“…For Isabelle/HOL, the Isabelle Refinement Framework [22,24,25,29] provides a powerful stepwise refinement tool chain, featuring a nondeterministic shallowly embedded programming language [29], a library of efficient collection data structures and generic algorithms [24][25][26], and convenience tools to simplify canonical refinement steps [22,24]. It has been used for various software verification projects (e. g. [23,27,28]), including a fully fledged verified LTL model checker [4,12].…”