F ORMALIZING C HEMICAL P HYSICS USING

THE L EAN T HEOREM P ROVER

Maxwell P. Bobbin1 , Samiha Sharlin1 , Parivash Feyzishendi1 , An Hong Dang1 ,

Catherine M. Wraback1 , and Tyler R. Josephson1,2
1
arXiv:2210.12150v5 [cs.LO] 8 Dec 2023

Department of Chemical, Biochemical, and Environmental Engineering, University of Maryland Baltimore County,
1000 Hilltop Circle, Baltimore, MD 21250
2
Department of Computer Science and Electrical Engineering, University of Maryland Baltimore County,
1000 Hilltop Circle, Baltimore, MD 21250
Accepted for publication in Digital Discovery

A BSTRACT
Interactive theorem provers are computer programs that check whether mathematical statements are
correct. We show how the mathematics of theories in chemical physics can be written in the language
of the Lean theorem prover, allowing chemical theory to be made even more rigorous and providing
insight into the mathematics behind a theory. We use Lean to precisely define the assumptions and
derivations of the Langmuir [1] and BET [2] theories of adsorption. We can also go further and create
a network of definitions that build off of each other. This allows us to define a common basis for
equations of motion or thermodynamics and derive many statements about them, like the kinematic
equations of motion or gas laws such as Boyle’s Law. This approach could be extended beyond
chemistry, and we propose the creation of a library of formally-proven theories in all fields of science.
Furthermore, the rigorous logic of theorem provers complements the generative capabilities of AI
models that generate code; we anticipate their integration to be valuable for automating the discovery
of new scientific theories.

Keywords Proof assistants · Formal verification · Proof assistant · Theorem provers · Logic · Adsorption ·
Thermodynamics · Kinematics · Theory

1 Introduction

Theoretical derivations in the scientific literature are typically written in a semi-formal fashion, and rely on human
peer reviewers to catch mistakes. When these theories are implemented in software, the translation from mathematical
model to executable code also requires humans to catch errors. This reflects the gap between mathematical equations
describing models in science and the software written to encode these [3]. This occurs because the computer doesn’t
understand relationships among the scientific concepts and mathematical objects under study, it simply executes the code
given it. Here, we recommend an alternative: interactive theorem provers that enable the mathematics and programming
of science to be expressed in a rigorous way, with the logic checked by the computer.

1.1 Theorem provers for chemical theory

Interactive theorem provers are a type of computer program used for the creation of formal proofs or derivations, which
are a sequence of logical deductions used to prove a theorem1 is correct [4]. They provide a way to write a proof step by
step, while the computer verifies each step is logically correct [5, 6, 7, 8, 9, 10]. Formal proofs are used extensively in
mathematics to prove various theories. On the other hand, scientific theory tends to use informal proofs when deriving
its theories, since they are easier to write and understand (see Table 1).

1
Mathematical terms that may be unfamiliar to the reader, like theorem, are defined in the glossary, section 4
 Formalizing Chemical Physics

The table comparing hand-written proofs and formal proofs. The left column pertains to hand-written proofs, while the right column relates to formal proofs. Features of hand-written proofs include informal syntax, intended for human readers, potential to exclude information, possible presence of mistakes, the necessity of human proofreading, and the relative ease of writing. In contrast, formal proofs are characterized by a strict, computer language syntax, machine-readability and executability, inability to miss assumptions or steps, rigorous verification by a computer, automated proof checking, and a level of difficulty in writing. The caption of the table reads "Comparison of hand-written and formalized proofs".
The table references two distinct types of computational systems used in mathematical and logical operations. Firstly, Interactive Theorem provers such as the ones mentioned in the citations (including Lean and Isabelle), are tools that assist in the creation and checking of formal logic proofs. Secondly, Computer Algebra Systems including Mathematica, Sympy, and MATLAB, as referenced, are software packages that facilitate symbolic mathematics.

Table 1: Comparison of hand-written and formalized proofs.

Scientists are generally familiar with computer algebra systems (CAS) that can symbolically manipulate mathematical
expressions (see Table 2). These systems include SymPy [11] and Mathematica. These systems are used frequently for
scientific applications but come at the cost of being unsound, meaning they can have false conclusions.
Theorem provers are more rigorous than computer algebra systems, because they require computer-checked proofs
before permitting operations, thereby preventing false statements from being proven. For example, a × b = b × a is true
when a and b are scalars, but A × B ̸= B × A when A and B are matrices. CAS impose special conditions to disallow
A × B = B × A [11], whereas theorem provers only allow changes that are proven to be valid. Theorem provers
construct all of their math from a small, base kernel of mathematical axioms, requiring computer-checked proofs for
for objects constructed from the axioms. Even the most complicated math can be reduced back to that kernel. Since
this kernel is small, verifying it by human experts or with other tools is manageable. Then, all higher-level math built
and proved from the kernel is just as trustworthy. This contrasts with how CAS represent and introduce mathematics;
because proofs are not required when high-level math is introduced, mistakes could enter at any level, and would require
humans to catch and debug them [12] (see Table 2).

Table 2: Interactive Theorem Provers [13, 6] vs. Computer Algebra Systems [14, 11, 15].

Historically, interactive theorem provers have been used to logically connect advanced math theorems to the foundational
axioms of mathematics [16, 17, 18, 19, 20, 21]. Before computers, this “axiomatization” of mathematics was developed
by hand, in works like Principia Mathematica by Alfred North Whitehead and Bertrand Russell [22] – the aim is to
write down a minimal list of fundamental assumptions (axioms), and then systematically derive all of mathematics from
those axioms. Computers play a key role in modern formalization efforts because they can store and verify massive
libraries of interconnected theorems collaboratively written by hundreds of mathematicians [23].
An analogous program to “axiomatize” physics was famously articulated as Hilbert’s sixth problem [24]. Recent
reviews have discussed progress and unsolved questions on this “endless road” to describe how all of physics can be
derived from a minimal set of axioms [25, 26]. Our vision is somewhat distinct from this – we are inspired by Paleo’s
ideas for formalizing physics theories [27] as a collection of proofs, instead of aiming to represent science as a single
edifice emerging from one set of axioms (though this structure may emerge in the future). In particular, we ask “How
can we formally represent a collection of proofs/derivations using an interactive theorem prover?”
Theorem provers have previously been used to formalize derivations in physics: theorems from Newton’s Principia
[28, 29], versions of relativity theory [30, 31], electromagnetic optics [32], and geometrical optics [33] have been
described and proved using proof assistants. Artificial intelligence tools for scientific discovery have also used theorem

2
 Formalizing Chemical Physics

provers in designing optical quantum experiments [34], as well as for rediscovering and deriving scientific equations
from data and background theory [35].
Here we focus on formalizing fundamental theories in the chemical sciences. Progress toward axiomatizing thermo-
dynamics began with Carathéodory in 1909 [36], with recent developments by Lieb and Yngvason [37]. But broadly,
these questions have not been addressed using theorem provers to check the mathematics, which have seen limited use
in the chemical sciences. One notable application by Bohrer [38] uses a proof assistant that reasons about differential
equations and control algorithms [39] to describe and prove properties of chemical reactors.

1.2 The Lean theorem prover

We have selected the Lean theorem prover [40] for its power as an interactive theorem prover, the coverage of its
mathematics library, mathlib [41], and the supportive online community of Lean enthusiasts [42] with an aim to
formalize the entire undergraduate math curriculum [23, 43]. Interesting projects in modern mathematics have emerged
from its foundations, including Perfectoid Spaces [44], Cap Set Problem [45] and Liquid Tensor [46] have garnered
attention in the media [47]. A web-based game, the Natural Number Game [48], has been widely successful in
introducing newcomers to Lean. As executable code, Lean proofs can be read by language modeling algorithms that
find patterns in math proof databases, enabling automated proofs of formal proof statements, including International
Math Olympiad problems [49, 50].
We anticipate that Lean is expressive enough to formalize diverse and complex theories across quantum mechanics,
fluid mechanics, reaction rate theory, statistical thermodynamics, and more. Lean gets its power from its ability to
define mathematical objects and prove their properties, rather than just assuming premises for the sake of individual
proofs. Lean is based on Type Theory [51, 52] where both mathematical objects and the relation between them are
modeled with types (see Fig. S1 in the Supporting Information). Everything in Lean is a term of a Type, and Lean
checks to make sure that the Types match. Natural numbers, real numbers, functions, Booleans, and even proofs are
types; examples of terms with these types include the number 1, Euler’s number, f (x) = x2 , TRUE, and the proof of
BET theory, respectively. Lean is also expressive enough to allow us to define new types, just like mathematicians do
[40], which allows us to define specific scientific theories and prove statements about them.
In this paper, we show how formalizing chemical theories may look, by demonstrating the tools of Lean through
illustrative proofs in the chemical sciences. First, we introduce variables, types, premises, conjectures, and proof steps
through a simple derivation of the Langmuir adsorption model. Next, we show how functions and definitions can be
used to prove properties of mathematical objects by revising the Langmuir adsorption model through definitions and
showing it has zero loading at zero pressure. Finally, we turn to more advanced topics, such as using geometric series to
formalize the derivation of the BET equation and using structures to define and prove relationships in thermodynamics
and motion.

2 Methods

Lean has a small kernel, based on dependent type theory [51, 52], with just over 6000 lines of code that allows it to
instantialize a version of the Calculus of Inductive Constructions (CoIC) [53, 54]. The strong normalizing characteristic
of the CoIC [55] creates a robust programming language that is consistent. The CoIC creates a constructive foundation
for mathematics allowing the entire field of mathematics to be built off of just 6000 lines of code.
In Section 3 we outline the proofs formalized using Lean version 3.51.1. We host proofs on a website that provides a
semi-interactive platform connecting to the Lean codes in our GitHub repository . An extended methods section
introducing Lean is in the Supporting Information Section 5.1.

3 Formalized Proofs

3.1 Langmuir Adsorption: Introducing Lean Syntax and Proofs

We begin with an easy proof to introduce Lean and the concept of formalization. The Langmuir adsorption model
describes the loading of adsorbates onto a surface under isothermal conditions [1]. Several derivations have been
developed [1, 56, 57, 58]; here we consider the original kinetic derivation [1]. First, we present a derivation of the
Langmuir model given by the Eq. 6, in LATEX, then transfer this into Lean and rigorously prove it. We also discuss how
these proofs can be improved to be more robust.

3
 Formalizing Chemical Physics

The Langmuir model assumes that all sites are thermodynamically equivalent, the system is at equilibrium, and that
adsorption and desorption rates are first order. The adsorption and desorption rates are given by Eq. 1 and Eq. 2,
respectively.

rad = kad pA [S] (1)

The symbols rad , kad , pA , and [S] represent the rate of adsorption, the adsorption rate constant, the pressure of the
adsorbate gas, and the concentration of available sites on the surface, respectively.

rd = kd [Aad ] (2)

Where rd stands for the rate of desorption, kd signifies the desorption rate constant, and [Aad ] represents the concentra-
tion of adsorbed molecules. From assumption (2), rad = rd , and with some rearrangement, we get Eq. 3.

kd [Aad ]
[S] = (3)
kad pA

Using the site balance [S0 ] = [S] + [Aad ], where [S0 ] represents the total concentration of available sites, we arrive at
Eq. 4.

[Aad ]
[S0 ] = kad
+ [Aad ] (4)
kd pA

We can rearrange Eq. 4 into a familiar form, Eq. 5.2

k
kd pA
ad
[Aad ]
= (5)
[S0 ] 1 + kkad
d
pA

[Aad ] A kad
Using the definition of the fraction of adsorption, θ = [S0 ] , and the definition of the equilibrium constant, Keq = kd ,
we arrive at the familiar Langmuir Model, Eq. 6.

Keq pA
θA = (6)
1 + Keq pA

This informal proof is done in natural language, and it doesn’t explicitly make clear which equations are premises to
the proof and which are intermediate steps. While the key steps from the premises to the conclusion are shown, the
fine details of the algebra are excluded. In contrast, Lean requires premises and conjecture to be precisely defined and
requires that each rearrangement and cancellation is shown or performed computationally using a tactic. The next part
shows how this proof is translated into Lean.

2
The manuscript we first submitted for peer review included a typo in Eq. 5, with [S0 ] appearing as [S]. Neither the authors nor
the peer reviewers detected this; it was identified by a community member who accessed the paper on arXiv. Of course, Lean catches
such typos immediately.

4
 Formalizing Chemical Physics

Figure 1: A formalization of Langmuir’s adsorption model, shown as screenshots from Lean operating in VSCode.
The left side of the figure shows the “Code Window,” while the right side shows variables and goals at each step in
the “Tactic State”. When the user places the cursor at one of the numbered locations in the “Code Window,” VSCode
displays the “Tactic State” of the proof. Lean allows the use of Unicode symbols, so we use “S0 ” to represent the total
concentration of adsorption sites without needing underscores. The turnstile symbol represents the state of the goal after
each step. As each tactic is applied, hypotheses and/or goals are updated in the tactic state as the proof proceeds. For
clarity, we only show the hypothesis that changes after a tactic is applied and how that changes the goal. As an example,
the goal state is the same in steps 1 and 2 since the first tactic rewrites (rw) the equation of adsorption (hrad) and
desorption (hrd) into the premise that equilibrium (hreaction) exists. Next, we rewrite (rw), simplify (field_simp), and
otherwise rearrange the variables to exactly equal the goal state (steps 3-5). When the proof is finished, a celebratory
message and party emoji appears (6).

As shown in Figure 1, every premise must be explicitly stated in Lean, along with the final conjecture and proof tactics
used to show that the conjecture follows from the premises. Lean is an interactive theorem prover, meaning that the
user is primarily responsible for setting up the theorem and writing the proof steps, while Lean continuously checks the
work and provides feedback to the user. The central premises of the proof are expressions of adsorption rate (hrad),
desorption rate (hrd), the equilibrium relation (hreaction), and the adsorption site balance (hS0 ). Additional premises
include the definition of adsorption constant (hK) and surface coverage (hθ) from the first four premises, as well as
mathematical constraints (hc1, hc2, and hc3) that appear during the formalization. The model assumes the system
is in equilibrium, so the adsorption rate, rad = k_ad ∗ P ∗ S and desorption rate, rd = k_d ∗ A are equal to each
other, where kad and kd are the adsorption and desorption rate constant respectively, S is concentration of empty sites,
and A is the concentration of sites occupied by A. After begin, a sequence of tactics rearranges the goal state until
the conjecture is proved. Note when performing division, Lean is particular to require that the denominator terms are
nonzero.
An interesting part of the proof is that only certain variables or their combinations are required to be not zero. When
building this proof, Lean imports the real numbers and the formalized theorems and tactics for them in mathlib. Lean
does not permit division by zero, and it will flag issues when a number is divided by another number that could be
zero. Consequently, we must include additional hypotheses hc1-hc3 in order to complete the proof. These provide the
minimum mathematical requirements for the proof; more strict constraints requiring rate constants and concentrations to
be positive would also suffice. These ambiguities are better addressed by using definitions and structures, which enable
us to prove properties about the object. Nonetheless, this version of the Langmuir proof is still a machine-readable,
executable, formalized proof.

5
 Formalizing Chemical Physics

Though this is a natural way to write the proof, we can condense the premises by using local definitions. For instance,
the first two premises hrad and hrd can be written into hreaction to yield k_ad*P*S = k_d*A and we can also write
expressions of hθ and hK in the goal statement. While hrad, hrd, hθ, and hK each have scientific significance, in this
proof, they are just combinations of real numbers. Alternative versions of this proof are described in SI Section 5.2.1.

3.2 Langmuir Revisited: Introducing Functions and Definitions in Lean

Functions in Lean are similar to functions in imperative programming languages like Python and C, in that they take
in arguments and map them to outputs. However, functions in Lean (like everything in Lean) are also objects with
properties that can be formally proved.
Formally, a function is defined as a mapping of one set (the domain) to another set (the co-domain). The notation for a
function is given by the arrow "→". For instance, the function, conventionally written as Y = f (X) or Y (X), maps
from set X to set Y is written as X → Y in arrow notion.3 .
Importantly, the arrow "→" is also used to represent the conditional statement (if-then) in logic, but this is not a
duplication of syntax. Because everything is a term of Type in Lean, functions map type X to type Y; when each type is
a proposition, the resulting function is an if-then statement.
As stated in the introduction, Lean’s power comes from the ability to define objects globally, not just postulate them for
the purpose of local proof. When a mathematical object is formally defined in Lean, multiple theorems can be written
about it with certainty that all proofs pertain to the same object. In Lean, we use def to define new objects and then
prove statements about these objects. The def command has three parts: the arguments it takes in (the properties of the
object), the type of the output, and the proof that the object has such a type. In Lean:

def name properties : type := proof of that type

For instance, we can define a function that doubles a natural number:

def double : N → N := λ n : N, n + n

The λ symbol comes from lambda calculus and is how an explicit function is defined. After the lambda symbol is
the variable of the function, n with type N. After the comma is the actual function. By hand, we would write this as
f (n) = n + n. This function doubles any natural number, as the name suggests. We could use it, for example, to show:

double (3 : N) = (6 : N)

In the previous section, we showed an easy-to-read derivation of Langmuir adsorption, and in SI Section 5.2.1, we
improved the proof using local definitions. Here, we improve it further by defining the Langmuir model as an object
in Lean and then showing the kinetic derivation of that object. This way, the object defining the single-site Langmuir
model can be reused in subsequent proofs, and all are certain to refer to the same object.
We define the model as a function that takes in pressure as a variable. Given a pressure value, the function will compute
the fractional occupancy of the adsorption sites. In Lean, this looks like :

def langmuir_single_site_model (equilibrium_constant : R) : R → R :=

λ P : R, equilibrium_constant*P/(1+equilibrium_constant*P)

The λ symbol comes from λ-calculus [59] and is one way to construct functions. It declares that P is a real number
that can be specified. When the real number is specified, it will take the place of P in the equation. The definition also
requires the equilibrium constant to be specified4 .
With this, the kinetic derivation of Langmuir can be set up in Lean like this :

theorem langmuir_single_site_kinetic_derivation
{P k_ad k_d A S : R}
(hreaction : let r_ad := k_ad*P*S, r_d := k_d*A in r_ad = r_d)
3
These types are easily extended to functionals, which are central to density functional theory. A function that takes a function as
an input can be defined by (R → R) → R
4
This definition can be specified in multiple ways. The pressure could be required as an input like the equilibrium constant, or the
equilibrium constant can be specified as a variable in the function like pressure. Any of these definitions work, and it is possible to
prove congruence between them. We chose this way to purposefully show both definitions and functions in Lean.

6
 Formalizing Chemical Physics

(hS : S =
̸ 0)
(hk_d : k_d ̸= 0)
:
let θ := A/(S+A),
K := k_ad/k_d in
θ = langmuir_single_site_model K P :=
This derivation is almost exactly like the proof in SI Section 5.2.1; the only difference is the use of the Langmuir model
as an object. After the langmuir_single_site_model simplifies to the Langmuir equation, the proof steps are the
same.
Using the definition makes it possible to write multiple theorems about the same Langmuir object. We can also prove
that the Langmuir expression has zero loading at zero pressure, and in the future we can show that it has a finite loading
in the limit of infinite pressure, and converges to Henry’s Law in the limit of zero pressure . Definitions and structures,
as we will see in later sections, are crucial to building a web of interconnected scientific objects and theorems.

3.3 BET Adsorption: Formalizing a complex proof

Brunauer, Emmett, and Teller introduced the BET theory of multilayer adsorption (see Fig. 2) in 1938 [2]. We formalize
this derivation, beginning with Equation 26 from the paper, which is shown here in Eq. 7:

V Cx
= (7)
A ∗ V0 (1 − x)(1 − x + Cx)

Figure 2: Langmuir model vs BET model. The BET model, unlike Langmuir, allows particles to create infinite layers
on top of previously adsorbed particles. Here θ is fraction of the surface adsorbed, V is total volume adsorbed, V0 is the
volume of a complete unimolecular layer adsorbed in unit area, si is the surface area of the ith layer, s0 is the surface
area of the zeroth layer, and x and C are constants that relates heats of adsorption of the molecule in layers.

Here A is the total area adsorbed by all (infinite) layers expressed as sum of infinite series:

∞
X ∞
X
A= si = s0 (1 + C xi ) (8)
i=0 i=1

and V is the total volume adsorbed is given by:

∞
X ∞
X
V = V0 isi = Cs0 V0 ixi (9)
i=0 i=1

7
 Formalizing Chemical Physics

The variables y, x and C are expressed in the original paper as shown through Eq. 10 to 12:

y = P C1 , where C1 = (a1 /b1 )eE1 /RT (10)

x = P CL , where CL = eEL /RT /g (11)

C = y/x = C1 /CL (12)

where a1 , b1 , and g are fitted constants, E1 is the heat of adsorption of the first layer, EL is for the second (and higher)
layers (also the same as heat of liquefaction of the adsorbate at constant temperature), R is the universal gas constant,
and T is temperature. In Eq. 10 and 11, everything besides the pressure term is constant, since we are dealing with an
isotherm, so we group the constants together into one term.
These constants, along with the surface area of the zeroth layer, given by s0 , saturation pressure, and the three constraints
are defined using the constant declaration in Lean. Mathematical objects can also be defined in other ways such as def,
class or structure [40] but for this proof we will use constant which is convenient for such simple objects. We will
illustrate later in our thermodynamics proof how constants can be merged into a Lean structure for reusability.
In Lean, this is :

constants (C_1 C_L s_0 P_0: R)

(hCL : 0 < C_L) (hC1 : 0 < C_1) (hs_0 : 0 < s_0)

With these constant declarations, we can now define y, x, and C in Lean as :

def BET_first_layer_adsorption_rate (P : R) := (C_1)*P

local notation ‘y’ := BET_first_layer_adsorption_rate

def BET_n_layer_adsorption_rate (P : R):= (C_L)*P

local notation ‘x’ := BET_n_layer_adsorption_rate

def BET_constant := C_1/C_L

local notation ‘C’ := BET_constant

Since y and x are both functions of pressure, their definitions require pressure as an input. Alternatively, the input can
be omitted if we want to deal with x as a function rather than as a number. Notice that the symbols we declared using
constant do not need to be supplied in the inputs as they already exist in the global workspace.
We formalize Eq. 7 by recognizing that the main math behind the BET expression is an infinite sequence that describes
the surface area of adsorbed particles for each layer. The series is defined as a function that maps the natural numbers to
the real numbers; the natural numbers represent the indexing. It is defined in two cases: if the index is zero, it outputs
the surface area of the zeroth layer, and if the index is the n + 1, it outputs xn+1 s0 C.
si = Cxi s0 f or i : [1, ∞) (13)

In Lean, we define this sequence as :

def seq (P : nnreal) : N → R

|(0 : N) := s_0
|(nat.succ n) := x^(n+1)*s_0*C

Where si is the surface area of the ith layer, C and x are given by Eq. 12 and Eq. 11, respectively, and s0 is the surface
area of the zeroth layer. The zeroth layer is the base surface and is constant.
We now have the area and volume equations both in terms of geometric series with well-defined solutions. The BET
equation is defined as the ratio of volume absorbed to the volume of a complete unimolecular layer, given by Eq. 14.
P∞
V Cs0 i=1 ixi
= P∞ (14)
A ∗ V0 s0 (1 + C i=1 xi )

8
 Formalizing Chemical Physics

The main transformation in BET is simplifying this sequence into a simple fraction which involves solving the geometric
series. The main math goal is given by Eq. 15.
P∞
C i=1 ixi Cx
P∞ = (15)
(1 + C i=1 xi ) (1 − x)(1 − x + Cx)
Before doing the full derivation, we prove Eq.15, which we call sequence_math. In Lean, this is :
lemmaPBET.sequence_math {P : R} (hx1: (x P) < 1)P
(hx2 : 0 < (x P)) :
( ’ k : N, ((k + 1)*(seq P (k+1))))/(s_0 + ’ k, (seq P (k+1))) =
C*(x P)/((1 - (x P))*(1 - (x P) + (x P)*C)) :=
In Lean, the apostrophe after the sum symbol denotes an infinite sum, which is defined to start at zero since it is indexed
by the natural numbers, which start at zero. Since the infinite sum of Eq. 15 starts at one, we add one to all the indexes,
k, so that when k is zero, we get one, etc. We also define two new theorems that derive the solution to these geometric
series with an index starting at one. After expanding seq, we use those two theorems, and then rearrange the goal to get
two sides that are equal. We also use the tag lemma instead of theorem, just to communicate that it is a lower-priority
theorem, intended to prove other theorems. The tag lemma has no functional difference from theorem in Lean, it’s
purpose is for mathematicians to label proofs.
With this we can formalize the derivation of Eq. 7. First we define Eq. 7 as a new object and then prove a theorem
showing we can derive this object from the sequence. In Lean, the definition looks like this :

def brunauer_26 := λ P : R, C* (x P)/((1-(x P))*(1-(x P)+C*(x P)))

Here, we explicitly define this as a function, because we want to deal with Eq. 7 normally as a function of pressure,
rather then just a number. Now we can prove a theorem that formalizes the derivation of this equation :

theorem brunauer_26_from_seq
{P V_0 : R}
(hx1: (x P) < 1)
(hx2 : 0 < (x P))
: P′
let Vads :=
P′ V_0 * (k : N), ↑k * (seq P k),
A := (k : N), (seq P k) in
Vads/A = V_0*(brunauer_26 P)
:=

Unlike the Langmuir proof introduced earlier in Fig. 1, the BET uses definitions that allow reusability of those definitions
across the proof
P′structure. The proof starts by showing that seq is summable. This means the sequence has some infinite
sum and the symbol is used to get the value of that infinite series. We show in the proof that both seq and k*seq
is summable, where the first is needed for the area sum and the second is needed for the volume sum. After that, we
simplify our definitions, move the index of the sum from zero to one so we can simplify the sequence, and apply the
BET.sequence_math lemma we proved above. Finally, we use the field_simp tactic to rearrange and close the goal. With
that, we formalized the derivation of Eq. 7, just as Brunauer, et al. did in 1938.
In the SI, we continue formalizing BET theory by deriving Equation 28 from the paper, given by Eq. 16
V CP
= (16)
A ∗ V0 (P0 − P )(1 + (C − 1)(P/P0 ))
This follows from recognizing that 1/CL = P0 . While Brunauer, et al. attempt to show this in the paper, we discuss the
trouble with implementing the logic they present. Instead, we show a similar proof that Eq. 7 approaches infinity as
pressure approaches 1/CL , and assume as a premise in the derivation of Eq. 16 that 1/CL ≡ P0 .

3.4 Classical Thermodynamics and Gas Laws: Introducing Lean Structures

Lean is so expressive because it enables relationships between mathematical objects. We can use this functionality to
precisely define and relate scientific concepts with mathematical certainty. We illustrate this by formalizing proofs of
gas laws in classical thermodynamics.
We can prove that the ideal gas law, P V = nRT follows Boyle’s Law, P1 V1 = P2 V2 , following the style of our
derivation of Langmuir’s theory: demonstrating that a conjecture follows from the premises . However, this proof

9
 Formalizing Chemical Physics

style doesn’t facilitate interoperability among proofs and limits the mathematics that can be expressed. z In contrast,
we can prove the same, more systematically, by first formalizing the concepts of thermodynamic systems and states,
extending that system to a specific ideal gas system, defining Boyle’s Law in light of these thermodynamic states, and
then proving that the ideal gas obeys Boyle’s Law (see Fig. 3).

Figure 3: Thermodynamic system in Lean. Here the thermo_system and ideal_gas are Lean structures that describe
different kinds of thermodynamic systems like isobaric, isochoric, isothermal etc. using Lean definitions to proof
theorems relating to the gas laws.

Classical thermodynamics describes the macroscopic properties of thermodynamic states and relationships between them
[60, 61]. We formalize the concept of “thermodynamic system” by defining a Lean structure called thermo_system
over the real numbers, with thermodynamic properties (e.g., pressure, volume, etc.) defined as functions from a type to
the real numbers α → R. Here, α is meant to represent a general indexing type. It could be the natural numbers if
we wanted to use those to represent states of the system, real numbers to represent time, or anything else. The only
requirement is that α is nontrivial, meaning it has at least two different elements. In Lean, this is :

structure thermo_system (α) [nontrivial α]:=

(pressure : α → R)
(volume : : α → R)
(temperature : α → R)
(substance_amount : α → R)
(energy : α → R)

10
 Formalizing Chemical Physics

We define six descriptions of the system: isobaric (constant pressure); isochoric (constant volume); isothermal (constant
temperature); adiabatic (constant energy); closed (constant mass); and isolated (constant mass and energy). Each of
these conditions has the type Prop, or proposition, considering them to be assertions about the system. We formally
define these by stating that, for all (∀) pairs of states n and m, the property at those states is equal. We define these six
descriptions to take in a thermo_system since we need to specify what system we are ascribing this property to. In Lean,
this is :

def isobaric (α) [nontrivial α] (M : thermo_system ) : Prop :=

∀ n m : α, pressure n = pressure m
def isochoric (α) [nontrivial α] (M : thermo_system ) : Prop :=
∀ n m : α, volume n = volume m
def isothermal (α) [nontrivial α] (M : thermo_system ) : Prop:=
∀ n m : α, temperature n = temperature m
def adiabatic (α) [nontrivial α] (M : thermo_system ) : Prop :=
∀ n m : α, energy n = energy m
def closed_system (α) [nontrivial α] (M : thermo_system ) : Prop:=
∀ n m : α, substance_amount n = substance_amount m
def isolated_system (α) [nontrivial α] (M : thermo_system ) : Prop :=
adiabatic M ∧ closed_system M

We define an isolated system as just a closed system and (∧) adiabatic, rather than using the universal quantifier (∀),
since it would be redundant.
Now that the basics of a thermodynamic system have been defined, we can define models that attempt to describe the
system mathematically. These models can be defined as another structure, which extends the thermo_system structure.
When a structure extends another structure, it inherits the properties of the structure it extended. This allows us to create
a hierarchy of structures so we don’t have to redefine properties repeatedly. The most well-known model is the ideal gas
model, which comes with the ideal gas law equation of state. We define the ideal gas model to have two properties,
the universal gas constant, R, and the ideal gas law. In the future, we plan to add more properties to the definition,
especially as we expand on the idea of energy. We define the ideal gas law as an equation relating the products of
pressure and volume to the product of temperature, amount of substance, and the gas constant. In Lean, this is :

structure ideal_gas
extends thermo_system :=
(R : R)
(ideal_gas_law : ∀ n : α,(pressure n)*(volume n) = (substance_amount n)*R*(temperature n))

To define a system modeled as an ideal gas, we write in Lean: (M : ideal_gas R). Now we have a system, M, modeled
as an ideal gas.
Boyle’s law states that the pressure of an ideal gas is inversely proportional to the system’s volume in an isothermal
and closed system [62]. This is mathematically given by Eq. 17, where P is pressure, V is volume, and k is a constant
whose value is dependent on the system.

PV = k (17)

In Lean, we define Boyle’s Law as :

def boyles_law {α} [nontrivial α] (M : thermo_system α ) :=

∃(k : R), ∀ n : α, (pressure n) * (volume n)= k

We use the existential operator (∃) on k, which can be read as there exists a k, because each system has a specific
constant. We also define the existential before the universal, so it is logically correct. Right now, it reads, there exists a
k, such that for all states, this relation holds. If we write it the other way, it would say for all states, there exists a k,
such that this relation holds. The second way means that k is dependent on the state of the system, which isn’t true.
The constant is the same for any state of a system. Also, even though Boyle’s law is a statement about an ideal gas, we
define it as a general system so, in the future, we can look at what assumptions are needed for other models to obey
Boyle’s Law.
Next, we prove a couple of theorems relating to the relations that can be derived from Boyle’s law. From Eq. 17, we can
derive a relation between any two states, given by Eq. 18, where n and m are two states of the system.

11
 Formalizing Chemical Physics

Pn Vn = Pm Vm (18)

The first theorem we prove shows how Eq.18 follows from Eq.17. In Lean this looks like :
theorem boyles_law_relation {α} [nontrivial α] (M : thermo_system α) :
boyles_law M → ∀ n m : α, pressure n * volume n = pressure m * volume m :=
The right arrow can be read as implies, so the statement says that Boyle’s law implies Boyle’s relation. This is achieved
using modus ponens, introducing two new names for the universal quantifier, then rewriting Boyle’s law into the goal by
specializing Boyle’s law with n and m. We also want to show that the inverse relation holds, such that Eq. 18 implies
Eq. 17. In Lean, this is :
theorem boyles_law_relation’ {α} [nontrivial α] (M : thermo_system α) :
(∀ n m, pressure n * volume n = pressure m * volume m) → boyles_law M :=
We begin in the same way by using modus ponens and simplifying Boyle’s law in the form of Eq. 17. Next, we satisfy
the existential by providing an old name. In our proof, we use P1 V1 as an old name for k, then we specialize the relation
with n and 1 and close the goal.
Finally, with these two theorems, we show that Boyle’s law can be derived from the ideal gas law under the assumption
of an isothermal and closed system. In Lean, this is :
theorem boyles_from_ideal_gas {α} [nontrivial α] (M : ideal_gas α)
(iso1 : isothermal M.to_thermo_system ) (iso2 : closed_system M.to_thermo_system ):
boyles_law M :=
This proof is completed by using the second theorem for Boyle’s relation and simplifying the ideal gas relation using
the two iso constraints.
We have implemented this framework to prove both Charles’ and Avagadro’s Law illustrating the interoperability
of these proofs. In the future, we plan to define energy and prove theorems relating to it, including the laws of
thermodynamics [63].

3.5 Kinematic equations: Calculus in Lean

Calculus and differential equations are ubiquitous in chemical theory, and much has been formalized in mathlib. To
illustrate Lean’s calculus capabilities and motivate future formalization efforts, we formally prove that the kinematic
equations follow from calculus-based definitions of motion, assuming constant acceleration. The analysis of physical
equations of motion, particularly those based on Newtonian mechanics, is strongly related to the formulation of many
theories in chemical physics, including reaction kinetics [64], diffusion and transport phenomena [65] and molecular
dynamics [66]. These concepts are essential for understanding chemical reactions and how molecules move and interact.
The equations of motion are a set of two coupled differential equations that relate the position, velocity, and acceleration
of an object in an n-dimensional vector space [67]. The differential equations are given by Eq. 19 and 20, where x, v,
and a represent position, velocity, and acceleration, respectively (bold type face signifies a vector quantity). All three
variables are parametric equations, where each dimension of the vector is a function of time.5

d(x(t))
v(t) = (19)
dt
d(v(t))
a(t) = (20)
dt
As in the thermodynamics section, we can define a structure, motion, to encompass these concepts. This structure
defines three new elements: position, velocity, and acceleration, which are functions, and two differential equations
relating these three functions. This structure also requires the vector space to form an inner product space, which is a
real or complex vector space with an operator (the inner product) over the field. The inner product is a generalization
of the dot product for any vector space. By requiring inner_product_space, the motion structure inherits all of
inner_product_space’s properties and allows us to access the calculus theorems in mathlib. In Lean, this is :
5
These proofs could also be constructed using partial differential equations, but mathlib doesn’t currently have enough theorems
for partial derivatives.

12
 Formalizing Chemical Physics

This is a description of how kinematics is represented in the Lean theorem prover. A structure named 'motion' is defined to depict the relationship between position, velocity, and acceleration through the use of differential equations. These relationships are formalized and proven using Lean's definitions of derivative functions.

structure motion (K : Type u_1) (E : Type u_2) [is_R_or_C K]

[inner_product_space K E] :=
(position velocity acceleration : K → E )
(hvel : velocity = deriv position)
(hacc : acceleration = deriv velocity)

K represents a field that we require to be either a real (R) or complex (C) number, and E symbolizes a general vector
field. In mathematics, a field is an algebraic structure with addition, subtraction, multiplication, and division operations.
Our vector space could be an n-dimensional Euclidean vector space, but we instead use a general vector field to be as
general as possible. This allows us to describe motion in a Euclidean vector space, as well as a hyperbolic vector space
or a vector space with special properties.
In Lean, if a function is not differentiable at a point, the derivative at that point returns zero6 . During our first
formalization attempt, we tried to define a function to be constant by setting its derivative to zero. However, df /dx = 0
may also arise if a function is not differentiable at that point. To avoid this edge case, we define another structure to
require the equations of motion to be n-times continuously differentiable everywhere. We only require the equations to
be n-times differentiable instead of infinitely differentiable for generality reasons, however, a theorem can instantiate
this structure and assume infinite differentiability. We also declare this as a separate structure, instead of in the motion
structure, to allow future proofs that require the equations to be n-times continuously differentiable on a set or an
interval rather than everywhere (e.g., a molecular mechanics force field with a non-smoothed cutoff is not differentiable
at that point). That way, depending on the theorem, the user can choose the appropriate extension. In Lean, this structure
looks like :

structure motion_cont_diff_everywhere (K :Type u_1) (E : Type u_2) [is_R_or_C K]

[inner_product_space K E]
extends motion K E :=
(contdiff : ∀ n : with_top N, m : N,
(m < n) → (cont_diff K n (deriv^[m] position)))

6
Likewise, division by zero is defined to return zero instead of something like "undefined" or "NaN”. In Lean and other theorem
provers, the symbol / is not used for mathematical division but instead points to a function called real.div. This function returns x/y
if y is not zero, and 0 if y equals 0. Another case is the real square root function (real.sqrt), which outputs a real number for any
input, even negatives since it is defined as R → R. These conventions may be unfamiliar to scientists and engineers, but they are
used for convenience and won’t lead to contradictions in a proof. Any invalid step in a proof involving these conventions will be
caught when invoking a theorem not true for its definition. We wrestled with this convention for some time before finding clarity in
this blog post archived for reference [68].

13
 Formalizing Chemical Physics

The field contdiff states that for all n, defined as a natural number including positive infinity, and for all m, defined as a
natural number, if m is less than n, then the mth derivative of position is continuously differentiable n-times.
When acceleration is constant, this set of differential equations has four useful analytical solutions, the kinematic
equations, Eq. 21–24, where the subscript naught denotes variables evaluated at t = 0.
v(t) = at + v0 (21)
2
at
x(t) = + v0 t + x0 (22)
2
v(t) + v0
x(t) = t + x0 (23)
2
v 2 (t) = v02 + 2a · d (24)
Under the assumption of one-dimensional motion, these equations simplify to the familiar introductory kinematic
equations. Eq. 24, also known as the Torricelli Equation, uses the shorthand square to represent the dot product,
v 2 (t) ≡ v(t) · v(t).
With this, we can now begin deriving the four kinematic equations. The first three derivations for Eq. 21–23, all use the
same premises, given below:
(K : Type u_1) (E : Type u_2) [is_R_or_C K] [inner_product_space K E]
(M : motion_cont_diff_everywhere K E)
(A : E) (n : with_top N)
(accel_const : motion.acceleration = λ (t : K), A)
The first line contains four premises to declare the field and vector space the motion space is defined on. The next line
defines a motion space, M. The third line contains two premises, a variable, A, which represents the value of constant
acceleration, and n, the number of times position can be differentiated. When applying these theorems, the top function,
which means positive infinity in Lean, can be used to specify n. The final line is a premise that assumes acceleration is
constant. The lambda function is constant because A is not a function of t, so for any value of t, the function outputs the
same value, A. The three kinematic equations in Lean are given below (note, the premises are omitted since they
have already been given above).
theorem const_accel premises : velocity = λ (t : K), t·A + velocity 0 :=

theorem const_accel’ premises :

position = λ (t : K), (t^2)/2·A + t·(velocity 0) + position 0 :=

theorem const_accel’’ premises :

∀ t : K, position t = (t/2)·((velocity t) - (velocity 0)) + position 0 :=
The · symbol indicates scalar multiplication, such as when a vector is multiplied by a scalar. We normally use the
· symbol for the dot product, but Lean uses the inner function for the dot product. Also, velocity 0 means the
velocity function evaluated at 0. Lean uses parentheses for orders of operations, not for function inputs, so f (x) in
normal notation converts to f x in Lean. The proofs of the first two theorems use the two differential equations from
the motion structure and the antiderivative, whose formalization we explain in the supplementary information (these
theorems weren’t available in mathlib at the time of writing, so we proved them ourselves). The third theorem is
proved by rearranging the previous two theorems.
Because we declared the field is_R_or_C, the above proofs hold for both real and complex time. However, we were
unable to prove Eq. 24, due to the complex conjugate that arises when simplifying the proof. Eq. 24 uses the inner
product, a function that takes in two vectors from a vector space and outputs a scalar. If the vector space is a Euclidean
vector space, this is just the dot product. The inner product is semi-linear, linear in its first argument, Equation 25, but
sesquilinear in its second argument, Equation 26.
⟨ax + by, z⟩ = a⟨x, z⟩ + b⟨y, z⟩ (25)
⟨x, ay + bz⟩ = ā⟨x, y⟩ + b̄⟨x, z⟩ (26)
The bar denotes the complex conjugate: for a complex number, g = a + bi, the complex conjugate is: ḡ = a − bi.
If g is a real number, then g = ḡ. For the proof of Eq. 24, we get to a form where one of the inner products has an
addition in the second term that we have to break up, and no matter which way we rewrite the proof line, one of the
inner products ends up with addition in the second term. To proceed, we instead defined the final kinematic equation to
hold only for real time. In Lean, this looks like :

14
 Formalizing Chemical Physics

theorem real_const_accel’’’
(N : motion_cont_diff_everywhere R E)
(accel_const : N.to_motion.acceleration = (t :R), A)
{n : with_top N}
:

∀ t : R, inner (motion.velocity t) (motion.velocity t) =

inner (motion.velocity 0) (motion.velocity 0) +
2 * inner A ((motion.position t) - (motion.position 0)) :=

While we haven’t proved that Eq. 24 doesn’t hold for complex time, we encountered difficulties and contradictions
when attempting to prove the complex case. Thus, Eq. 24 currently only holds for real time.
An imaginary-time framework can be used to derive equations of motion from non-standard Lagrangians [69, 70] to
examine hidden properties in classical and quantum dynamical systems in the future. By exploring these proofs in both
real and complex time, we illustrate how a proof in one case can be adapted for related cases. Here, four proofs for real
numbers can be easily extended to complex numbers by changing the type declared up front, and the validity of the
proofs in the more general context is immediately apparent.

4 Conclusions and Outlook

In this paper, we demonstrate how interactive theorem proving can be used to formally verify the mathematics in science
and engineering. We found that, although formalization is slower and more challenging than writing hand-written
derivations, our resulting proofs are more rigorous and complete. We observed that in some cases, translating scientific
statements into formal language revealed hidden assumptions behind the mathematical derivations. For example, we
make explicit common implicit assumptions, such as the denominator must not be zero when we deal with division.
As well, in a more abstract way, we have attempted to reveal the formal definitions of equations, such as exactly how
pressure is defined as a function or the assumptions of differentiability needed for kinematics. All of these are a result
of formalizing these theorems. We concur with others who have discussed the limitations of hand-written proofs and
their reliability [71, 4, 72]; formalized proofs can provide greater assurance and robustness.
Importantly, we emphasize that while our proofs are verified to be mathematically correct, this verification does not
extend to the external world. This distinction between syntax (logical relationships among words and arguments in
a language) and semantics (whether words are meaningful or arguments are true, according to external reality) in
scientific reasoning has been emphasized by logicians such as Alfred Tarski [73] and Rudolf Carnap [74, 75]. For
scientists and engineers, whether a theory is true or meaningful is first and foremost about whether observational data
support it – logical correctness of the derivation is required, of course, but this is typically assumed. Indeed, when one
of us described our BET proof to an experimentalist in adsorption, their reply was, "but BET isn’t accurate." They knew
that BET theory does not semantically match experiments in many contexts (in fact, much literature has discussed when
BET analysis should not be applied, for instance [76]). BET theory has been a useful conceptual model for the field, but
nonetheless relies on approximations that often drift far from reality. In this work, we only claim to rigorously establish
the syntax of the theories we describe. Nonetheless, Lean operating with input/output functions can receive data from
the external world, which may open possibilities for semantically grounding its logical conclusions in certain contexts,
as well.
The Lean Theorem Prover is especially powerful, as it facilitates the re-use of theorems and the construction of
higher-level mathematical objects from lower-level ones. We showed how this feature can be leveraged in science
proofs; after a fundamental theory is formally verified, it can then be used in the development of other theories. This
can be approached in two ways: definitions can be directly reused in subsequent proofs, and structures can enable
hierarchies of related concepts, from general to more specific. Thus we have not just proved a few theorems about
scientific objects but have begun to create an interconnected structure of formally verified proofs relating fields of
science.
While learning Lean and writing the proofs appearing here, we routinely asked ourselves, “How do I close this goal? I
wish there was a way to automate this.” In fact, the first vision for computer-assisted proofs in the 1950s and 60s was to
automate the process fully [77]; interactive theorem provers that “merely” check human-written proofs didn’t appear
until later. But historically, automated theorem provers (ATPs) made progress on narrow classes of problems (e.g.,
problems in first-order logic [78]) but couldn’t address proofs in advanced math (except when problems are described
in such simple terms, like the Robbins Conjecture [79]). In short, theorem proving is like searching for a path from
premises to conjecture, but in a realm with an “infinite action space” [?] – traditional algorithms have been inadequate.
For complex proofs, interactive theorem provers (ITPs) have been more successful, because they facilitate human

15
 Formalizing Chemical Physics

creativity in writing proofs, while leveraging the rigor of the computer for checking them and providing feedback to the
user. Modern ITPs also use the computer for small-scale automation via tactics; the human provides strategy while the
computer executes tactics. Complex tactics sometimes blur the line between automated and interactive theorem proving.
For example, Isabelle (an ITP) has the Sledgehammer tactic [80], which takes the current proof state and attempts to
transform it into an equivalent problem in first-order logic, which can then be efficiently solved using an ATP.
Recent approaches have leveraged machine learning to expand the capabilities of automated theorem proving. Theorem
proving can be framed as a reinforcement learning problem [81, 82], in which an agent is to learn an effective theorem
proving policy via rewards from successfully proving theorems. “Autoformalization” refers to the translation of informal
proofs into formal proofs, akin to translating text from one language to another (but with extremely strict requirements
on the formal side) [83]. Theorem proving can also be framed as a next-word-prediction problem (“auto-complete” for
math proofs) in which a database of formal math proofs is used to train a language model to predict the next word in the
proof. Large language models (LLMs) like ChatGPT [84, 85] have some emergent reasoning abilities [86] but often
make mistakes and cannot be trusted. By connecting language models with ITPs to provide feedback, training them on
proof databases like mathlib, and deploying them as part of traditional search algorithms, progress has been made
toward automating proofs in Lean [49, 87, 88], even to the point of generating correct solutions to International Math
Olympiad problems [89].
This interplay between creative but unreliable generative algorithms and the strict logic of a proof-checking system may
be a model for future AI-driven discovery in science, especially for discovering new theories. An early example of this
is AI-Descartes, in which a symbolic regression algorithm generates equations to match experimental data, which is then
combined with an automated theorem prover to establish the equations’ “derivability” with respect to a scientific theory
[35]. However, in this work, each theory required human expertise to be expressed in formal language, and reliance on
an automated theorem prover limited the scope of theories to those expressible in first-order logic. AI tools that can
autoformalize the informal scientific literature, generate novel theories, and auto-complete complex proofs could open
new avenues for automating theory discovery. LLMs have demonstrated capabilities in solving chemistry problems
[90, 91], as well as answering scientific question-and-answer problems invoking quantitative reasoning [92]. However,
LLMs are unreliable - they famously “hallucinate” (generate falsehoods) and are biased or unreliable evaluators of their
own outputs [93, 94]. Pairing them with external tools [95, 96, 97] improves their capabilities; theorem provers could
play a role like that. How will these models be trained? We suggest two avenues: training on human-written databases
of formal proofs in science and engineering (which are yet to be written) and leveraging interactive feedback from
Lean through tools like LeanDojo [88]. Beyond being formally grounded in axiomatic mathematics, formal proofs in
science and engineering are machine-readable instances of correct mathematical logic that could serve as a foundation
for artificial intelligences aiming to learn, reason, and discover in science [98, 99, 100].
Our next goals are to continue building out classical thermodynamics, formalize statistical mechanics, and eventually
construct proofs relating the two fields. We are also interested in laying the foundations for classical mechanics in
Lean and formalizing more difficult proofs like Noether’s Theorem [101] (a basis for deriving conservation laws) or
establishing the 2nd Law of Thermodynamics axiomatically [37].
The proofs in this paper were written in Lean 3 [72], because the extensive mathlib library was only available in Lean
3 when we began. While Lean 3 was designed for theorem proving and management of large-scale proof libraries, the
new version, Lean 4 [102], is a functional programming language for writing proofs and programs, as well as proofs
about programs [102, 103]. The Lean community recently finished porting mathlib to Lean 4; we recommend future
proofs be written in Lean 4, which is more capable, versatile, and easy to use compared to Lean 3. With Lean 4, we are
bridging formally-correct proofs with executable functions for bug-free scientific computing; we will be elaborating on
that in future work.
We hope these expository proofs in adsorption, thermodynamics, and kinematics will inspire others to consider what
proofs and derivations could be formalized in their fields of expertise. Virtually all mathematical concepts can be
established using dependent type theory; the density functionals, partial derivatives, N-dimensional integrals, and
random variables appearing in our favorite theories should be expressible in Lean. Just as an ever-growing online
community of mathematicians and computer scientists is building mathlib [42], we anticipate a similar group of
scientists building a library of formally-verified scientific theories and engineering mathematics. To join, start learning
Lean, join the online community, and see what we can prove!

Author Contributions

We summarize author contributions using the CRediT system. Conceptualization: TRJ; Data curation: MPB, PF, SS;
Formal Analysis: MPB, SS, PF, AHD, CMW, TRJ; Funding Acquisition: TRJ; Methodology: MPB, TRJ; Project

16
 Formalizing Chemical Physics

administration: MPB, SS, TRJ; Software: MPB, SS, TRJ; Supervision: TRJ; Validation: Lean; Visualization: MPB, SS,
PF, TRJ; Writing, Original draft: MPB, SS, PF, TRJ; Writing, review and editing: MPB, SS, PF, TRJ.

Acknowledgements
We are grateful to the Lean prover community and contributors of mathlib on whose work this project is built. We
especially thank Kevin Buzzard, Patrick Massot, Tomas Skrivan, Eric Wieser, and Andrew Yang for helpful comments
and discussions around our proof structure and suggestions for improvement. We thank Charles Fox, Mauricio Collares,
and Ruben Van de Velde for helping with the website. We thank two anonymous peer reviewers, as well as Rose Bohrer,
John Keith, and Ben Payne for reading the manuscript and providing helpful feedback. This material is based upon
work supported by the National Science Foundation under Grant No. (NSF #2138938), as well as startup funds from
the University of Maryland, Baltimore County.

Supporting Information
The supporting information provides additional background on how Lean works (Section 5.1) and all the additional
proofs (Section 5.2), including an improved version of Langmuir adsorption model (5.2.1), the final derived form of
BET adsorption model (5.2.2), and the antiderivative proofs (5.2.3) that was used for kinematic equations. All code and
proofs for this project are available in our GitHub repository .

Conflicts of Interest
The authors declare that they have no known competing financial interests or personal relationships that could have
appeared to influence the work reported in this paper.

17
 Formalizing Chemical Physics

Glossary of Mathematical Terms and Symbols

Term Definition Example

Axiom A self-evident truth which is assumed to be true Two sets are equal if they have the same elements;
and doesn’t require proof. this is not proved, it is assumed.
Theorem A theorem is a proposition or statement in math The Pythagorean theorem, a2 + b2 = c2 for all
that can be demonstrated to be true by accepted right triangles
mathematical operations and arguments.
Lemma A true statement which is used as a stepping stone All numbers multiplied by 2 are even. Proving
to prove other true statements. A lemma is a this could be an intermediate result used for other
smaller, less important result than a theorem. proofs.
Proposition A true or false statement. Socrates is mortal, all swans are white, and 3 < 4
are propositions.
Hypothesis A statement assumed to be true that the proof fol- If all four sides of a rectangle have the same
(Premise) lows from. It can also be thought of as the con- length, it is a square. The hypotheses would be
ditions or prerequisites for the theorem to hold. “the shape is a rectangle (has four sides and four
We emphasize that the math community uses "hy- equal, right angles)” and “all sides have the same
pothesis" somewhat differently than the scientific length.”
community.
Conjecture A statement which is proposed to be true, but no Goldbach’s conjecture: every even number
proof has been found yet. greater than 2 is the sum of two prime numbers.
This hasn’t been proven true or false yet.
Proof A sequence of logical steps which conclude that a The proof of the Pythagorean theorem using ge-
statement is true from its hypotheses. ometry
Function An expression that defines a relation between a set f (x) = x2 relates (or maps) the set of real num-
of inputs and a set of outputs. bers x to their square.
Tactic A command used to construct or manipulate rw is "rewrite", a simple tactic that performs sub-
proofs. Tactics in Lean provide a way to auto- stitution for equalities. ring is a more complex
mate certain proof steps or apply predefined proof tactic for automatically closing goals requiring
strategies to make the process of constructing for- numerous algebraic operations, without the user
mal proofs more efficient and convenient. specifying all the steps.
Type A type can be thought of as a set, or category, that The natural numbers are a type. The Booleans
contains terms. In other programming languages, (True and False) are also a type. Functions from
types define the category of data certain objects integers to reals are also a type.
have (e.g. floats, strings, integers). Types in Lean
work this way, too, and have more features: they
can depend on values, as well as be the subject of
proofs.
Term Terms are members of a type. Considering the type of natural numbers, then
numbers like 1, 2, 3, and 8 are terms of that type.
N Symbol for the set of natural numbers The numbers 0, 1, 2, 3, 4...
Z Symbol for the set of integers The numbers, -3, -2, -1, 0, 1, 2 ...
Q Symbol for the set of rational numbers The numbers, 21 , 34 , 59 , etc. √
R Symbol for the set of real numbers p number, π, 2, etc.
-1, 3.6, Euler’s
C Symbol for the set of complex numbers -1, 5 + 2i, (2) + 5i, etc.
∀ Logical symbol for "for all"
∃ Logical symbol for "there exists"

References
[1] Langmuir I. The adsorption of gases on plane surfaces of glass, mica and platinum. Journal of the American
Chemical Society. 1918;40(9):1361-403.
[2] Brunauer S, Emmett PH, Teller E. Adsorption of gases in multimolecular layers. Journal of the American
Chemical Society. 1938;60(2):309–319.
[3] Hinsen K. Computational science: shifting the focus from tools to models. F1000Research. 2014;3(101).
[4] Hales TC. Formal proof. Notices of the AMS. 2008;55(11):1370-80.

18
 Formalizing Chemical Physics

[5] Rudnicki P. An overview of the Mizar project. In: Proceedings of the 1992 Workshop on Types for Proofs and
Programs; 1992. p. 311-30.
[6] Wenzel MM. Isabelle/Isar - A versatile environment for human-readable formal proof documents; 2002.
[7] Barras B, Boutin S, Cornes C, Courant J, Filliatre JC, Gimenez E, et al.. The Coq proof assistant reference
manual: Version 6.1; 1997.
[8] Gordon MJ, Melham TF. Introduction to HOL: A theorem proving environment for higher order logic. Cambridge
University Press; 1993.
[9] Nipkow T, Wenzel M, Paulson LC. Isabelle/HOL: A proof assistant for higher-order logic. Springer; 2002.
[10] Owre S, Rushby JM, Shankar N. PVS: A prototype verification system. In: International Conference on
Automated Deduction. Springer; 1992. p. 748-52.
[11] Meurer A, Smith CP, Paprocki M, Čertík O, Kirpichev SB, Rocklin M, et al. SymPy: Symbolic Computing in
Python. PeerJ Computer Science. 2017;3:e103.
[12] Durán AJ, Pérez M, Varona JL. The Misfortunes of a Trio of Mathematicians Using Computer Algebra Systems.
Can We Trust in Them? Notices of the American Mathematical Society. 2014 Nov;61(10):1249. Available from:
http://www.ams.org/notices/201410/rnoti-p1249.pdf.
[13] de Moura L, Kong S, Avigad J, van Doorn F, von Raumer J. The Lean theorem prover (system description).
Automated Deduction - CADE-25. 2015:378–388.
[14] Wolfram S. Mathematica: A system for doing mathematics by computer. Addison Wesley Longman Publishing
Co., Inc.; 1991.
[15] Inc TM. Symbolic Math Toolbox - MATLAB: 9.14.0 (R2023b). Natick, Massachusetts, United States: The
MathWorks Inc.; 2023. Available from: https://www.mathworks.com.
[16] Appel K, Haken W, Koch J. Every planar map is four colorable. Part II: Reducibility. Illinois Journal of
Mathematics. 1977;21(3):491-567.
[17] Gonthier G, et al. Formal proof–the four-color theorem. Notices of the AMS. 2008;55(11):1382-93.
[18] Boldo S, Lelay C, Melquiond G. Coquelicot: A user-friendly library of real analysis for Coq. Mathematics in
Computer Science. 2015;9(1):41-62.
[19] Hales T, Adams M, Bauer G, Dang TD, Harrison J, Le Truong H, et al. A formal proof of the Kepler conjecture.
In: Forum of Mathematics, Pi. vol. 5. Cambridge University Press; 2017. .
[20] Buzzard K, Commelin J, Massot P. Formalising perfectoid spaces. In: Proceedings of the 9th ACM SIGPLAN
International Conference on Certified Programs and Proofs; 2020. p. 299-312.
[21] Hartnett K. Proof Assistant Makes Jump to Big-League Math; 2021. Accessed: 2022-08-26. https://www.
quantamagazine.org/lean-computer-program-confirms-peter-scholze-proof-20210728/.
[22] Whitehead AN, Russell B. Principia Mathematica. Cambridge University Press; 1997.
[23] Hartnett K. Building the Mathematical Library of the Future. Quanta Magazine. 2020 Oct.
[24] Hilbert D. Mathematical problems. Bulletin of the American Mathematical Society. 1902;8(10):437–479.
[25] Corry L. David Hilbert and the axiomatization of physics (1894–1905). Archive for history of exact sciences.
1997;51:83-198.
[26] Gorban AN. Hilbert’s sixth problem: the endless road to rigour. The Royal Society Publishing; 2018.
[27] Paleo BW. Physics and proof theory. Applied Mathematics and Computation. 2012;219(1):45-53.
[28] Fleuriot JD, Paulson LC. A combination of nonstandard analysis and geometry theorem proving, with application
to Newton’s Principia. In: Carbonell JG, Siekmann J, Goos G, Hartmanis J, Van Leeuwen J, Kirchner C, et al.,
editors. Automated Deduction — CADE-15. vol. 1421. Springer Berlin Heidelberg; 1998. p. 3-16. Series Title:
Lecture Notes in Computer Science. Available from: https://link.springer.com/10.1007/BFb0054241.
[29] Fleuriot JD, Paulson LC. Proving Newton’s Propositio Kepleriana Using Geometry and Nonstandard Analysis
in Isabelle. In: Goos G, Hartmanis J, Van Leeuwen J, editors. Automated Deduction in Geometry. vol. 1669.
Springer Berlin Heidelberg; 1999. p. 47-66. Series Title: Lecture Notes in Computer Science. Available from:
http://link.springer.com/10.1007/3-540-47997-X_4.
[30] Stannett M, Németi I. Using Isabelle/HOL to verify first-order relativity theory. Journal of Automated Reasoning.
2014;52(4):361-78.
[31] Lu EH. A formalization of elements of special relativity in Coq; 2017.

19
 Formalizing Chemical Physics

[32] Khan-Afshar S, Siddique U, Mahmoud MY, Aravantinos V, Seddiki O, Hasan O, et al. Formal analysis of optical
systems. Mathematics in Computer Science. 2014;8(1):39-70.
[33] Siddique MU. Formal analysis of geometrical optics using theorem proving; 2015.
[34] Cervera-Lierta A, Krenn M, Aspuru-Guzik A. Design of quantum optical experiments with logic artificial
intelligence. Quantum. 2022;6:836.
[35] Cornelio C, Dash S, Austel V, Josephson TR, Goncalves J, Clarkson KL, et al. Combining data and theory for
derivable scientific discovery with AI-Descartes. Nature Communications. 2023 Apr;14(1):1777. Available
from: https://www.nature.com/articles/s41467-023-37236-y.
[36] Carathéodory C. Untersuchungen über die Grundlagen der Thermodynamik. Mathematische Annalen.
1909;67:355-86.
[37] Lieb EH, Yngvason J. The physics and mathematics of the second law of thermodynamics. Physics Reports.
1999;310(1):1-96.
[38] Bohrer R. Chemical Case Studies in KeYmaera X. In: Groote JF, Huisman M, editors. Formal Methods for
Industrial Critical Systems - 27th International Conference, FMICS 2022, Warsaw, Poland, September 14-15,
2022, Proceedings. vol. 13487 of Lecture Notes in Computer Science. Springer; 2022. p. 103-20. Available from:
https://doi.org/10.1007/978-3-031-15008-1_8.
[39] Alur R. Formal verification of hybrid systems. In: Proceedings of the ninth ACM international conference on
Embedded software; 2011. p. 273-8.
[40] Avigad J, de Moura L, Kong S. Theorem proving in Lean. Release. 2015;3(0):1-4.
[41] mathlib Community T. The lean mathematical library. In: Proceedings of the 9th ACM SIGPLAN International
Conference on Certified Programs and Proofs. ACM; 2020. Available from: https://doi.org/10.1145%
2F3372885.3373824.
[42] Lean Prover Community on Zulip;. https://leanprover.zulipchat.com/.
[43] Undergraduate Mathematics in mathlib;. https://leanprover-community.github.io/undergrad.html.
[44] Buzzard K, Commelin J, Massot P. Formalising Perfectoid Spaces. In: Proceedings of the 9th ACM SIGPLAN
International Conference on Certified Programs and Proofs. CPP 2020. New York, NY, USA: Association for
Computing Machinery; 2020. p. 299–312. Available from: https://doi.org/10.1145/3372885.3373830.
[45] Dahmen SR, Hölzl J, Lewis RY. Formalizing the solution to the Cap Set problem. In: 10th International
Conference on Interactive Theorem Proving (ITP 2019). vol. 141 of Leibniz International Proceedings in
Informatics (LIPIcs). Dagstuhl, Germany: Schloss Dagstuhl–Leibniz-Zentrum fuer Informatik; 2019. p. 15:1-
15:19. Available from: http://drops.dagstuhl.de/opus/volltexte/2019/11070.
[46] Scholze P. Lean liquid. GitHub; 2020. https://github.com/leanprover-community/lean-liquid.
[47] Hartnett K. Proof Assistant Makes Jump to Big-League Math. Quanta Magazine. 2021 Jul.
[48] Buzzard K, Pedramfar M. Natural Number Game. GitHub; 2020. https://github.com/
ImperialCollegeLondon/natural_number_game.
[49] Han JM, Rute J, Wu Y, Ayers EW, Polu S. Proof artifact co-training for theorem proving with language models.
arXiv; 2021. Available from: https://arxiv.org/abs/2102.06203.
[50] Polu S, Han JM, Zheng K, Baksys M, Babuschkin I, Sutskever I. Formal Mathematics Statement Curriculum
Learning. In: International Conference on Learning Representations; 2023. .
[51] Whitehead GW. Elements of Homotopy Theory. vol. 61. Springer Science & Business Media; 2012.
[52] Goerss PG, Jardine JF. Simplicial Homotopy Theory. Springer Science & Business Media; 2009.
[53] Coquand T, Huet G. The Calculus of Constructions; 1986.
[54] Coquand T, Paulin C. Inductively defined types. In: International Conference on Computer Logic. Springer;
1988. p. 50-66.
[55] Coquand T, Gallier JH. A proof of strong normalization for the theory of constructions using a Kripke-like
interpretation; 1990.
[56] Volmer M. Thermodynamische Folgerungen ans der Zustandsgleichung für adsorbierte Stoffe. Zeitschrift für
Physikalische Chemie. 1925;115(1):253-60.
[57] Masel RI. Principles of adsorption and reaction on solid surfaces. vol. 3. John Wiley & Sons; 1996.
[58] Kleman M, Lavrentovich OD. Soft Matter Physics: An introduction. Springer; 2003.

20
 Formalizing Chemical Physics

[59] Barendregt H, Dekkers W, Statman R. Lambda calculus with types. Cambridge University Press; 2013.
[60] Dahm KD, Visco DP. Fundamentals of Chemical Engineering Thermodynamics. Cengage Learning; 2015.
[61] Sandler SI. Chemical, Biochemical, and Engineering Thermodynamics. John Wiley & Sons; 2017.
[62] Levine IN. Physical Chemistry. McGraw-Hill; 1978.
[63] Atkins P. The Laws of Thermodynamics: A Very Short Introduction. OUP Oxford; 2010.
[64] Frost A, Pearson R. Kinetics and Mechanism. The Journal of Physical Chemistry. 1961;65(2):384-4.
[65] Bird RB. Transport phenomena. Appl Mech Rev. 2002;55(1):R1-4.
[66] Haile JM, Johnston I, Mallinckrodt AJ, McKay S. Molecular Dynamics Simulation: Elementary Methods. vol. 7.
American Institute of Physics; 1993.
[67] Beggs JS. Kinematics. CRC Press; 1983.
[68] Division by zero in type theory: a FAQ — web.archive.org;. [Accessed 21-Jul-2023]. https:
//web.archive.org/web/20230719150030/https://xenaproject.wordpress.com/2020/07/05/
division-by-zero-in-type-theory-a-faq/.
[69] Popov V. Imaginary-time method in quantum mechanics and field theory. Physics of Atomic Nuclei.
2005;68(4):686-708.
[70] Rami ENA, Soulati T, Rezazadeh H. Non-standard complex Lagrangian dynamics. J Adv Res Dyn Control Syst.
2013;5:50-62.
[71] Bundy A, Jamnik M, Fugard A. What is a proof? Philosophical Transactions of the Royal Society A:
Mathematical, Physical and Engineering Sciences. 2005;363(1835):2377-91.
[72] Avigad J, Harrison J. Formally Verified Mathematics. Communications of the ACM. 2014;57(4):66-75.
[73] Tarski A. The semantic conception of truth: and the foundations of semantics. Philosophy and phenomenological
research. 1944;4(3):341-76.
[74] Stebbing LS. The logical syntax of language. by Rudolf Carnap. translated from the German by Amethe Smeaton
(countess von zeppelin). (London: Kegan Paul, Trench, Trubner &amp; Co., Ltd. 1937. pp. XVI + 352. price
25s.). Philosophy. 1938;13(52):485–486.
[75] Carnap R. Introduction to Semantics; 1942.
[76] Ambroz F, Macdonald TJ, Martis V, Parkin IP. Evaluation of the BET Theory for the Characterization of Meso
and Microporous MOFs. Small methods. 2018;2(11):1800173.
[77] Harrison J, Urban J, Wiedijk F. History of Interactive Theorem Proving. In: Computational Logic. vol. 9; 2014.
p. 135-214.
[78] Kovács L, Voronkov A. First-order theorem proving and Vampire. In: International Conference on Computer
Aided Verification. Springer; 2013. p. 1-35.
[79] McCune W. Solution of the Robbins Problem. Journal of Automated Reasoning. 1997;19(3):263–276.
[80] Blanchette JC, Bulwahn L, Nipkow T. Automatic proof and disproof in Isabelle/HOL. In: Frontiers of Combining
Systems: 8th International Symposium, FroCoS 2011, Saarbrücken, Germany, October 5-7, 2011. Proceedings 8.
Springer; 2011. p. 12-27.
[81] Kaliszyk C, Urban J, Michalewski H, Olšák M. Reinforcement learning of theorem proving. Advances in Neural
Information Processing Systems. 2018;31.
[82] Crouse M, Abdelaziz I, Makni B, Whitehead S, Cornelio C, Kapanipathi P, et al. A deep reinforcement learning
approach to first-order logic theorem proving. In: Proceedings of the AAAI Conference on Artificial Intelligence.
vol. 35; 2021. p. 6279-87.
[83] Szegedy C. A promising path towards autoformalization and general artificial intelligence. In: Intelligent Com-
puter Mathematics: 13th International Conference, CICM 2020, Bertinoro, Italy, July 26–31, 2020, Proceedings
13. Springer; 2020. p. 3-20.
[84] Brown T, Mann B, Ryder N, Subbiah M, Kaplan JD, Dhariwal P, et al. Language models are few-shot learners.
Advances in Neural Information Processing Systems. 2020;33:1877-901.
[85] Chen M, Tworek J, Jun H, Yuan Q, Pinto HPdO, Kaplan J, et al. Evaluating large language models trained on
code. arXiv preprint arXiv:210703374. 2021.
[86] Wei J, Wang X, Schuurmans D, Bosma M, Xia F, Chi E, et al. Chain-of-thought prompting elicits reasoning in
large language models. Advances in Neural Information Processing Systems. 2022;35:24824-37.

21
 Formalizing Chemical Physics

[87] Han JM. GPT-f in Lean. GitHub; 2020. https://github.com/jesse-michael-han/lean-gptf.

[88] Yang K, Swope AM, Gu A, Chalamala R, Song P, Yu S, et al. LeanDojo: Theorem Proving with Retrieval-
Augmented Language Models. arXiv preprint arXiv:230615626. 2023.
[89] Zheng K, Han JM, Polu S. MiniF2F: a cross-system benchmark for formal Olympiad-level mathematics; 2022.
[90] Hocky GM, White AD. Natural language processing models that automate programming will transform chemistry
research and teaching. Digital Discovery. 2022;1(2):79-83.
[91] White AD, Hocky GM, Gandhi HA, Ansari M, Cox S, Wellawatte GP, et al. Do large language models know
chemistry? Cambridge Open Engage; 2022. .
[92] Lewkowycz A, Andreassen A, Dohan D, Dyer E, Michalewski H, Ramasesh V, et al. Solving quantitative
reasoning problems with language models. NeurIPS. 2022.
[93] Bran AM, Cox S, White AD, Schwaller P. ChemCrow: Augmenting large-language models with chemistry tools.
arXiv preprint arXiv:230405376. 2023.
[94] Liu Y, Iter D, Xu Y, Wang S, Xu R, Zhu C. Gpteval: Nlg evaluation using gpt-4 with better human alignment.
arXiv preprint arXiv:230316634. 2023.
[95] Richards TB. Auto-GPT: An Autonomous GPT-4 Experiment. GitHub; 2023. https://github.com/
Significant-Gravitas/Auto-GPT.
[96] Chase H. LangChain: Building applications with LLMs through composability. GitHub; 2022. https://
github.com/langchain-ai/langchain.
[97] Function calling in GPT-4 and GPT-3.5;. https://openai.com/blog/
function-calling-and-other-api-updates.
[98] Bradshaw GF, Langley PW, Simon HA. Studying scientific discovery by computer simulation. Science.
1983;222(4627):971-5.
[99] Kitano H. Nobel Turing Challenge: creating the engine for scientific discovery. npj Systems Biology and
Applications. 2021;7(1):1-12.
[100] Krenn M, Pollice R, Guo SY, Aldeghi M, Cervera-Lierta A, Friederich P, et al. On scientific understanding with
artificial intelligence. Nature Reviews Physics. 2022:1-9.
[101] Kosmann-Schwarzbach Y. The Noether theorems. Springer; 2011.
[102] Moura Ld, Ullrich S. The Lean 4 theorem prover and programming language. In: International Conference on
Automated Deduction. Springer; 2021. p. 625-35.
[103] Christiansen DT. Functional Programming in Lean;. https://leanprover.github.io/functional_
programming_in_lean/.
[104] Dybjer P. Inductive families. Formal aspects of computing. 1994;6(4):440-65.
[105] Skolem TA. Peano’s Axioms and Models of Arithmetic. vol. 16. Elsevier; 1955.

22
 Formalizing Chemical Physics

5 Supporting Information
5.1 Additional Background

Lean is an open source theorem prover developed by Microsoft Research and Carnegie Mellon University, based on
dependent type theory, with the goal to formalize theorems in an expressive way [13]. Lean supports user interaction
and constructs axiomatic proofs through user input, allowing it to bridge the gap between interactive and automated
theorem proving. Like Mizar [5] and Isabelle [6], Lean allows user to state definitions and theorems but also combines
more imperative tactic styles as in Coq [7], HOL-Light [8], Isabelle [9] and PVS [10] to construct proofs. The ability to
define mathematical objects, rather then just postulate them is where Lean gets its power [40]. It can be used to create
an interconnected system of mathematics where the relationship of objects from different fields can be easily shown
without loosing generality.

Figure S1: Overview of Lean Theorem Prover

As mentioned above, the power of Lean comes from the ability to define objects and prove properties about them. In
Lean, there are three ways to define new Types: type universes, Pi types, and inductive types. The first two are used to
construct the basis of dependent type theory, and are used for more theoretical, foundational stuff. Instead we will focus
on the use of inductive types. Standard inductive types, known as just inductive types, are built from a set of constructors
and well found recursion. Non-recursive inductive types that contain only one constructor are called structures.
Many mathematical objects in Lean can be constructed through inductive types, which is a type built from a set of
constructors and proper recursion [104]. The natural numbers are an inductive type, defined using Peano’s Encoding
[105]. This requires two constructors, a constant element, 0 : nat, and a function called the successor function, S. Then
one can be constructed as S(0), two can be constructed as S(S(0)), etc.
In Lean, the natural numbers are defined as:

inductive nat
| zero : nat
| succ (n : nat) : nat

Here, the type nat is defined through recursion by a constant element, zero, and a function. With this, the def command
is used to define properties about the class, like addition or multiplication. For instance, the addition of the natural
numbers is defined as:

protected def add : nat → nat → nat

| a zero := a
| a (succ b) := succ (add a b)

Addition is defined as a function that takes in two natural numbers and outputs a natural number. Since the natural
numbers are created from two constructors, there are two cases of addition that must be shown. The first is a general
natural number plus zero which yields the general natural number, and the next is a general natural number plus the
successor of a general natural number. The second case used recursion and calls add again until it reduces to zero.
The other way to define types is using structure which allows us to add constraints to a type variable. For instance, the
class has_add constrains a type to have a function called add which represents addition.

class has_add (α : Type u) :=

(add : α → α → α)

23
 Formalizing Chemical Physics

This can be used for more advanced ideas, like defining rings or abelian groups. We can use class to define areas of
science as new types with constraints to follow certain rules.

5.2 Additional Proofs

5.2.1 Langmuir Adsorption

The first Langmuir proof introduced earlier states every premise explicitly but however we can condense that by
rewriting hrad and hrd into hreaction to yield k_ad*P*S = k_d*A and we can then rewrite hθ and hK in the goal
statement. While hrad, hrd, hθ, and hK have scientific significance, they do not have any mathematical significance. In
Lean it looks like:

theorem Langmuir_single_site2
(P k_ad k_d A S: R)
(hreaction : k_ad*P*S = k_d*A)
(hS : S ̸= 0)
(hk_d : k_d ̸= 0)
: A/(S+A) = k_ad/k_d*P/(1+k_ad/k_d*P) :=

However, while those four variables do not have any mathematical significance, and only serve to hinder our proofs,
they do have scientific significance, and we do not want to just omit them. Instead we can use the let command to
create an in-line, local definition. This allows us to have the applicability of the theorem, while still having scientifically
important variables. In Lean, this looks like :

theorem Langmuir_single_site
(P k_ad k_d A S : R)
(hreaction : let r_ad := k_ad*P*S, r_d := k_d*A in r_ad = r_d)
(hS : S ̸= 0)
(hk_d : k_d ̸= 0)
:
let θ := A/(S+A),
K := k_ad/k_d in
θ = K*P/(1+K*P) :=

The first line after the theorem statement, gives the variables use in the proof. Notice that rad , rd , Keq , and θ are not
defined as variables. Instead, the let statement defines those four variables in their respective premise or goal. Then, in
the proof we can simplify the let statement to get local definitions of those variables, just like hrad, hrd, hθ, and hK.
While this version of proof follow the same proof logic minus the two initial rewrites from earlier version, however if
we stick with the first proof, we will find it very difficult to use compared to using this proof above, because of all those
hypothesises. Suppose we wanted to prove langmuir_single_site2 and we already have proven langmuir_single_site.
We would find it impossible to use langmuir_single_site because we are missing premises like hrad or hrd. Yet, we
could prove the other way, ie. use langmuir_single_site to prove langmuir_single_site2. Having all of those extra
premises that define the relation between variables only serves to hinder the applicability of our proofs.

5.2.2 BET Adsorption

We continue the derivation of Equation 27 from the paper that aims to redefine x as x = P/P0 , by recognizing that the
volume should approach infinity at the saturation pressure, and, mathematically, it approaches infinity as x approaches
one from the left. For x to approach one, pressure must approach 1/CL . First, we show that Equation 26 from the
paper approaches infinity as P approaches 1/CL . We specifically require it to approach from the left because volume
approaches negative infinity if we come from the right. In Lean, this looks like :

lemma BET.tendsto_at_top_at_inv_CL
: filter.tendsto brunauer_26
(nhds_within (1/C_L) (set.Ioo 0 (1/C_L)))
filter.at_top:=

The function filter.tendsto is the generic definition of the limit. It has three inputs, the function, what the independent
variable approaches, and what the function approaches, in that order. We split this into three lines to better visualize
what is happening. First, we are using the object brunauer_26, which is the BET equation as a function of pressure in

24
 Formalizing Chemical Physics

terms of x. Next, (nhds_within (1/C_L) (set.Ioo 0 (1/C_L))) is how we say approaches 1/CL from the left. nhds_within
means the intersection of a neighborhood, abbreviated as nhds, and a set. A neighborhood of a point is the open
set around that point. set.Ioo designates a left-open right-open interval. Here we have the interval (0, 1/CL ). The
intersections of the neighborhood and this set constrains us to approach the neighborhood from the left. The final part is
filter.at_top which is a generalization of infinity, and just says our function approaches infinity.
In the original derivation done by Brunauer et al, they wish to show that P0 = 1/CL because as pressure approaches
each of these values, volume approaches infinity, these two values are equal. It should be noted that this idea is only true
if C, the BET constant, is greater than or equal to one. If not, the function has two points where it hits infinity in the
positive pressure region. We also have problems showing the congruence of such a fact in Lean, since such a relation
has yet to be formalized and the congruence of two nhds_within has not been shown. For now, we use the lemma
above to prove a simplier version of the theorem where we assume P0 = 1/CL , and show that with this assumption, V
approaches infinity. In Lean, this looks like :

theorem brunauer_27
(h1 : P_0 = 1/C_L)
: filter.tendsto brunauer_26 (nhds_within (P_0) (set.Ioo 0 (P_0))) filter.at_top:=

The proof of this theorem involves rewriting h1, and then applying the lemma proved above. While we would prefer
to prove that P0 = 1/CL , this proof will serve as a placeholder, until Mathlib builds out more math related to the
congruence of this subject. This theorem does not use a lcoal definition, like Langmuir, because P0 is already defined
as a variable using constant.
Finally, we formalize the derivation of Equation 28 from the paper, givne by Equation 27.

V CP
= (27)
A ∗ V0 (PO − P )(1 + (C − 1)(P/P0 )
Just like Equation 7, we first define Equation 27 at an object then formalize the derivation of this object. In Lean, the
object looks like :

def brunauer_28 := λ P : R, C*P/((P_0-P)*(1+(C-1)*(P/P_0)))

Now we can prove a theorem that formalizes the derivation of this object :

theorem brunauer_28_from_seq
{P V_0: R}
(h27 : P_0 = 1/C_L)
(hx1: (x P) < 1)
(hx2 : 0 < (x P)) P′
: let Vads :=
P′ V_0 * (k : N), ↑k * (seq P k),
A := (k : N), (seq P k) in
Vads/A = V_0*(brunauer_28 P) :=

Rather then explicitly solving the sequence ratio, like we did for Equation 7, we can now use the theorem that derived
Equation 7 to solve the left hand side of our new goal. We then have a goal where we show that Equation 27 is just a
rearranged version of Equation 7, which is done through algebraic manipulation.

5.2.3 The antiderivative in Lean

For a function, f , the antiderivative of that function, given by F , is a differentiable function, such that the derivative
of F is the original function f . In Lean, we formalize the general antiderivative and show how it can be used for
several specific applications, including the antiderivative of a constant, of a natural power, and of an integer power. We
generalize our functions as a function from a general field onto a vector field, f : K → E. This allows us to apply the
theorems to any parametric vector function, including scalar functions.
Our goal is to show, from the assumption that f (t) is the derivative of F (t) and f (t) is the derivative of G(t), then we
have an equation F (t) = G(t) + F (0), which is the antiderivative of f (t). G(t) is the variable portion of the equation.
For example, if the antiderivative is of the form F (t) = t3 + t + 6, then G(t) = t3 + t and F (0) = 6. F (0) is the
constant of integration, but written in a more explicit relation to the function. Since G(t) is the function of just variables,
we have as another premise G(0) = 0.

25
 Formalizing Chemical Physics

The first goal is to show that a linearized version of the antiderivative function holds. We can rewrite F (t) so that is
linear by moving G(t) to the left hand side, leaving us with an equation that equals a constant.
F (t) − G(t) = C (28)
Thus, we can relate any two points along this function, ∀xy, F (x) − G(x) = F (y) − G(y). To show this holds, we
recognize that if Equation 28 is constant, then the derivative of this function is equal to zero.
d
(F (t) − G(t)) = 0 (29)
dt
d d
Next, we apply the linearity of differentiation to Equation 29 to get a new form: dt F (t) − dt G(t) = 0, and rearrange
to get:
d d
F (t) = G(t) (30)
dt dt
From the first premise, we assumed that f (t) is the derivative of F (t). From our second premise, we assumed that f (t)
is also the derivative of G(t). Thus, applying both premises, we can simplify Equation 30 to:
f (t) = f (t) (31)
which we recognize to be correct.
Now that we have a new premise to use, given by Equation 32, we can specialize this function to get our final form.
∀xy, F (x) − G(x) = F (y) − G(y) (32)
We specialize the universals by supplying two old names. For x, we use t (the variable we have been basing our
differentiation around), and for y we use 0. Thus, Equation 32 becomes:
F (t) − G(t) = F (0) − G(0) (33)
Our third premise was that G(0) = 0, so we can simplify and rearrange Equation 32, to get our final form:
F (t) = G(t) + F (0) (34)
Which satisfies the goal we laid out in the beginning. In Lean, the statement of this theorem looks like :
theorem antideriv
{E : Type u_2} {K: Type u_3} [is_R_or_C K] [normed_add_comm_group E]
[normed_space K E]
{f F G: K → E} (hf : ∀ t, has_deriv_at F (f t) t)
(hg : ∀ t, has_deriv_at G (f t) t)
(hg’ : G 0 = 0)
: F = λ t, G t + F(0) :=
Applying the antideriv theorem to examples is very straight forward. We will show an example by deriving the
antiderivative of a constant function. In Lean, we would state this as :
theorem antideriv_const
(F : K → E) k : E
(hf : ∀ t, has_deriv_at F k t):
(F = (x : K)), x·k + F 0) :=
Here we say that the derivative of F (x) is the constant k, and want to show that F (x) = x · k + F (0), where the "·"
operator stands for scalar multiplication. To use the antideriv theorem, we must show that its premises follow, meaning
we must show:
∀ t, has_deriv_at F k t
∀ t, has_deriv_at x·k k t
0·k = 0
The first goal is explicitly given in our premises, hf. The next goal can be derived by taking out the constant, and
showing that the function x has a derivative equal to 1. The final goal can be easily proven by recognizing zero
multiplied by anything is zero. Thus, we have formalized antiderivative of a constant function, and can use this same
process for any other function. The antiderivative is especially important for deriving the kinematic equations, as seen
in the next section.

26