Interview With Turing-Award Winner Robin Milner

Martin Berger writes "Turing Award (1991) winner Robin Milner is one of the most influential computer scientists. He may not be as well-known as he deserves to be, but his research contributions are ubiquitous: he developed the first mathematically sound yet practical tool for machine assisted proof construction. This research has been continued successfully and led to many useful proof assistants such as HOL, Coq or Isabelle that are being used heavily for verification purposes today." Read on for more information about Milner, and a link to Berger's excellent interview with him. Berger continues "There is also a direct line from this strand of Milner's work to what may be one of the hottest topics in computer science: proof carrying code. Milner also headed the effort to develop ML (best known today by its descendant Ocaml), the first language to include polymorphic type inference together with type-safe exception-handling and module mechanisms. Most modern programming languages can trace some of their advanced features directly back to ML's pioneering efforts. Most of all, he established concurrency theory as a scientific field by creating and studying idealised concurrent programming languages like the Pi-Calculus. That calculus is becoming more and more influential in the design of new programming languages (for example Microsoft's XLANG) and the WWW infrastructure. A few weeks ago, I interviewed Milner. I wanted to find out about the man and the stories behind all this great research. I hope you find it as interesting as I do. The transcript of the interview can be found here."

Comments

So he's the one

[bsharitt]

So he's the reason I have to take so much calculus to be a computer programmer.

Re:So he's the one

[Jagasian]

First we should make the distinction between Integral Calculus and other calculi such as the pi-calculi and the lambda-calculi. The Integral Calculus can be categorized as continous math, while the pi and lambda calculi can be put under the label of "discrete math" as both pi and lambda calculi are term rewrite systems.

I am still trying to figure out why Integral Calculus is forced down everyone's throat. Computer Scientists are better off studying proof theory, axiomatic set theory, lambda-calculi, etc...

There are subfields within CS that make use of Integral Calculus... but most subfields of CS do not use it and instead use things like proof theory, set theory, etc.

One thing that you have to understand is that there are still people out there that think that "math" means numbers, and therefore sophisticated numerical math such as the Integral Calculus is crammed down everyone's throats. I think that for most people, a more conceptual math based on category theory or set theory or somesuch would be far more useful in the long run.

Re:So he's the one

[Com2Kid]

• I am still trying to figure out why Integral Calculus is forced down everyone's throat.

Because Differential/Integral Calculus makes up the basis of, well, everything. Understanding D&I Calculus has allowed me to grasp both concepts that I could sort of understand, but never really comprehend, and new ideas that have expanded my awareness of the world around me.

For starters, lines, curves, and surfaces, the very basics of geometrical mathematics, has differentials and integrals as a fundamental idea that surrounds it completely. As a person who enjoys doing 3D modeling and is currently hired as a writter of 3D tutorials, Calculus has enabled me to have such a deep understanding of the material that I am able to explain it to others with ease, including those who have not had calculus or even trig classes!

Second off, Calculus relates to Physics. Anyone can be taught to memorize Physics equations, but once you know calculus, you can derive them yourself! It is a far better feeling to have a good solid theoretical understanding of the material being covered rather than just saying "well this equation fits to the data decently well so it must be true."

The first, is a scientific mind set. The second is what a business major learns.

Continuing on the physics note, Calculus is used in an understanding of how the basic fundamentals of computers work. Being able to say "take the derivative of it here" and have it make sense, ah, a lovely thing. Hell, anytime you have units and notation being thrown around, Calculus can make itself handy. A lot of relationships in the natural world only show up if you understand what taking the differential or the integral of something does to its units.

Then there is Linear Algebra, which is VERY fundamental to computers. Matrixes are used throughout computers of all types and sizes, (with some limited exceptions, yes yes ), teaching Linear Algebra becomes far easier if the students are required to learn Calculus first. Heck everything becomes easier after Calculus is learned.

You are also ignoring that, at its heart, all mathematics are related. The more a person understands in any field of mathematics, the more they can learn in all other fields. Calculus forms an excellent base for more knowledge to be built upon, and even if sight of that base is (unfortunately) lost by the student over time, it still exists there as a foundation for all that the student has learned.

(That, and, quite frankly I found Calculus to be fun. :)

Re:So he's the one

[CharlesEGrant]

I am still trying to figure out why Integral Calculus is forced down everyone's throat. Computer Scientists are better off studying proof theory, axiomatic set theory, lambda-calculi, etc...

There are subfields within CS that make use of Integral Calculus... but most subfields of CS do not use it and instead use things like proof theory, set theory, etc

Most undergraduates do not have an accurate idea which field, let alone which subfield, they are going to end up in. The integral/differential calculus is a gateway topic. If you don't have it you've foreclosed study in many areas: physical sciences, numerical methods, probability and statistics, much of engineering, economics etc. I agree that the lambda calculus belongs in every CSci undergrad education, but lacking proof theory or axiomatic set theory closes very few doors, interesting topics though they may be.

In practice, the average CSci B.S. is going to end up writing database front ends for a business somewhere, so you could argue that all of these topics are academic and irrelevant. I just think that the first two years of college are too soon to drop out from so many areas of human knowledge.

Re:So he's the one

[CharlesEGrant]

You obviously know very little about computer science. How pray tell, does integral calculus have anything at all to do with the design of a programming language?

It is getting to be one of my pet peeves that folks take their little corner of computer science and presume it to be the whole thing. I think you are probably right: integral calculus is probably not a useful tool in the design of computer languages. However, this ignores the dozens of other subfields of computer science where the integral calculus is essential. Anything involving stochastic modeling is going to pull in probability theory, and you won't get far in probablility theory without the basics of integral/differential calculus. On top of this most programmers and computer scientists are using computers to solve some problem external to computer science. To understand many of those problems you will need the basics of integral/differential calculus.

Re:So he's the one

[AxelTorvalds]

I am still trying to figure out why Integral Calculus is forced down everyone's throat. Computer Scientists are better off studying proof theory, axiomatic set theory, lambda-calculi, etc...

I'm a CS and Math guy... to preface this opinion

Now it depends on the program and the school of thought. Anyone who's ever worked with a physicist in the tech business (they crop up from time to time) understands that the guys with the PhD in Phyiscs is almost always better than the guys with Masters in CS, it just works out that way. Physics and Calc are one in the same when you get through all the BS.

Everyone knows that physicists are better and so there is a desire to teach the tools that they use. That's just a theory I have, nothing to back it up other than everyone knows how Einstein was and everybody has an idea who Hawking is and nobody knows who Turing was or Euler was or Galois. If it wasn't for Russle Crowe a fair number of math geeks wouldn't know who Nash is... Copy what works.

Secondly, better programs tie it all together. You can start off simulataneously learning continuous calc and Zermelo set theory in a discrete class. Keep learning calc and more discrete. Then throw some linear algebra in and some abstract algebra and then right about that time one of them (the way I had it, it was a calc class) goes into the throes of a mathgasm and proves Euler's formula, using discrete math and calc both and kind of ties the whole thing together (because after you've learned all the different methods of integrations you're spending a lot of time doing what a class mate of mine called "that big E shit" with additive and multiplicitive series...) If all goes well you'll be wondering what's the true "key to math" at about this time and it's kind of like having God whisper in to your ear when you see how it all links up. I think proving a lot of the linear algebra stuff is substantially easier if you have calc as a tool. Then you continue on and prove all of the calc stuff using the set theory that you had been building up, take a few more calc courses doing diffeqs, partials and calc in 3d which is all mostly mechanical at that point and then after all of that you do whatever the hell you want in math. I think most of the stuff in typical stats classes is very difficult to prove without calc.

The link between linear algebra, abstract algebra and discrete math is pretty easy to see as you're doing it. The bridge between discrete and continuous math is a bit more complex but it's really undeniable when you see it.

Ok, here we go

[October_30th]

"He may not be as well-known as he deserves to be, but his research contributions are ubiquitous"

Now that just makes feel so much more confident about his work...

How do we know?

[guacamolefoo]

How do we know that the interview is with the Turing Award winner? Maybe the interview was just with a computer?

GF.

Obligatory disclaimer for the Comic Book Guys out there:
I know, I know -- the Turing Prize isn't the Loebner Prize. It's the day before a holiday -- give it a rest and laugh a little.

Still a male-dominated industry...

[Space cowboy]

Coq and Isabelle are used heavily "for verification purposes" today. ... poor old Isabelle... Give a girl a break!

Simon.

remember MegaHAL

[DarklordSatin]

Mention of the Turing Award brings back memories of all the fun times we had with MegaHAL (http://megahal.sourceforge.net/). We set up a machine in my local dorm kitchen and our MegaHAL rapidly became a horrible swearing bigot; it provided endless amusement for all.

Re:Formal proofs?

[heironymouscoward]

You're an ignorant bastard and you should RTFA instead of spouting your half-cooked opinions.

(Help, moderators, mod me "-1 Insane in the membrain", I'm flaming myself!)

Re:Turing Award winner? Is this a mistake?!

[Jonathan]

The Turing Award has nothing to do with the Turing Test. It's just an award given by a major computer science association (the ACM) to people that they consider to have significantly advanced the field.

http://www.acm.org/awards/taward.html

Re:Formal proofs?

[Anonymous Coward]

This is the strangest instance of Karma-Whoring I have ever seen. Congrats, I think...

Proof of Code

[starseeker]

I have been wondering for some time now if proving code might be the next step in computers. If you think about it, most problems related to everyday use of computers have been solved, in one form or another - spreadsheets, word processors, databases, and communications seem to account for most of what we want to do, and their feature sets are largely well defined. The task now is not to figure out what we want to do - we know that very well. What we want to do now is do it WELL.

I know little about the field of proving code, so whether this is possible I don't know, but it would be interesting to try something like the following:

a) create a large, detailed specification of what a database (for example) should be able to do. Start general and work down to specifics. Map the full feature set out, eventually down to the function level.

b) translate those requirements into some proof language - Z or B are one's I've heard of, perhaps there are others more appropriate. Identify what the limits are - ultimately the behavior of the program should be well defined, ideally. Break it down to a point where the individual units under consideration can be reasonably expected to be provided by the operating system or system libraries (which, in an ideal world, would also have been created or could be created by a similar process).

c) Having the proven structure, use code generation techniques to automatically produce code that will create the program.

In essense, basically all the work would be done at the specification level, and once we can specify in full detail what we want, the computer itself handles the job of writing the actual code.

As I said, I don't know how much of this is possible, but if we were to start from scratch at the assembly level perhaps something like this could occur:

0) Before anything else, based on language specs, create a proven compiler for the language(s) to be used. Without that, all practical work is useless.

1) Define kernel or microkernel design, and map that design down to hardware levels (RISC might be an easier platform for this). EROS might be a good design starting point. Once it is clear what jobs the hardware would need to do for each command, map out and prove the assembly commands in the RISC platform that would do each job. Build off of those proven components to prove the behavior of each higher level language command, and once the higher levele language behavior is defined and matched to what is needed, write and prove the kernel.

2) Having a kernel whose behavior is now well defined and trusted, the real work begins. Working off of the well defined and proven components in the kernel, build up the rest of the tools needed to provide an operating environment expected on a modern machine. Compartmentalization is key, both for system security concerns and for proof concerns. Essentially the unix idea of one tool doing its specific job correctly, taken to its logical extreme.

3) Having a basic system developed, begin to work on the end user components. Graphics libraries and toolkits would need to be implimented and proven. Porting current toolkits would be possible, but the would likely not be suitable for the rigorous hard core proof testing and a major system graphics setup would have to be designed, specified, and created. Fresco might be a good source of ideas here. Once the proven structure is available,

4) Identify and specify key end user applications. Define an Office application, with various components like word processor and spreadsheet, and define clearly their features. Treat the last 20 years of software usage as field research on what features are required. Impliment them using the proven system tools. As they mature, replace ports of non-proof based tools with new software. Instead of having many tools for one job, define the job itself clearly, and its solution clearly. If more features are needed or desired, the place to add them is in the proof structu

Re:Proof of Code

[nicophonica]

Almost no branch of computer science has seen more countless hours of research devoted to it with more meager results then program verification theory. (And that is not primarily what Milner's work addresses.) The fundament problem with program verification, and why you will not see any of the applications the you mentioned for at least the foreseeable future and probably ever, is that even after you've developed a language that is amenable to correctness analysis and after you have developed a specification requirements language to articulate the 'implication' of your programs written in the verifiable language, and after you have built a tool that allows you automate the construction of correctness proofs, you find that all you've done is push the real problem solving work of programming (where most of the errors come from) into a fuzzy realm of prerequirements that is even less conducive to the types of problem solving that programmers do then the original programming language. These techniques can be useful for very narrow, specialized types of applications which must be correct. But can never work for something even as specialized as an operating system, let alone a general-purpose business application.

Re:Proof of Code

[Anonymous Coward]

Ignorance abounds. Just because it is hard to verify some properties, we should ignore verifying those that we can?

Re:Proof of Code

[Anonymous Coward]

These techniques can be useful for very narrow, specialized types of applications which must be correct. But can never work for something even as specialized as an operating system, let alone a general-purpose business application.

This is correct, BUT the applications for which you really NEED verified correctness are so vital (for example airplane software) that we cannot afford not developing the formal methods. That research will spin off to more general purpose software. Just look at the countless millions, if not billions companies like Intel or Microsoft throw at formal methods now (for example in the form or model checking, eg SLAM).
They do this, because they have taken huge economic hits from faulty software/hardware ...

The first 2 decades of formal methods were abysmal in their results, but this is changing now. Model checking for example really is a succesfully technology.

Re:Proof of Code

[starseeker]

I expect this is true, but if I may...

"all you've done is push the real problem solving work of programming (where most of the errors come from) into a fuzzy realm of prerequirements that is even less conducive to the types of problem solving that programmers do then the original programming language."

By prerequirements do you mean identifying the behaviors and properties needed at each level of programming? I know this won't suddenly enable the creation of "perfect" programs but if errors are occuring in the design of the software rather than the code implimentation, hopefully they would be easier to address by identifying that behavior and tracking it back to the specification. Specifying how a program will behave is something I know we aren't terribly good at, but if we want really secure and reliable software its a hurdle that must be overcome.

"These techniques can be useful for very narrow, specialized types of applications which must be correct. But can never work for something even as specialized as an operating system, let alone a general-purpose business application."

I guess it depends on what you mean by general purpose - I guess I don't really think of something like a database or spreadsheet as general purpose. They accept specific types of input, and perform specific operations on input, and return well defined output. If you define these types and the behavior for the types, and clean failure for other input types, shouldn't that be enough to specify the behavior of the program? Obviously there are a lot of specific points, such as allowable cell input, sheet formatting, operation specific input, etc. but I guess I don't see why it couldn't be attacked. Undoubted this is simply my ignorance. Are there any good introductory references to this kind of thing?

Re:turing

[vbweenie]

Or how's about John Maynard Keynes, the economist? Anthony Burgess' _Earthly Powers_ has a very funny running joke about how many of the greatest and most serious thinkers of the twentieth century were gay (or non-straight, in any one of a number of ways).

An excellent biography of Turing that explicitly deals with the significance of his sexual outlaw status is Andrew Hodges' Alan Turing: The Enigma. Makes one think of the expression "the backroom boys" in an altogether different way.

I don't think that Turing wanted to be a "sexual outlaw", by the way - obviously he'd have preferred it if the authorities had simply left him alone - but there is a subversive, anti-authoritarian streak in him which has some of its roots in the British gay culture of his times. An often overlooked aspect of the Turing Test is the stipulation that the human participants must also pretend to be something they're not - namely a member of the opposite sex...

I worked with Robin Milner...

[C A S S I E L]

...way back in the mid to late 80's, mostly doing compiler programming in the ML project. In fact, my first exposure to ML was in 1979, with an early version running on on DECsystem 20. (I can't remember what it was written in - something like Lisp or Prolog.) For my Ph.D. I implemented a polymorphically typed hybrid functional/logic language based on the ideas of Milner and Ehud Shapiro.

The big push to ML as a language was, as stated, a redesign and implementation (in Pascal, I think) on VAX/VMS by Luca Cardelli back around 1981 - it was a lovely piece of design, with first-class records and union types, and pattern matching. During the standardisation of the formal semantics (late 1980's), the implementation effort was shared with Dave MacQueen at AT&T and Andrew Appel at Princeton (whose compiler books and papers on continuation passing are a good read).

Throughout, the implementations and the mathematics advanced hand-in-hand; on many occasions I'd be doing something in the compiler, and referring to the formal equations of the static or dynamic semantics to make sure I was doing the right thing.

I've been out of touch for about ten years (just when the Pi-Calculus was emerging) but my patterns of thought and reasoning about software structure are still rooted in the experiences of a quarter of a century ago, and I still come across things whose lineage can be traced back to ML's theory and practice (for example, Java exceptions and inner classes).