Incremental Proof Development in Dafny with Module-Based Induction

TL;DR

The paper tackles instability and opaque failures in highly automated proving with Dafny during iterative proof development. It introduces a Coq-inspired induction principle implemented as an abstract Dafny module (ListInduction) and shows how to instantiate it for list-append associativity (AppAssoc) and a mini-Dafny interpreter verification (IsPure). The approach reduces boilerplate, enables modular proofs with clearer failure points, and improves maintainability and verification time control in multi-pass compiler proofs. This technique offers a practical path to bring more trackable induction reasoning into Dafny workflows, with future work on automating induction-principle generation.

Abstract

Highly automated theorem provers like Dafny allow users to prove simple properties with little effort, making it easy to quickly sketch proofs. The drawback is that such provers leave users with little control about the proof search, meaning that the small changes inherent to the iterative process of writing a proof often lead to unpredictable variations in verification time, and eventually hard-to-diagnose proof failures. This sometimes turns the boon of high automation into a curse, as instead of breaking early and showing unsolved goals to the user like in Coq, proofs tend to gradually become unstable until their verification time explodes. At this point, the absence of a proof context to investigate often leaves the user to a painful debugging session. In this paper, we show how to use Dafny modules to encode Coq-like induction principles to dramatically improve the stability and maintainability of proofs about inductive data structures.

Figures (2)

• Figure : Proof that list concatenation is associative (top: Dafny, bottom: Coq).
• Figure : Proof of associativity of list concatenation with a module-based induction principle.