There was a discussion initiated by James Frank in November last year on the Isabelle mailing list about problems with making mathematics formalized in HOL similar in notation and terminology to the standard (informal) mathematics. The main difficulty here is that standard mathematics uses set theory notation, so obviously something based on type theory has to look different. This lead to a discussion what might be the reasons of doing formalized mathematics in simply typed HOL rather than set theory. Josef Urban expressed the following opinion:

I do not think that there are good pragmatic automation-related reasons for persuading mathematicians to work in HOL instead of ZF. Given the very low penetration that formal mathematics has so far among mathematicians, I think it would not hurt the formal systems to go where the mathematicians are.

with which I fully agree.

In the same thread Steven Obua announced the ProofPeer project – a cloud-based social network interactive theorem proving system. (That is probably the the highest concentration of buzzwords in one sentence that I ever wrote.) The alpha launch is planned for summer 2012. He recently published a paper with more details about ProofPeer.

On the subject of types vs. sets as a foundation I recall a funny cartoon that I found on a LtU thread related to this.

Back in 2008 Freek Wiedijk wrote a nice article on “Formal Proof—Getting Started”. Here is my favorite part of it:

In mathematics there have been three main revolutions:

• The introduction of proof by the Greeks in the fourth century BC, culminating in Euclid’s Elements.
• The introduction of rigor in mathematics in the nineteenth century. During this time the nonrigorous calculus was made rigorous by Cauchy and others. This time also saw the development of mathematical logic by Frege and the development of set theory by Cantor.
• The introduction of formal mathematics in the late twentieth and early twenty-first centuries.

Frank Quinne’s article “A Revolution in Mathematics? What Really Happened a Century Ago and Why It Matters Today” in  the January issue of Notices of the AMS is devoted to the second revolution. Here is a quote:

As the transition progressed, the arguments became more heated but more confined. At the beginning traditionalists were deeply offended but not threatened. But because modern methods lack external checks, they depend heavily on fully reliable inputs. Older material was filtered to support this, and as the transition gained momentum some old theorems were reclassified as “unproved”, some methods became unacceptable for publication, and quite a few ways of looking at things were rejected as dangerously imprecise. Understandably, many eminent late nineteenth-century mathematicians were outraged by these reassessments.
Meanwhile, very high reliability has been achieved in mathematics without drawing attention or having significance attached to it. The axiomatic-definition approach also made mathematics more accessible. A century ago original research was possible only for the elite. Today it is accessible enough that publication is required for promotion at even modest institutions, and an original contribution can be required for a Ph.D.

It is striking for me how well this describes the situation with the third revolution. The analogy extends also to the sort of democratization of mathematics that machine verification makes possible.

Here, is the collection of neighborhoods of zero (sets whose interior contains the neutral element of the group), and for two sets we define as .

Also, I replaced jsMath with MathJax as the LaTeX rendering engine on the isarmathlib.org site. The results are very good, the math renders faster and it looks better. It forced me to do some Haskell programming again to modify the tool that parses Isar and generates HTML with LaTeX markup. I haven’t seen that code or programmed in Haskell for about two years, but with Leksah now in Ubuntu repositories it was rather easy: just modify the code in one place and keep fixing it until it builds. Once it built, it worked.

The tool will probably become obsolete after the next Isabelle release. There is a Google Summer of Code project that will allow generating nice HTML presentations of Isar theories from within Isabelle.

Another small piece of formal math that I added in this release is a chapter in the Topology_ZF_2 theory on the pasting lemma. The classical pasting lemma states that if we have two topological spaces, say and and we partition into two sets , both open (or both closed), and a function is continuous on both and , then is continuous. The version in IsarMathLib is bit different, stating that the collection of open sets forms a topology.
Surprisingly from this we can conclude that the empty set (which in ZF is the same as zero of natural numbers) is continuous. Here is how it happens: since the collection forms a topology, belongs to it, i.e. is continuous. But is in fact and we get that zero is continuous. Ha Ha.
I would like to emphasize that I do not consider facts like this as demonstrating that ZF set theory is not a suitable foundation for formalizing mathematics (as some people interpret). It is just fun and games that formal math allows and I am sure other foundations also have their unintuitive corner cases.

I am not actually completely sure that this is the first one. It has been online since June 2009 and I didn’t know about it, so it is quite possible that I missed some other one as well. Please tell me if this is the case. But for now I consider it the first ever.

Some of my hopes/predictions turned to be accurate. The wiki is not affiliated with any research institution. It is not financed by an EU grant, or any other taxpayer’s money redistribution mechanism. It does not promise to allow writing software that is free of bugs. It did not announce its existence to the world before it existed. Not that there would be anything wrong with all that, just that I didn’t consider it likely for a project that does any of this to succeed.

The proofs are  verified with JHilbert, written in Java by Alexander Klauer. JHilbert has been influenced by  Metamath, although its language is different.

There are a lot of things that I like about Wikiproofs. JHilbert is of Metamath descent and that means it is very generic. There are modules formulating  ZFC axioms of course, but there also things like geometry and complex numbers axioms. This brings memories from high school when I learned geometry by the axiomatic method (and  vice versa). The wiki uses my favorite style of interleaving the formal text with informal commentary, taking it a step farther than what I do in IsarMathLib by putting comments also inside proofs, not only between theorems. With MediaWiki one can illustrate geometry proofs with pictures.

So, will I contribute to wikiproofs.org? Six years ago I would definitely answer yes. Now, however, the answer is “probably not yet”.  After years of writing Isar proofs I have a clear view on what I need for fun proving:

1) I need a high-level language for structured proofs with  automation at least on the level provided by Isabelle/Isar.  Writing formal proofs is tedious and Metamath-style proofs are beyond of what I can bear. Creating a Metamath prover (rather than checker) that would allow to take larger steps in the proofs  is apparently a very difficult problem that nobody has been able to solve so far (am I wrong here?).

2) I need a readable presentation for my proofs so that I can hope they can be studied by someone who does not know the formal proof language. “Readable” here means just that: close enough to standard (informal) proofs that a person who can follow a detailed informal proof can follow also the formalized version of it without having first to study the proof language. This gives me  some justification in my own eyes of spending endless hours of crafting a formal proof of something that is proven by “clearly” keyword in the informal math.  Wikiproofs may some day have a more friendly presentation layer for formal text, I think there are no fundamental obstacles here.

The jEdit interface  (see the screenshot)  represents a new approach based on “continuous proving” concept. While I think it is very interesting technologically, it turned out extremely slow on my Athlon 64 1.8GHz with ony 512MB of RAM. Apparently all this proving in the background with keeping multiple versions of the document was just too much. It would be usable if it was possible to temporarily disable the continuous proving feature, but unfortunately this is not supported yet.

Isabelle2011jEdit interface

Then I turned to the latest I3P version 1.0.10 that supports Isabelle2011. This seems to be the best choice for me. The previous problems with Isabelle symbols display have been fixed. The interface is somewhat similar to ProofGeneral which makes it easier to get used to. The subscripts (Isabelle’s \<^isub> markup) are still not displayed, but this is also the case for the jEdit interface.

I3P v. 1.0.10

As for IsarMathLib, I released version 1.7.0. The release adds two theory files contributed by Victor Porton.

On a an unrelated topic, Mark Adams gave a good answer to the question “Why is is so difficult to write complete (computer verifiable) proofs?” posted on MathOverflow.The answer is an accurate description of the process of writing a formal proof. The only thing I disagree with is his opinion that “there are very few people in the world capable of doing this stage effectively for large proofs (perhaps just John Harrison, Tom Hales and Georges Gonthier)”, the stage being creating coherent formalisable  versions of standard proofs as found in math publications. It is indeed rather rare skill, but still there are hundreds of people who are able to effectively create large formal proofs, for any sensible definition of “effectively” and “large”. Those are people who contribute to Mizar, publish in the Archive of Formal Proofs or write extensive libraries for proof checkers that they created, like Norman Megill of Metamath or Rob Arthan of ProofPower.

In other news, Jeremy Bem is writing a “lightweight proof assistant based on standard set theory and Hindley-Milner type theory”. Layering type theory on top of untyped set theory seems to be popular these days – Sebastian Reichelt’s HLM is another very interesting example. HLM deserves a separate blog post which I hope to write soon.

Should the next generation of proof assistants be based on ZFC set theory?

Short answer: yes, of course. Long answer: no, why would we want to limit the proof assistant to one foundation? The next generation of proof assistants should be generic enough to be able to support many logics. Isabelle is like that now and so is Metamath. As the standard foundation for modern mathematics ZFC should be well supported, but alternatives my be interesting for purposes other than pure mathematics or just for experimentation.

Should the next generation of proof assistants have an advanced type system?

One possibility mentioned in the slides where types are a layer on top of an untyped foundation is probably the best idea. Having some type system would simplify proofs of facts about how set membership changes when functions are applied. In IsarMathLib proofs of such facts have to be done explicitly (using standard Isabelle’s apply_funtype lemma). It is not difficult but repetitive and boring.

Should the next generation of proof assistants take partiality seriously?

To be honest, I don’t understand the question. One remark however: I don’t think the statement is disprovable in Metamath as Wiedijk claims. In ZF set theory the situation is  that to define the value of a function at some point of its domain we first define what is the image of a set by a function. Having that we define the value of the function at  as the union of the image of . If is a function and is in its domain then the image is a singleton and the union extracts its only element (recall that in ZF). When is not in the domain of however, (like zero is not in the domain of division), the image of is empty and so is its union. Thus is the empty set, which is zero of natural numbers. So in a way, you can prove that (except that zeros on the right and left hand side are typically different things). I write some more about that in another post.

Should the next generation of proof assistants take category theory seriously?

Category theory can be done based on ZFC (with some additional axioms) and there is some work on formalization in Isabelle/HOL. However, the question is, can we treat category theory as foundation which we use to formalize mathematics?  I would really like someone to make a serious attempt at implementing category theory in some proof assistant starting from its axioms and proving some typical theorems. Both failure and success of doing so would be very instructive. Until that happens, my answer is no.

(Btw, there is an interesting discussion on Math Overflow about the role of the Replacement Axiom in category theory. Some people think it’s necessary, others find its consequences unacceptable. It seems that there is some overlap between those two sets (categories?) of people. This is similar to the situation with the Axiom of Choice in set theory some hundred years ago. )

Should the next generation of proof assistants be based on a logical framework?

Yes. The reasons are well explained on the slides.

Should the next generation of proof assistants have a self-verified kernel?

I don’t think it is essential. It would be good if the core system was short enough to be convincing to humans (like Metamath is) and possible to verify by hand. That is the important part. The self verification is not worth much – as Wiedijk notes “if it is incorrect it can falsely claim to be correct”. In addition, there is some design tension between building a system for doing formalized mathematics and software verification. These tasks are similar in theory, but quite different in practice from the user perspective. If we want a better proof assistant for formalized math (and I do), we don’t want the designers to focus on software verification.

Should the next generation of proof assistants be programmed in itself?

It would be better if it was not. The reasons are explained in the previous answer.

Should the next generation of proof assistants be competitive with commercial computer algebra?

Probably not. Maybe next after that.

Should the next generation of proof assistants use a declarative proof style?

Yes. But the most important is not how the proofs are written but how they look like after being processed by the presentation layer. I think this is the killer app for formalized mathematics: having a faithful semantic representation of mathematical knowledge in a machine that can be studied by humans. “No mystery” hyperlinked proofs that can be searched, viewed at desired level of detail and refactored. Imagine the possibilities.

How should the next generation of proof assistants be arrived at?

Better question is how can they be arrived at. I don’t know the answer. Such things typically come from academia. The problem is that the products of  Computing Science departments (where the knowledge necessary to create the NGoPA is)  are biased towards software verification, thus can not improve in the “better match with existing mathematical culture” area. Mathematics departments are simply not interested in formalized mathematics.

I have a fantasy sometimes that a very rich person just throws a large amount of money at the problem for pure love of mathematics. Something like that did happen for poetry, so why not for formalized mathematics?

The changes in the new version are related mostly to HOL. There is a small change in naming of some environment variables, so I released IsarMathLib 1.6.10 to make sure the library checks out of the box by typing “isabelle make”. This IsarMathLib version contains no new formalized mathematics.

Isabelle2009-2 contains “the preliminary Isabelle/jEdit application demonstrates the emerging Isabelle/Scala layer for advanced prover interaction and integration”. Here is a screenshot of the editor showing TopologicalGroup_ZF theory.

The new jEdit based Isabelle interface

The display of the Isabelle math symbols is flawless. The subscripts (\<^isub> in source) are not displayed though.

I was unable to use this as an actual interface to Isabelle. When I select “Plugins/Isabelle/Activate current buffer” the colors change somewhat. From the ps output it seems that Isabelle process starts, but there is some kind of failure in lib/scipts/feeder.pl. I couldn’t do anything else. I didn’t try too hard though.

Following the Isabelle release a new version of the I3P interface was relesed as well. There is some improvement in rendering math symbols possibly because of improvement in the Isabelle font. However the display of symbols is still not reliable. Some symbols (like \<tau>) are rendered correctly in some places but not others. Some, like \<langle> and \<rangle> are not displayed at all. This is not a problem with Isabelle fonts as the jEdit based interface displays those symbols correctly. The subscripts are also not rendered as such.

One of the interesting aspects of this story is the difference in attitude between the authors of the Notices article. The first author (called Au1) is a professor of political science at a leading U.S. university and the second (Au2) is an associate professor of mathematics. While Au2 was kind of receptive to criticism, Au1 idea was blame everything on Hill’s “misconceptions and misinterpretations”.
To me it looks like an example of clash of cultures between mathematics and humanities. While truth in mathematics is more objective, in humanities it is more of a matter of position in hierarchy. Au1 probably considers days when someone might effectively tell him he is wrong as long gone. Such clashes will happen more often as softer sciences become more mathematicised.

This is a Formalized Mathematics blog so I have to mention that of course such things can not happen when proofs are written in a formal proof language. I don’t want to defend Au1 but you can’t really say that a theorem is wrong if it is not clear what it says. When formalized mathematics becomes more popular similar clashes between the standards of truth will occur. Formalizers will be pointing errors in romantic math proofs and soft mathematicians won’t understand the problems.

There is a part missing in Hill’s story. Everybody makes mistakes in romantic math and one may be curious what Professor Hill does when someone finds an errror in his paper. I am in position to add that missing part. When I was a graduate student at The University of Tennessee I found such mistake in an article published in Proceedings of AMS by T. Hill and M. Spruill. When I notified them they sent an erratum to the publisher with all possible acknowlegments and thanks. So they did what they should. But in fact they did much more than that. Ted Hill invited me to Georgia Tech to give a talk on related subjects. As I was facing the prospect of a job search in near future it was an important opportunity to advertise my research. After the talk we went to an all-you-can-eat sushi bar and that was great. It was there when my fiance (now wife) started to accept that certain kinds of arthropods are edible and even tasty. So, my advice to every math graduate student: read Ted Hill’s papers very carefully and try to find a mistake. If you manage, you will have an opportunity to meet a remarkable person.

For me the lack of proper display of mathematical symbols and subscripts is a show stopper. You can’t write mathematics without that. I hope that will be resolved soon and I3P will be an excellent replacement for ProofGeneral.

When I see a discussion like this I think how some seventy years ago a similar forum would discuss the idea that it would be possible and useful to do away with human computers and use machines to execute algorithms. There would be similar arguments about how you could not do that because to execute an algorithm one has to understand it first and machines can not uderstand anything. The art of designing algorithms would lose its beauty when the algorithms would have to be written in a machine language. And, due to a deep theoretical result called the “halting problem” we would have no way to know in advance if such algorithm would ever stop to produce a useful result.

It is easy to dismiss  Slasdot discussions and blame them on the general cluessness of the Slashdot crowd. However, I recently stumbled upon the text of a talk given by Chaitin at the University of Cordoba in November last year that completely puzzled me.

It has all the typical elements – a story of Hilbert’s dream to “formalize mathematics completely in such a way that there is an algorithm, a mechanical procedure, for checking whether or not a proof is correct” an how “Kurt Gödel showed that Hilbert’s project could never work”.

Chaitin knows what Gödel incompleteness theorems are about and is not afraid of computers, so I don’t understand why is he so confused about formalized mathematics. Some of the things he writes are really bizarre, like

Furthermore, they envision an official repository for formal proofs that have been put through this verification process. Proofs will have to be accepted by this repository to be used by the mathematics community; everything that has been formalized and checked will be there, in one place.

Sounds almost like a warning about a plot to create a world government.

Most annoying to me is his conviction that formalized math is somehow in opposition to creativity. He asks “is mathematics creative or is it mechanical?”. Well to me the answer is simple: creating a proof is creative, checking it is mechanical.

The process of creating formalized mathematics is similar to programming in that it consists of two phases: coming up with an idea for the proof (kind of like design in programming) and putting it in formalized form (implementation). In romantic math one stops at the first phase. I am sure that there are software designers who are unable to code, but I think being able to implement the design makes a better designer, not a less creative one. Similarly, I believe being able to write proofs in a formal language makes one a better mathematician.

Ok, I am done with Chaitin. On an unrelated subject, there is an interesting discussion on the Lambda the Ultimate blog/forum about similarities and differences between COQ and Isabelle. I especially like the following opinion by Steven Obua:

If you are proving a program to be correct, you actually don’t need your program to have an advanced type system at all (again: simple types are useful just for not needing to deal with raw sets), because you can express everything you want to say about this program in normal mathematical theorems.

This is what I think too. I prefer to program in statically typed languages. A good type system is a very useful and cheap substitution for formal verification. But if you could have the real thing (without types) there would be no need for types.