Isabelle (proof assistant)
Original author(s)  Lawrence Paulson 

Initial release  1986^{[1]} 
Stable release 
Isabelle2016 (February 2016)

Written in  Standard ML and Scala 
Operating system  Linux, Windows, Mac OS X 
Type  Mathematics 
License  BSD license (core system) 
Website 
isabelle 
The Isabelle theorem prover is an interactive theorem prover, a Higher Order Logic (HOL) theorem prover. It is an LCFstyle theorem prover (written in Standard ML), so it is based on a small logical core to ease logical correctness. Isabelle is generic: it provides a metalogic (a weak type theory), which is used to encode object logics like firstorder logic (FOL), higherorder logic (HOL) or Zermelo–Fraenkel set theory (ZFC). Isabelle's main proof method is a higherorder version of resolution, based on higherorder unification. Though interactive, Isabelle also features efficient automatic reasoning tools, such as a term rewriting engine and a tableaux prover, as well as various decision procedures. Isabelle has been used to formalize numerous theorems from mathematics and computer science, like Gödel's completeness theorem, Gödel's theorem about the consistency of the axiom of choice, the prime number theorem, correctness of security protocols, and properties of programming language semantics. The Isabelle theorem prover is free software, released under the revised BSD license.
Isabelle was named by Lawrence Paulson after Gérard Huet's daughter.^{[2]}
Example proof
Isabelle allows proofs to be written in two different styles, the procedural and the declarative. Procedural proofs specify a series of tactics or procedures to apply; while reflecting the procedure that a human mathematician might apply to proving a result, they are typically hard to read as they do not describe the outcome of these steps. Declarative proofs (supported by Isabelle's proof language, Isar), on the other hand, specify the actual mathematical operations to be performed, and are therefore more easily read and checked by humans.
The procedural style has been deprecated in recent versions of Isabelle. The Archive of Formal Proofs also recommends the declarative style.
For example, a declarative proof by contradiction in Isar that the square root of two is not rational can be written as follows.
theorem sqrt2_not_rational: "sqrt (real 2) ∉ ℚ" proof let ?x = "sqrt (real 2)" assume "?x ∈ ℚ" then obtain m n :: nat where sqrt_rat: "¦?x¦ = real m / real n" and lowest_terms: "coprime m n" by (rule Rats_abs_nat_div_natE) hence "real (m^2) = ?x^2 * real (n^2)" by (auto simp add: power2_eq_square) hence eq: "m^2 = 2 * n^2" using of_nat_eq_iff power2_eq_square by fastforce hence "2 dvd m^2" by simp hence "2 dvd m" by simp have "2 dvd n" proof from ‹2 dvd m› obtain k where "m = 2 * k" .. with eq have "2 * n^2 = 2^2 * k^2" by simp hence "2 dvd n^2" by simp thus "2 dvd n" by simp qed with ‹2 dvd m› have "2 dvd gcd m n" by (rule gcd_greatest) with lowest_terms have "2 dvd 1" by simp thus False using odd_one by blast qed
Applications
Isabelle has been used to aid formal methods for the specification, development and verification of software and hardware systems.
 The use of Isabelle by HewlettPackard in the design of the HP 9000 line of servers' Runway bus led to the discovery of a number of bugs uncaught by previous testing and simulation.^{[3]}
 In 2009, the L4.verified project at NICTA produced the first formal proof of functional correctness of a generalpurpose operating system kernel:^{[4]} the seL4 (secure embedded L4) microkernel. The proof is constructed and checked in Isabelle/HOL and comprises over 200,000 lines of proof script to verify 7,500 lines of C. The verification covers code, design, and implementation, and the main theorem states that the C code correctly implements the formal specification of the kernel. The proof uncovered 144 bugs in the C code of the seL4 kernel, and about 150 issues in each of design and specification.
 The programming language Lightweight Java was proven typesound in Isabelle.
Larry Paulson keeps a list of research projects that use Isabelle.
Notes
 ↑ Paulson, L. C. (1986). "Natural deduction as higherorder resolution". The Journal of Logic Programming. 3 (3): 237. doi:10.1016/07431066(86)900154.
 ↑ Gordon, Mike (19941116). "1.2 History". Isabelle and HOL. Cambridge AR Research (The Automated Reasoning Group). Retrieved 20160428.
 ↑ Philip Wadler's "An Angry HalfDozen" (1998) attributes this result to: Albert J. Camilleri. "A hybrid approach to verifying liveness in a symmetric multiprocessor". 10th International Conference on Theorem Proving in HigherOrder Logics, Elsa Gunter and Amy Felty, editors, Murray Hill, New Jersey, August 1997. Lecture Notes in Computer Science (LNCS) Vol. 1275, Springer Verlag, 1997
 ↑ Klein, Gerwin; Elphinstone, Kevin; Heiser, Gernot; Andronick, June; Cock, David; Derrin, Philip; Elkaduwe, Dhammika; Engelhardt, Kai; Kolanski, Rafal; Norrish, Michael; Sewell, Thomas; Tuch, Harvey; Winwood, Simon (October 2009). "seL4: Formal verification of an OS kernel" (PDF). 22nd ACM Symposium on Operating System Principles. Big Sky, Montana, US. pp. 207–200.
References
 Lawrence C. Paulson: The foundation of a generic theorem prover. Journal of Automated Reasoning, Volume 5, Issue 3 (September 1989), Pages: 363397, ISSN 01687433
 Lawrence C. Paulson: The Isabelle Reference Manual
 M. A. Ozols, K. A. Eastaughffe, and A. Cant. "DOVE: Design Oriented Verification and Evaluation". Proceedings of AMAST 97, M. Johnson, editor, Sydney, Australia. Lecture Notes in Computer Science (LNCS) Vol. 1349, Springer Verlag, 1997.
 Tobias Nipkow, Lawrence C. Paulson, Markus Wenzel: Isabelle/HOL  A Proof Assistant for HigherOrder Logic