From LCF to Isabelle/HOL

Abstract

Interactive theorem provers have developed dramatically over the past four decades, from primitive beginnings to today's powerful systems. Here, we focus on Isabelle/HOL and its distinctive strengths. They include automatic proof search, borrowing techniques from the world of first order theorem proving, but also the automatic search for counterexamples. They include a highly readable structured language of proofs and a unique interactive development environment for editing live proof documents. Everything rests on the foundation conceived by Robin Milner for Edinburgh LCF: a proof kernel, using abstract types to ensure soundness and eliminate the need to store proofs. Compared with the research prototypes of the 1970s, Isabelle is a practical and versatile tool. It is used by system designers, mathematicians and many others.Isabelle is a leading interactive theorem prover. It is generic, supporting a number of different formal calculi, but by far the most important of these is its instantiation to higher-order logic: Isabelle/HOL. Already during the 1990s, Isabelle/HOL was being applied with great success to the task of verifying cryptographic protocols [Pau98]. Turning to mathematics, it played a critical role in Hales's Flyspeck project, which verified his proof of the Kepler conjecture [HAB + 17]. It is the basis for the seL4 project, under which an entire operating system kernel was verified, proving full functional correctness [KAE + 10]. It was adopted by researchers outside the verification milieu for specifying and verifying algorithms for replicated datatypes that provide "eventual consistency" [GKMB17]. Numerous other projects are underway around the world. Like other proof assistants, Isabelle is not directly concerned with program verification, i.e. with verifying code written in a programming language, but it can be used as a back end to prove verification conditions. Isabelle can also be used as a verified programming environment, where mathematical functions can be proved correct and then automatically translated to executable code in one of several different programming languages. The translation process itself is currently unverified, but even this is likely to change in the near future.This essay focuses on Isabelle/HOL and therefore has little to say about techniques common to most systems. For example, simplification by rewriting-coupled with recursive simplification to handle conditional rewrite rules-was already realised in both the Boyer/Moore theorem prover [BM79] and Edinburgh LCF by the end of the 1970s. Recursive datatype and function definitions, as well as inductive definitions, were commonplace by around 1995. Linear arithmetic decision procedures were also widely available by then.Our title echoes Mike Gordon's paper "From LCF to HOL: a Short History" [Gor00]. Like Mike, we begin with LCF, the source of the most fundamental ideas. But we pass over this material quickly in order to focus on Isabelle. There is no way to surpass Mike's account of the early years. He starts in 1969, wi...

The Isabelle/Naproche Natural Language Proof Assistant

“…The documentation file $ISABELLE_NAPROCHE/Intro.thy gives further hints on implementation near the end, with hyperlinks to the sources. A lot of technical Isabelle infrastructure is re-used by Isabelle/Naproche, but there is presently no connection to Isabelle/HOL, which is a much larger and better-known application of the same Isabelle framework [18].…”

Formalizing Ordinal Partition Relations Using Isabelle/HOL

“…This architecture ensures soundness through the use of a small proof kernel that implements the rules of inference and has the sole right to declare a statement to be a theorem. Upon this foundation, Isabelle/HOL provides many forms of powerful automation [38]:…”

A Formalised Theorem in the Partition Calculus

“…All versions of Isabelle share a substantial code base, including a sophisticated interactive environment and tools for automatic simplification and logical reasoning. However, Isabelle/HOL extends all that with specialised, powerful automation for proving theorems and detecting counterexamples [30].…”