Add two points on a curve. Keep going.
On some cubic curves the fraction solutions run out almost immediately. On others they never stop, and the numbers involved get astronomically large astonishingly fast. There is no known way to tell which kind you have by looking at the equation.
In the early 1960s Bryan Birch and Peter Swinnerton-Dyer ran an experiment on the EDSAC computer in Cambridge. They could not answer the question directly, so they counted solutions modulo every small prime instead and looked at how the counts behaved in bulk. What came out of that was a pattern nobody expected, and nobody has explained since.
01 | The group law
Two points on the curve make a third.
Take a cubic curve and two points on it with fraction coordinates. Draw the line through them. A line meets a cubic in three places, so there is a third intersection, and its coordinates are fractions too because they come out of solving a quadratic whose other roots you already know. Reflect it across the horizontal axis and you have defined addition on the curve.
Adding a point to itself means taking the tangent. Do that repeatedly from a single starting point and, on some curves, you never return and never repeat. Below is y² = x³ − 2, starting from the one small solution anybody can find: x = 3, y = 5. Slide along and watch the fractions.
Every one of these is an exact rational solution of the equation, computed here with unbounded integers, not floating point. The height roughly doubles at each step, so the digit count grows like the square of the multiple. This curve has rank one: every rational point on it is a multiple of this one.
02 | Rank
How many independent starting points does a curve need?
Louis Mordell proved in 1922 that the rational points on an elliptic curve are always generated by a finite list. Some of that list is repetitive: points that eventually cycle back to where they started, of which there are never more than sixteen. The rest is the interesting part, and the number of independent non-repeating generators is the rank.
Rank zero means finitely many rational points in total. Rank one means one generator and an infinite chain like the one above. Higher ranks exist; the record known example has rank at least twenty-eight. And there is no algorithm, proved to terminate, that takes a curve and returns its rank. That is the practical problem the conjecture would solve.
03 | The experiment
Count solutions modulo every prime and watch the product drift.
Here is what Birch and Swinnerton-Dyer actually did. For each prime p, count the solutions of the curve modulo p. If the curve has many rational points, you would expect it to have slightly more solutions modulo p than average, for most p. One prime tells you nothing. Multiply the ratios together over all primes up to some bound and a signal appears out of the noise.
The figure plots that running product against the bound for two curves: one with no infinite family of rational points, one with a single infinite family. The curve with rational points to spare climbs and keeps climbing. The one without levels off. That separation, appearing out of raw counting, is what came off the EDSAC and is the reason anybody suspected the two sides of the conjecture were connected at all.
Be honest about what this shows. The conjectured statement is that the product grows like a power of the logarithm of the bound, with the rank as the exponent, and at twenty thousand primes that exponent is nowhere near settled: fit it here and you get about 0.3 for the rank one curve, not 1. The convergence is notoriously slow. What the picture does show, unmistakably, is that the two curves behave differently, and that the difference tracks something the equation alone does not reveal. Everything since has been an attempt to explain why.
04 | What is known
Proved for the two easiest ranks, and stuck above them.
Benedict Gross and Don Zagier in 1986, together with Victor Kolyvagin shortly after, proved one direction of the conjecture in the first two cases: if the analytic function vanishes to order zero or one at s = 1, then the rank really is zero or one respectively. That covers a great many curves in practice and is the deepest thing known about the problem.
Rank two and above is completely open. So is the converse in general. There is also a second obstacle sitting behind the conjecture, an object called the Tate–Shafarevich group, which the full statement requires to be finite; that finiteness is itself unproved except in the cases above.
The practical stakes are real. Elliptic curves are the arithmetic underneath a large share of modern public key cryptography, and questions about how rational points are distributed feed directly into how those systems are understood.
Read the equation
The product runs over primes, with ap = p + 1 − Np recording how far the solution count modulo p is from average. The product converges only for the real part of s above 3/2, and the function is continued to the whole plane; that continuation is itself a theorem, and a hard one, following from the modularity of elliptic curves proved by Wiles, Taylor and others in the course of settling Fermat's Last Theorem. The conjecture says the order of vanishing at s = 1 is the rank, and its refined form predicts the leading coefficient exactly, in terms of six arithmetic quantities of the curve.
Behind the visuals
Figure 01 computes multiples of P = (3, 5) on y² = x³ − 2 using the chord and tangent rules in exact rational arithmetic over big integers, so the coordinates shown are correct to the last digit however long they get. The plotted positions come from converting those exact values to floating point at the end, purely for drawing.
Figure 02 counts points on each curve modulo every prime up to twenty thousand by brute force, marking the quadratic residues once per prime and reading the solution count off them, then accumulating the product of Np/p with the primes of bad reduction skipped. The readouts are the running products themselves, not a fitted exponent, because at this bound a fitted exponent would flatter the picture. The two curves are y² = x³ − x, of rank 0, and y² = x³ − 2, of rank 1.