Foundational Verification of Running-Time Bounds for Interactive Programs
Name
3779031.3779088.pdf
Size
680.85 KB
Format
Adobe PDF
Checksum (MD5)
5282b2f4be72f6a08631ac734825c327
Author(s)
Tockman, Andy
Singh, Pratap
Erbsen, Andres
Gruetter, Samuel
Chlipala, Adam
Date Issued
January 8, 2026
Publisher
ACM|Proceedings of the 15th ACM SIGPLAN International Conference on Certified Programs and Proofs
Citation
Andy Tockman, Pratap Singh, Andres Erbsen, Samuel Gruetter, and Adam Chlipala. 2026. Foundational Verification of Running-Time Bounds for Interactive Programs. In Proceedings of the 15th ACM SIGPLAN International Conference on Certified Programs and Proofs (CPP '26). Association for Computing Machinery, New York, NY, USA, 187–200.
Version
Final published version
Abstract
Some important domains of software demand concrete bounds on how long functions may run, for instance for real-time cyberphysical systems where missed deadlines may damage industrial machinery. Such programs may interact with external devices throughout execution, where time deadlines ought to depend on, for instance, sensor readings (e.g. we only scramble to close a valve immediately when a sensor reports that a tank is about to overflow). We present the first software-development toolchain that delivers first-principles proofs of meaningful time bounds for interactive machine code, while allowing all per-application programming and verification to happen at the source-code level. We allow C-like programs to be proved against separation-logic specifications that also constrain their running time, and such proofs are composed with verification of a compiler to RISC-V machine code. All components are implemented and proved inside the Rocq proof assistant, producing final theorems whose statements depend only on machine-language formal semantics and some elementary specification constructions for describing running time. As a capstone case study, we extended a past verification (of a real microcontroller-based cyberphysical system) to bound time between arrival of network packets and actuation of an attached device.
Description
CPP ’26, Rennes, France
MIT Department
Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science
Terms of Use
Creative Commons Attribution
Persistent DSpace Link
DOI of Published Version
https://doi.org/10.1145/3779031.3779088
