From Rocq to Metal: A Pipeline for Formally Verified Microcontroller Firmware

Abstract

Enforcing invariants in safety-critical firmware is increasingly urgent as generated code becomes widespread, but standard extraction targets for proof assistants require runtimes too large for many embedded devices. We present a pipeline for running formally verified Rocq firmware logic on Cortex-M microcontrollers. The pipeline extracts Gallina to Scheme, compiles it with Encore!, a bare-metal Continuation-Passing Style (CPS) bytecode virtual machine, and embeds the result in no_std Rust firmware. We structure applications as pure state-transition functions, so the business logic is proved in Rocq while the event/effect boundary, host callbacks, compiler, and VM remain explicit trusted components: no proof yet relates bytecode execution to Gallina semantics. On eight firmware workloads, from APDU parsing to a credential store, Encore! runs unmodified Rocq-extracted code within the 50 KiB RAM budget of ST33-class targets on every input size, where CertiRocq's generated code runs out of memory on the larger ones, at the price of up to 10 times more executed instructions than CertiRocq; a transaction-signing application is validated on physical Ledger Flex hardware.

arXiv commentPreprint: Accepted to the 19th International Conference on Verification and Evaluation of Computer and Communication Systems (VECoS 2026)