## From LCF to HOL: a short history (2000)

Venue: | Proof, Language, and Interaction |

Citations: | 24 - 0 self |

### BibTeX

@INPROCEEDINGS{Gordon00fromlcf,

author = {Mike Gordon},

title = {From LCF to HOL: a short history},

booktitle = {Proof, Language, and Interaction},

year = {2000},

pages = {169--185},

publisher = {MIT Press}

}

### Years of Citing Articles

### OpenURL

### Abstract

### Citations

936 | A theory of type polymorphism in progra.mming
- Milner
- 1978
(Show Context)
Citation Context ...isted by Morris and Newey, designed the programming language ML (an abbreviation for "Meta Language"). This was strictly typed to support the abstract type mechanism needed to ensure theorem security =-=[35]-=-. In Stanford LCF, the axioms and rules of inference of Scott's logic were directly encoded in the implementation of the simplification and subgoaling mechanism. The user could only construct proofs `... |

847 |
A formulation of the simple theory of types
- Church
- 1940
(Show Context)
Citation Context ... supported by Cambridge LCF has the usual formula structure of predicate calculus, and the term structure of the typed *-calculus. The type system, due to Milner, is essentially Church's original one =-=[4]-=-, but with type variables moved from the meta-language to the object language (in Church's system, a term with type variables is actually a meta-notation - a term-schema - denoting a family of terms, ... |

471 |
The calculus of constructions
- Coquand, Huet
- 1988
(Show Context)
Citation Context ...her LCF-style proof assistants were developed with ML as their metalanguage (in some cases code from LCF was used as the starting point). These include a proof system for the Calculus of Contructions =-=[10, 9]-=-, Nuprl [8], and a proof system for Martin L"of type theory [44]. These applied Milner's LCF methodology to widely different logics. To try to provide a systematic implementation methodology for `LCF-... |

420 | Isabelle: A generic theorem prover
- Paulson
- 1994
(Show Context)
Citation Context ...4]. These applied Milner's LCF methodology to widely different logics. To try to provide a systematic implementation methodology for `LCF-style' systems, Paulson developed the generic prover Isabelle =-=[41, 43]-=-. This provided a metalogic in which the proof rules of object logics can be described declaratively (in LCF and HOL, rules are represented as ML programs - i.e. they are implemented rather than speci... |

198 | Melham, editors. Introduction to HOL: A Theorem Proving Environment for Higher Order Logic - Gordon, F - 1993 |

182 |
Isabelle: The next 700 theorem provers
- Paulson
- 1990
(Show Context)
Citation Context ...4]. These applied Milner's LCF methodology to widely different logics. To try to provide a systematic implementation methodology for `LCF-style' systems, Paulson developed the generic prover Isabelle =-=[41, 43]-=-. This provided a metalogic in which the proof rules of object logics can be described declaratively (in LCF and HOL, rules are represented as ML programs - i.e. they are implemented rather than speci... |

165 |
Logic and Computation: Interactive Proof with Cambridge LCF
- Paulson
- 1987
(Show Context)
Citation Context ...hat he created). The resulting Standard ML based version of Cambridge LCF is documented (with supporting case studies and a tutorial of underlying theory) in Paulson's 1987 book Logic and Computation =-=[40]-=-. 5 From LCF to HOL Whilst Paulson was designing and implementing Cambridge LCF, I was mainly concerned with hardware verification. I had been impressed by how the Expansion Theorem of Milner's Calcul... |

88 |
Why higher-order logic is a good formalism for specifying and verifying hardware
- Gordon
- 1985
(Show Context)
Citation Context ...e represented by functions from time to values (wire states), so that higher-order relations and quantification are necessary. This immediately suggests higher-order logic as an appropriate formalism =-=[13]-=- (the same idea occurred earlier to Keith Hanna [19], the designer of the Veritas hardware verification system). The design of HOL was largely taken `off the shelf' the theory being classical higher o... |

87 |
Edinburgh LCF: A Mechanised Logic
- Gordon, Milner, et al.
- 1979
(Show Context)
Citation Context ...and the Australian National University, respectively, and were replaced by Chris Wadsworth and myself. The design and implementation of ML and Edinburgh LCF was finalised and the book "Edinburgh LCF" =-=[15]-=- was written and published.3 In 1978, the first LCF project finished, Chris Wadsworth went off trekking in the Andes (returning to a permanent position at the Rutherford Appleton Laboratory) and I rem... |

80 |
Constable et al. Implementing Mathematics with the NuPRL Proof Development System
- L
- 1986
(Show Context)
Citation Context ...roof assistants were developed with ML as their metalanguage (in some cases code from LCF was used as the starting point). These include a proof system for the Calculus of Contructions [10, 9], Nuprl =-=[8]-=-, and a proof system for Martin L"of type theory [44]. These applied Milner's LCF methodology to widely different logics. To try to provide a systematic implementation methodology for `LCF-style' syst... |

74 | Automating recursive type definitions in higher order logic
- Melham
- 1989
(Show Context)
Citation Context ...inition principle that converts descriptions of recursive datatypes into primitive definitions and then automatically derives the natural induction and primitive recursion principles for the datatype =-=[29]-=-.9 It was probably this tool that was most responsible for changing the perception of HOL from being purely a hardware verification system to being a general purpose proof assistant. For example, it b... |

72 |
Constructions: A Higher Order Proof System for Mechanizing Mathematics
- Coquand, Huet
- 1985
(Show Context)
Citation Context ...her LCF-style proof assistants were developed with ML as their metalanguage (in some cases code from LCF was used as the starting point). These include a proof system for the Calculus of Contructions =-=[10, 9]-=-, Nuprl [8], and a proof system for Martin L"of type theory [44]. These applied Milner's LCF methodology to widely different logics. To try to provide a systematic implementation methodology for `LCF-... |

56 |
A proof of correctness of the VIPER microprocessor: the first levels
- Cohn
- 1987
(Show Context)
Citation Context ...o verify a toy microprocessor [12], subsequently called Tamarack6 and the LSM notation was used by a group in the Royal Signals and Radar Establishment (RSRE) to specify the ill-fated Viper processor =-=[5]-=-. During this time Ben Moskowski, who had recently graduated from Stanford, was doing a postdoc at Cambridge. He 6The name "Tamarack" is due to Jeff Joyce, who reverified it in HOL [27] and fabricated... |

49 | A Higher-Order Implementation of Rewriting
- Paulson
- 1983
(Show Context)
Citation Context ...nstructive type theory. 5Edinburgh LCF, including the ML interpreter, was implemented in Lisp. 3slaboration with G'erard Huet) to the implementation of LCF. The now-standard techniques of conversions =-=[39]-=- and theorem continuations [40, Section 8.7.2] were devised by him and then used to implement a large collection of tools. Edinburgh LCF had a monolithic simplifier provided as a primitive. Paulson re... |

48 | The notion of proof in hardware verification
- Cohn
(Show Context)
Citation Context ...h other provers) has increased dramatically. In the early 1980's the verification of simple systems with a few registers and gates was considered significant. By the late 1980s simple microprocessors =-=[6, 7, 16, 49]-=- and networking hardware [23] was being verified and by the mid 1990s complex hardware structures (e.g. pipelines) were being analysed and many non-hardware applications were being attempted, includin... |

48 |
A type-theoretical alternative to ISWIM
- Scott
- 1993
(Show Context)
Citation Context ...ner's Calculus of Communicating Systems (CCS). 2 Stanford LCF "LCF" abbreviates "Logic for Computable Functions", Milner's name for a logic devised by Dana Scott in 1969, but not published until 1993 =-=[46]-=-. The LCF logic has terms from the typed *-calculus and formulae from predicate calculus. Types are interpreted as Scott domains (CPOs) and the logic is intended for reasoning, using fixed-point induc... |

37 |
Correctness properties of the Viper block model: the second level
- Cohn
(Show Context)
Citation Context ...h other provers) has increased dramatically. In the early 1980's the verification of simple systems with a few registers and gates was considered significant. By the late 1980s simple microprocessors =-=[6, 7, 16, 49]-=- and networking hardware [23] was being verified and by the mid 1990s complex hardware structures (e.g. pipelines) were being analysed and many non-hardware applications were being attempted, includin... |

33 | Extending the HOL theorem prover with a computer algebra system to reason about the reals
- Harrison, ThÃ©ry
- 1993
(Show Context)
Citation Context ...ting it many times. Another programming technique is to separate out proof search from proof checking. An ML program, or even an external oracle (like a C-coded tautology checker or an algebra system =-=[22]-=-), can be used to find a proof. The result is validated by formal inference inside the HOL logic. One way of packaging (and automating) this separation is Boulton's technique of lazy theorems [2].20 T... |

28 | A Package for Inductive Relation Definitions in HOL
- Melham
- 1991
(Show Context)
Citation Context ...lly easier to embed languages inside HOL, by defining a recursive type of abstract syntax trees and a primitive recursive semantic function. Another derived definitional principle, also due to Melham =-=[30]-=-, allows inductively defined relations to be specified by a transition system, and then a rule-induction tactic to be automatically generated. This enables operational semantics to be easily defined i... |

27 |
A Mizar Mode for HOL
- Harrison
- 1996
(Show Context)
Citation Context ...useful to provide the option of using a Mizar style for developing theories and a goal-oriented style for deploying them. To this end, John Harrison has recently added support for `Mizar mode' in HOL =-=[21]-=-. 7.4 Libraries and other user supplied contributions To enable theories (and other utility code) to be shared, HOL has a rudimentary library facility. This provides a file structure and documentation... |

23 |
The SECD Microprocessor: A verification case study, Volume 178 of Kluwer international series in engineering and computer science
- Graham
- 1992
(Show Context)
Citation Context ...h other provers) has increased dramatically. In the early 1980's the verification of simple systems with a few registers and gates was considered significant. By the late 1980s simple microprocessors =-=[6, 7, 16, 49]-=- and networking hardware [23] was being verified and by the mid 1990s complex hardware structures (e.g. pipelines) were being analysed and many non-hardware applications were being attempted, includin... |

23 |
Specification and verification using higher-order logic: A case study
- Hanna, Daeche
- 1986
(Show Context)
Citation Context ... states), so that higher-order relations and quantification are necessary. This immediately suggests higher-order logic as an appropriate formalism [13] (the same idea occurred earlier to Keith Hanna =-=[19]-=-, the designer of the Veritas hardware verification system). The design of HOL was largely taken `off the shelf' the theory being classical higher order logic and the implementation being LCF. The dev... |

23 |
Verifying the unification algorithm
- Paulson
- 1985
(Show Context)
Citation Context ...tly binding them to ML variables with cumbersome names like g.2.1.3). These developments were driven and tested by a number of major case studies, including the formalisation and checking, by Paulson =-=[42]-=-, of a proof of correctness of the unification algorithm. The resulting new LCF system was named "Cambridge LCF" and completed around 1985. Paulson did little work on it after that. Mikael Hedlund (of... |

22 |
A window inference tool for refinement
- Grundy
- 1992
(Show Context)
Citation Context ...orthy tools that generate parsers and pretty-printers from a declarative 18An example of this is Grundy's window inference system for hierarchical transformational reasoning (e.g. program refinement) =-=[17]-=-. This provides an environment on top of HOL for pointing at subterms and then transforming them `in place' (subject, of course, to contextdependent side-conditions). Grundy was able to base his syste... |

22 |
Function definition in higher order logic
- Slind
- 1996
(Show Context)
Citation Context ...tics to be easily defined inside HOL. Other derived definitional principles have also been implemented, including a powerful tool by Konrad Slind for making general recursive definitions of functions =-=[47]-=- (which also runs in Isabelle/HOL) and at least two independent packages for creating quotient types. 5.4 Simplification Cambridge LCF had a powerful simplifier that dealt separately with term rewriti... |

21 |
Proving compiler correctness in a mechanized logic
- Milner, Weyrauch
- 1972
(Show Context)
Citation Context ... of memory. Stanford LCF was used for a number of case studies. Weyhrauch worked on the proof of correctness of a compiling algorithm for a simple imperative language to a stack-based target language =-=[36]-=- and Newey on the generation of equational theories of integers and lists. 3 Edinburgh LCF Around 1973 Milner moved to Edinburgh University and established a project to build a successor to Stanford L... |

19 | The HOL logic extended with quantification over type variables
- Melham
- 1993
(Show Context)
Citation Context ...e to prove c equals both true and false, by type-instantiating the definition with the two instances. In future versions of HOL it is expected that there will be explicit type variable quantification =-=[31]-=-, i.e. terms of the form 8ff:t (where ff is a type variable). The right hand side of definitions will be required to be closed with respect to both term and type variables. Melham has shown that this ... |

17 |
Proving a computer correct in higher order logic
- Joyce, Birtwistle, et al.
- 1986
(Show Context)
Citation Context ...Viper processor [5]. During this time Ben Moskowski, who had recently graduated from Stanford, was doing a postdoc at Cambridge. He 6The name "Tamarack" is due to Jeff Joyce, who reverified it in HOL =-=[27]-=- and fabricated a chip based on it whilst visiting Xerox Parc as a summer student. 4sshowed me how the terms of LSM could be encoded in predicate calculus in such a way that the LSM expansion-law just... |

16 |
Proving a computer correct
- Gordon
- 1983
(Show Context)
Citation Context ...printer support for LSM and provided the expansion-law as an additional axiom scheme [11]. This lash-up worked quite well and even got used outside Cambridge. I used it to verify a toy microprocessor =-=[12]-=-, subsequently called Tamarack6 and the LSM notation was used by a group in the Royal Signals and Radar Establishment (RSRE) to specify the ill-fated Viper processor [5]. During this time Ben Moskowsk... |

15 |
Logic for computable functions: description of a machine implementation
- Milner
- 1972
(Show Context)
Citation Context ...e collaborated on designing, implementing and using the original LCF system, now known as Stanford LCF. The resulting system is a proof checker for Scott's logic and is described by Milner as follows =-=[34]-=-: The proof-checking program is designed to allow the user interactively to generate formal proofs about computable functions and functionals over a variety of domains, including those of interest to ... |

13 |
Doing algebra in simple type theory
- Gunter
- 1989
(Show Context)
Citation Context ...'s definitional principles. He produced informal proofs that they could not introduce inconsistency [14, Chapter 16]. 7Axiomatic developments, like group theory, have been attempted with some success =-=[18]-=- (though the LCF/HOL theory mechanism is not ideal for it and various improvements have been proposed). The facilities inherited from LCF for declaring axioms are still available in HOL. 8The problem ... |

11 |
Constructing the real numbers
- Harrison
- 1994
(Show Context)
Citation Context ...s, topology). Many applications (e.g. floating point verification, cryptography, signal processing) require a general mathematical infrastructure to be brought to bear via problem-specific algorithms =-=[20]-=-. It is thus useful to provide the option of using a Mizar style for developing theories and a goal-oriented style for deploying them. To this end, John Harrison has recently added support for `Mizar ... |

10 |
LCF-LSM: A system for specifying and verifying hardware
- Gordon
- 1983
(Show Context)
Citation Context ...e a proof assistant for LSM, I lashed up a version of Cambridge LCF (called LCF LSM) that added parsing and pretty-printer support for LSM and provided the expansion-law as an additional axiom scheme =-=[11]-=-. This lash-up worked quite well and even got used outside Cambridge. I used it to verify a toy microprocessor [12], subsequently called Tamarack6 and the LSM notation was used by a group in the Royal... |

7 |
Case study of the Cambridge fast ring ECL chip using HOL
- Herbert
- 1988
(Show Context)
Citation Context ...ally. In the early 1980's the verification of simple systems with a few registers and gates was considered significant. By the late 1980s simple microprocessors [6, 7, 16, 49] and networking hardware =-=[23]-=- was being verified and by the mid 1990s complex hardware structures (e.g. pipelines) were being analysed and many non-hardware applications were being attempted, including program and algorithm verif... |

6 |
Lazy techniques for fully expansive theorem proving
- Boulton
- 1993
(Show Context)
Citation Context ...tem [22]), can be used to find a proof. The result is validated by formal inference inside the HOL logic. One way of packaging (and automating) this separation is Boulton's technique of lazy theorems =-=[2]-=-.20 There have been many developments in the implementation and use of tactics over the last twenty years. It is remarkable that Milner's original concept has turned out to be sufficiently general to ... |

2 |
Melham and Juanito Camilleri, editors. Higher Order Logic Theorem
- Thomas
- 1994
(Show Context)
Citation Context ...23. There is no space to summarise all the work that has been done with HOL here, but recent work can be found in the proceedings of the conference now called24 Theorem Proving in Higher Order Logics =-=[28, 32, 45, 48]-=- or in special issues of The Computer Journal [26] and Formal Methods in System Design [24, 25]. One noteworthy niche has been the embedding of programming and hardware description languages in HOL.25... |

1 |
38] Monica Nesi. A formalization of the process algebra CCS in higher order logic
- Communication, Prentice-Hall
- 1989
(Show Context)
Citation Context ... was designing and implementing Cambridge LCF, I was mainly concerned with hardware verification. I had been impressed by how the Expansion Theorem of Milner's Calculus of Communicating Systems (CCS) =-=[37]-=- enabled a direct description of the behaviour of a composite agent to be calculated from the parallel composition of its individual components. This seemed like a good paradigm for deriving the behav... |