Verified controller zoo

One source → every target — proved, simulated, and (where it exists) measured.

Program cards come first: each is one kernel built for one board, and every row on it is read from that program's own records. The cards after them are the original zoo, each true of what it lists (its emitted targets, proofs and simulation) and unchanged by any program card.

Programs on platforms

A program is one kernel compiled for one platform into one directory that builds with make, checks itself with make check against the kernel's exact real value on recorded inputs, and reproduces itself with make reproduce. Each card keeps the kernel's mathematical evidence apart from the program's integration evidence, and shows only what the program's records say.

Each card below was produced by one command (make all) from a single EML source. From that one source Forge emits every target it can — general-purpose software, GPU shaders, LLVM IR, machine-checked proofs (Lean / Coq / Isabelle), safety-critical (Ada / SPARK, AUTOSAR, AADL, ROS2), a smart contract, a zk circuit, and — for the RC filter, which is an actual circuit — a SPICE netlist, a KiCad schematic, and a JLCPCB fab bundle. Alongside the code sits a contract proof whose axiom footprint is clean of sorryAx, a simulation whose measured quantity satisfies the proved bound, and links to the raw evidence. This page is a generated view of that evidence — nothing is hand-authored; a proof that weren't clean, or a sim check that didn't hold, would show in red. (FPGA RTL — Verilog/VHDL/Chisel — appears wherever a source carries an @target(fpga) clock annotation: the aerospace actuator guard emits synthesizable Verilog/VHDL/Chisel for the Arty A7, the scalar Kalman filter below runs bit-exact at 100 MHz on a real Arty A7-100T (whole-design, all three of its anchors closing), and the other estimation kernels run bit-exact under Verilator. The plain scalar controllers don't ask for it, so they emit none — the tool skips what a source doesn't request rather than fake it.)

Those contract proofs are sorryAx-clean but not axiom-free — they stand on MachLib's small axiomatic real-number base, kept Mathlib-free for build speed. That base is machine-checked consistent: of its 156 trusted axioms, 124 are modelled in Mathlib's ℝ — 107 witnessed by typecheck, 14 interpreted carrier or function symbols, 3 Lean's own (propext, Classical.choice, Quot.sound). The remaining 32 are float-bridge rows: claims that a concrete IEEE-754 operation rounds within a stated bound, which Mathlib cannot model because it has no IEEE-754 semantics. Those are validated by measurement and are never counted as witnessed. A machine-checked ledger pins every axiom a shipped theorem reaches inside that set, and its teeth have caught real defects twice: a genuinely unsound axiom (an open-interval Rolle, now retired and machine-checked false), and — on 2026-09-11 — the decimal-literal family, which every certificate carrying a 100.0 depended on while sitting outside the trusted set, because the footprint is indexed on MachLib's own theorems and none of those needs a literal. Found by reading a generated certificate's #print axioms; promoted and witnessed the same day.

The exact reals are proved; the float rounding is now proved too — conditionally: the emitted C for a controller's arithmetic — the PID datapath among them, and a tanh-saturated variant — carries a machine-checked forward-error bound (re-derivable with make verify-grounding) against those exact reals, but only when the run stays float-safe: every intermediate sum, difference and product is a finite float, and no product's exact value is a nonzero number below the smallest normal double (DBL_MIN, about 2.2·10⁻³⁰⁸). MachLib proves those conditions hold for PID inputs inside a stated bounded domain (finite, at most B in magnitude with 60·B ≤ DBL_MAX, each either 0 or at least δ with 0.025·δ ≥ DBL_MIN); outside it no bound is claimed. The bound rests on a disclosed, named model of IEEE-754 binary64, restated on 2026-09-14 after a measurement showed the earlier, unconditional model false of real doubles: each basic op correctly rounded when its result is finite (for a product, when the exact product is also 0 or at least DBL_MIN), and each libm primitive within a stated bound on finite inputs (tanh within 2u, twice the unit roundoff, so the tanh variant's rounding term is 2u, not u). That model is the honest floor — un-witnessable inside Lean, since Float is opaque — so the bit-exactness of a specific chip's libm behind the silicon / bit-exact badges stays measured, not proved; grounding it further is a Flocq-scale project.

A few cards are proof-first kernels rather than emitted controllers: a closed-loop safety envelope, a pure-math finiteness theorem (iterated-exponential Khovanskii), and two verified finance kernels — an amortization schedule that reconciles to the penny and a 30E/360 day-count whose coupon periods compose exactly, both in exact integers. They earn a place because the same discipline carries beyond control code: a machine-checked contract (clean of sorryAx) paired with a runtime witness that satisfies it.

Reproduction tiers: LOCAL one command, no heavy toolchain · TOOLCHAIN re-derive with Lean / Vivado · REPLAY captured on real hardware, replayed from evidence. 8 controllers + 4 theorems · 4 with real-hardware evidence.