HOL4 vs Why3
HOL4
hol-theorem-prover.orgWhy3
why3.orgSide by side
| Figure | HOL4 | Why3 |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | — | Yes |
| Windows | Yes | Yes |
| macOS | Yes | — |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Formal Verification Tools | 8.1 (#9) | 8.0 (#12) |
| Development | HOL is a collaborative project hosted on GitHub and welcomes code contributions via pull requests. | Why3 is developed by the Inria Toccata team, a joint research team of Inria Saclay-Île-de-France, Université Paris-Saclay, and CNRS. |
| Integrations | The maker documents editor support for Emacs and Vim. | The project lists EasyCrypt, Frama-C, and SPARK 2014 among projects that use Why3. |
| License | HOL is free software released under the Modified (3-clause) BSD licence. | TryWhy3 is distributed under the GNU Lesser General Public License version 2.1 with a special linking exception. |
| Notable limitation | The maker notes that Moscow ML HOL lacks libraries available in the Poly/ML version and does not support concurrent Holmake builds. | Loop invariant inference is described as work in progress, with many features still very limited. |
| Purpose | HOL4 is a proof assistant for higher-order logic and a programming environment for proving theorems and implementing proof tools. | Why3 is a platform for deductive program verification that uses WhyML and external theorem provers to discharge verification conditions. |
| Support | The community offers help through a mailing list and Zulip chat, while bug reports and feature suggestions go to GitHub issues. | The project provides a user mailing list, a Zulip chat, and a bug tracking system. |
Plans
In their own words
HOL4
HOL4 is a free, interactive proof assistant for higher-order logic, with a programming environment for proving theorems and building proof tools. It supports work that combines deduction, execution, and property checking. Built-in decision procedures and theorem provers can establish many simple theorems, and an oracle mechanism can connect to external programs such as SMT and BDD engines. HOL4 supports higher-order logic and Standard ML, and can produce proof artifacts and counterexamples. It is self-hosted and listed for Linux, macOS, and Windows. A Standard ML compiler is required, with Poly/ML recommended; Moscow ML and MLTon are also supported for building tool executables. Windows installation can use Cygwin or the Windows Linux subsystem with Poly/ML. Moscow ML is another option, but the Windows guide notes that it is slower, lacks some Poly/ML libraries, and cannot run concurrent Holmake builds. HOL includes Emacs modes for syntax display and session interaction, and the installation guide links to Vim plugin documentation. Online materials include a tutorial, quick reference, FAQ, manuals, and generated indexes.
Why3
Why3 is a platform for deductive program verification. It uses WhyML to express programs and specifications, then works with external automated or interactive theorem provers to discharge verification conditions. WhyML supports preconditions, postconditions, assertions, and loop invariants, alongside logical theories and data structures such as arrays, queues, and hash tables. External provers need to be installed and configured separately. Why3 can be extended with support for new provers and used as a software library through its OCaml API. WhyML programs can be extracted automatically into correct-by-construction OCaml programs, and WhyML is also used as an intermediate language for verification of C, Java, Rust, and Ada. TryWhy3 provides a JavaScript version that runs in a browser. Installation options include Opam, Docker, source compilation, and listed Debian, Fedora, and Ubuntu packages. Its graphical interface saves proof attempts and transformations in an XML file and can replay obsolete attempts. Why3 is free and open source under GNU LGPL 2.1 with a special linking exception. Loop invariant inference is a work in progress, and many features remain very limited.