Proof Weaving

Mulhern Automated proof assistants provide few facilities for incremental development. Generally, if the underlying structures on which a proof is based are modified, the developer must redo much of the proof. Yet incremental development is really the most natural approach for proofs of programming language properties [5, 12]. We propose " proof weaving " , a technique that allows a proof developer to combine small proofs into larger ones by merging proof objects. We automate much of the merging process and thus ease incremental proof development for programming language properties. To make the discussion concrete we take as an example the problem of proving type-soundness by proving progress and preservation [17] in Coq [3, 7]. However we believe that the methods can be generalized to other proof assistants which generate proof objects, and most directly to those proof assistants which exploit the Curry-Howard isomorphism in representing proof terms as λ-terms [16], e.g. Isabelle and Minlog. We rely on the proof developer to initially prove type-soundness for " tiny " languages. Each of these languages encapsulates a single well-defined programming feature. For example, a tiny language of booleans can be restricted to the terms True, False, and If and their accompanying typing and evaluation rules. Tiny languages have relatively small and easily developed proofs of type-soundness. Having developed a repository of small languages along with their associated soundness proofs, the developer builds larger languages by combining small languages in a pairwise progression. Proofs are woven together using a multiphase approach. In the first phase, we rely explicitly on the fact that the proofs are developed using induction on the structure of the terms of the language 2. The two proofs being merged thus have a similar structure; each proof is the application of the induction principle for the terms of the language to subproofs corresponding to each term. We extract these subproofs from the already existing proofs for each tiny language and apply the induction principle for the combined language to each extracted proof. Generally there will not be a completed proof at the end of the first phase. Each subproof may contain transparent dependencies 3 on parts of the language in the same way that the whole proof contains a transparent dependency on the structure of terms. In the second phase, we rewrite each term that contains a transparent dependency introducing place holders, i.e., " holes " , for each …