An Encoding of TLA in Isabelle

This note describes the representation of Lamport's Temporal Logic of Actions that comes with the standard distribution of the generic theorem prover Isabelle. It is based on a simple technique for embedding possible-worlds based logics in Isabelle. 1 Background Formal methods will only be applied in practice if they are supported by suuciently powerful, highly automated, and extensible proof tools. This note describes the design of a representation of Lamport's Temporal Logic of Actions 10] in the higher-order logic of the interactive theorem prover Isabelle 16]. Representations of object logics in logical frameworks are traditionally classiied as \deep" or \shallow" embeddings. In a deep embedding, the syntax and semantics of the object logic are fully formalized in the meta-logic. For a temporal logic, this would mean to give an inductive deenition of formula syntax, and to deene concepts such as state, state sequence, temporal succession, and the satisfaction relation. One can then reason not only \inside" the logic, applying its axioms and rules, but also \about" the logic. In particular, one can justify the logic's proof system by establishing sound-ness and completeness theorems. However, it is rather diicult to set up a deep embedding in such a way that it is also comfortable to work in. Since our emphasis has been on developing an apparatus that is useful for the veriication of actual case studies, we have opted for a shallow embedding of TLA. Even more, our theory is axiomatic, although the HOL approach to deening object logics encourages the use of deenitional embeddings. This decision comes from the fact that the deenition of the concept of a universal state space that underlies TLA is not well supported by the type system of Isabelle/HOL. The remaining temporal logic axioms could easily be derived from a deenition of innnite state sequences, either as functions from the natural numbers to states or via a coinductive deenition. We have deliberately not done so in order to force the user to use the TLA proof system