Formally verified compilation

CompCert is a formally verified optimizing C compiler. Its intended use is compiling safety-critical and mission-critical software written in C and meeting high levels of assurance. It ac­cepts most of the ISO C 99 language, with some exceptions and some extensions. It produces machine code for a growing number of different architectures.

What sets CompCert apart?

CompCert is the only production compiler that is formally verified, using machine-assisted math­ematical proofs, to be exempt from mis­compilation issues. The code it pro­duces is proved to behave exactly as specified by the semantics of the source C program.

This level of confidence in the correctness of the compilation process is unprecedented and con­tributes to meeting the highest levels of software assurance.

verified with Rocqvalidated with Valex

The formal proof covers all transformations from the abstract syntax tree to the generated assem­bly code. To preprocess and produce object and executable files, an external C pre­processor, assemblers, linkers, and C libraries have to be used. However, these unverified stages are well-understood and robust from an implementation perspective. This was demon­strated on an early version of CompCert in a 2011 study by Regehr, Yang et al.:

In 2022, the Association for Computing Machinery, ACM, presented the CompCert development team with the prestigious ACM Software System Award. Subsequently, the team also received the ACM SIGPLAN Programming Languages Software Award.

Your benefits

• CompCert is a natural complement to any verification tech­niques that you apply at the source-code level — be it model checking, program proof, or static analysis. Only with CompCert can you guarantee that all the safety pro­perties verified on the source code also hold for the ge­nerated machine code.
• When using a conventional compiler to compile safety-critical applications, you typically have to disable compiler optimizations and run into resource problems as a result. With CompCert, you can significantly improve your applications’ performance, as you no longer have to switch off optimizations for safety reasons.

Formally verified optimizations

CompCert implements a variety of controlled non-aggressive optimizations, all of them formally verified:

• Register allocation using graph coloring and iterated register coalescing,
  to keep local variables and temporaries in processor registers as much as possible;
• Instruction selection with strength reduction,
  to take advantage of combined instructions provided by the target architecture;
• Constant propagation for integer and floating-point types,
  to pre-evaluate constant computations at compile time;
• Common subexpression elimination,
  to avoid redundant recomputations and instead reuse previously-computed results;
• Dead and redundant code elimination,
  to remove useless arithmetic operations and memory loads and stores;
• Function inlining,
  to avoid function call overhead for functions declared inline;
• Tail call elimination,
  to implement tail recursion in constant stack space;
• If-conversion,
  to replace conditional branches by conditional move instructions.

Loop optimizations are currently not performed, but can be implemented on request.

Compilation with execution time in mind

On average, code generated by CompCert is:

• twice as fast as code generated by GCC without optimizations,
• only 10% slower than GCC code at optimization level 1,
• some 20% slower than GCC code at optimization level 3.

Due to the lack of aggressive loop optimizations, performance is lower on benchmarks that involve many matrix computations.

Ease-of-use and interoperability

• From command-line options to error messages to the handling of built-in functions, many CompCert features are very deliberately implemented to feel familiar and intuitive to GCC and LLVM users.
• Another express goal is to generate object code that respects the ABI of the target platform, and thus can be linked with object code and libraries compiled by other C compilers. In this, CompCert succeeds to a great extent, with some target-specific exceptions that are thoroughly documented.
• CompCert is supported by the entire chain of AbsInt tools for safety-critical and mission-critical applications:
  • Astrée for sound static analysis of your C code
  • RuleChecker for proving compliance with MISRA, CERT, CWE, and other standards
  • ValueAnalyzer for uncovering illegal accesses from within third-party object code
  • StackAnalyzer for static analysis of the worst-case stack usage
  • EnergyAnalyzer for static analysis of the worst-case energy consumption
  • aiT for static WCET analysis
  • TimeWeaver for hybrid WCET analysis
  • TimingProfiler for timing analysis at early stages of software development

A growing list of supported architectures and ABIs

CompCert produces machine code for PowerPC, ARM & AArch64, x86, RISC-V, and AURIX.

Try now, for free

Start your free trial today.

Building blocks, not a black box

Thanks to the modularity of the formal proof, CompCert’s individual components — notably, its clightgen frontend for generating Clight — can be used separately, incorporated into other applications, and/or extended as need be.

• For example, in 2025, researchers with the Cornell University made use of clightgen to formally verify the correctness of a modular-inverse implementation in the libsecp256k1 cryptographic library used by Bitcoin.
• Similarly, various research groups from around the globe have successfully extended CompCert’s optimization module with additional formally verified optimizations of their own, including loop optimizations, peephole optimizations, and more.
• Further work still was done by a joint group of researchers from China, France, and the US who modified and extended the compilation chain for 32-bit x86 with a verified assembler which further transforms assembly programs into ELF object files and supports verified separate compilation.
• Sandia National Laboratories, operated for the US Department of Energy, have presented an approach that reuses and extends CompCert’s single-threaded proofs for multithreaded programs.
• Several of CompCert’s intermediate representations, including Clight, can be used as basis for static analyses that help make the compiled code resilient to side-channel attacks. Much research on formally verified constant-time preserving compilation has been completed in France, and more is currently ongoing in Germany.

Strong roots in academia

AbsInt was founded in 1998 at the Chair for Compiler Construction at the University of Saarland, Germany. CompCert is developed and distributed by AbsInt since 2015 under license from INRIA, the French National Institute for Research in Digital Science and Technology.

Using CompCert for educational and research purposes is free of charge.

Additionally, we offer free academic evaluations of all our tools for static analysis of C, C++, and binary code. Have a browse through our extensive catalog and get in touch if anything catches your eye.