## How to Believe a Machine-Checked Proof (1996)

Citations: | 26 - 1 self |

### BibTeX

@MISC{Pollack96howto,

author = {Robert Pollack},

title = {How to Believe a Machine-Checked Proof},

year = {1996}

}

### OpenURL

### Abstract

This paper presents a technological approach for reducing the problem of believing a formal proof to the same psychological and philosophical issues as believing a conventional proof in a mathematics journal. The approach is not entirely successful philosophically as there seems to be a fundamental difference between machine checked mathematics, which depends on empirical knowledge about the physical world, and informal mathematics, which needs no such knowledge (see section 3.2.2). In the rest of this introduction I outline the approach and mention related work. In following sections I discuss what we expect from a proof, add details to the approach, pointing out problems that arise, and concentrate on what I believe is the primary technical problem: expressiveness and feasibility for checking of formal systems and representations of mathematical notions.

### Citations

1598 | The Definition of Standard ML
- Milner, Tofte, et al.
- 1990
(Show Context)
Citation Context ... a proof, and cannot easily use proofs developed by other proof tools for HOL. A concrete suggestion: the three-level approach. LCF style uses two-levels, with a computational meta-language (e.g. SML =-=[MTH90]-=-) in which a proof checker for an objectlevel logic is programmed. Strong typing of the meta language is seen to guarantee that access to the atomic proof constructors of the object logic is safely co... |

707 | A framework for defining logics - Harper, Honsel, et al. - 1987 |

419 | Constructive Analysis
- Bishop, Bridges
- 1985
(Show Context)
Citation Context ... about operations of human consciousness, there are some things we can say about human beliefs. 2.1 Truth If God has mathematics of his own that needs to be done, let him do it himself. Errett Bishop =-=[Bis67] We have n-=-o access to truth in either formal or informal mathematics; the way things "really are", with the natural numbers for example. For me this is neither a deep claim nor a serious limitation on... |

310 | Lambda Calculus Notation with Nameless Dummies, A Tool for Automatic Formula Manipulation, with Application to the Church-Rosser Theorem
- Bruijn
- 1972
(Show Context)
Citation Context ...n discussed example of a notion that is hard to reason about formally is binding, and there are many representations in the literature. Variable names [CF58] are the naive approach. De Bruijn indexes =-=[dB72]-=-, inspired by needs of machine implementation, are also convenient for formal reasoning in many applications. Even simpler is higher order abstract syntax (HOAS) [PE88] as used in ELF and Isabelle. Bu... |

309 |
Higher-order abstract syntax
- Pfenning, Elliott
- 1988
(Show Context)
Citation Context ...ive approach. De Bruijn indexes [dB72], inspired by needs of machine implementation, are also convenient for formal reasoning in many applications. Even simpler is higher order abstract syntax (HOAS) =-=[PE88]-=- as used in ELF and Isabelle. But HOAS doesn't naturally support structural induction, and sometimes it is desired to formalize expressions with names, since this is what people use. A new and interes... |

290 | A logic programming language with lambda-abstraction, function variables, and simple unification
- Miller
- 1991
(Show Context)
Citation Context ...y strong higher-order logic as its meta-logic, and uses higherorder unification inside its safe kernel; we might want a weaker meta-logic and a simpler kernel (perhaps using Miller's fi 0 unification =-=[Mil91]-=-). Second, Isabelle supports derivable rules, but not admissible rules of object logics [Pol95]. The three-level approach places few restrictions on the object logic. A different approach is reflectio... |

283 | Every Planar Map is Four Colorable - Appel, Haken - 1989 |

266 |
Programming in MartinLöf’s Type Theory, an introduction
- Nordstrom, Petersson, et al.
- 1990
(Show Context)
Citation Context ...nabled precise and concrete presentations of large classes of formal systems [AHMP92]. I have in mind such frameworks 4 as the Edinburgh Logical Framework (ELF) [HHP93, Gar92], Martin-Lof's framework =-=[NPS90], Feferman-=-'s FS 0 [Fef88, MSB93], -prolog [NM88] and Isabelle [Pau94]. By "concrete presentation" I mean faithful to particular representation; all of these frameworks have been implemented as compute... |

214 |
Combinatory Logic
- Curry, Feys
- 1958
(Show Context)
Citation Context ...perations on base representation numbers. An often discussed example of a notion that is hard to reason about formally is binding, and there are many representations in the literature. Variable names =-=[CF58]-=- are the naive approach. De Bruijn indexes [dB72], inspired by needs of machine implementation, are also convenient for formal reasoning in many applications. Even simpler is higher order abstract syn... |

199 |
editors. Introduction to HOL: a theorem proving environment for higher order logic
- Gordon, Melham
- 1993
(Show Context)
Citation Context ... checker that we can believe is correct just by reading and understanding some of its code. The prototypical way to do this is using the "LCF style" of proof checker construction, such as us=-=ed in HOL [GM93]-=-. HOL afficionados might argue that HOL is suitable for both constructing proofs, because of it's tactic language and rich library of available tactics, and for independently checking them to attain b... |

138 |
Isabelle: A Generic Theorem
- Paulson
- 1994
(Show Context)
Citation Context ...systems [AHMP92]. I have in mind such frameworks 4 as the Edinburgh Logical Framework (ELF) [HHP93, Gar92], Martin-Lof's framework [NPS90], Feferman's FS 0 [Fef88, MSB93], -prolog [NM88] and Isabelle =-=[Pau94]. By "-=-;concrete presentation" I mean faithful to particular representation; all of these frameworks have been implemented as computer programs, and can be used as primitive proof checkers for any forma... |

109 |
An algorithm for testing conversion in type theory
- Coquand
(Show Context)
Citation Context ... it represents expressions only up to alpha conversion (as with de Bruijn indexes, HOAS, and another alternative [Sat83]). A more intensional approach, using parameters and variables, is suggested in =-=[Coq91] and forma-=-lized in [MP93, Pol94]. As just suggested, these representations are not all "isomorphic": a presentation of type theory using de Bruijn indexes has different theorems than one using paramet... |

105 |
Social Processes and Proofs of Theorems and Programs
- Millo, Lipton, et al.
- 1979
(Show Context)
Citation Context ...pilers (for the same language), running on different operating system/cpu platforms is inconcievable. This is discussed further in section 3.2 1.2 Related work The prototypical paper on this topic is =-=[DLP79], whe-=-re it is argued that "Mathematical proofs increase our confidence in the truth of mathematical statements only after they have been subjected to the social mechanisms of the mathematical communit... |

100 |
Probabilistic algorithms
- Rabin
- 1976
(Show Context)
Citation Context ...er. Such approaches involve random choices (coin tosses), but it is still necessary to apply the rules of the system correctly. For a well-known example, using Rabin's algorithm for primality testing =-=[Rab76]-=- requires much less computation to test primality of very large numbers than conventional methods, but the probability bounds don't hold if you make mistakes in multiplication! In this paper I propose... |

92 | Reasoning with higher-order abstract syntax in a logical framework - McDowell, Miller - 2002 |

90 | The Semantics of Reflected Proof - Allen, Constable, et al. - 1990 |

83 | Using typed lambda calculus to implement formal systems on a machine
- Avron, Honsell, et al.
- 1992
(Show Context)
Citation Context ...me sense 4.1 Formal systems for feasible checking Work on logical frameworks, which are used as formal meta-theories, has enabled precise and concrete presentations of large classes of formal systems =-=[AHMP92]. I h-=-ave in mind such frameworks 4 as the Edinburgh Logical Framework (ELF) [HHP93, Gar92], Martin-Lof's framework [NPS90], Feferman's FS 0 [Fef88, MSB93], -prolog [NM88] and Isabelle [Pau94]. By "con... |

75 | An approach to systems verification - Bevier, Hunt, et al. - 1989 |

71 | Edinburgh LCF: A Mechanized Logic - Gordon, Milner, et al. |

69 | The Theory of LEGO: A Proof Checker for the Extended Calculus of Constructions
- Pollack
- 1994
(Show Context)
Citation Context ...s to avoid duplicate work. This idea is used in Huet's Constructive Engine [Hue89]; an abstract explanation and machine-checked proof of correctness of this transformation on type systems is given in =-=[Pol94]-=- section 4.4.10. Another common technique for improving efficiency of checking a formal system is annotation of judgements so that a full derivation of a judgement can be mechanically constructed from... |

66 | An intuitionistic theory of types
- Martin-Löf
- 1998
(Show Context)
Citation Context ...to find the common substructures, but some formal systems duplicate work in such a uniform way that we can give an alternative system that shares some common substructures by construction. Martin-Lof =-=[Mar71]-=- gives an algorithm for type synthesis in his impredicative system (now calleds) that transforms official derivations to avoid duplicate work. This idea is used in Huet's Constructive Engine [Hue89]; ... |

58 | Metatheory and Reflection in Theorem Proving: A Survey and Critique - Harrison - 1995 |

54 | Five axioms of alpha-conversion - Gordon, Melham - 1996 |

49 | The notion of proof in hardware verification - Cohn - 1989 |

33 | A mechanisation of name-carrying syntax up to alpha-conversion - Gordon - 1994 |

25 |
The constructive engine
- Huet
- 1989
(Show Context)
Citation Context ...f [Mar71] gives an algorithm for type synthesis in his impredicative system (now calleds) that transforms official derivations to avoid duplicate work. This idea is used in Huet's Constructive Engine =-=[Hue89]-=-; an abstract explanation and machine-checked proof of correctness of this transformation on type systems is given in [Pol94] section 4.4.10. Another common technique for improving efficiency of check... |

25 | The Machine-Assisted Proof of Programming Language Properties - VanInwegen - 1996 |

24 | Finitary inductively presented logics - FEFERMAN - 1989 |

24 | Formalized Mathematics - Harrison - 1996 |

22 | Mistakes and ambiguities in the definition of Standard ML - Kahrs - 1993 |

21 | Representing Logics in Type Theory - Gardner |

19 |
Pretopologies and completeness proofs
- Sambin
- 1995
(Show Context)
Citation Context ...terest in the Type Theory community. Persson [Per96] describes the formalization of a completeness theorem for intuitionistic first-order logic, using formal topological models as suggested by Sambin =-=[Sam95]-=-. Coquand [Coq] proposes a program of proof-theoretic analysis of non effective arguments using formal topological models. Such problems seemed infeasible for Constructive Type Theory until this appro... |

18 |
The death of proof
- Horgan
- 1993
(Show Context)
Citation Context ... At the moment you find an error, your brain may disappear because of the Heisenberg uncertainty principle, and be replaced by a new brain that thinks the proof is correct. Leonid A. Levin, quoted in =-=[Hor93]-=- Everyone has had the experience of understanding and believing a proof at one time, and seeing an error in it at a later time. After such an experience, you must accept that it might happen again. Th... |

17 | Error correcting codes, perfect hashing circuits, and deterministic dynamic dictionaries - Miltersen - 1998 |

16 | Experience with FS0 as a framework theory - Matthews, Smaill, et al. - 1993 |

14 | Metalogical frameworks II: Using reflected decision procedures. Unpublished Manuscript - Aitken, Constable, et al. |

13 |
Pure Type Sytems formalized
- McKinna, Pollack
- 1993
(Show Context)
Citation Context ... As long as your favorite definition can be shown to be appropriately related to other definitions in the formal literature, you can use existing results. 6 For example, compare the thinning lemma in =-=[MP93]-=-, which is close to the informal statement, with that in [Bar95], where explicit variable lifting is required. Even what I have said about new and different representations for mathematical notions is... |

13 | The Four-Color Problem and Its Philosophical Significance”, The - Tymoczko - 1979 |

11 | Coq en Coq. Rapport de Recherche 3026 - Barras - 1996 |

10 |
Recording HOL proofs
- Wong
- 1993
(Show Context)
Citation Context ... missing: the current implementation of HOL doesn't actually store or write out the official proof that is constructed by expanding all the tactics, although this is also under study by the HOL group =-=[Won93]-=-. Without this feature, a reader cannot use other, independent checkers for the HOL logic to increase confidence in a proof, and cannot easily use proofs developed by other proof tools for HOL. A conc... |

9 |
The Crisis in Finite Mathematics: Automated Reasoning as Curse and Cure
- Slaney
- 1994
(Show Context)
Citation Context ... standard approach in tasks such as computing many digits of �� . A proposal similar to the present paper ("verify the proofs rather than the programs which produce them") is made, in le=-=ss detail, in [Sla94]-=-. There has been much discussion recently of the possibility and desirability of carrying out formal mathematics [Boy94, Har96]. The present paper addresses many points necessary to carry out such a p... |

9 | Constructive completeness of Intuitionistic Predicate Logic: A formalization in Type theory - Persson - 1996 |

7 |
An overview of lambda-prolog
- Nadathur, Miller
- 1988
(Show Context)
Citation Context ...e classes of formal systems [AHMP92]. I have in mind such frameworks 4 as the Edinburgh Logical Framework (ELF) [HHP93, Gar92], Martin-Lof's framework [NPS90], Feferman's FS 0 [Fef88, MSB93], -prolog =-=[NM88] and Isabe-=-lle [Pau94]. By "concrete presentation" I mean faithful to particular representation; all of these frameworks have been implemented as computer programs, and can be used as primitive proof c... |

7 | On extensibility of proof checkers
- Pollack
- 1995
(Show Context)
Citation Context ...o that proof tool. These are programs to compute derivations in the underlying formal system; e.g. derivable or admissible rules of the official logic, or searches for derivations which may fail (see =-=[Pol95]-=-). For example, many proof tools will support some kind of tautology checking and some kind of equality rewriting. Crucially, there is no need for you to understand any of the tactics or heuristics in... |

7 |
Theory of Symbolic Expressions
- Sato
- 1985
(Show Context)
Citation Context ...approach meets these needs [Gor93, GM96]. However useful this approach turns out to be, it represents expressions only up to alpha conversion (as with de Bruijn indexes, HOAS, and another alternative =-=[Sat83]). A more -=-intensional approach, using parameters and variables, is suggested in [Coq91] and formalized in [MP93, Pol94]. As just suggested, these representations are not all "isomorphic": a presentati... |

7 | Finitary Inductively Presented Logics, in: Logic Colloquium - Feferman - 1988 |

6 |
Coq en Coq
- Barras
- 1996
(Show Context)
Citation Context ...iately related to other definitions in the formal literature, you can use existing results. 6 For example, compare the thinning lemma in [MP93], which is close to the informal statement, with that in =-=[Bar95]-=-, where explicit variable lifting is required. Even what I have said about new and different representations for mathematical notions is too restricted. We can look for entirely new ways to do mathema... |

5 | Intensional aspects of function definitions - Fredholm - 1995 |

5 | Probabilistic proof systems (A survey
- Goldreich
- 1994
(Show Context)
Citation Context ...blistic proofs A red herring sometimes arises (e.g. [DLP79]): since all proof is uncertain, why not abandon deterministic notions of proof in favor of probabilistic proof. Probabilistic proof systems =-=[Gol94]-=- can be much more powerful than their deterministic counterparts. While they carry a probability of error, this probability is explicitly bounded, and can be reduced to any desired positive number. Su... |

5 | Trustworthy storage and exchange of theorems
- Grundy
- 1996
(Show Context)
Citation Context ...logic" causes experts in the field to roll on the floor with laughter. However, alternative suggestions such as using cryptographic means to certify that a theorem has been checked by some proof =-=tool [Gru96] break the-=- primary abstraction: the only way a proof checker can accept a theorem as proved is to actually check a proof of it. It is necessary to restrict the notion of "proof checking program" to pr... |