🤖 AI Summary
This work addresses the challenge of deploying runtime systems that support expressive formal specification languages on resource-constrained microcontrollers, a limitation that undermines the verifiability of AI-generated safety-critical firmware. To bridge this gap, the authors propose Encore!, a bare-metal CPS virtual machine that models firmware cores as pure state-transition functions and executes Scheme code extracted from Rocq. By decoupling a constant-size, unverified host layer from a formally verified core, the approach ensures that verification effort remains independent of overall system complexity. Furthermore, it integrates large language models to assist in policy synthesis, replacing manual inspection with automatically generated theorem statements. This methodology enables, for the first time, the execution of fully formally verified, AI-generated firmware directly on microcontrollers, achieving both rigorous safety guarantees and practical deployability.
📝 Abstract
Enforcing invariants in safety-critical systems is increasingly urgent as AI-generated code becomes widespread. Unfortunately, the runtimes required to support high-level specification languages are too large for most embedded targets. In this article, we show how formally verified firmware is achievable today. We built Encore!, a bare-metal Continuation Passing Style (CPS) virtual machine (VM) that runs Rocq-extracted Scheme on microcontrollers. We also show how to structure firmware as a pure state-transition function, making its core fully provable in Rocq while keeping the unverified host layer constant regardless of firmware complexity. Large Language Model (LLM)-assisted tactic synthesis fits naturally into this workflow: formal theorem statements replace manual code review, allowing AI-generated firmware to prove itself.