Re: [math-fun] Proof checking and program checking
I did a little of this stuff many years ago, mainly for software verification. The surprising thing is that many errors are caught during the process of preparing the material for verification, and almost none are caught during verification. This latter arises either because the specification is wrong in some respect (e.g., doesn't capture the concept precisely) or because the verification system is faulty, or because there aren't any errors left (hah!). At the time, there seemed to be general agreement that the process of specifying and verifying things (theorems, software, hardware) was valuable, but it was also extremely expensive and required a new class of experts. Automated theorem verification could become a new mathematical specialty, generating its own kind of complexity theorems and great unsolved problems. Hilarie
I like to present a conundrum facing this fine ambition as follows (see my "computist quiz" on the fun www.hackersdelight.org for more) ======== Define a predicate on positive integers (in Javaesque style): boolean isToad(int n) { return n==2 || n==frog(4,floor((n-1)/2),1,0)-1); } with the aid of the following helper method: int frog(int q, int r, int s, int t) { if (r<t) { return 0; } else if (r==t) { return 1; } else if (q==0) { return 0; } else { return frog(q,r,s+1,s+t) + frog(q-1,r-t,1,0); } } ======== Now we pose three queries, in increasing order of difficulty: 1. Which integers are toads? 2. Describe what the frog method does. 3. Can you explain why this code works? With these denouements: #1: Running the program, one quickly sees that the Toads are the primes. #2: After lots of tedious tracing, most programmers painfully realize the code is *not* doing some kind of division-by-subtraction. (What it *is* doing I'll leave as a puzzle for those inclined). #3: The explanation is essentially a fairly non-trivial theorem of Legendre. Automatically finding such a justification for the bald assertion "the predicate is true just if N is prime" seems implausible anytime soon. Worse, this may not even be asserted explicitly, but implicitly required as a lemma (such as if the predicate is called as a subroutine within larger programs). While the above example seems like a big jump to us, if we imagine a future of increasingly harder proofs, it would eventually become the norm, then a triviality. But this is really no different than zillions of other facts humans depend on unconsciously in verifying correctness. For example, we depend on knowing, without reproof, that if we add 1 to a variable it will get larger, that if we add an even number its oddness will be conserved, and so on. Admittedly artificial, but this illustrates just how wide the gap could be that we may implicitly be asking a mechanism to fill, and how much is gained in human proofs by ready reference to "known" results--not just from citing them, but by being able to select the relevant ones and apply them aptly. ======== But, having said all that, I still think that there's something valuable in Henry Baker's suggestion. Surely leveraging our growing automation resources would be a good thing. I think the trick to making it successful will be to find a way to plug each piece into an ever-growing machinable context, (much as the web itself grows) rather than imagining each case in isolation, stranding some forlorn AI on a hard proof's desert island, provisioned with nothing more than some axioms and rules of inference.
Define a predicate on positive integers (in Javaesque style):
boolean isToad(int n) { return n==2 || n==frog(4,floor((n-1)/2),1,0)-1); }
But put a left-parenthesis just before "frog".
int frog(int q, int r, int s, int t) { if (r<t) { return 0; } else if (r==t) { return 1; } else if (q==0) { return 0; } else { return frog(q,r,s+1,s+t) + frog(q-1,r-t,1,0); } }
Can you explain why this code works? ... The explanation is essentially a fairly non-trivial theorem of Legendre.
Clever! I hadn't seen that theorem. But I have seen theorem 386 of Hardy&Wright (An Introduction to the Theory of Numbers). From that, I derive this similar program. int crow(int q, int r, int s, int t) { if (r < t) { return 0; } else if (r == t) { return 1; } else if (q == 0) { return 0; } else { int x = crow(q, r, s+1, s+s+1+t); if (t == 0) x *= 2; /* account for the negative thingies :-) */ return x + crow(q-1, r-t, 0, 0); } } boolean isLark(int n) { return n == (crow(4, n, 0, 0) / 8 - 1); } And I shall torture the dear reader in the same ways. 1. Which integers are larks? (Same as toads, of course.) 2. Describe what the Crow method does. 3. Explain why this code works. (The cited theorem should help.) -- Don Reble djr@nk.ca -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.
participants (3)
-
Don Reble -
Marc LeBrun -
The Purple Streak, Hilarie Orman