HOL4

HOL4 is a self-hosted environment for interactive higher-order logic proving, aimed at researchers, verification engineers, and teams that need to program their own proof tools. It rewards substantial technical investment with automation, counterexamples, proof artifacts, and connections to external engines, while its Standard ML setup and extended learning period make it unsuitable for casual or immediate use.

Overview

HOL4 combines deduction, program execution, and property checking in one proof assistant. Higher-order logic is its central formalism, and Standard ML supplies the programming environment for constructing proofs and implementing custom tools. That combination suits projects where the verification workflow itself must be developed and inspected, rather than selected from a fixed, turnkey process.

The software is free under the Modified (3-clause) BSD licence and is deployed on your own infrastructure. It is a collaborative GitHub project that accepts contributions through pull requests. Projects identified by its makers include CakeML, HOL4P4, HolBA, and Verifereum, indicating use in substantial formal-methods work.

Key features

• Interactive higher-order proving: HOL4 produces proof artifacts and supports counterexamples, giving users both a record of successful arguments and a way to investigate failed conjectures. This is valuable for rigorous verification, but it assumes familiarity with formal logic and proof development.
• Built-in automation: Decision procedures and theorem provers can settle many simple theorems. They reduce repetitive work on routine goals; complex results still require users to design and maintain proofs.
• External engines: An oracle mechanism can call programs such as SMT and BDD engines. This broadens the methods available for difficult properties, although it also makes the workflow depend on configuring and understanding those external tools.
• Programmable tooling: Standard ML lets users implement proof tools inside the environment. It is a strong fit for experimental or domain-specific verification, less so for teams that want a graphical application with little programming.
• Editor integration: Emacs modes provide syntax display and interaction with HOL sessions, while installation documentation points to a Vim plugin. These integrations help users who already work in those editors, but do not replace the need to learn HOL itself.
• Documentation and support: Tutorials, a quick reference, FAQ, manuals, and generated library, theory, and signature indexes provide a substantial reference set. Questions and discussion go through the hol-info mailing list and Zulip chat; bugs and feature requests use GitHub issues.

Pricing

HOL4 — free. The free software plan includes the complete self-hosted distribution under the Modified (3-clause) BSD licence. There are no paid tiers, seat charges, usage quotas, or trial-to-renewal terms to weigh. The trade-off is operational rather than financial: you provide the Standard ML compiler and manage installation and deployment yourself.

Platforms

HOL4 supports Linux, macOS, Windows, and self-hosted deployment. Poly/ML is the recommended compiler; Moscow ML is supported, and MLTon can build tool executables. On Windows, the documented routes use Cygwin or the Windows Subsystem for Linux with Poly/ML. A Moscow ML build can run from a standard Windows console, but it is many times slower than Poly/ML, lacks libraries found in the Poly/ML version, and cannot perform concurrent Holmake builds. Windows users who need the fuller, faster setup should therefore plan around the Linux-subsystem or Cygwin route.

Who it's for

Choose HOL4 for formal-methods researchers, verification engineers, and technically experienced teams that need programmable higher-order logic, inspectable proof artifacts, counterexamples, and optional SMT or BDD assistance. It is also appropriate for contributors who want to extend an open collaborative prover. A newcomer should budget about a month to become comfortable from scratch, in addition to installing a Standard ML compiler. Teams seeking a short onboarding path, a hosted service, or a prepackaged application should look elsewhere.

Pros and cons

Pros

• Free BSD-licensed software: There is no purchase price or paid-plan ceiling, and the permissive licence supports self-hosted use.
• Broad proof workflow: Higher-order logic, proof artifacts, counterexamples, built-in procedures, and external engines cover both construction and diagnosis.
• Extensible environment: Standard ML and an active GitHub project support custom proof tools and community contributions.
• Strong reference and community channels: Manuals, indexes, tutorial material, mailing-list support, Zulip, and issue tracking give experienced users several ways to proceed.

Cons

• High entry cost: The project estimates about a month for a beginner to become comfortable, before accounting for project-specific proof development.
• Compiler dependency: Standard ML is required, adding setup and build decisions that simpler theorem-proving tools may avoid.
• Uneven Windows options: The Moscow ML path is substantially slower, lacks some libraries, and omits concurrent Holmake builds.
• Self-hosted responsibility: Installation, external-engine integration, and ongoing environment management remain with the user.

Alternatives

Browse the Formal Verification Tools directory for a wider shortlist. Lean is a free alternative spanning Linux, macOS, Windows, and the web, worth considering when that broader platform mix and its Lean 4 distribution fit better. Rocq is another free interactive theorem prover and dependently typed programming language, with extension, desktop, and web availability. Choose Z3 when a free MIT-licensed SMT solver is the primary need rather than a complete higher-order proof assistant. Boogie suits users wanting a free MIT-licensed verifier built around .NET and a supported SMT solver. cvc5 is a free open-source solver for teams comfortable with its optional GPL-licensed dependencies. PVS offers free noncommercial use and a separate commercial plan with custom pricing. Why3 is a free verification platform under the GNU Lesser General Public License with a special linking exception. Alloy Analyzer is a free, self-contained executable for users who prefer that form of analysis.

Verdict

HOL4 is a strong choice for specialists who need a free, self-hosted higher-order logic prover they can extend in Standard ML and connect to external decision engines. Its main reason to choose it is the combination of programmable proof tooling, counterexamples, artifacts, and broad documentation without licensing cost. Look elsewhere if your priority is rapid onboarding, a hosted workflow, or a Windows installation without compiler and subsystem trade-offs.