low in the Kreisel–Wainer hierarchy. Later still, the work of Gowers, using analytic methods, got even better bounds. The bounds by the last two authors are far better than those unwound by Girard, but this is not the point. It is not obvious how to extract Phil. Trans. R. Soc. A (2005)

Mathematical signiﬁcance of proof theory

2431

bounds from Furstenberg–Weiss, and Girard shows how proof-theoretic tricks of the trade, in the hands of a master, enable one to get bounds. There seems to me no point, in a brief discussion paper, embarking on an outline of Girard’s proof, especially as he gives a lively, explicit account in Girard (1987). The essential point is to break down the proofs of the high-level dynamics proofs, done for general spaces X, into a series of proofs in arithmetic, which take account of the speciﬁc X needed at each stage of the conventional inductive proof (powers of the space used in the deduction of van der Waerden occur in this unwinding). He made his task easier by a series of ‘astuces’, making small observations that would gain Fursstenberg–Weiss nothing, but are crucial for keeping down the complexity of unwinding. Thus, he makes uses of certain symmetry arguments, and the fact that his space X is ultrametric, to avoid complicating the induction, and thereby the unwinding. After this preparation, Girard has a memorable geometrical picture. The process introduces other cuts, but he has managed things so they will have no dynamical signiﬁcance. After the elimination of the dynamical systems components he gets a bound of Ackermann type for the van der Waerden theorem. What he has unwound is really a minor (from the dynamics viewpoint) variant of Furstenberg–Weiss. I again stress that it is not the quality of the bounds that matter, but the fact that a skilled proof theorist, using in an imaginative way classic theorems of the subject, can get bounds that eluded the ﬁrst generation of mathematicians who gave noncombinatorial proofs of van der Waerden. It is no surprise that methods more closely tied to the subject matter will eventually do better than a powerful general method. Girard, later in the book, does another, quite different unwinding, using the socalled no-counterexample interpretation. This method was ﬁrst popularized by Kreisel, though it has its origins in work of Godel from the 1930s (It can be derived by either the method of Herbrand or the method of Gentzen.). This time he analyses directly the Furstenberg–Weiss proof via minimal dynamical systems. There is still a cut-elimination that can be done, but not on the proof of existence of minimal systems. On that he uses a sequence of no-counterexample interpretations, thus opening the way to bounds. These turn out to be at a level above that of the Ackermann function! This conﬁrms a moral of Kreisel that small differences in a proof can make an enormous difference to the information one can extract. This is not, of course, catastrophe theory for proofs!! Girard’s accounts of his two unwindings are illuminating and very explicit, but his method is perhaps a bit special. The general shape of applicable result from proof theory is that if something is proved then in truth it has a very special Skolemization or Herbrandization maybe involving higher-order functionals. This may or may not have to do with a cut-elimination. Moreover, one can often make a proof in a prima facie strong system work in a much weaker system, so that for example one gets iterated exponential bounds by doing a proof in bounded arithmetic plus exp (in particular, it seems that all of Hardy & Wright (1979) can be codiﬁed there, including the elementary proof of the prime number theorem—what is different about the Isabelle proof?). In still other cases, one is on the non-Godelian side of the fence, and one can use fast elimination, etc., to get bounds systematically—of course in general inferior to those got by speciﬁc methods like cohomology. Phil. Trans. R. Soc. A (2005)

2432

A. Macintyre

The vigilant reader may have noticed that I have mentioned only brieﬂy the functional interpretations deriving from Godel. They are somewhat unwieldy in practice because of the iterated implications (though, as we see below, there are contexts where they work very well). I leave it to the reader to ponder the remarks of Girard (1987), concerning the place of this interpretation in Godel’s opus. (d ) Identity of proofs Though it may well be worthwhile (even for lawyers) the attempt to formalize notions of identity of proofs are not discussed here. When an important theorem has many proofs (e.g. quadratic reciprocity) mathematicians will want to compare the merits of these proofs. It is unlikely to be worthwhile to consider all 153 proofs of quadratic reciprocity, but most number theorists would agree that quadratic reciprocity is a part of a greater theory, class ﬁeld theory, and that in turn part of a greater (Langlands theory) and thus one is mainly interested in proofs that generalize. This is one of the defects of the elementary proof of the prime number theorem, that it does not generalize widely, and moreover it suppresses sight of e.g. zeta functions. It can very well be that a special proof has other virtues, e.g. for computational complexity. Recall the example of Sylevster’s proof of inﬁnitude of primes (Woods 1981). It does not appeal to entities of exponential growth, almost uniquely among such proofs (at least in the sense of appeal that logicians use). The main point here is that we do not at the moment have any clear sense of the extra information concealed in different proofs of the same theorem, especially if these proofs are formalized in the same Hilbertian system. It is good to draw attention to these things, as Kreisel has often done, but it is certainly premature to attempt to formulate any philosophy of such matters. It is already important to note, as Kreisel does, and Girard does, that small differences in proof can make a great difference to what can be extracted. (e ) Kohlenbach’s work Kohlenbach’s papers provide a detailed account of the technicalities of unwinding, ﬁrst for Cebychev’s theorem, and subsequently for more complex problems. But as always the idea is to get some formal simpliﬁcation proved, and then be able to bound something usefully. This would have to happen in the Littlewood case for Kreisel to have had real success there. One does not expect general considerations to provide such bounds, and real work will always be needed. What is signiﬁcant is that the proof-theoretic manipulations give a real advantage (deﬁnitely for Kohlenbach). The functional interpretations are descended from Herbrand’s theorem. This has an almost trivial model-theoretic proof, in a useful special case. But the general case is typically daunting to all but proof theorists. Moreover, the Godel functional interpretation is for intuitionistic systems, again not exactly attractive to classical mathematicians. Herbrand’s theorem can be extended to higher complexity formulas by the devices of Skolemization and Herbrandization, though this is not how Herbrand did it. There is a useful account in Buss’s (1998) survey, giving the link to staples of computer science, such as resolution and uniﬁcation. But the essential point is Phil. Trans. R. Soc. A (2005)

Mathematical signiﬁcance of proof theory

2433

that if something is provable in certain systems, it has a proof which gives more in the way of witnessing existential quantiﬁers, and is thus natural/explicit. Put differently, it reveals a nontrivial uniformity. Kreisel has repeatedly pointed out that classical proof theory has not achieved any serious combinatorial analysis of the Herbrand terms, and that one is unlikely to go much deeper in unwinding unless one has some perhaps quite elementary methods for reasoning about this kind of thing. The Godel functional interpretation translates intuitionistic higher-order arithmetic into a quantiﬁer-free axiom system for primitive recursive functionals of higher type. The recursion is purely formal. In particular it provides yet another consistency proof for PA, and one may wonder what the point/need of that is/was. The point emphasized here, and derived from Kreisel, is that it is at least equally rewarding to see what this translation gives as a tool for extracting bounds from proofs. On the one hand, it subsumes the no-counterexample interpretation as used by Girard. On the other, it is the method that Kohlenbach uses in his unwinding of much of classical approximation theory. A perhaps temporary advantage of Kohlenbach’s work is that the bounds obtained are better than any others known. Finally, there is the Herbrand technique used by Kreisel and later Luckhardt (1996) to bound the number of solutions in diophantine problems in cases when one does not have any bound on the location of the solutions. In fact such situations in diophantine geometry seem to be the norm in practice. In Cohen’s talk he described such situations as providing most of the very few genuinely nonconstructive proofs in mathematics. Typical examples are Siegel’s theorem or Faltings theorem, where effective estimates are known for the number of zeros, and where logic proofs can usually get this too. In the unwindings of this kind, so far, one does not need to pay any attention to the formal system in which the result was proved. Rather one looks for a Herbrand form that is being proved. In practice one ﬁnds one, and one knows what one needs on the growth rate. Then, even for the classical proof Luckhardt beats the Davenport–Roth bound, and for the Esnault–Viehweg proof Luckhardt was able to get by logical devices the same bound as Bombieri–van der Poorten. That he did not do better is not the point. But it is an important part of the description of the particular tricks of the trade used here that no real proof theory is used, only the guiding principle that one will be well prepared to get a bound for the number if one gets a Herbrand form with sufﬁciently good growth rate. Naturally one hopes to combine this with higher technology from proof theory to do better, but no hint of how to proceed thus has been found. 4. Closing remarks My main impression of the meeting is that the mathematicians and computer scientists did not really get close to understanding each other (despite many illuminating exchanges). The problems go well beyond those concerning strategies in theorem proving by mathematicians and the strategies of the artiﬁcial intelligence community. I, as a mathematical logician, operate closer to the borders than most participants at the meeting, and I have been left with a Phil. Trans. R. Soc. A (2005)

2434

A. Macintyre

sense of having missed something basic. I chose to talk on the use of precise theorems from Hilbertian proof theory formal proof to extract hidden information from informal mathematical proofs. I have tried to reﬂect on the enterprise, explicitly championed by Hales on his website, of producing fully formalized proofs of important results in geometry. Hales is quite explicit that he sees this as the only way of convincing the mathematical community of the correctness of his entire proof of the Kepler Conjecture. One thing that worries me is that we seem to have no theory underlying this enterprise, and this it is difﬁcult to relate it to other formal activities in proof theory. Moreover, I rather doubt that complete formalization will satisfy many mathematicians. There are some references I wish to add for those who would like to look a bit further in the directions set in this paper. One is a rich discussion by Kreisel (1990) on logical aspects of computation. The others are from Hales and the enterprise of full formalization. They state clear enough goals, but leave me with a sense of having missed something. They are the statements about Flyspeck, and that about the QED Project.1 I cannot imagine any useful sequel to our meeting in which the above discussions are not pursued.

References Aschbacher, M. 2005 Highly complex proofs and implications of such proofs. Phil. Trans. R. Soc. A 363. (doi:10.1098/rsta.2005.1655.) Avigad, J. Proof mining. Notes from ASL 2004, at www.andrew.cmu.edu/avigad. Ax, J. & Kochen, S. 1965 Diophantine problems over local ﬁelds. II. A complete set of axioms for padic number theory. Am. J. Math. 87, 631–648. Boolos, G. 1993 The logic of provability. Cambridge: Cambridge University Press. Browder, F. E. 1976 Mathematical developments arising from Hilbert problems. In Proceedings of Symposia in Pure Mathematics, vol. XXVIII. Providence, RI: American Mathematical Society. Bucholz, W. & Wainer, S. 1987 Provably computable functions and the fast growing hierarchy Logic and combinatorics, contemporary mathematics, vol. 65. Providence, RI: American Mathematical Society. Buss, S. 1998 An introduction to proof theory. In Handbook of proof theory (ed. S. Buss), pp. 1–78. North-Holland: Elsevier. Cohen, P. J. 2005 Skolem and pessimism about proof in mathematics. Phil. Trans. R. Soc. A. 363. (doi:10.1098/rsta.2005.1656.) Constable, R. 1998 Types in logic, mathematics and programming. In Handbook of proof theory (ed. S. Buss), pp. 683–786. North-Holland: Elsevier. Davis, M., Matejasevic, Y. & Robinson, J. 1976 Hilbert’s 10th problem: positive aspects of a negative solution. In Proceedings of Symposia in pure mathematics, pp. 323–378. Providence, RI: American Mathematical Society. ´ tudes Sci. Publ. Math. No. 52, 137–252. Deligne, P. 1980 La conjecture de Weil. II. Inst. Hautes E Feferman, S. 1996 Kreisel’s “Unwinding” program. In Kreiseliana, pp. 247–274. Wellesley, MA: A.K. Peters. Gentzen, G. 1969 Investigations into logical deduction. In The collected works of Gerhardt Gentzen (ed. M. E. Szabo), pp. 68–131. Amsterdam: North Holland. Girard, J.-Y. 1987 Proof theory and logical complexity. In Studies in Proof Theory, Monographs, 1, 505 pp. Naples: Bibliopolis. Hardy, G. & Wright, E. 1979 The theory of numbers. London: Oxford University Press. 1

See http://www.math.pitt.edu/wthales/ﬂyspeck/.

Phil. Trans. R. Soc. A (2005)

Mathematical signiﬁcance of proof theory

2435

Herbrand, J. 1967 Investigations in proof theory (1930). In Translation in “From Frege to Godel” (ed. J. van Heijenoort), pp. 529–581. Cambridge, MA: Harvard University Press. Higman, G. 1961 Subgroups of ﬁnitely presented groups. Proc. R. Soc. A 262, 455–474. Hilbert, D. & Bernays, P. 1934 Grundlagen der Mathematik, vol. 1. Berlin: Springer. Hilbert, D. & Bernays, P. 1939 Grundlagen der Mathematik, vol. 2. Berlin: Springer. Kohlenbach, U. 2001 On the computational content of the Krasnoselski and Ishikawa ﬁxed point theorems. In Proc. Fourth Workshop on Computability and Complexity in Analysis (ed. J. Blanck, V. Brattka, P. Hertling & K. Weihrauch), pp. 119–145. Springer LNCS 2064. Kohlenbach, U. & Olivia, P. 2003a Proof mining: a systematic way of analysing proofs in mathematics. Proc. Steklov Inst. Math. 242, 136–164. Kohlenbach, U. & Olivia, P. 2003b Proof mining in L1-approximation. Ann. Pure Appl. Logic 121, 1–38. (doi:10.1016/S0168-0072(02)00081-7.) Kreisel, G. 1951 On the interpretation of non-ﬁnitist proofs. I. J. Symbolic Logic 16, 241–267. Kreisel, G. 1952 On the interpretation of non-ﬁnitist proofs. II. Interpretation of number theory. Applications. J. Symbolic Logic 17, 43–58. Kreisel, G. 1990 Logical aspects of computation. In Logic and computer science (ed. P. Odifredddi), pp. 205–278. San Diego: Academic Press. Kreisel, G. & Macintyre, A. 1982 Constructive logic versus algebraization. I. The L. E. J. Brouwer Centenary Symposium (Noordwijkerhout, 1981). Stud. Logic Found. Math. 110, 217–260. Luckhardt, H. 1996 Bounds extracted by Kreisel from ineffective proofs. In Kreiseliana, pp. 275–288. Wellesley, MA: A. K. Peters. Mackenzie, D. 2005 Computers and the cultures of proving. Phil. Trans. R. Soc. A 363. (doi:10. 1098/rsta.2005.1649.) Odifreddi, P. (ed.) 1996. Kreiseliana. Wellesley, MA: A. K. Peters. Paris, J. & Wilkie, A. 1987 On the scheme of induction for bounded arithmetical formulas. Ann. Pure Appl. Logic 35, 261–302. (doi:10.1016/0168-0072(87)90066-2.) Serre, J. 1953 Quelques calculs de groupes d’homotopie. C.R. Acad. Sci. Paris 236, 2475–2477. Serre, J.-P. 1997 Lectures on the Mordell–Weil Theorem, Vieweg. Shelah, S. 1988 Primitive recursive bounds for van der Waerden numbers. J. Am. Math. Soc. 1, 683–697. Shepherdson, J. 1964 A nonstandard model for a free variable fragment of number theory. Bull. Acad. Pol. Sci. 12, 79–86. Smullyan, R. 1961 The theory of formal systems Annals of mathematics studies, vol. 47. Princeton, NJ: Princeton University Press. Solovay, R. 1970 A model of set theory in which all sets are Lebesgue measurable. Ann. Math. 92, 1–56. Woods, A. 1981 Ph.D. thesis, Manchester.

Phil. Trans. R. Soc. A (2005)

Phil. Trans. R. Soc. A (2005) 363, 2437–2447 doi:10.1098/rsta.2005.1658 Published online 12 September 2005

The justiﬁcation of mathematical statements B Y P ETER S WINNERTON -D YER University of Cambridge, Wilberforce Road, Cambridge CB3 OWB, UK ([email protected]) The uncompromising ethos of pure mathematics in the early post-war period was that any theorem should be provided with a proof which the reader could and should check. Two things have made this no longer realistic: (i) the appearance of increasingly long and complicated proofs and (ii) the involvement of computers. This paper discusses what compromises the mathematical community needs to make as a result. Keywords: proof; justiﬁcation; programs; conjectures

I approached this conference with a seriously split personality. I am usually regarded as a number theorist, and therefore, as a pure mathematician of the most uncompromising kind. On the other hand, I also work at the more vulgar end of the study of ordinary differential equations; indeed for years I was the only pure mathematician in Cambridge who had a visa to enter the Department of Applied Mathematics. And for a substantial part of my career I was employed not as a mathematician but as a computer scientist. In these three roles, my attitudes to what should be regarded as a proof have been quite different. In the real world, what is regarded as an adequate proof depends very much on what one is trying to prove. It takes far less evidence to convict a person of speeding than to convict him (or her) of murder—and nowadays it appears that even less evidence is needed to justify waging war. In mathematics we need to accept (and indeed have tacitly accepted) the same diversity. We have an ideal concept of what is meant by a rigorous proof, but in many contexts we cannot afford to live up to that standard; and even before the days of computers, mathematicians had devised various ways of loosening that straightjacket. Moreover, the amount of effort which the mathematical community puts into checking a purported proof depends very much on the importance, the unexpectedness and the beauty of the result. The most demanding standard that I have ever encountered was that impressed on me by J. E. Littlewood, who was my research supervisor. He maintained that because so many published papers contained errors or at least gaps, one should never make use of someone else’s theorem unless one had checked the proof oneself. He was of course conditioned by having lived through the traumatic process of making classical analysis rigorous; and for most of his lifetime there were important branches of pure mathematics based more on plausibility than on certainty. But if such a doctrine was ever feasible it is certainly no longer so. The ﬁnal death-blow to it may well have been the One contribution of 13 to a Discussion Meeting Issue ‘The nature of mathematical proof’.

2437

q 2005 The Royal Society

2438

P. Swinnerton-Dyer

classiﬁcation of the ﬁnite simple groups. But until the advent of computers, most pure mathematicians had no difﬁculty with the concept of a rigorous proof. To quote A. E. Houseman in a rather different context: ‘A terrier may not be able to deﬁne a rat, but a terrier knows a rat when he sees it.’ Not all mathematical statements are theorems. In most branches of pure mathematics there is a border-zone between what is rigorously established and what is totally mysterious. That zone is populated by what are variously called conjectures, hypotheses and open questions. If one were asked for criteria which justify making a particular conjecture, one might say that it must satisfy one or more of the following conditions: (i) It sheds new light on the structure of the subject. (ii) Its statement is simple and fascinating. (iii) It is plausible and enables mathematicians to prove important results which they are currently unable to prove without it. (iv) It can be shown to hold in particular (but preferably typical) cases. These reasons are listed in what seems to me the order of decreasing merit. All but the second of them also tend to support the truth of the conjecture. In number theory the border-zone is particularly rich, and I shall take my examples from there. Two of the Clay Institute’s Million Dollar problems fall within number theory. The original Riemann Hypothesis was that the non-trivial zeroes of the Riemann zeta function z(s) all lie on the line RsZ 1=2. Riemann’s reasons for believing his Hypothesis (of which a good account can be found in Siegel (1932)) were sophisticated, and he probably had no computational evidence for it. Subsequently, more than a billion zeroes have been computed (mostly funded by the Pentagon), and they all lie on the critical line; but there are strong reasons for believing that even if counterexamples to the Riemann Hypothesis exist they will be rare and will have very large imaginary parts, so computers cannot provide strong evidence for it. Littlewood, indeed, believed that the Riemann Hypothesis was false, on the grounds that if it were true the combined efforts of classical analysts would have proved it long ago. But in my view this is to see it in the wrong context. The Riemann Hypothesis has been repeatedly generalized, and the more far-reaching the generalizations the more central they appear to be to the structure of modern number theory. Thus, the Riemann Hypothesis ought not to be regarded as lying within classical analysis, and one ought not to hold it against classical analysts that they have not yet provided a proof of it. In its simplest form, the Birch/Swinnerton-Dyer conjecture for an elliptic curve relates the value of the associated L-series at sZ1/2 (the mid-point of the critical strip) to the order of the Tate-Safarevic group of the curve. (The clearest detailed description of the conjecture can be found in Tate (1966).) As Tate said, ‘it relates the value of a function at a point where it is not known to exist to the order of a group which is not known to be ﬁnite’. Nevertheless, even when the conjecture was ﬁrst formulated it was possible to provide numerical evidence in support of it in particular cases—primarily when the elliptic curve is deﬁned over Q and admits complex multiplication, for in that case the L-series can be analytically continued and can be explicitly evaluated at sZ1/2. Moreover, if the Tate-Safarevic group is ﬁnite its order is known to be a square; and even forty Phil. Trans. R. Soc. A (2005)

The justiﬁcation of mathematical statements

2439

years ago its p -component could be evaluated in principle for any prime p and nearly always in practice for pZ2. Over the last forty years a lot more numerical evidence has been obtained, and special cases of the conjecture have been proved—in contrast with the Riemann Hypothesis, which still appears absolutely impregnable. It has also been vastly generalized, though it is not clear to me that these generalizations are supported by any additional evidence. Fermat’s Last Theorem fell into the category of conjectures until the work of Wiles. I am sure that Fermat believed he had proved it; and indeed one can with fair conﬁdence reconstruct his argument, including one vital but illegitimate step. It satisﬁes the second of my four criteria, but none of the others, and it has not fascinated everybody. Gauss, when asked why he had never attempted to prove it, replied that he could set up a hundred such statements, which could be neither proved nor disproved and which served only to impede the progress of mathematics. But it was the attempt to prove Fermat’s Last Theorem which motivated Kummer to create algebraic number theory—a rich garden to grow from a single seed. I should also mention a conjecture which turned out to be false and which satisﬁed none of my criteria, but from which important developments sprang. It has been known since Dirichlet that a quadratic equation deﬁned over Q is soluble in Q if it is soluble in each completion Qp and R. (The corresponding result over a general algebraic number ﬁeld, which is much harder to prove, is due to Hasse; so for any family of equations a result of this kind is known as a Hasse Principle.) Mordell conjectured that the corresponding result would hold for the equation of a non-singular cubic surface. He gave no reason for this, and I suspect that he put forward the conjecture partly for probabilistic reasons and partly because he could think of no other obstruction. The ﬁrst counterexample depended on the sheer cussedness of small integers and threw no light on the nature of a possible obstruction in general. The second one was provided by Cassels & Guy (1966). It depended on a computer search, extensive by the standards of the time, which generated a list of diagonal cubic equations, which had no small integer solutions; but the proof that the simplest equation in this list was actually insoluble did not involve a computer. These counterexamples led Manin to discover the Brauer-Manin obstruction, which plays a central role in the modern theory of Diophantine equations. I could go on. But I hope that I have done enough to demonstrate two things: ﬁrst, that at least in some branches of pure mathematics the formulation of welljustiﬁed conjectures plays an important role in advancing the subject and second, that there is general agreement what ‘well-justiﬁed’ means in this context. Both for theorems and for conjectures, one should make a distinction between structural statements such as the Riemann Hypothesis and accidental statements such as Goldbach’s conjecture. This distinction is not clear-cut; there would be disagreement, for example, about the description of the Four Colour theorem or the classiﬁcation of ﬁnite simple groups. (I regard the latter as accidental, because there are so many sporadic simple groups and they are so diverse.) Most mathematicians are resigned to the likelihood that the proofs of some accidental theorems may sometimes be long, turgid and ill-motivated; but they expect that the proof of a structural theorem, even if it is long and difﬁcult, will be in some sense straightforward. Phil. Trans. R. Soc. A (2005)

2440

P. Swinnerton-Dyer

The situation with differential equations is very different. It is true that there are theorems about differential equations which have been rigorously proved, but these tend not to answer the questions which users of differential equations actually ask. The typical situation is as follows: Consider some interesting realworld system. It is in principle possible to write down the differential equations which describe how the system varies with time, according to the laws of nature as currently understood (and ignoring the effects of the Uncertainty Principle); but these equations will be far too complicated to use as they stand. One therefore needs to make radical simpliﬁcations, hoping that the solutions of the simpliﬁed model will still describe to a good approximation the behaviour of the original system. Currently, this process seems to be a matter of pure faith; but for some systems there may be scope for a rigorous treatment. For example, in the Million Body Problem, which studies the interaction of the stars in a galaxy, the stars are treated as point masses satisfying the Newtonian laws of gravitation, though each star does gradually radiate away some of its mass. Again, Nose´ managed to reduce the thermodynamics of the universe to three ﬁrst order ordinary differential equations. To this simpliﬁed system one applies whatever tools seem appropriate. For the Nose´ equations (or the better known and more studied Lorenz equations, which are another system of three ﬁrst order equations derived in much the same way) these are of three kinds: (i) Genuinely rigorous arguments. (ii) Arguments whose conclusion takes the form ‘Such-and-such happens unless there is a rather unlikely-looking coincidence.’ (iii) Information about particular trajectories, obtained numerically. These will not be enough to determine the behaviour of the system even qualitatively; but among the possible qualitative descriptions compatible with the information obtained there will usually be a simplest one—and an appeal to Ockham’s Razor should lead us to adopt that description. This process must be regarded as a justiﬁcation of the conclusion rather than a proof of it; but for differential equations there seems little prospect of ever being able to do better. So far I have mentioned computers only peripherally. I must now turn to the issues raised by computer-based proofs; and here it is necessarily to take account of the fallibility both of computers and of programmers. Most computers probably have bugs even in their hardware. (One early ﬁxed-point machine evaluated (K1)!(K1) as 0 owing to a very plausible design fault; fortunately that was an operation not often performed.) Probably all computers have bugs in their software—their operating systems, assemblers and compilers—though if these have not been detected and cured that implies that they very seldom cause trouble. More importantly, the process of turning an algorithm into a computer program is notoriously fallible even when the program is in a high-level language. Moreover, although it is feasible for a referee or reader to check an algorithm for errors, it is almost impossible to check that someone else’s program is correct. (Some computer scientists claim that there exist programs which will rigorously check whether an algorithm has been correctly translated into a program, and there do exist similar programs which check that the design of a microchip correctly implements its speciﬁcation. But no one has yet used these methods to Phil. Trans. R. Soc. A (2005)

The justiﬁcation of mathematical statements

2441

check the correctness of any of the existing programs for proving the Four Colour theorem, and this can hardly be because computer scientists do not think that theorem important enough.) All this needs to be taken into account in deciding the level of credibility of a computer-based or computer-assisted proof. That last phrase covers a considerable diversity of computer involvements, and they need to be separated. Let me start with what might be called the computer’s role as conjurer’s assistant. When you meet the word ‘Consider’ in a proof, you know that a rabbit is about to be pulled out of a hat; but you are unlikely to be told, nor logically do you need to be told, where the rabbit came from. We have already had one example of this. When Cassels thought of a method, which might prove that some pre-assigned diagonal cubic equation was a counterexample to the Hasse Principle he needed an equation for which the method might work; and the only way of ﬁnding such an equation was by a computerized search. Again, it is known that the set of rational points on an elliptic curve deﬁned over Q form a ﬁnitely generated abelian group. Its torsion part is easy to compute, so what is of interest is to ﬁnd its rank. For any given curve, there is a standard method for ﬁnding an upper bound r for this rank; and empirically the upper bound thus obtained is usually the actual rank. To prove this for a particular curve, we have to ﬁnd r independent rational points on the curve, and this is done by means of a search program. Once such points have been obtained, it is a relatively simple task to prove that they lie on the curve— and even if a computer is used to check this, it is most unlikely to report that a given point lies on the curve when in fact it does not. The canonical structure of a proof, as exempliﬁed in that unreadable tour-deforce Russell and Whitehead’s Principia Mathematica, is as follows. One starts with a ﬁnite collection of well-established statements. At each step one writes down one more statement, which must be an immediate logical consequence of the existing statements. Eventually one generates in this way the result which one is trying to prove. There is some resemblance here to a chess-playing program, in that there is an enormous choice at each step and it is essential to have a good evaluation function to tell one which is the most helpful next statement to adjoin. To the extent that this scheme could ever be made to work on a computer, the process would generate proofs which could be checked by a ﬂesh-and-blood mathematician—or indeed by a proof-checking program. The latter would of course be far easier to write than a theorem-proving program because it would not need the evaluation subroutine, which is where (as with a chess-playing program) the fundamental difﬁculties occur. I myself do not believe that a theorem-proving program of this kind will ever prove theorems which are beyond the capacity of a human being. But the ideas which it would need could be applied, in a much simpliﬁed form, to a program to referee papers written by human beings; for such papers contain small gaps in the logic which the reader is expected to ﬁll, and ﬁlling such gaps is theorem-proving of a very elementary kind. Any editor will bear witness to the need for such a program. So far I have been dealing with cases where a computer is essential or at least useful in generating a proof, but is not needed in the proof itself—in other words, proofs which are computer-assisted rather than computer-based. I now turn to those which are genuinely computer-based. Let me give two examples. The ﬁrst is the Four Colour theorem, for which two computer-based proofs have already been constructed, of which at least one is generally accepted as valid. Phil. Trans. R. Soc. A (2005)

2442

P. Swinnerton-Dyer

(For an account of the second proof, with many references, see Robertson et al. (1997); a summary of this paper is also available on the Web.) The second is a conjecture which has not yet been proved, largely because it belongs to a branch of mathematics which is not currently fashionable; but it is well within reach of modern desk-top computers and it illustrates the points I want to make. Recall that a lattice L in Euclidean space is said to be admissible for an open set R if no point of L except the origin O lies in R. Then the assertion is thatpﬃﬃﬃﬃﬃﬃﬃ every ﬃ lattice admissible for the region jX1X2X3X4j!1 has determinant at least 725. (This is best possible if true, for the lattice L0 of integers of the totally real quartic ﬁeld of discriminant 725 is certainly admissible.) As these two examples show, a large part of a computer-based proof may be devoted to vulgar numerical calculation, but this will not always be so. Such a part presents few difﬁculties for checking correctness. Calculation with integers is exact, though calculation with real numbers is not. In the latter case one must take account of round-off errors, and this requires working with inequalities rather than with equalities. Where serious difﬁculties do occur is if processes from numerical analysis are involved: it is, for example, almost impossible to generate bounds for the solution of a differential equation which are both tight and rigorous. This is a further reason for what I said earlier, that in the study of differential equations one must accept much lower standards of justiﬁcation than in most of pure mathematics. In a simpliﬁed form, the algorithm which is expected to prove the lattice assertion above is as follows. We look for all admissible lattices L which satisfy say det L!27. By standard theory, it is enough to consider lattices which contain the point P1Z(1,1,1,1). No admissible point, and hence in particular no point of the lattice other than O, is a distance less than 2 from O; so standard theory provides an explicit constant C such that there are lattice points P2, P3, P4 within a distance C of the origin which together with P1 generate the lattice. We can think of the lattice as described by the point LZP2!P3!P4 in 12 dimensions, and information about the lattice is equivalent to information about the set in which L lies. The admissible region jX1X2X3X4jR1 is the union of 16 disjoint convex subregions, according to the signs of the Xi; we initially split cases according to which region each of the Pj lies in. Some of these cases can be immediately shown to be impossible: for example, if all the coordinates of P2 are positive then it turns out that P1KP2 cannot be admissible. More generally, for any particular case we choose integers n1, . ,n4 not all zero and consider the lattice point PZSnjPj. (The design of an efﬁcient algorithm for choosing the nj is the one sophisticated part of the program.) There are now three possibilities: (i) P cannot lie in any of the 16 admissible subregions; if so, this case can be deleted. (ii) There is exactly one subregion in which P can lie; if so, this is a constraint on P and, therefore, reduces the set in which L can lie. We can now continue the process with a new choice of the nj. (iii) There is more than one subregion in which P can lie; if so, we split this case into subcases according to the subregion in which P is assumed to lie. Thus the process keeps on deleting old members from the list of cases to be studied but also putting new ones in. What we hope is that eventually the list Phil. Trans. R. Soc. A (2005)

The justiﬁcation of mathematical statements

2443

reduces to a single case and for that case the open region containing L is small and contains the point L0 corresponding to the conjectured critical lattice L0; if so, we can complete the proof by means of a known isolation theorem. If this does not happen, in due course we obtain a list of very small regions in one of which L must lie; and provided the process is error-free we expect each of these regions to provide an admissible lattice which can be found by hand. The algorithm which underlies the proof of the Four Colour theorem ﬁts the same pattern—and indeed this appears to be the natural pattern for a long and complicated computer-based proof. Here too the proof starts with a ﬁnite list of cases, and when any particular case is processed it is either deleted or replaced by a ﬁnite number of subcases. For if the theorem is false, among the maps which cannot be coloured with only four colours there is one which contains the smallest number of regions. The list of cases is a list of sub-maps which might form part of this map. A case can be split by adjoining an extra region to the submap, which can be done in various ways. A case can be rejected if there is a different sub-map having fewer regions such that if the old map cannot be coloured with only four colours, then nor can the new map obtained by replacing the old sub-map by the new one. (Fortunately, this is a property which can often be established without knowing anything about the rest of the map.) The proof succeeds if the list can be exhausted. The principle underlying such proofs is attributed to Sherlock Holmes: ‘When you have eliminated the impossible, whatever remains, however improbable, must be the truth.’ The point which I wish to make about computer-based proofs of this kind is as follows. Suppose that there are errors in the program, but the program does in fact terminate; since that was the result which we were expecting, we have no reason to doubt the correctness of the program—for programming errors are usually only detected because they have led to surprising results. Moreover, in a program of this kind an error is likely to lead either to some cases being wrongly rejected or to some cases never being generated by the splitting process. Either of these will make the program terminate sooner than it should have done, or even when it should not have terminated at all. In other words, errors will usually generate false proofs rather than merely failing to generate true proofs. It is this which makes validation of this kind of proof so important. More than thirty years ago I stated what I thought was needed to validate a computer-based proof, within the limits of practicality; and I see no reason to change my views now. (I was heartened to discover at this conference that Annals of Mathematics has been forced to adopt a very similar attitude.) Suppose that Alice has produced a computer-based proof and wishes Bob to validate it; what should each of them do? Alice should publish the algorithm which underlies the program, in so simple a form that other people (and in particular Bob) can check it. She should be very cautious about including in the algorithm the sort of gimmicks which make the program more efﬁcient, because they also make the correctness of the algorithm harder to check. It is highly desirable, if possible, that the algorithm should also specify some intermediate output. Alice should not at this stage provide Bob with any other information; in particular she should not give Bob a copy of her program or any part of it, nor a copy of her intermediate output. Ideally, Bob should not even come from the same environment as Alice, because that would tend to give them a common mind-set. Bob should then turn the algorithm into Phil. Trans. R. Soc. A (2005)

2444

P. Swinnerton-Dyer

a program, preferably not using the same language as the one which Alice used. If both programs yield the same results, including the same intermediate output, this is as much validation as can reasonably be provided. Finally, a more general point. Manichaeans hold that power over the universe is equally divided between God and the Devil. At least until Go¨del, mathematicians believed that their subject lay entirely within God’s share. It is my impression that most of the speakers at this conference still hold this view, even though much of what they have said points in the opposite direction. The doctrine is well illustrated by two couplets written nearly three centuries apart, the second being written as an answer to the ﬁrst: Nature, and Nature’s laws, lay hid in night; God said ‘Let Newton be! ’ and all was light. But not for long; the Devil, shouting ‘Ho! Let Einstein be! ’ restored the status quo.

Appendix A This appendix provides some further information about some of the topics mentioned in the body of the talk. (i) The most general version of the Riemann Hypothesis which I know is as follows. Let f (s) be a Dirichlet series satisfying the following conditions: (a) It occurs naturally in a number-theoretic context. (b) It has an Euler product. (c) It can be analytically continued as a meromorphic function over the whole s-plane, and satisﬁes a functional equation which relates f (s) and f (nKs) for some integer s and which up to sign is tantamount to a symmetry law. Then all the non-trivial zeroes of f (s) lie on the critical line RsZ ð1=2Þn. This as it stands appears to contain an escape clause, in that the ﬁrst condition is metamathematical rather than mathematical. But in practice there would be little disagreement whether a purported counterexample satisﬁed that condition or not. (ii) Fermat’s last theorem asserts that if nO2 there are no solutions in positive integers of X nCY nZZ n. Gauss clearly regarded it as an accidental rather than a structural theorem; but the heart of Wiles’s proof is a proof of a weak form of the modularity conjecture, which is certainly a structural theorem. (iii) The modularity conjecture (over the attribution of which controversy rages) states that each elliptic curve deﬁned over Q can be parametrized by modular functions. The ﬁrst assertion of this kind is due to Tamagawa, who died young. The ﬁrst substantial justiﬁcation of it was given by Weil (1967), though he stated it only as an open question. The ﬁrst substantial numerical evidence for it was given by Birch and his students. It has now been completely proved. (iv) Goldbach’s conjecture is that every positive even integer other than 2 is the sum of two primes. It has been proved for all even integers up to 6!1016. This is a case in which a purported proof of the full conjecture would deserve very careful checking, but the proof of the weaker statement in the previous sentence deserves rather little. Phil. Trans. R. Soc. A (2005)

The justiﬁcation of mathematical statements

2445

(v) The Nose´ equations are x_ ZKyKxz; y_ Z x; z_ Z aðx 2 K1Þ; where a is a positive parameter. There are certainly values of a for which the behaviour of the trajectories is chaotic both in the usual and in the technical sense; whether this is so for all values of aO0 is not known. The Lorenz equations are x_ Z sðyKxÞ; y_ Z rx KyKxz; z_ Z xyKbz; where s, r and b are three real positive parameters. A good introduction to their study can be found in Sparrow (1982). (vi) William of Ockham (or Occam) was a medieval theologian and philosopher. He stated the principle that ‘entities should not be multiplied without cause’, which is known as Ockham’s Razor. A reasonable paraphrase would be that one should accept the simplest explanation of any phenomenon. (vii) The simplest base for the rational points on an elliptic curve usually consists of points with numerator and denominator comparable with the coefﬁcients in the equation of the curve; but occasionally this fails badly. For example, the group of rational points on the curve y2Zx3K673 has rank 2, and the simplest generators are the points with 3398323537 x Z 29 and x Z : 617612 A large table of ranks and generators can be found in Cremona (1997).

References Cassels, J. W. S. & Guy, M. J. T. 1966 On the Hasse principle for cubic surfaces. Matematika 13, 111–120. Cremona, J. E. 1997 Algorithms for modular elliptic curves, 2nd edn. Cambridge: Cambridge University Press. Robertson, N., Sanders, D. P., Seymour, P. D. & Thomas, R. 1997 The four colour theorem. J. Comb. Theory Ser. B 70, 2–44. (doi:10.1006/jctb.1997.1750) ¨ ber Riemanns Nachlass zur analytischen Zahlentheorie. Quellen und Studien Siegel, C. L. 1932 U zur Geschichte der Mathematik, Astronomie, Physik 2, 45–80. (Gesammelte Abhandlungen, 1, 275–310). Sparrow, C. 1982 The Lorenz equations, bifurcations, chaos and strange attractors. Berlin: Springer. Tate, J. 1966 On the conjectures of Birch and Swinnerton-Dyer and a geometric analog. Se´m. Bourbaki 306. ¨ ber die Bestimmung Dirichletscher Reihen durch Funktionalgleichungen. Math. Weil, A. 1967 U Ann. 168, 149–156. (doi:10.1007/BF01361551) (Collected Works, 3, 165–172).

Discussion C. JONES (Computing Science Department, University of Newcastle, UK ). The view that one might prefer to construct a second program (rather than study a carefully annotated one) is odd. It could be compared to a journal, which only Phil. Trans. R. Soc. A (2005)

2446

P. Swinnerton-Dyer

sends the statement of a new theorem to referees asking them to provide their own proofs. This might uncover errors but would be rather wasteful! The assertions in a program provide a rigorous argument of its correctness; or careful development using for example data abstraction is even more like the (rigorous) proof of a theorem. R. D. ARTHAN (Lemmal Ltd, Berkshire, UK ). Direct evaluation of programs within a theorem-proving environment such as HCL offers a good half way house between relying on an untrusted program and formal program veriﬁcation. This has been used with some success by John Morrison and others giving validated calculations with the real numbers. Can you comment on this? P. SWINNERTON-DYER. The question is what degree of credibility should attach to a theorem none of whose proofs conform to classical standards. This question is usually asked about proofs which depend on computer programs (as in these two questions), and this answer will deal only with those. Even if a computer program in a high-level language is itself correct, the results obtained by running it may be vitiated by undetected bugs in the compiler, the operating system or even the hardware—or indeed by viruses temporarily present in the computer being used. (Few if any compilers or operating systems are without bugs; and in this paper, I gave an example of a hardware error in an important computer, which to my knowledge went undetected for years.) To reduce these dangers it is reasonable to insist that the program should be run twice, on essentially different computers using essentially different compilers. This does not quite meet classical standards; but it is a very modest requirement, and gives rather strong assurance that the program did do what it says it does. But does the program do what the programmer thinks it does, and how does the mathematical community obtain reasonable assurance of this? The suggestion that the reader can actually check the correctness of a complicated published program is ludicrous; indeed, I doubt if there is anyone alive who is both willing and able to do this with a high degree of reliability for the sort of programs which gave rise to this meeting. (The difﬁculty is not only with fundamental errors, and indeed these are usually eradicated in the course of writing and checking the program. But slips of the pen, of a kind which also occur in published classical proofs but do little damage there, can short-cut some branches of the program; and the result is apt to be that not all possibilities have been investigated.) Working within a theorem-proving environment, even when this is feasible, does add to the credibility of a program; but for a program used in the proof of an important or unexpected theorem, the mathematical community will probably not feel that the credibility which it adds is enough. Formal program veriﬁcation is not at present capable of dealing with programs as complicated as those which we are discussing in this meeting, and I am not conﬁdent that it ever will be. N. SHAH (Durham, UK ). You have raised an important point, ‘theorems’ if proofs are submitted to journal, e.g. 2nd ODE where there are no closed forms. I would urge the mathematical community to make sure that mathematical software currently used has been proved correct otherwise theorems will be published but because of bugs these theorem are non repeatable. Phil. Trans. R. Soc. A (2005)

The justiﬁcation of mathematical statements

2447

P. SWINNERTON-DYER. Theory does provide methods for computing provable bounds for the solution of a given ordinary differential equation, but I do not know of any satisfactory implementation of any of these methods as a library subroutine. If one solves an ordinary differential equation by standard numerical methods, it is not hard to build in extra equations whose solutions are error estimates; these will not be provably correct, but in practice usually are correct. (As I implied in my talk, this is an area in which one must take a much more relaxed attitude to provable correctness than in pure mathematics.) In particular, over an interval in which the solution is stable standard subroutines are good enough. For partial differential equations the situation is much less good. But the limitation here arises from the unsatisfactory state of the theory, and this needs to be improved before one is entitled to start complaining about any shortcomings in the software. E. B. DAVIES (Department of Mathematics, King’s College London, UK ). When cold fusion was ‘discovered’ there was immediate public criticism that the effect was entirely implausible. However, a number of laboratories set up experiments to try to duplicate the ﬁndings. In experimental science an effect is not believed until it has been conﬁrmed independently. The mathematical community should follow the same procedure with respect to computer assisted proofs by requiring independent programmes to be written. P. SWINNERTON-DYER. I entirely agree. But there is one ﬂaw in the analogy. Cold fusion was always implausible, and I am sure that most of the laboratories which tried to ‘duplicate’ it were actually trying to refute it. But all the computer assisted proofs which I know of are proofs of results which everyone in the area believed to be true long before any proof was announced; and not a great deal of credit is given for producing the second proof of such a result unless that second proof differs fundamentally from the ﬁrst one.

Phil. Trans. R. Soc. A (2005)

Phil. Trans. R. Soc. A (2005) 363, 2449–2460 doi:10.1098/rsta.2005.1657 Published online 12 September 2005

Pluralism in mathematics B Y E. B. D AVIES Department of Mathematics, King’s College, Strand, London WC2R 2LS, UK ([email protected]) We defend pluralism in mathematics, and in particular Errett Bishop’s constructive approach to mathematics, on pragmatic grounds, avoiding the philosophical issues which have dissuaded many mathematicians from taking it seriously. We also explain the computational value of interval arithmetic. Keywords: pluralism; constructive mathematics; interval arithmetic

1. Introduction Errett Bishop’s book ‘Foundations of Constructive Analysis’ appeared in 1967 and started a new era in the development of constructive mathematics. His account of the subject was entirely different from, and far more systematic than, Brouwer’s programme of intuitionistic mathematics. The latter attracted a few adherents in the 1920s and 1930s, but was widely rejected because of its conﬂicts with the dominant classical view of the subject. Unfortunately, Bishop’s book was ignored by most mathematicians, who assumed that the issues involved had all been settled, and that he could not have anything interesting to say. My task in this meeting is to try to persuade you that his programme provides valuable insights into matters which should be of concern to anyone who has even indirect involvement in computation. In this paper I will not discuss the philosophical issues relating to Bishop’s work, which are treated at some length in Billinge (2003) and Davies (2004), beyond saying that one can admire his mathematical contributions without adopting his philosophical position. Brieﬂy, I defend what I call pluralism in mathematics—the view that classical mathematics, constructive mathematics, computer assisted mathematics and various forms of ﬁnitistic mathematics can coexist. I revive Carnap’s dictum that one must decide the framework of discourse before questions about existence and truth make sense; see Carnap (1950). In different frameworks the answer to a question may be different, but this in no way implies that one or the other is ‘right’. This position is antiPlatonistic. From chapter 2 onwards Bishop (1967) is completely recognizable as rigorous pure mathematics. Many well-known theorems appear, sometimes in forms which are not the usual ones, although trivially equivalent to them from a classical point of view. A few theorems are simply absent. The value of Bishop’s efforts may not be immediately clear to everyone, in spite of what he writes in One contribution of 13 to a Discussion Meeting Issue ‘The nature of mathematical proof’.

2449

q 2005 The Royal Society

2450

E. B. Davies

his ﬁrst chapter. I will show that the differences between classical and constructive mathematics always correspond to situations in which real difﬁculties arise in numerical computation for suitable examples. Classical mathematics may provide a more ﬂexible context for proving the existence of entities, but constructive mathematics provides a systematic approach to understanding why computational solutions of problems are sometimes not easy to obtain. This is not to say that constructive mathematics is simply a part of numerical analysis. Numerical analysts have more problems than do constructivists. Bishop (1967, p. 140) gives a straightforward proof of the fundamental theorem of algebra, with one small but interesting proviso, even though it is known that the zeros of a polynomial of moderate degree (say at least 50) are highly unstable with respect to very small changes in the coefﬁcients. Nevertheless, one can gain many insights into the differences between classical and constructive mathematics by considering numerical examples.

2. What is constructive mathematics? It has often been said that Bishop rejected the law of the excluded middle, but a more useful description of the situation is that he gave the symbol d a different meaning from the usual one. In classical mathematics d refers to Platonic existence, but Bishop used it to refer to the production of an algorithm for constructing the relevant quantity. In classical mathematics d may be deﬁned in terms of c: the expression dxA is logically equivalent to l(calA). In constructive mathematics, d is a new quantiﬁer with stricter conditions for its application. All of the differences between classical and constructive mathematics follow from the new meaning assigned to the symbol. We wish to emphasize that every theorem in Bishop’s constructive mathematics is also a theorem in classical mathematics. Constructive mathematicians have to work harder to prove theorems, because their criteria for existence are stricter; the pay-off is that the statements of the theorems contain more information. Starting from the natural numbers, Bishop constructed the real number system and established many of its familiar properties. However, in his approach, one cannot assert for every real x that either xZ0 or xs0. Nor is it the case that every bounded set of real numbers has a least upper bound. The reason for this is best illustrated with an example. For each positive integer n, we deﬁne the number an to be 1 if the nth digit in the decimal expansion of p is the start of a sequence of a thousand consecutive sevens; otherwise we put anZ0. For each n, the value of an can be determined within a ﬁnite length of time. However, the least upper bound A of the sequence is currently unknown. Platonically speaking either AZ0 or AZ1, even if we do not know which is the case, but Bishop would say that such a statement has no content: it simply reformulates the question in a trivial manner. If we put N X sZ an ðK1=3Þn ; nZ1

Phil. Trans. R. Soc. A (2005)

Pluralism in mathematics

2451

then s exists constructively, because it can be calculated with any assigned accuracy in a ﬁnite length of time. However, we do not know whether or not sZ0. Even if it were eventually proved that every sequence of digits occurs somewhere in the decimal expansion of p, so that ss0, whether s is positive or negative seems to be far beyond reach. The development of constructive mathematics has to reﬂect the existence of an inﬁnite number of questions of the same type. It is very surprising that Bishop could develop so much of analysis without using the least upper bound principle or the law of the excluded middle. His book contains fully worked out accounts of the theory of Banach spaces, the spectral theorem, integration theory and Haar measure, among other topics. Set theory is substantially different from the classical version, particularly when considering the complement of a subset. Point set topology is not easy to develop (see Bridges & Luminit¸a 2003 for one approach to this), but Bishop contains a rich constructive version of the theory of metric spaces. Compactness is deﬁned in Bishop (1967, p. 88) using the notion of total boundedness, which is the way compactness is often proved in applications. This is not a coincidence. 3. What signiﬁcance do the differences have? My goal in this section is to explain why a classical mathematician (and I emphasize that I am one) might be interested in Bishop’s programme. My thesis is that by adopting the constructive framework one can handle certain numerical problems on a systematic basis, whereas classical mathematicians have to deal with them piecemeal, and try to remember whether or when they are using results which are not computationally feasible. I make no claim that constructive mathematics is superior to classical mathematics in all contexts, but only that it sometimes provides illuminating insights. Producing examples to demonstrate the differences between classical and constructive mathematics often exploits the difference between recursive and recursively enumerable subsets of N . Another method is to deﬁne a sequence whose behaviour as n/N depends upon whether some famous conjecture is true or false.1 We adopt a third strategy, showing that the impossibility of proving something in constructive mathematics is regularly associated with the extreme difﬁculty of showing it numerically for quite ordinary functions. We emphasize that the functions considered below do not, strictly speaking, provide examples of the constructive phenomenon, but we feel that in spite of this they explain why the constructive phenomenon exists. Let us start with the intermediate value theorem for continuous functions of a single real variable. Bishop (1967, p. 5) explains why this theorem cannot be proved in a constructive framework. In the context of constructive mathematics one cannot ﬁnd a value of the variable x for which f (x)Zc by the method of bisection, because being able to evaluate f (x)Kc with arbitrary accuracy does not imply that one can determine whether it is positive or negative. Slight modiﬁcations of the intermediate value theorem are, however, valid constructively. If f : ½a; b/ R is continuous and f (a)!c!f (b) then, given 3O0, 1

If one uses the Goldbach conjecture, for example, then one puts anZ0, if 2n may be written as the sum of two primes, and anZ1 if it cannot. Phil. Trans. R. Soc. A (2005)

2452

E. B. Davies 10

5

0

–5 – 1.0

– 0.5

0

0.5

1.0

1.5

Figure 1. Graph of the function f (x) deﬁned by equation (3.1).

one can constructively ﬁnd x2(a, b) such that jf (x)Kcj!3. In addition the intermediate value theorem itself may be proved constructively under a mild extra condition on f (being locally non-constant), which is almost always satisﬁed. See Bishop & Bridges (1985) and Bridges (1998). We explain the differences between the classical and constructive versions of the intermediate value theorem by means of two examples, one ersatz and one genuine. Let f ðxÞ Z logð1 C x 45 Þ;

ð3:1Þ

on (K1, 1) (ﬁgure 1). Given the formula, it is evident that the only solution of f (x)Z0 is xZ0, but one would need to calculate to very high accuracy to determine from its numerical values that the function is not identically zero throughout the interval (K1/4, 1/4). However, many digits one uses in the numerical computation, a similar difﬁculty arises if one replaces 45 by a larger number. In applied situations a closed formula is frequently not available, and the above problem may be a pressing one. A genuine example presenting exactly the same difﬁculties is obtained as follows. Let 8 x C 1 if x %K1; > < gðxÞ Z 0 if K1! x ! 1; > : x K1 if 1% x: Then one cannot constructively solve g(x)Zc if c is an extremely small number for which one does not know whether cZ0, c!0 or cO0. Phil. Trans. R. Soc. A (2005)

2453

Pluralism in mathematics 100 90 80 70 60 50 40 30 20 10 0 –4

–3

–2

–1

0

1

2

3

4

Figure 2. Graph of the function p(x) deﬁned by equation (3.2) with 3Z0.01.

In constructive mathematics every non-negative continuous function on a closed bounded interval has a non-negative inﬁmum; Bishop (1967, p. 35) provides a procedure for computing this with arbitrary accuracy. This does not imply that one can always determine whether the minimum is zero or positive, nor does it imply that one can ﬁnd a point at which the inﬁmum is achieved. Both can be a serious problem in numerical analysis as well. If 3O0 is sufﬁciently small it is difﬁcult to show purely numerically that the polynomial pðxÞ Z x 4 K2p2 x 2 C p4 C 3ðx K2Þ2 ;

ð3:2Þ

never vanishes, and also difﬁcult to determine whether its minimum value occurs near xZp or xZKp. For functions arising in applied mathematics that are not given by explicit formulae this can again be a serious problem (ﬁgure 2). The suggestion that classical mathematics takes priority over constructive mathematics because of the Putnam–Quine argument about the indispensability of the former in the physical sciences are not convincing, for reasons spelled out in Davies (2003a,b). The differences between the two systems are unimportant from the point of view of physicists; this is why Newton, Laplace, Maxwell and other scientists were able to develop very successful mathematically based theories long before the real number system was formalized at the end of the nineteenth century. Hellman has tried to put some ﬂesh on the Putnam–Quine argument in several recent papers, in which he claims that there are no constructive versions of some key results in mathematical physics. We start with Hellman (1993a), which deals with Gleason’s theorem, considered by some (but not the author of this paper) to be of considerable importance in the foundations of quantum theory. This concerns the (non-distributive) lattice L of closed subspaces of a Hilbert space H Phil. Trans. R. Soc. A (2005)

2454

E. B. Davies

of dimension greater than two. In this lattice the analogues of set-theoretic complements are orthogonal complements. Gleason’s theorem states that if m is a normalized, countably additive measure on L in a suitable sense, then there exists a non-negative, self-adjoint operator S on H with trace 1 such that mðLÞ Z traceðSPL Þ; for all L2L, where PL is the orthogonal projection with range L. Hellman showed that a different version of Gleason’s theorem cannot be proved in constructive mathematics. Nevertheless, Gleason’s original version of the theorem, stated above, is constructively valid; see Richman & Bridges (1999) and Richman (2000). The difference between the two versions relates to the validity of the principal axes theorem, discussed below. In Hellman (1993b), the author showed that one version of the spectral theorem for unbounded self-adjoint operators is not constructively valid. However, in his original book Bishop (1967, p. 275) had already proved a different version, for a commuting sequence of bounded self-adjoint operators, which is completely acceptable even to classical mathematicians. After Hellman’s paper appeared, Ye (1998) published a constructive version of the spectral theorem for an unbounded self-adjoint operator. Hellman’s focus on the issue of domains and unboundedness is misguided because an unbounded operator becomes bounded as soon as one makes its domain into a Banach space by endowing it with the graph norm qﬃﬃﬃﬃﬃﬃﬃﬃﬃﬃﬃﬃﬃﬃﬃﬃﬃﬃﬃﬃﬃﬃﬃﬃﬃﬃﬃﬃ jkf jk Z kf k2 C kAf k2 : The difﬁculty of determining whether a vector lies in the domain of an unbounded self-adjoint operator is not just a problem for constructivists. The classical theory progressed much more rapidly after it was realized that it was sufﬁcient to specify an explicit domain of essential self-adjointness (a so-called ‘core’ of the operator) or even a core for the associated quadratic form; see Davies (1980). A considerable amount is now known about the spectral theory of whole classes of differential operators whose domains cannot be identiﬁed as standard function spaces; see, for example, Davies (1989). The principal axes theorem is the classical result that every self-adjoint matrix has a complete orthonormal set of eigenvectors. The theorem is not constructively valid, for good reasons: the eigenvectors may change extremely rapidly as a parameter passes smoothly through a critical value. We invite the reader to check this for the elementary example 3 s As Z ; s K3 where 3Z10K100 and s passes through the value 0. The classical version of the spectral theorem provides no insight into the existence of these computational problems, and does not suggest how they might be overcome. One can understand such problems in classical terms, but the constructive approach provides a systematic framework for doing so. Finally in Hellman (1998) the author showed that the Hawking–Penrose singularity theorem is not constructively valid. This is an interesting Phil. Trans. R. Soc. A (2005)

Pluralism in mathematics

2455

observation, since the theorem has been extremely inﬂuential in the subject. It is embarrassing for a radical constructivist but not for a pluralist. It remains extremely hard to say much about the nature of the singularities: one certainly cannot identify them as black holes without the beneﬁt of a ‘cosmic censorship hypothesis’. It is very likely that any detailed classiﬁcation of the singularities will also be constructively valid. The constructive version of the Hahn–Banach theorem in Bishop (1967, p. 263) applies to normable linear functionals, and Bishop needs to distinguish these from the more general bounded linear functionals. The following example explains why. Take the sequence a deﬁned above using the digits of p and put bnZ1 if anZ1 and also amZ0 for all m!n; otherwise put bnZ0. The sequence b identiﬁes the ﬁrst occurrence of a thousand consecutive sevens in the decimal expansion of p, if such a sequence exists. Classically b2l 2(N ) but constructively we cannot assert this (in 2004), because we are not able to evaluate kbk2 with arbitrary accuracy. Even if we were assured that a sequence of a thousand consecutive sevens existed, we would still not be able to place b in l 2(N ) constructively unless we were given some information about how large n had to be for bnZ1.2 Nevertheless the formula fðcÞ Z

N X

cn bn ;

nZ1

is constructively well deﬁned for all c2l 2(N ) and deﬁnes a bounded linear functional f on l 2(N ). A linear operator A on a Banach space B is said to be bounded if there exists a constant c such that kAxk%ckxk for all x2B. Its norm is the smallest such constant if that exists. The constructive distinction between bounded and normable operators is related to the fact that there is no effective classical algorithm for determining the norms of bounded operators on most Banach spaces. This is why ﬁnding the best constants for various Sobolev embeddings in Lp spaces and other operators of importance in Fourier analysis has occupied mathematicians for decades. The same problem occurs for large ﬁnite matrices— standard software packages only provide routines for computing the norm of a sufﬁciently large n!n matrix with respect to the l p norm on Cn for pZ1, 2, N.

4. Computer-assisted mathematics Over the last 30 years a number of famous problems in pure mathematics have been solved by methods that conform entirely to the standards of classical mathematics, except for the fact that they involve a large amount of computation. Because it may not be well known to this audience, I will concentrate on the increasing use of controlled numerical methods to prove completely rigorously the 2

Taken literally this sentence is non-sensical. Classically, there is no problem in asserting that b2l 2(N ). Constructively, one could not be given an assurance about the existence of n for which bnZ1 without also being given the relevant information about how large n had to be. This is a familiar problem when one tries to compare two incommensurate frameworks. Phil. Trans. R. Soc. A (2005)

2456

E. B. Davies

existence of, and describe, the solutions of various problems in analysis. Interval arithmetic provides a new version of ﬁnite arithmetic. It has an ancient history, but is slowly becoming more important in connection with computer-assisted proofs of theorems in analysis. See Moore (1979), Markov & Okumura (1999), Plum (2001), Plum & Wieners (2002), Breuer et al. (2003) and Interval Computations Web-Site (2004) for some of the many applications. Its basic entities may be written in the form x Z 1:24706304 296 e3; where one imposes some upper bound on the number of signiﬁcant digits allowed. where The interpretation of this expression is as the interval x Z ½x; x xZ1247.062 96 and x Z 1247:063 04, but the deﬁnitions of the basic operations of arithmetic on the entities do not depend logically upon this intuition, nor upon any commitment to the existence of the real number system. To add two entities one adds the lower bounds and then rounds down to the prescribed number of digits, and also adds together the two upper bounds and rounds up to the prescribed number of digits. If one ignores the rounding procedure then uCvZw where w Z u C v; w Z u C v: The deﬁnition of multiplication is similar, but more complicated. One puts uvZw where u v; uvg; w Z minfuv; uv; u v; uvg: w Z maxfuv; uv; One identiﬁes an integer n with the interval [n, n] and writes uwv if the two intervals overlap, i.e. if vg: maxfu; vg% minfu; One puts xO0 if xO 0, and x!0 if x ! 0; if neither of these holds then xw0. One might deﬁne p in the system by p w3:141 592 6543 , without commitment to the existence of an ‘exact’ value. In interval arithmetic ðx K1Þ2 wx 2 K2x C 1; but the two are not equal. One needs to choose the right way of evaluating an expression to minimize the width of the interval produced. In interval arithmetic the standard functions such as sin, log, etc. take intervals to intervals. The programming languages have to be fairly subtle to achieve this. For example when obtaining sinð½1:57; 1:58Þ 4½0:999 957; 1; the programming language must take into account the fact that 1.57!p/2! 1.58. There is no requirement for the initial interval to be small. Thus cosð½0; 2Þ 4½K0:416 147; 1: A systematic description of interval arithmetic has been completed, and programming languages using it are readily available. It allows a rigorous Phil. Trans. R. Soc. A (2005)

Pluralism in mathematics

2457

approach to global optimization and makes a small but vital contribution to the solution of certain well-known, nonlinear, elliptic, partial differential equations. See Plum (2001), Plum & Wieners (2002), Breuer et al. (2003) and references there. In these papers the authors start by searching for approximate solutions on an experimental basis. They then prove various analytical results which establish that one can use a contraction mapping principle to prove the existence of true solutions close to the approximate solutions, provided certain inequalities hold. Finally, they verify the inequalities rigorously using interval arithmetic. It seems clear that this approach to nonlinear PDEs will expand rapidly over the coming decades. Those of us who feel uneasy about computer assisted proofs will either have to come to terms with them, or assign an ever-increasing fraction of their subject to a new category. Computers are fallible in different ways from mathematicians, but both are subject to veriﬁcation by a variety of methods. In the case of computer-assisted proofs these range from formal proofs of correctness to the writing of independent programs, which are then run on machines with different operating systems. Absolute certainty is a chimera in both contexts, as the classiﬁcation of the ﬁnite simple groups and the solution of Kepler’s sphere packing problem have shown. Journal editors are struggling to come to terms with this situation. In the author’s opinion they should state in each problematical case exactly what degree of conﬁdence they have in each part of a very complex proof. This will provide the best information for future generations to assess whether they wish to rely upon the result and if not, which parts need further attention. Programs should probably be archived for reference, if this is practically possible, but the checking of badly written programs will never be as convincing as the production of better ones.

References Billinge, H. 2003 Did Bishop have a philosophy of mathematics? Phil. Math. 11, 176–194. Bishop, E. 1967 Foundations of constructive analysis. New York: McGraw-Hill. Bishop, E. & Bridges, D. 1985 Constructive analysis. Grundlehren der mathematischen Wissenschaft, vol. 279. Heidelberg: Springer. Breuer, B., McKenna, P. J. & Plum, M. 2003 Multiple solutions for a semilinear boundary value problem: a computational multiplicity proof. J. Differ. Equations 195, 243–269. (doi:10.1016/ S0022-0396(03)00186-4.) Bridges, D. 1998 Constructive truth in practice. In Truth in mathematics (ed. H. G. Dales & G. Olivieri), pp. 53–69. Oxford: Clarendon Press. Bridges, D. & Luminit¸a, V. 2003 Apartness spaces as a framework for constructive topology. Ann. Pure Appl. Logic 119, 61–83. (doi:10.1016/S0168-0072(02)00033-7.) Carnap, R. 1950 Empiricism, semantics, and ontology. Rev. Int. Phil. 4, 20–40. [See also Supplement to ‘Meaning and necessity: a study in semantics and modal logic‘, enlarged edition. Chicago: University of Chicago Press, 1956.] Davies, E. B. 1980 One-parameter semigroups. LMS Monographs, vol. 15. London: Academic Press. Davies, E. B. 1989 Heat kernels and spectral theory. Cambridge Tracts in Mathematics, vol. 92. Cambridge: Cambridge University Press. Davies, E. B. 2003a Empiricism in arithmetic and analysis. Phil. Math. 11, 53–66. Phil. Trans. R. Soc. A (2005)

2458

E. B. Davies

Davies, E. B. 2003b Quantum mechanics does not require the continuity of space. Stud. Hist. Phil. Mod. Phys. 34, 319–328. (doi:10.1016/S1355-2198(03)00003-0.) Davies, E. B. 2004 A defence of pluralism in mathematics. Preprint. Available at http://philsciarchive.pitt.edu/archive/00001681. Hellman, G. 1993a Gleason’s theorem is not constructively provable. J. Phil. Logic 22, 193–203. (doi:10.1007/BF01049261.) Hellman, G. 1993b Constructive mathematics and quantum mechanics: unbounded operators and the spectral theorem. J. Phil. Logic 22, 221–248. (doi:10.1007/BF01049303.) Hellman, G. 1998 Mathematical constructivism in space-time. Br. J. Phil. Sci. 49, 425–450. (doi:10. 1093/bjps/49.3.425.) Interval Computations Web-Site 2004 http://www.cs.utep.edu/interval-comp/main.html. Markov, S. & Okumura, K. 1999 The contribution of T. Sunaga to interval analysis and reliable computing. In Developments in reliable computing (ed. T. Csendes), pp. 167–188. Dordrecht: Kluwer. Moore, R. E. 1979 Methods and applications of interval analysis. Philadelphia: SIAM. Plum, M. 2001 Computer-assisted enclosure methods for elliptic differential equations. Lin. Alg. Appl. 324, 147–187. (doi:10.1016/S0024-3795(00)00273-1.) Plum, M. & Wieners, C. 2002 New solutions of the Gelfand problem. J. Math. Anal. Appl. 269, 588–606. (doi:10.1016/S0022-247X(02)00038-0.) Richman, F. 2000 Gleason’s theorem has a constructive proof. J. Phil. Logic 29, 425–431. (doi:10. 1023/A:1004791723301.) Richman, F. & Bridges, D. 1999 A constructive proof of Gleason’s theorem. J. Funct. Anal. 162, 287–312. (doi:10.1006/jfan.1998.3372.) Ye, F. 1998 On Errett Bishop’s constructivism—some expositions, extensions and critiques. Ph. D. thesis, Princeton University.

Discussion D. B. A. EPSTEIN (Department of Mathematics, University of Warwick, UK). We could use the symbol (backwards capital E with outline and hollow inside) ‘hollow exists’ for classical (backwards E), and (backwards E) for constructive (backwards E). E. B. DAVIES. Yes, suggestions of this type have been made. Your proposal, with its judgemental overtones, is more likely to be received well by a constructivist than by a classical mathematician! The problem with trying to amalgamate the two frameworks in this way is that once one gets more deeply into the two approaches, one ﬁnds them proceeding on divergent paths, particularly in subjects using set theory heavily, such as topology. My guess is that one would eventually have to use distinguishing fonts for so many concepts that the proposal would be counterproductive. Even if this were not the case, may I make an analogy with English and French? One could regard them as a single language in which words that we now regard as translations of each other are considered instead to be synonyms, possibly with different shades of meaning. Would this actually help anything? D. B. A. EPSTEIN. Moe Hirsch suggests a half-life for the truth of theorems or rather one’s degree of belief. If it has not been reproved or re-used, then one’s degree of belief decreases and eventually vanishes. Phil. Trans. R. Soc. A (2005)

Pluralism in mathematics

2459

E. B. DAVIES. This is a different issue, but nevertheless an important one. Mathematicians value theorems more highly if they have connections with other results than if they are totally isolated. In spite of their commitment to proofs being true or false as they stand, mathematicians appear to like theories that have highly redundant logical structures. It seems that they do not wholly trust their ability to avoid error when following a long logical argument—and there is quite a lot of historical evidence that they should not trust proofs that have not been conﬁrmed by some independent evidence. Such a statement would not be regarded as controversial in any experimental subject, but many mathematicians do not like to admit that it also applies to their own subject. J. M. NEEDHAM (Department of Computer Science, University of Bath, UK). How do you propose to run the classical world and the constructive world side by side? E. B. DAVIES. I do not personally think this is a fundamental problem. When I play chess I manage to remember that its rules are different from those of checkers, and when I study vector spaces I remember which theorems only work in ﬁnite dimensions and which generalize to inﬁnite dimensions. I manage to remember that the standard form of remainder in Taylor’s theorem does not work for complex-valued functions. If one wants to remember another distinction then one can. Of course it is easier if one does this from the beginning rather than when one is older. A valuable guideline is that if one has a classical proof that provides a stable procedure for computing the answer, then it almost surely has a constructive analogue. I would stress that the classical and constructive worlds are indeed different—one is not discussing ‘the real numbers’ and arguing about whether some proof about them is acceptable. One is studying two different entities that have similar but different properties. One might compare the integers as a classical mathematician thinks about them and the integers as treated in a typical computer program. In both cases addition leads to a deﬁnite result, but for very large integers the computer’s output might be an inﬁnity or error symbol. We consider that one system is right and the other is wrong, but that is because we consider that the computer is trying to implement our ideas and not fully succeeding in doing so. In the case of classical versus constructive mathematics no such judgement is possible. E. B. DAVIES (additional comment). Those working in and promoting constructive mathematics are well accustomed to hearing comments to the effect that there is no evidence that it has any contributions to make to ‘real mathematics’. A few remarks are worth making about this. In some ﬁelds, such as algebraic geometry, this may well be true, but that does not mean that it is bound to be equally true in others. Nobody would (or should) claim that constructive analysis leads to the routine solution of difﬁcult problems. Highly original ideas often enable one to solve problems that were previously intractable, and this will remain the case whether one uses classical or constructive methods. One of my goals was to persuade people to move beyond the commonplace view that classical mathematics is somehow ‘right’ and other approaches thereby ‘wrong’. Phil. Trans. R. Soc. A (2005)

2460

E. B. Davies

The areas in which constructive mathematics does provide valuable insights are those close to numerical analysis and other ﬁelds in which the existence of explicit estimates is of the essence. In these subjects a number of ordinary working mathematicians have found that an awareness of constructive mathematics helps them to understand the nature of the problems that they are facing better.

Phil. Trans. R. Soc. A (2005)

Phil. Trans. R. Soc. A (2005) 363, 2461 doi:10.1098/rsta.2005.1659 Published online 12 September 2005

Abstracts of additional presentations made at the Royal Society Discussion Meeting ‘The nature of mathematical proof ’

Social processes and mathematical proof in mathematics & computing: a quarter-century perspective By Richard Lipton Georgia Institute of Technology, Atlanta, GA, USA Twenty-ﬁve years ago we (DeMillo, Lipton, Perlis) wrote a paper on how mathematics is a ‘social process’. In particular, real proofs are tested and checked by a complex social process. One of the consequences of our position is that it is unlikely that real computer systems can or will ever be proved correct. The core of the argument is a careful examination of the difference between formal proofs and real proofs. In this talk I will present the main argument that we made. Actually, the changes in modern computer technology make it even more applicable today than twenty-ﬁve years ago.

Machine computation and proof By Robert D. MacPherson School of Mathematics, Institute for Advanced Study, Princeton, NJ, USA In 1609, Kepler made a beautiful conjecture about spheres in space. It was one of the oldest unsolved problems in mathematics. In 1998, Tom Hales produced a brilliant computer-assisted proof of the Kepler conjecture. By now, the theoretical part of Hales’ proof has been refereed as usual mathematical papers are, but the parts involving the computer have resisted all efforts at checking by humans. Should we think of the Kepler conjecture proved? This talk will examine various aspects of this story and the questions it raises, from the point of view of a practicing mathematician.

One contribution of 13 to a Discussion Meeting Issue ‘The nature of mathematical proof’.

2461

q 2005 The Royal Society

RSTA_363_1835.qxp

9/20/05

6:53 PM

Page 3

Neuroeconomics (Philosophical Transactions of the Royal Society series B)

The Neurobiology of Social Recognition, Attraction and Bonding (Philosophical Transactions of the Royal Society series B)

Cultural Transmission and the Evolution of Human Behaviour (Philosophical Transactions of the Royal Society series B)

Scientific Discourse in Sociohistorical Context: The Philosophical Transactions of the Royal Society of London, 1675-1975 (Rhetoric, Knowledge, and Society)

The Nature of Mathematical Proof (Philosophical Transactions of the Royal Society A)

Neuroeconomics (Philosophical Transactions of the Royal Society series B)

Transactions of the American Philosophical Society

Evolution of Society (Philosophical Transactions of the Royal Society series B)

The Neurobiology of Social Recognition, Attraction and Bonding (Philosophical Transactions of the Royal Society series B)

Cultural Transmission and the Evolution of Human Behaviour (Philosophical Transactions of the Royal Society series B)

Mechanisms and Functions of Brain and Behavioural Asymmetries (Philosophical Transactions of the Royal Society series B)

The Sapient Mind: Archaeology Meets Neuroscience (Philosophical Transactions of the Royal Society B)

Babylonian Horoscopes (Transactions of the American Philosophical Society)

Isaiah Berlin's Counter-Enlightenment (Transactions of the American Philosophical Society)

The nature of philosophical inquiry

Scientific Discourse in Sociohistorical Context: The Philosophical Transactions of the Royal Society of London, 1675-1975 (Rhetoric, Knowledge, and Society)

Rationality and Emotions (Philosophical Transactions of the Royal Society series B)

Evolution and Human Behavioural Diversity (Philosophical Transactions of the Royal Society series B)

Culture Evolves (Philosophical Transactions of the Royal Society series B) issue 1567

Group decision making in humans and animals (Philosophical Transactions of the Royal Society series B)

Social intelligence: from brain to culture (Philosophical Transactions of the Royal Society B)

Cultural and Linguistic Diversity: Evolutionary Approaches (Philosophical Transactions of the Royal Society series B)

Cooperation and Deception: From Evolution to Mechanisms (Philosophical Transactions of the Royal Society series B)

The Logic of Society: A Philosophical Study

The Proof is in the Pudding: The Changing Nature of Mathematical Proof

The Proof is in the Pudding: The Changing Nature of Mathematical Proof

The Nature of Mathematical Modeling

The nature of mathematical modeling

The nature of mathematical thinking

The Nature of Mathematical Knowledge

The Nature of Mathematical Knowledge

The moment of proof: mathematical epiphanies

The Moment of Proof: Mathematical Epiphanies

The Moment of Proof: Mathematical Epiphanies

The Nature of Consciousness: Philosophical Debates

The Nature of Mathematical Proof (Philosophical Transactions of the Royal Society A)

Neuroeconomics (Philosophical Transactions of the Royal Society series B)

Transactions of the American Philosophical Society

Evolution of Society (Philosophical Transactions of the Royal Society series B)

The Neurobiology of Social Recognition, Attraction and Bonding (Philosophical Transactions of the Royal Society series B)

Cultural Transmission and the Evolution of Human Behaviour (Philosophical Transactions of the Royal Society series B)

Mechanisms and Functions of Brain and Behavioural Asymmetries (Philosophical Transactions of the Royal Society series B)

The Sapient Mind: Archaeology Meets Neuroscience (Philosophical Transactions of the Royal Society B)

Babylonian Horoscopes (Transactions of the American Philosophical Society)

Isaiah Berlin's Counter-Enlightenment (Transactions of the American Philosophical Society)

The nature of philosophical inquiry

Scientific Discourse in Sociohistorical Context: The Philosophical Transactions of the Royal Society of London, 1675-1975 (Rhetoric, Knowledge, and Society)

Rationality and Emotions (Philosophical Transactions of the Royal Society series B)

Evolution and Human Behavioural Diversity (Philosophical Transactions of the Royal Society series B)

Culture Evolves (Philosophical Transactions of the Royal Society series B) issue 1567

Group decision making in humans and animals (Philosophical Transactions of the Royal Society series B)

Social intelligence: from brain to culture (Philosophical Transactions of the Royal Society B)

Cultural and Linguistic Diversity: Evolutionary Approaches (Philosophical Transactions of the Royal Society series B)

Cooperation and Deception: From Evolution to Mechanisms (Philosophical Transactions of the Royal Society series B)

The Logic of Society: A Philosophical Study

The Proof is in the Pudding: The Changing Nature of Mathematical Proof

The Proof is in the Pudding: The Changing Nature of Mathematical Proof

The Nature of Mathematical Modeling

The nature of mathematical modeling

The nature of mathematical thinking

The Nature of Mathematical Knowledge

The Nature of Mathematical Knowledge

The moment of proof: mathematical epiphanies

The Moment of Proof: Mathematical Epiphanies

The Moment of Proof: Mathematical Epiphanies

The Nature of Consciousness: Philosophical Debates

Recommend Documents