1 Introduction
An axiomatic theory (theory for short) is a set of axioms that specifies a set of mathematical structures. For example, the usual axioms for a group specify the mathematical structures that contain an associative binary function with an identity element and an inverse operation. Another example is the axioms of a complete ordered field that uniquely specify the real numbers (up to isomorphism).
Theories serve as modular units of mathematical knowledge. Theories can be constructed by combining smaller theories. For example, a theory of fields is a combination of two copies of a theory of groups. Theories can also be connected to each other via meaningpreserving mappings called theory morphisms^{1}^{1}1Theory morphisms are also known as immersions, realizations, theory interpretations, translations, and views.. (See [12] for some illustrative examples of theory morphisms.) A theory morphism from a theory to a theory maps the formulas valid in to formulas valid in . For example, there are two natural theory morphisms from a theory of groups to a theory of fields. Theory morphisms serve as information conduits that enable theory components such as definitions and theorems to be transported from an abstract theory to a more concrete theory or equally abstract theory [2].
A network of theories connected with theory morphisms is called a theory graph. The theories are the nodes of the graph, while the theory morphisms are directed edges. We will argue in the next section that the architecture of a theory graph is well suited for organizing bodies of mathematical knowledge. A theory morphism connects concepts and facts in one theory with concepts and facts in another theory that might be formulated very differently from the first theory. The theory morphisms thus make explicit part of the great interconnectedness of mathematical knowledge.
Neither the traditional proofs given in mathematics papers nor the formal proofs produced by proof assistants (such as Coq [7], Isabelle [22], and Mizar [31]) fulfill all the purposes that mathematical proofs have. Moreover, they also do not exploit the kind of connections exhibited within a theory graph. This paper introduces a new style of mathematical proof that fulfills the principal purposes of a mathematical proof as well as capitalizes on the connections provided by the theory morphisms in a theory graph. This new style of proof combines the strengths of traditional proofs with the strengths of formal proofs.
The rest of the paper is organized as follows. Section 2 gives an introduction to theory graphs. Section 3 discusses the different styles of proof, focusing in particular on the traditional and formal styles. The notion of a cross check that compares a new result with previous results is presented in section 4. The purposes of a mathematical proof and how well traditional and formal proofs fulfill them are discussed in section 5. A new style of proof in the context of a theory graph is introduced in section 6. And the paper ends with some concluding remarks in section 7.
The major contributions of the work presented in this paper are:

We discuss the importance in mathematics of cross checks.

We describe eight purposes of a mathematical proof and compare how well traditional and formal proofs fulfill them.

We introduce a new style of mathematical proof in the context of theory graphs that fulfills the purposes of a proof better than traditional and formal proofs do.
2 Theory Graphs
A theory is a triple where is a logic, is language of , and is a set of formulas of called the axioms of . A model for is an interpretation of in that satisfies all the members of . A model of can be represented by a theory whose language has a symbol for each value in the model.
Let be theories for . A theory morphism from to is a triple where is a mapping of the expressions in to the expressions in such that, if is formula in that is a logical consequence of in , then is a formula in that is a logical consequence of in . Roughly speaking, a theory morphism is a meaningpreserving syntactic mapping from one theory to another. The logics and may be different and the languages and may involve totally different vocabulary. and are called the source theory and target theory of , respectively.
An instance of is the target theory of any theory morphism whose source theory is . An instance of an expression in is for any theory morphism of the form . An inclusion is a theory morphism where is an extension of and is the identity mapping. Theory morphisms can be composed together: The composition of two theory theory morphisms and is the theory morphism .
A theory graph [24] is a directed graph whose nodes are theories and whose edges are theory morphisms. In a theory graph, mathematical knowledge is distributed over the set of theories in the graph. A theory graph provides an advantageous architecture for a digital mathematics library (DML) [4] for the following reasons:

In accordance with the little theories method [14], the development of a mathematical topic can be done in the theory in a theory graph that has the most convenient underlying logic, the most convenient level of abstraction, and the most convenient vocabulary and then concepts and facts produced in the development can be transported to many other contexts via the theory morphisms in the theory graph. For example, concepts and facts about a group can be developed in a theory of an abstract group and then transported to both the additive and multiplicative contexts in a theory of fields. The little theories method thus enables a large body of mathematical knowledge to be developed with a minimal amount of redundancy.

The results developed in a theory can be shared with another theory that has a different underlying logic, vocabulary, or axiomatization as long as exhibits the same conceptual structure as . This allows the mathematical knowledge in a theory graph to be highly distributed.

Two theories and representing different developments of the same mathematical topic based on different axiomatizations of the topic can be shown to be equivalent by producing a theory morphism from to and another from to . The set of equivalent theories can be consolidated into a single structure called a realm [6].

The theories in a theory graph can be developed independently in parallel and then they can be later integrated with each other by defining appropriate theory morphisms between them. This allows a theory graph to built by multiple independent teams working in parallel.

Concepts and facts in a theory graph that are relevant to the development in a theory can be found by following theory morphisms to backwards to their source theories. Concepts and facts several “steps” away from can be found by following compositions of theory morphisms backwards. The concepts and facts found in this way could reside in theories that are quite different from and possibly even unknown to the developers of .
Substantial software support is needed to realize the benefits of a theory graph. Although significant progress has been made in developing software based on and inspired by theory graphs, there is not yet a full system for developing and organizing a DML as a theory graph.
The imps theorem proving system [15, 16] represents mathematical knowledge as a theory graph. However, all the theories in the imps theory library employ the same underlying logic, lutins [10, 11, 13], a version of Church’s type theory with undefinedness and partial functions. In imps, theory morphisms are used to transport definitions and theorems from one theory to another. They are also used to find for the user relevant theorems that reside outside of the theory in which the user is working.
mmt [34] is a foundationindependent framework for representing mathematical knowledge as a theory graph developed largely by Florian Rabe within the KWARC research group [27] at FriedrichAlexander University. It does not currently include the kind of tools for developing mathematical knowledge that proof assistants provide, but it is a very major step towards a software system that can be used to build a theorygraphbased DML. Two other notable KWARC projects that build on the notion of a theory graph are the OAF project [32] on integrating formal libraries and the LATIN project [29] on formalizing logics and logic translations.
3 Styles of Mathematical Proof
A proof is a deductive argument intended to show that a mathematical statement is a logical consequence of a set of premises. There are many styles of proof. Some proofs describe a deduction of the statement from the premises, while other proofs prescribe the steps needed to produce the deduction. Many proofs are presented in a twocolumn format where each line in the left column is an intermediate result in a deduction and the corresponding line in the right column explains how the result is obtained. Some proofs contain computations (e.g., numeric or algebraic simplifications) or constructions (e.g., via straightedge and compass). Some are fully constructive in the sense that they strictly adhere to the principles of constructive logic. Geometry proofs are deductions guided by a geometric drawing. Visual proofs are presented by a series of diagrams or an animation.
The proofs presented in mathematical books and articles usually exhibit a particular style that we call the traditional proof style. Proofs of this style are arguments written in a stylized form of natural language with a heavy use of special symbols. In traditional proofs the terminology and notation may be ambiguous, assumptions may be unstated, and the argument may contain logical gaps. However, the reader is expected to be able to resolve the ambiguities, identify the unstated assumptions, and fill in the gaps in the argument. The writer — whose purpose is to serve some particular community of readers — has the freedom to express the argument in whatever manner is deemed most effective. This includes exhibiting other styles of proof within the traditional style.
The formal proof style is to present a proof as a derivation in a proof system for a formal logic. Formal proofs can be interactively developed and mechanically checked using proof assistants. This style of proof is highly constrained by the logic, proof system, and the fact that every detail must be verified. On the other hand, there is a very high level of assurance that the statement proved is indeed a theorem of the proof system. Although the traditional proof style dominates mathematics, the formal proof style is beginning to make some modest inroads in mathematical practice. For example, see the special issue of the Notices of the AMS on formal proof [17].
4 Cross Checks
A proof by itself does not establish that the theorem it proves is correct since there is always the possibility of error. Error is even possible if the proof is machine checked because the proof may be valid but the theorem may not be correctly stated. For example, one can conjecture that a mathematical object has a certain property, prove the conjecture, and then conclude that the object does indeed possess the property. But the property may have been expressed incorrectly in a way that is not easily noticed.
Since proofs may be incorrect and theorems may be misstated, mathematicians are usually reluctant to accept a theorem on only the basis of its proof. Georg Kreisel has noted in several of his papers, e.g., in [25, p. 126] and [26, p. 145], that a better way to avoid error than carefully checking a proof is to use cross checks to compare the result with known facts. For example, the proof can be checked against similarly structured proofs and the theorem can be compared with consequences of the theorem or related versions of the theorem that have been independently proved. Although cross checks are very important, they are rarely written down and are not considered as part of either a traditional or a formal proof.
Here are some examples of cross checks:

Let be a proof of a theorem . A cross check would be to verify that a proof similar to proves a theorem similar to .

Let be a theorem asserting that each member of a set of objects satisfies a certain property . A commonly employed cross check would be to verify independently from the proof of that is satisfied by certain special members of like the empty set, the empty function, constant functions, etc.

Let be a theorem and be a statement that is the “dual” of in some sense and that is expected to hold if holds. For instance, if is statement involving universal quantification, could be the dual statement involving existential instead of universal quantification. A cross check would be to verify independently from the proof of .

Let be a theorem expressed as an algebraic statement. A cross check would be to verify a geometric analog of independently of the proof of .
In the context of a theory graph, there are two main ways of representing a cross check. The first is as a tuple where is a proof in a theory for and and have a similar structure. This cross check succeeds if the theorems and prove similar theorems and fails otherwise.
The second is as a tuple where:

is a theorem of a theory for .

is a theory morphism .

is expected to follow from in .
could be, for example, a formulation of in a theory that is a more concrete setting than or the dual of under some notion of duality captured by . Notice that, if is an inclusion, then is actually expected to follow from in . In this case, could be a special case of or a corollary of . This cross check succeeds if indeed follows from in and otherwise fails.
A failed cross check could indicate that a mistake has been made or that something is not adequately understood. Thus failed cross checks are valuable because they can lead to finding hidden mistakes and making new discoveries. Also, if the proof or statement of a fully verified theorem with cross checks is ever modified in the future, the cross checks can be used to discover errors that are introduced by the modification.
5 Purposes of a Mathematical Proof
Mathematical proofs serve several purposes. So what are they? Various purposes have been discussed in the mathematics literature [3, 5, 8, 9, 18, 19, 30]. Michael de Villiers presents in [9] a list of the following six purposes:

Verification (concerned with the truth of a statement).

Explanation (providing insight into why it is true).

Systematization (the organisation of various results into a deductive system of axioms, major concepts and theorems).

Discovery (the discovery or invention of new results).

Communication (the transmission of mathematical knowledge).

Intellectual challenge (the selfrealization/fulfillment derived from constructing a proof).
We claim that mathematical proofs serve eight principal purposes, four of which are not on de Villiers’ list. For each of the eight, we describe what the purpose is and compare how well traditional and formal proofs fulfill the purpose.
Purpose 1: Communication
The main purpose of a proof given in a textbook or scientific article is to communicate to the reader why a mathematical statement follows from a set of premises. Proofs constructed for communication are used to convey insight and to build intuition. The highly flexible style of traditional proofs is usually a much better vehicle for communication than the highly constrained style of formal proofs. This is especially true when the writer is more concerned about highlevel ideas than lowlevel details (that often can be mechanically checked by computation). However, formal proofs can be much more effective at presenting intricate syntactic manipulations than traditional proofs. (This purpose combines de Villiers’ explanation and communication purposes.)
Purpose 2: Certification
Another important purpose of a proof is to certify that a mathematical statement follows from a set of premises. Such a proof serves as a certificate that can be independently checked. Since a traditional proof is written for a particular audience, it may not be easily checked by someone outside of this audience. Moreover, a traditional proof may contain mistakes that are not easily noticed by a reader, even a reader in the intended audience. In contrast, a formal proof can be mechanically checked by software alone. A formal proof thus offers the highest level of certification. (This purpose includes de Villiers’ verification purpose.)
Purpose 3: Organization
Mathematical knowledge is usually organized as a deductive edifice composed of axioms, definitions, theorems, and proofs. The proofs are the threads that hold the edifice together. Any body of mathematical knowledge built without proofs will almost certainly contain falsehoods and contradictions that compromise its deductive structure. Both traditional and formal proofs are very effective tools for organizing mathematical knowledge as a deductive structure, but formal proofs are somewhat better since their correctness can be machine checked. (This purpose is the same as de Villiers’ systematization purpose.)
Purpose 4: Discovery
A proof is often formulated to be a provisional argument that a mathematician can use to discover new theorems. This idea is brilliantly expressed in Proofs and Refutations by Imre Lakatos [28]. See also Yehuda Rav, “Why Do We Prove Theorems?” [35]. Traditional proofs are well suited for expressing provisional arguments that can be analyzed by humans. Formal proofs are too rigid to express provisional arguments and thus are poorly suited for this task. On the other hand, machines can be used to discover various kinds of structure embodied in a formal proof, but it is much more difficult to analyze traditional proofs in this way. (This purpose is the same as de Villiers’ discovery purpose.)
Purpose 5: Learning
The most effective way to learn mathematics is to read and write proofs. Traditional proofs are today generally much easier to read and write than formal proofs. However, a reader of a traditional proof may have to work hard to resolve ambiguities, identify unstated assumptions, and fill in the gaps in the argument, and a writer may have to work hard to verify that each step of the argument is valid. With effective software support, reading and writing formal proofs could become almost as easy as reading and writing traditional proofs. (This purpose is not explicitly included in de Villiers’ list of purposes.)
Purpose 6: Universality
A proof is universal if it is expressed without any superfluous ideas and can thus be applied in every context in which the conditions of the proof hold. Universality is not absolute; it depends on audience and context. A proof can be universal with respect to one audience and context but not with respect to another. Traditional proofs can be expressed in a universal manner, but the underlying mathematical foundation is usually implicit. Traditional proofs are thus untethered; they do not have a precise mathematical home. Formal proofs have a precise mathematical home, but the home is usually not connected to many other contexts in which the proof can be applied. Hence both traditional and formal proofs fall short in achieving universality. (This purpose is not included in de Villiers’ list of purposes.)
Purpose 7: Coherency
A theorem is coherent with a body of mathematical knowledge if it properly fits into the body without any contradictions or unexpected relationships. A traditional or formal proof by itself does not establish that the theorem it proves is coherent with other mathematical knowledge. Coherency is established by cross checks. Although cross checks are very important, they are rarely written down and are not considered as part of either a traditional or a formal proof. (This purpose is not explicitly included in de Villiers’ list of purposes.)
Purpose 8: Beauty
Mathematics is a utilitarian art form like architecture or industrial design. The desire to create beauty (what mathematicians call elegance) is one of the strongest driving forces in mathematics. Mathematicians seek to develop proofs that are beautiful as well as correct. Indeed some mathematicians will not accept a theorem until an elegant proof of the theorem has been found. It is safe to say that most mathematicians find it easier to write beautiful proofs in the highly flexible traditional proof style than in the highly constrained formal proof style. (This purpose is not included in de Villiers’ list of purposes.)
Summary
Table 1 summarizes the differences between traditional and formal proofs. As can be seen, neither traditional proofs nor formal proofs fulfill the eight purposes that we claim mathematical proofs have. Furthermore, both styles lack the capacity to fully achieve universality and coherency.
Traditional Proofs  Formal Proofs  

Communication 
● 
◑ 
Certification 
◑ 
● 
Organization 
◑ 
● 
Discovery (Human) 
● 
○ 
Discovery (Machine) 
○ 
● 
Learning (Reading) 
◑ 
◑ 
Learning (Writing) 
◑ 
◑ 
Universality 
◑ 
◑ 
Coherency 
○ 
○ 
Beauty 
● 
○ 
● : high; ◑ : medium high; ◑ : medium low; ○ : low.
6 A New Style of Proof
Since traditional and formal proofs do not adequately achieve universality and coherency, they are not adequate for building theory graphs. We therefore propose a new style of proof that fulfills universality and coherency as well as other six purposes described in the previous section. Let TG be a theory graph. A proof in TG of this new proof style has four components:

A home theory where Log is a formal logic, Lang is a language in Log, and Axms is a set of formulas in Lang.

A theorem Thm that is a formula in Lang purported to be a logical consequence of Axms.

An argument Arg that shows Thm is a logical consequence of Axms.

A set CC of cross checks of the two forms mentioned in section 4 that compare Arg with similar arguments in TG and Thm with related theorems in HT or in other theories in TG.
The home theory HT is a node in TG and a formal context for the proof. It is connected via theory morphisms to other theories in TG. Ideally, the home theory is at the optimal level of abstraction for the proof and contains only the concepts and assumptions needed to express the proof’s argument and theorem.
The theorem Thm is a formal statement of what the proof’s argument shows. It can be transported via appropriate theory morphisms to other theories in which the conditions of the proof hold. HT and Thm together thus serve as a specification of the set of theories and formulas in TG such that is an instance of HT and is an instance of Thm under some theory morphism. In this way, the proof fulfills the purpose of universality.
The argument Arg has both a traditional component for communication, organization, humanoriented discovery, learning, and beauty and a formal component for certification, organization, learning, and machineoriented discovery. The two components are tightly integrated so that, for example, a reader of the traditional component can switch, if desired, to the formal component when a gap in the argument is reached. It is not necessary that the formal component is a complete formal proof of the theorem. The formal component can even be totally absent. Thus the proof is flexiformal [23] in the sense that it is mixture of formal and informal components.
The set of cross checks should be carefully chosen to show that the theorem is coherent with the web of previously established facts in TG. With the set CC the proof thus fulfills the purpose of coherency.
In summary, the new style of proof we propose is a mixture of the traditional and formal proof styles in which the context of the proof and the statement proved are formal, the argument of the proof is expressed in a traditional style, and parts of the argument may be integrated with formal derivations. The home theory of the proof is a node in a theory graph of a TG that is an optimal expression of the context of the proof. And the cross checks of the proof connect the proof and the theorem to similar proofs and related theorems in the theory graph.
7 Conclusion
We have shown that a theory graph is a network of theories connected by theory morphisms in which mathematical knowledge is distributed across the network of theories. The underlying logics of the theories can be different and the languages of the theories can vary greatly. The theories can organized according to the little theories method and can be developed independently in parallel. The theory morphisms capture many of the connections in the mathematical knowledge represented in the theory graph. As a result, they can be used to find concepts and facts relevant to a theory that reside outside of in other, possibly quite different, theories.
With these attributes, a theory graph is well suited to be the architecture for a largescale, multifoundational, highly connected, and highly distributed DML. This is particularly true for a DML whose mathematical knowledge is intended to be formal or flexiformal. The obvious example of such a DML is the Global Digital Mathematics Library (GDML) [21] proposed by the International Mathematical Union (IMU) [20].
Proofs have a crucial role to play in building a GDML. However, traditional and formal proofs do not adequately fulfill all the purposes of a proof that we presented in section 5. Traditional proofs are good for communication, organization, human discovery, learning, and beauty, while formal proofs are good for certification, organization machine discovery. But neither traditional nor formal proofs are especially good for universality and coherency.
To capitalize on the structure offered by a theory graph, we have proposed a new style of proof that merges the traditional and formal styles of proof, achieves universality using the little theories method, and incorporates cross checks to establish coherency. We believe this proof style will promote the development of highly structured DMLs while preserving the benefits of both traditional and formal proofs.
Acknowledgments
The author would like to thank the referees for their comments. This research was supported by NSERC.
References

[1]
C. Ballarin.
Locales: A module system for mathematical theories.
Journal of Automated Reasoning
, 52:123––153, 2014.  [2] J. Barwise and J. Seligman. Information Flow: The Logic of Distributed Systems, volume 44 of Tracts in Computer Science. Cambridge University Press, 1997.
 [3] A. Bell. A study of pupils’ proofexplanations in mathematical situations. Educational Studies in Mathematics, 7:23–40, 1976.
 [4] T. Bouche. Digital mathematics libraries: The good, the bad, the ugly. Mathematics in Computer Science, 3:227––241, 2010.
 [5] T. CadwalladerOlsker. What do we mean by mathematical proof? Journal of Humanistic Mathematics, 1:33–60, 2011.
 [6] J. Carette, W. M. Farmer, and M. Kohlhase. Realms: A structure for consolidating knowledge about mathematical theories. In S. Watt, J. Davenport, A. Sexton, P. Sojka, and J. Urban, editors, Intelligent Computer Mathematics, volume 8543 of Lecture Notes in Computer Science, pages 252–266. Springer, 2014.
 [7] Coq Development Team. Reference Manual for the Coq Proof Assistant, Version 8.8.2, 2018. Available at https://coq.inria.fr/refman/.
 [8] M. de Villiers. The role and function of proof in mathematics. Pythagoras, 24:17–24, 1990.
 [9] M. de Villiers. Rethinking Proof with Sketchpad. Key Curriculum Press, 1999.
 [10] W. M. Farmer. A partial functions version of Church’s simple theory of types. Journal of Symbolic Logic, 55:1269–91, 1990.
 [11] W. M. Farmer. A simple type theory with partial functions and subtypes. Annals of Pure and Applied Logic, 64:211–240, 1993.
 [12] W. M. Farmer. Theory interpretation in simple type theory. In J. Heering, K. Meinke, B. Möller, and T. Nipkow, editors, HigherOrder Algebra, Logic, and Term Rewriting, volume 816 of Lecture Notes in Computer Science, pages 96–123. Springer, 1994.
 [13] W. M. Farmer. Theory interpretation in simple type theory. In J. Heering, K. Meinke, B. Möller, and T. Nipkow, editors, HigherOrder Algebra, Logic, and Term Rewriting, volume 816 of Lecture Notes in Computer Science, pages 96–123. Springer, 1994.
 [14] W. M. Farmer, J. D. Guttman, and F. J. Thayer. Little theories. In D. Kapur, editor, Automated Deduction—CADE11, volume 607 of Lecture Notes in Computer Science, pages 567–581. Springer, 1992.
 [15] W. M. Farmer, J. D. Guttman, and F. J. Thayer. IMPS: An Interactive Mathematical Proof System. Journal of Automated Reasoning, 11:213–248, 1993.
 [16] W. M. Farmer, J. D. Guttman, and F. J. Thayer Fábrega. IMPS: An updated system description. In M. McRobbie and J. Slaney, editors, Automated Deduction—CADE13, volume 1104 of Lecture Notes in Computer Science, pages 298–302. Springer, 1996.
 [17] T. Hales, G. Gonthier, J. Harrison, and F. Wiedijk. A special issue on formal proof. In Notices of the American Mathematical Society, volume 55, pages 1370–1380. 2008.
 [18] G. Hanna. Proof, explanation and exploration: An overview. Educational Studies in Mathematics, 4, 2000.
 [19] R. Hersh. Proving is convincing and explaining. Educational Studies in Mathematics, 24:389–399, 1993.
 [20] International Mathematical Union (IMU). Web site at https://www.mathunion.org/.
 [21] P. Ion and S. Watt. The global digital mathematics library and the international mathematical knowledge trust. In H. Geuvers, M. England, O. Hasan, F. Rabe, and O. Teschke, editors, Intelligent Computer Mathematics, volume 10383 of Lecture Notes in Computer Science, pages 56–69. Springer, 2017.
 [22] Isabelle. Web site at https://isabelle.in.tum.de/.
 [23] M. Kohlhase. The Flexiformalist Manifesto. In A. Voronkov, V. Negru, T. Ida, T. Jebelean, D. Petcu, S. M. Watt, and D. Zaharie, editors, 14th International Workshop on Symbolic and Numeric Algorithms for Scientific Computing (SYNASC 2012), pages 30–36. IEEE Press, 2013.
 [24] M. Kohlhase. Mathematical knowledge management: Transcending the onebrainbarrier with theory graphs. European Mathematical Society (EMS) Newsletter, 92:22–27, June 2014.
 [25] G. Kreisel. Some uses of proof theory for finding computer programs. In Colloque international de logique: ClermontFerrand 1825 juillet 1975, volume 249 of Colloques internationaux du Centre national de la recherche scientifique, pages 123–133. Centre national de la recherche scientifique, 1977.
 [26] G. Kreisel. Mathematical logic: Tool and object lesson for science. Synthese, 62:139–151, 1985.
 [27] KWARC Research Group, FriedrichAlexander University ErlangenNürnberg.
 [28] I. Lakatos. Proofs and Refutations. Cambridge University Press, 1976.
 [29] LATIN: Logic Atlas & Integrator. Web site at https://kwarc.info/projects/latin/.
 [30] C. Löfwall and K. Hemmi. Why do we need proof. In V. DurandGuerrier, S. SouryLavergne, and F. Arzarello, editors, Proceedings of the Sixth Congress of the European Society for Research in Mathematics Education (CERME 6), pages 200–210, Lyon, France, 2010.
 [31] The Mizar system. Web site at http://mizar.org/.
 [32] OAF: An Open Achive for Formalizations. Web site at https://kwarc.info/projects/oaf/.
 [33] S. Owre and N. Shankar. Theory interpretations in PVS. Technical Report SRICSL0101, SRI International, 2001.
 [34] F. Rabe and M. Kohlhase. A scalable module system. Information and Computation, 230:1–54, 2013.
 [35] Yehuda Rav. Why do we prove theorems. Philosophia Mathematica, 7:5–41, 1999.