I think I've figured out where Mario and I were talking past each other
yesterday. MMOM as currently implemented is something that can parse a totally
arbitrary character sequence into something resembling a metamath database with
a list of errors, then spit it out again. This was imagined for the use case
of a database editing program that could load corrupt databases and fix them
with the MMOM resources. But I see now that that isn't necessary; it would be
quite sufficient to declare that when a corrupt database is parsed, there is
either no MMOM output, or a degraded output that cannot be used for
editing/saving. The interactive repair tool could still work, it would just
have to use the parser output for annotations and then have you edit the file
at the character level.
The question remains of exactly what constraints are required to hold at all
times by MMOM. At this point I would definitely like MMOM editing databases to
always consist of a sequence of syntactically valid statements; and I would
also like it to be possible for invalid proofs to exist in an in-memory
database, because requiring all proofs to be valid at all times is probably
unnecessarily constraining for editing programs and unnecessarily
time-consuming to check.
As such, my current proposal follows:
D. Add the obvious missing analyzers (Outline, MathTypesetting, MathParser,
Tracebacks, I missing any you want?). Write some toys using this (eg: a script
to convert set.mm to Polish notation).
E. Open a discussion concerning expanded proof representations (which is a
different subject from the gross database representation discussed here).
On Sun, Jun 14, 2015 at 01:35:51AM -0400, Mario Carneiro wrote:
> > D. Add the obvious missing analyzers (Outline, MathTypesetting, MathParser,
> > Tracebacks, I missing any you want?). Write some toys using this (eg: a
> > script
> > to convert set.mm to Polish notation).
> >
>
> This should include anything needed to make the HTML output in principle.
> In particular, I would want theorem numbers matching the HTML output and
> optionally the metamath.exe numbers as well.
This can be done. BTW, one I thought of after posting that was
DefinitionalSoundness; do you have a writeup of the tests that need to be done
for that anywhere?
> Since you are writing in JS, it should not be difficult to use eval() to
> enable a "Turing-complete user script language". The only thing needed then
> is a decent API for accessing, adding, removing steps (and of course a step
> viewer of some sort, probably similar to the .mmp file format / HTML proof
> output).
I'm not sure what the context of the request for a step viewer is. I'd
eventually like to rewrite MPE as client-side javascript using smm, but it
sounds like you have another application in mind?
> uses token arrays for step contents and metamath uses arrays for
> everything, which is why your 'evil' example crashed them.) I don't know if
> you have worked on parsing formulas yet; in general it can be a hard
I haven't started the code yet but I've worked out out in my head (weeks ago) a
design for a statement parser that should be relatively simple and extremely
fast (set.mm's prefix unambiguity means that packrat parsers run in linear
time, and packrat parsers are "just code" so I can generate Javascript for them
at runtime to mitigate the cost of table lookups).
> problem but somehow mmj2 manages, while I think MM-PA sometimes gets
> confused here and has to ask the user to disambiguate. In addition to
> having better memory management asymptotics, it is also much easier to work
> with the tree representation for automatic proofs (although if possible a
> user script shouldn't need to specify syntax steps).
Yes, the "proof DOM" subsystem should hide the existance of syntax steps.
This, together with the requirement for a parser, limits us to tree-structured
languages, ie no miu.mm. I don't think this will be much of an issue in
practice.
What do you want to do about the configuration problem? The statement parser
needs to know that "wff", "class", and "set" are context-free classes, while
"|-" should always be parsed as a "wff". (I'm tentatively planning to add a $(
$smm {JSON-BLOB-HERE} $) comment to set.mm. Not sure what to do when I get to
"fonthtmldef", but that's a way off.)
But again, it makes a lot more sense to annotate these kinds of theorems directly in the file, rather than attempting to keep a separate list in my RunParms file (and this list doesn't get exported to other users, either). If I get the "preferred theorems" thing working correctly, this would allow us to unify an arbitrarily complicated substitution theorem all at once (although only for one variable at a time, so the justification theorems needed for the definition checker are still out of reach), or a complicated closure theorem (although only closure inferences, not deductions, unless we add mulcld-type theorems, which don't yet exist except for recnd - I've been investigating which theorems of this type would be the most useful, but I don't have any specific plans yet).Hi Norm,The other feature, which does not yet exist, but will be very useful if it is completed, is what I am calling for the moment "preferred theorems". These are theorems that will always unify immediately with steps if they can match the consequent. The theorems that this would be useful for things like mulcli, fveq2d, and the like, where the theorem is essentially the only one which is ever applied when it is applicable. This is not necessary for zero-hyp theorems, which are already used whenever applicable, but for theorems with one or more hyps there are usually many theorems that could apply, and even if we exclude theorems with no variables in the hypotheses that are not in the conclusion, there are lots of theorems like idi, notnotri, trud which apply to anything at all, or theorems like a1i that simplify the step, but probably not in the intended way most of the time.
Are there any "tags" that can be put in comments but would not show up in the HTML that mmj2 could parse for its own use? There are two features in mmj2 that could benefit from this. One, which already exists, is the ProofAsstUnifySearchExclude RunParm, which currently involves a list of labels that will be excluded from any unification searches. My list includes ax* type theorems, *OLDs, biigb and others that say "should not be referenced in any proof", but it would make a lot more sense to have this information stored directly in the file, perhaps as a second comment just before the HTML comment, like your TODO comments. The reason this concerns you is of course that it would involve modifications to the published version of set.mm, so I'm looking for what kinds of extended syntax would be acceptable to you.
Mario
On Sun, Jun 14, 2015 at 03:01:48AM -0400, Mario Carneiro wrote:
> On Sun, Jun 14, 2015 at 1:58 AM, Stefan O'Rear <stef...@cox.net> wrote:
> > This can be done. BTW, one I thought of after posting that was
> > DefinitionalSoundness; do you have a writeup of the tests that need to be
> > done
> > for that anywhere?
Question stands.
At some point, it would be nice to have a writeup of the algorithm(s)
you are using and what assumptions you are making, so that (1) a
mathematician can be convinced that the soundness checking is correct
and (2) an independent soundness checker could be written by someone
else.Actually, I'm not very happy with one particular part of the soundness checker, namely the free variable prover. The rest of it is fairly simple, but in order to show ( ph -> A. x ph ) for all the different syntax constructs requires a lot of reliance on mmj2's ability to derive proofs, although it should still err on the side of false positives, since if it is unable to do a certain proof it will pop the "possibly free" error. With Alexey's help, mmj2 has taken some great strides in being able to do complete proofs on its own, but it's not yet at the point where I can just hand it the justification theorem and ask it to prove it.
Here's an overview of the algorithm; the (error x) markings match the numbering code I-PA-020x:1. Suppose the definition after grammar parsing has structure "ax: [[...];syn, [...];defn];eq" where "[a,b,c];d" represents a syntax axiom d with three hypotheses a,b,c. Then eq is required to be wb or wceq (error 1).
2. Find the declaration of 'syn' in the file, and ensure that no axioms strictly between 'syn' and 'ax' have 'syn' in their parse trees, and 'defn' also does not have 'syn' in its parse tree (error 2).
3. Collect all the varhyps in the left side tree into 'parameters' and all the varhyps in the right side of the tree but not in 'parameters' into 'dummies'. For each pair of parameters, there is required not to be a DJ condition on those variables (error 3).
4. For each variable in 'dummies', there is required to be a DJ condition with each dummy and each parameter (error 4).5. If there are no dummies, stop processing and pass the test.6. Look for a justification theorem. Make an assignment map from each dummy to a variable of the same type which is not present in parameters or dummies or that was previously generated in this loop, and apply it to the tree defn to produce defn2. Now attempt to prove the assertion "[[...];defn, [...];defn2];eq". If successful, pass the test.
This is enough for a "technically correct" definition checker, but because mmj2 is not powerful enough to always prove the justification theorem, we try an alternative approach if we are not done yet.
7. If we still have not passed the test and there are non-set variables in 'dummies', fail the test (error 5). This is necessary because the next step has to assume that the variables are set variables.
8. For each dummy x, fail the test (error 6) if provablyBoundIn(defn, x) returns false, where provablyBoundIn is defined as:provablyBoundIn(tree: [children...];root, x):1. If children is empty, return (root = x);
2. If for all children, provablyBoundIn(child, x) is true, return true;3. Let tree2 = tree if tree is a wff expression and tree2 = [[y];cv, tree];wcel otherwise (when tree is a class expression), where y is a set variable not present in tree. Construct the tree [tree2, [x,tree2];wal];wi and attempt to prove it. Return true iff proof succeeds.
Your checker should give people a tremendous boost in the confidence in
Metamath as a rigorous tool for set theory, especially if there is an
unambiguous spec behind it. As I mentioned before, this has been a
"hole" that has made mathematicians uncomfortable with Metamath.The latter part of the algorithm makes me a bit worried, as I mentioned, but my goal with this project was something that could work on an unmodified version of set.mm and still be able to pass the majority of cases. I feel a bit constrained between this goal and the other goal of making an algorithm that is simple enough to be easily verified as correct by a mathematician, and indeed I only feel prepared enough to call the latter part a heuristic rather than a proof. If we required justification theorems, the latter part would not be needed, but it still seems like something that could be autogenerated by the verifier rather than worked into the Metamath spec itself. But it has caught a lot of bugs, so that is enough to satisfy me.
Ah. Having a proof assistant is still a bit down my TODO so I didn't catch
this at first.
> A while ago I asked Norm for permission to add a $j statement to the
> comment, but I never moved on the idea. I suggest that you take advantage
> of a mechanism like this, and smm and mmj2 can share the format. The syntax
> would look something like the $t comment; a $( $j line followed by a series
> of commands in some format. The RunParms format often requires long lines,
> and so is unsuitable - I would suggest a "keyword param param;" style like
> the $t commands. I'm forwarding our discussion below.
If this is to be the format used, then why have both comments? Just say that
statements within $t with unknown headwords are ignored.
(BTW, the metamath.pdf is not clear on precisely where white space is allowed
in the $t syntax.)
In retrospect, not requiring space before ';' seems oddly inconsistent
with everything else. I think it was just to make the spec conform to
existing practice. Perhaps I should change it to require a space?