Take a cubic curve like y^2 = x^3 + x + 1 and ask a childishly simple question: how many points does it have when the coordinates are only allowed to be remainders — say, whole numbers mod a prime p? For each prime you get a single integer, a headcount. String those headcounts together, one per prime, and something astonishing happens: they assemble into an Euler product — a function L(E,s) built exactly like the Riemann zeta function, but with the primes weighted by how the curve behaves modulo each one.

That L-function turns out to secretly know the curve's deepest arithmetic — in particular, how many rational solutions the curve has, and whether that supply is finite or infinite. The claim that ties these two worlds together, the Birch and Swinnerton-Dyer conjecture, is one of the seven million-dollar Millennium Prize Problems, and it is still open. This lesson builds the object from the ground up: count points, bound the counts, package them into L(E,s), and meet the conjecture that makes analysts and number theorists hold their breath.

The players: an elliptic curve over the rationals

An elliptic curve over \mathbb{Q} is (after tidying) the set of solutions to

together with one extra "point at infinity" \mathcal{O}, and subject to the smoothness condition that the discriminant

is nonzero (this forbids cusps and self-crossings — the cubic must have three distinct roots). The magic of an elliptic curve is that its points form an abelian group: you can "add" two points with a chord-and-tangent construction, with \mathcal{O} as the identity. The rational points E(\mathbb{Q}) form a subgroup, and by the Mordell–Weil theorem this group is finitely generated:

The finite part E(\mathbb{Q})_{\mathrm{tors}} is easy to pin down; the integer r, the rank, is the number of independent "infinite-order" rational points — and it is genuinely hard to compute. Holding that word rank in mind, let us go to the primes.

Counting points modulo p

Fix a prime p that does not divide the discriminant \Delta — a prime of good reduction. Reduce the equation mod p and count solutions (x,y) with x,y \in \mathbb{F}_p, then add the one point at infinity. Call the total \#E(\mathbb{F}_p). A "typical" curve mod p has about p affine points (for each of the p values of x, the right-hand side is a square about half the time, giving two y's when it is). So we measure the defect from p+1:

The quantity a_p is called the trace of Frobenius, because it is the trace of the Frobenius endomorphism acting on the curve — a fact we will not need, but which explains why these numbers behave so rigidly. Rigidly how? That is the Hasse bound.

The Hasse bound: the counts can't run wild

This is a "Riemann Hypothesis for curves over finite fields" — proved, by Hasse, and later generalised sweepingly by Weil. It says the point count is pinned to within 2\sqrt{p} of p+1: the curve is never wildly over- or under-populated. Writing a_p = 2\sqrt{p}\,\cos\theta_p defines an angle \theta_p \in [0,\pi]; the way these angles distribute as p varies is itself a deep story (the Sato–Tate distribution).

Worked example: counting on y^2 = x^3 + x + 1

Take E: y^2 = x^3 + x + 1, so a = b = 1 and \Delta = -16(4 + 27) = -496 = -2^4\cdot 31. The primes dividing \Delta are 2 and 31, so those are the only candidates for bad reduction; every other prime is good. That is why we will not apply the good-reduction formula at p = 2 — it gets a special local factor instead (more on that below). Let us count at the smallest good primes.

Modulo 3. The squares mod 3 are \{0,1\}. Evaluate f(x)=x^3+x+1:

Affine points: 2+1+0 = 3. Add \mathcal{O}: \#E(\mathbb{F}_3) = 4, so a_3 = 3 + 1 - 4 = 0. Check Hasse: |0| \le 2\sqrt{3}\approx 3.46. ✓

Modulo 5. The squares mod 5 are \{0,1,4\}:

Affine points: 2+0+2+2+2 = 8, so \#E(\mathbb{F}_5) = 9 and a_5 = 5 + 1 - 9 = -3. Check Hasse: |-3| \le 2\sqrt{5}\approx 4.47. ✓

Grinding through a few more good primes the same way gives the full picture — and every single count obeys the Hasse ceiling:

Seeing the Hasse bound

Plot each pair (p, a_p) from the table against the two envelope curves y = \pm 2\sqrt{p}. Every point is trapped inside the widening funnel — no count is ever allowed to escape it.

Packaging the counts: the L-function

Now the alchemy. Attach to each good prime a local factor — a quadratic in p^{-s} built from a_p — and multiply them all together, an Euler product exactly in the spirit of \zeta(s) = \prod_p (1 - p^{-s})^{-1}:

Because |a_p| \le 2\sqrt{p}, the good factors behave like (1 - 2\sqrt{p}\,p^{-s} + \dots)^{-1}, and the whole product converges absolutely for \Re(s) > 3/2 — a half-plane shifted right of zeta's \Re(s) > 1, precisely because the coefficients are as large as \sqrt{p}. Expanding the product gives a Dirichlet series L(E,s) = \sum_{n\ge 1} a_n\, n^{-s}, whose coefficients a_n are determined by the a_p through the same recursions Hecke operators satisfy — a foreshadowing of the next section.

As written, L(E,s) only makes sense to the right of 3/2. To reach the point we actually care about, s = 1, we need to continue it — and for decades nobody knew that we could.

Modularity: every rational elliptic curve is secretly a modular form

The breakthrough is that L(E,s) is not just some Dirichlet series — it is the L-function of a weight-2 Hecke eigenform.

Andrew Wiles proved the semistable case in 1994 (the missing ingredient in his celebrated proof of Fermat's Last Theorem), with Richard Taylor; Breuil, Conrad, Diamond and Taylor removed the remaining hypotheses by 2001, establishing modularity for all E/\mathbb{Q}. The payoff for analysis is immediate and enormous: modular L-functions are known to have an analytic continuation to all of \mathbb{C} and a clean functional equation. Completing L(E,s) with its conductor and Gamma factor,

the reflection is s \mapsto 2 - s, whose fixed centre is s = 1. The sign w (the "root number") is +1 or -1; when w = -1 the functional equation forces L(E,1) = 0. That forced (or not forced) vanishing at the centre is exactly what the next conjecture is about.

Birch and Swinnerton-Dyer: analysis reads off the rank

In the early 1960s, John Birch and Peter Swinnerton-Dyer did something that sounds unremarkable and was in fact revolutionary: they programmed the EDSAC computer at Cambridge to compute \#E(\mathbb{F}_p) for many primes, formed the partial products of the local factors near s = 1, and watched how fast they grew. Curves with more rational points made the product tend to 0 faster. The pattern they distilled is:

Think about how strange this is. The left side is analytic: it is about how a function of a complex variable behaves near a point, computed from point-counts mod every prime. The right side is algebraic: it counts genuine rational solutions of a cubic. BSD asserts these two utterly different numbers are always equal — a bridge between the local (mod-p) and the global (over \mathbb{Q}) arithmetic of the curve.

The refined conjecture: the leading coefficient

BSD says more than "the order of vanishing is r." It predicts the exact leading coefficient of the Taylor expansion at s = 1, in terms of every important arithmetic invariant of the curve:

• \Omega_E — the real period (an integral of the curve's differential);
• \operatorname{Reg}(E) — the regulator, a determinant of heights of the generators, measuring how "spread out" the rational points are;
• |\Sha(E)| — the order of the Tate–Shafarevich group \Sha, a subtle object measuring the failure of a local-to-global principle (not even known to be finite in general!);
• \prod_p c_p — the product of the Tamagawa numbers, small local correction factors at the bad primes;
• |E(\mathbb{Q})_{\mathrm{tors}}| — the size of the torsion subgroup.

The mere fact that \Sha appears here is one reason the conjecture is so hard: for many curves nobody has proved \Sha is even finite, yet the formula divides by its order.

What is actually known

The proved fragment of BSD is a triumph of 1980s number theory, combining two landmark results:

The engine is the Gross–Zagier formula, which relates L'(E,1) to the height of a special "Heegner point" on the curve — so a nonzero derivative manufactures a rational point of infinite order — combined with Kolyvagin's Euler system, which shows that when the analytic rank is \le 1 there are no other independent points hiding. Everything beyond analytic rank 1 — the vast majority of the conjecture — is open.