## How to Believe a Machine-Checked Proof (1997)

Citations: | 27 - 1 self |

### BibTeX

@MISC{Pollack97howto,

author = {Robert Pollack},

title = {How to Believe a Machine-Checked Proof},

year = {1997}

}

### OpenURL

### Abstract

### Citations

1624 | The Definition of Standard ML
- Milner, Tofte, et al.
- 1990
(Show Context)
Citation Context ... a proof, and cannot easily use proofs developed by other proof tools for HOL. A concrete suggestion: the three-level approach. LCF style uses two-levels, with a computational meta-language (e.g. SML =-=[MTH90]-=-) in which a proof checker for an objectlevel logic is programmed. Strong typing of the meta language is seen to guarantee that access to the atomic proof constructors of the object logic is safely co... |

716 | A framework for defining logics - Harper, Honsell, et al. - 1993 |

442 | Foundations of Constructive Analysis
- Bishop
- 1967
(Show Context)
Citation Context ... about operations of human consciousness, there are some things we can say about human beliefs. 2.1 Truth If God has mathematics of his own that needs to be done, let him do it himself. Errett Bishop =-=[Bis67] We have n-=-o access to truth in either formal or informal mathematics; the way things "really are", with the natural numbers for example. For me this is neither a deep claim nor a serious limitation on... |

320 | Lambda-calculus notation with nameless dummies: a tool for automatic formula manipulation with application to the Church-Rosser theorem
- Bruijn
- 1972
(Show Context)
Citation Context ...n discussed example of a notion that is hard to reason about formally is binding, and there are many representations in the literature. Variable names [CF58] are the naive approach. De Bruijn indexes =-=[dB72]-=-, inspired by needs of machine implementation, are also convenient for formal reasoning in many applications. Even simpler is higher order abstract syntax (HOAS) [PE88] as used in ELF and Isabelle. Bu... |

311 |
Higher-order abstract syntax
- Pfenning, Elliott
(Show Context)
Citation Context ...ive approach. De Bruijn indexes [dB72], inspired by needs of machine implementation, are also convenient for formal reasoning in many applications. Even simpler is higher order abstract syntax (HOAS) =-=[PE88]-=- as used in ELF and Isabelle. But HOAS doesn't naturally support structural induction, and sometimes it is desired to formalize expressions with names, since this is what people use. A new and interes... |

295 | A logic programming language with lambda-abstraction, function variables, and simple unification
- Miller
(Show Context)
Citation Context ...y strong higher-order logic as its meta-logic, and uses higherorder unification inside its safe kernel; we might want a weaker meta-logic and a simpler kernel (perhaps using Miller's fi 0 unification =-=[Mil91]-=-). Second, Isabelle supports derivable rules, but not admissible rules of object logics [Pol95]. The three-level approach places few restrictions on the object logic. A different approach is reflectio... |

294 | Every planar map is four colorable - Appel, Haken - 1989 |

273 |
Programming in Martin-Löf ’s Type Theory, an introduction
- Nordstrom, Petersson, et al.
- 1990
(Show Context)
Citation Context ...nabled precise and concrete presentations of large classes of formal systems [AHMP92]. I have in mind such frameworks 4 as the Edinburgh Logical Framework (ELF) [HHP93, Gar92], Martin-Lof's framework =-=[NPS90], Feferman-=-'s FS 0 [Fef88, MSB93], -prolog [NM88] and Isabelle [Pau94]. By "concrete presentation" I mean faithful to particular representation; all of these frameworks have been implemented as compute... |

221 |
Combinatory Logic
- Curry, Feys
- 1958
(Show Context)
Citation Context ...perations on base representation numbers. An often discussed example of a notion that is hard to reason about formally is binding, and there are many representations in the literature. Variable names =-=[CF58]-=- are the naive approach. De Bruijn indexes [dB72], inspired by needs of machine implementation, are also convenient for formal reasoning in many applications. Even simpler is higher order abstract syn... |

202 |
Melham, editors. Introduction to HOL: A Theorem Proving Environment for Higher Order Logic
- Gordon, F
- 1993
(Show Context)
Citation Context ... checker that we can believe is correct just by reading and understanding some of its code. The prototypical way to do this is using the "LCF style" of proof checker construction, such as us=-=ed in HOL [GM93]-=-. HOL afficionados might argue that HOL is suitable for both constructing proofs, because of it's tactic language and rich library of available tactics, and for independently checking them to attain b... |

141 |
Isabelle: A Generic Theorem
- Paulson
- 1994
(Show Context)
Citation Context ...systems [AHMP92]. I have in mind such frameworks 4 as the Edinburgh Logical Framework (ELF) [HHP93, Gar92], Martin-Lof's framework [NPS90], Feferman's FS 0 [Fef88, MSB93], -prolog [NM88] and Isabelle =-=[Pau94]. By "-=-;concrete presentation" I mean faithful to particular representation; all of these frameworks have been implemented as computer programs, and can be used as primitive proof checkers for any forma... |

110 |
An algorithm for testing conversion in type theory
- Coquand
- 1991
(Show Context)
Citation Context ... it represents expressions only up to alpha conversion (as with de Bruijn indexes, HOAS, and another alternative [Sat83]). A more intensional approach, using parameters and variables, is suggested in =-=[Coq91] and forma-=-lized in [MP93, Pol94]. As just suggested, these representations are not all "isomorphic": a presentation of type theory using de Bruijn indexes has different theorems than one using paramet... |

109 |
Social processes and proofs of theorems and programs
- MILLO, LIPTON, et al.
- 1979
(Show Context)
Citation Context ...pilers (for the same language), running on different operating system/cpu platforms is inconcievable. This is discussed further in section 3.2 1.2 Related work The prototypical paper on this topic is =-=[DLP79], whe-=-re it is argued that "Mathematical proofs increase our confidence in the truth of mathematical statements only after they have been subjected to the social mechanisms of the mathematical communit... |

104 |
Probabilistic algorithms
- Rabin
- 1976
(Show Context)
Citation Context ...er. Such approaches involve random choices (coin tosses), but it is still necessary to apply the rules of the system correctly. For a well-known example, using Rabin's algorithm for primality testing =-=[Rab76]-=- requires much less computation to test primality of very large numbers than conventional methods, but the probability bounds don't hold if you make mistakes in multiplication! In this paper I propose... |

90 | The semantics of reflected proof - Allen, Constable, et al. - 1990 |

85 | Using Typed Lambda Calculus to Implement Formal Systems on a Machine
- Avron, Honsell, et al.
- 1992
(Show Context)
Citation Context ...me sense 4.1 Formal systems for feasible checking Work on logical frameworks, which are used as formal meta-theories, has enabled precise and concrete presentations of large classes of formal systems =-=[AHMP92]. I h-=-ave in mind such frameworks 4 as the Edinburgh Logical Framework (ELF) [HHP93, Gar92], Martin-Lof's framework [NPS90], Feferman's FS 0 [Fef88, MSB93], -prolog [NM88] and Isabelle [Pau94]. By "con... |

77 | An approach to systems verification - Bevier, Hunt, et al. - 1989 |

69 | The Theory of LEGO: A Proof Checker for the Extended Calculus of Constructions
- Pollack
- 1994
(Show Context)
Citation Context ...s to avoid duplicate work. This idea is used in Huet's Constructive Engine [Hue89]; an abstract explanation and machine-checked proof of correctness of this transformation on type systems is given in =-=[Pol94]-=- section 4.4.10. Another common technique for improving efficiency of checking a formal system is annotation of judgements so that a full derivation of a judgement can be mechanically constructed from... |

68 | An intuitionistic theory of types
- Martin-Löf
- 1998
(Show Context)
Citation Context ...to find the common substructures, but some formal systems duplicate work in such a uniform way that we can give an alternative system that shares some common substructures by construction. Martin-Lof =-=[Mar71]-=- gives an algorithm for type synthesis in his impredicative system (now calleds) that transforms official derivations to avoid duplicate work. This idea is used in Huet's Constructive Engine [Hue89]; ... |

59 | Metatheory and reflection in theorem proving: a survey and critique - Harrison - 1995 |

53 | Five axioms of alpha conversion - Gordon, Melham - 1996 |

33 | A mechanisation of name-carrying syntax up to alpha-conversion - Gordon - 1994 |

26 |
The constructive engine
- Huet
- 1989
(Show Context)
Citation Context ...f [Mar71] gives an algorithm for type synthesis in his impredicative system (now calleds) that transforms official derivations to avoid duplicate work. This idea is used in Huet's Constructive Engine =-=[Hue89]-=-; an abstract explanation and machine-checked proof of correctness of this transformation on type systems is given in [Pol94] section 4.4.10. Another common technique for improving efficiency of check... |

24 | Finitary Inductively Presented Logics - Feferman - 1988 |

24 | Formalized mathematics - Harrison - 1996 |

22 | Representing Logics in Type Theory - Gardner - 1992 |

20 | Pretopologies and completeness proofs
- Sambin
- 1995
(Show Context)
Citation Context ...terest in the Type Theory community. Persson [Per96] describes the formalization of a completeness theorem for intuitionistic first-order logic, using formal topological models as suggested by Sambin =-=[Sam95]-=-. Coquand [Coq] proposes a program of proof-theoretic analysis of non effective arguments using formal topological models. Such problems seemed infeasible for Constructive Type Theory until this appro... |

19 |
The death of proof
- Horgan
- 1993
(Show Context)
Citation Context ... At the moment you find an error, your brain may disappear because of the Heisenberg uncertainty principle, and be replaced by a new brain that thinks the proof is correct. Leonid A. Levin, quoted in =-=[Hor93]-=- Everyone has had the experience of understanding and believing a proof at one time, and seeing an error in it at a later time. After such an experience, you must accept that it might happen again. Th... |

16 | Experience with FS0 as a framework theory - Matthews, Smaill, et al. - 1993 |

15 | The Four-Color Problem and Its Philosophical Significance”, The - Tymoczko - 1979 |

14 | Metalogical frameworks II: Using reflected decision procedures. Unpublished Manuscript - Aitken, Constable, et al. |

13 |
Pure Type Sytems formalized
- McKinna, Pollack
- 1993
(Show Context)
Citation Context ... As long as your favorite definition can be shown to be appropriately related to other definitions in the formal literature, you can use existing results. 6 For example, compare the thinning lemma in =-=[MP93]-=-, which is close to the informal statement, with that in [Bar95], where explicit variable lifting is required. Even what I have said about new and different representations for mathematical notions is... |

12 | Coq en coq. Rapport de Recherche 3026 - Barras - 1996 |

11 |
Recording HOL proofs
- Wong
- 1993
(Show Context)
Citation Context ... missing: the current implementation of HOL doesn't actually store or write out the official proof that is constructed by expanding all the tactics, although this is also under study by the HOL group =-=[Won93]-=-. Without this feature, a reader cannot use other, independent checkers for the HOL logic to increase confidence in a proof, and cannot easily use proofs developed by other proof tools for HOL. A conc... |

9 |
The Crisis in Finite Mathematics: Automated Reasoning as Curse and Cure
- Slaney
- 1994
(Show Context)
Citation Context ... standard approach in tasks such as computing many digits of �� . A proposal similar to the present paper ("verify the proofs rather than the programs which produce them") is made, in le=-=ss detail, in [Sla94]-=-. There has been much discussion recently of the possibility and desirability of carrying out formal mathematics [Boy94, Har96]. The present paper addresses many points necessary to carry out such a p... |

8 |
An overview of Lambda-PROLOG
- Nadathur, Miller
- 1988
(Show Context)
Citation Context ...e classes of formal systems [AHMP92]. I have in mind such frameworks 4 as the Edinburgh Logical Framework (ELF) [HHP93, Gar92], Martin-Lof's framework [NPS90], Feferman's FS 0 [Fef88, MSB93], -prolog =-=[NM88] and Isabe-=-lle [Pau94]. By "concrete presentation" I mean faithful to particular representation; all of these frameworks have been implemented as computer programs, and can be used as primitive proof c... |

8 |
Theory of Symbolic Expressions
- Sato
- 1985
(Show Context)
Citation Context ...approach meets these needs [Gor93, GM96]. However useful this approach turns out to be, it represents expressions only up to alpha conversion (as with de Bruijn indexes, HOAS, and another alternative =-=[Sat83]). A more -=-intensional approach, using parameters and variables, is suggested in [Coq91] and formalized in [MP93, Pol94]. As just suggested, these representations are not all "isomorphic": a presentati... |

7 | On extensibility of proof checkers
- Pollack
- 1995
(Show Context)
Citation Context ...o that proof tool. These are programs to compute derivations in the underlying formal system; e.g. derivable or admissible rules of the official logic, or searches for derivations which may fail (see =-=[Pol95]-=-). For example, many proof tools will support some kind of tautology checking and some kind of equality rewriting. Crucially, there is no need for you to understand any of the tactics or heuristics in... |

6 |
Coq en Coq
- Barras
- 1996
(Show Context)
Citation Context ...iately related to other definitions in the formal literature, you can use existing results. 6 For example, compare the thinning lemma in [MP93], which is close to the informal statement, with that in =-=[Bar95]-=-, where explicit variable lifting is required. Even what I have said about new and different representations for mathematical notions is too restricted. We can look for entirely new ways to do mathema... |

5 | Intensional aspects of function definitions - Fredholm - 1995 |

5 | Probabilistic proof systems (A survey
- Goldreich
- 1994
(Show Context)
Citation Context ...blistic proofs A red herring sometimes arises (e.g. [DLP79]): since all proof is uncertain, why not abandon deterministic notions of proof in favor of probabilistic proof. Probabilistic proof systems =-=[Gol94]-=- can be much more powerful than their deterministic counterparts. While they carry a probability of error, this probability is explicitly bounded, and can be reduced to any desired positive number. Su... |

5 | Trustworthy storage and exchange of theorems
- Grundy
- 1996
(Show Context)
Citation Context ...logic" causes experts in the field to roll on the floor with laughter. However, alternative suggestions such as using cryptographic means to certify that a theorem has been checked by some proof =-=tool [Gru96] break the-=- primary abstraction: the only way a proof checker can accept a theorem as proved is to actually check a proof of it. It is necessary to restrict the notion of "proof checking program" to pr... |

4 |
How reliable is a computer-based proof
- Lam
- 1990
(Show Context)
Citation Context ...ty to operate on formal proofs, namely independent checking. Independent checking is not a new idea. It has been discussed in terms of increasing confidence in computer-based enumerative search (e.g. =-=[Lam90], see sec-=-tion 2.2 below). It is considered the standard approach in tasks such as computing many digits of �� . A proposal similar to the present paper ("verify the proofs rather than the programs whi... |

3 | A Mechanically Proof-Checked Encyclopedia of Mathematics: Should We Build One? Can We - Boyer - 1994 |

2 | Strict finitism and feasibility - Cardone - 1995 |

2 |
Formal topology and constructive type theory, Talk at Twenty Five Years of Constructive Type Theory
- Coquand
- 1995
(Show Context)
Citation Context ...e Theory community. Persson [Per96] describes the formalization of a completeness theorem for intuitionistic first-order logic, using formal topological models as suggested by Sambin [Sam95]. Coquand =-=[Coq]-=- proposes a program of proof-theoretic analysis of non effective arguments using formal topological models. Such problems seemed infeasible for Constructive Type Theory until this approach was develop... |

1 | ic Colson. Repr'sentation Intentionnelle d'Algorithmes dans les Syst`ems Fonctionnels: Une ' tude de Cas - Lo - 1991 |

1 |
Semantics of first order languages in type theory. In preparation for Licenciate Thesis
- Persson
- 1996
(Show Context)
Citation Context ... especially suited for formalization in particular formal systems. An example of this is the use of formal topological models that has recently received interest in the Type Theory community. Persson =-=[Per96]-=- describes the formalization of a completeness theorem for intuitionistic first-order logic, using formal topological models as suggested by Sambin [Sam95]. Coquand [Coq] proposes a program of proof-t... |

1 |
Algorithmic Proof Theory: Taking the Curry-Howard correspondence seriously
- Simmons
(Show Context)
Citation Context ...rom annotations. In an interesting formal system there is always some derivation that is too hard to check 5 This interesting way of viewing linear derivations was pointed out to me by Harold Simmons =-=[Simar]-=-. with any possible hardware and software. Nevertheless, in the context of independent checking of proofs, annotations solve an important problem: suppose I have constructed some proof in CC, using cl... |

1 |
System verification and the CLI stack
- Young
- 1995
(Show Context)
Citation Context ...onventional proofs are believed Verifying the platform It is sometimes suggested that we should verify the correctness of the proof-checking program, and of the software and hardware that supports it =-=[You95]-=-. Such a verification is another formal proof that has to be believed. Since any interesting computational platform is too complicated to believe directly, and the only tool we have for believing it i... |