Formally certified stable marriages

We present an implementation of the Gale-Shapley stable matching algorithm in the Coq proof assistant. The resulting program is guaranteed to terminate and provides a proof of the stability of the matchings that it produces. While proofs of the algorithm's termination and correctness exist on paper, our purpose was to investigate the process of developing a completely formalized proof for an executable implementation. The stages of our development are presented as a series of refinements to an initial version of the program. We suggest that the incremental approach we demonstrate is a reasonable model to follow in developing formalized correctness proofs for complex algorithms.