{"slug": "compcert", "name": "CompCert", "category": "dev-libs", "category_name": "Libraries and frameworks", "description": "", "recommenders": 3, "commenters": 8, "warners": 2, "score": 1.159, "rising": 0.35, "first": "2025-12-09", "latest": "2026-10-15", "why": "CompCert (a proven correct C compiler used by Airbus)", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 4, "neutral": 2, "compare": 1, "warn": 2}, "spark": [0, 0, 0, 0, 0, 1, 0, 1, 1, 0, 0, 1], "listed": true, "loved": [], "caveat": "", "short_quote": "CompCert (a proven correct C compiler used by Airbus)", "kind": "", "icon": false, "domain": null, "github_repo": "github.com/absint/compcert", "official_url": "https://compcert.org/", "pricing": "", "aliases": ["CompCert"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 801224688, "item_id": 50076543, "url": "https://news.ycombinator.com/item?id=50076543", "by": "MaxBarraclough", "date": "2026-10-13", "stance": "recommend", "quote": "CompCert produces surprisingly fast native code.", "excerpt": "CompCert produces surprisingly fast native code. This 2022 article [0] says it generates binaries that run about 7% slower than what GCC produces with -O1. [0] https://www.cs.cornell.edu/courses/cs6120/2022sp/blog/compcert/", "context": "", "use_case": "", "switched_from": "", "story": "11 year old unsoundness bugs found in Rust borrow checker"}, {"id": 782689168, "item_id": 48918073, "url": "https://news.ycombinator.com/item?id=48918073", "by": "rwmj", "date": "2026-07-15", "stance": "recommend", "quote": "use a formally proven toolchain like compcert to compile it.", "excerpt": "However you can do what Airbus do and formally prove your C code and use a formally proven toolchain like compcert to compile it. Or you can take a performance hit and add bounds checking to the C code[1]. Aircraft systems are probably the best chance that CHERI has, and that's pretty niche, small runs and very expensive, and still better solved in software. [1] I literally wrote the paper on this back in 1996: https", "context": "", "use_case": "Formally verified C compilation", "switched_from": "", "story": "RISC-V Is Inevitable: State of the Union Keynote Argues"}, {"id": 779651905, "item_id": 48728244, "url": "https://news.ycombinator.com/item?id=48728244", "by": "deterministic", "date": "2026-06-29", "stance": "recommend", "quote": "Check out seL4 and CompCert for real-world examples", "excerpt": "Check out seL4 and CompCert for real-world examples of complex software proven correct and used in industry.", "context": "", "use_case": "", "switched_from": "", "story": "You Don't Know Jack About Formal Verification"}, {"id": 766886561, "item_id": 47930410, "url": "https://news.ycombinator.com/item?id=47930410", "by": "deterministic", "date": "2026-04-27", "stance": "recommend", "quote": "CompCert (a proven correct C compiler used by Airbus)", "excerpt": "Check out SeL4 (a proven correct micro kernel used by billions of devices worldwide) and CompCert (a proven correct C compiler used by Airbus).", "context": "", "use_case": "formally verified C compiler", "switched_from": "", "story": "\"Why not just use Lean?\""}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 764220272, "item_id": 47763767, "url": "https://news.ycombinator.com/item?id=47763767", "by": "armchairhacker", "date": "2026-04-14", "stance": "warn", "quote": "It happened in CompCert", "excerpt": "\u201c\u2018Proven\u2019 code turns out buggy, because of a bug outside the proven specification\u201d is relatively common. It happened in CompCert: https://lobste.rs/s/qlrh1u/runtime_error_formally_verified", "context": "", "use_case": "", "switched_from": "", "story": "Lean proved this program correct; then I found a bug"}, {"id": 741873824, "item_id": 46367114, "url": "https://news.ycombinator.com/item?id=46367114", "by": "aidenn0", "date": "2025-12-23", "stance": "warn", "quote": "a formally verified C compiler generates incorrect output because of an inconsistent value", "excerpt": "See also Regehr's example[1] where a formally verified C compiler generates incorrect output because of an inconsistent value in <limits.h> (TL;DR: The compiler can pick whether \"char\" is signed or unsigned. Compcert picked one, but the linux system header used the other for CHAR_MIN and CHAR_MAX). 1: https://blog.regehr.org/archives/482 there were many issues here, not just with compcert", "context": "", "use_case": "", "switched_from": "", "story": "Test, don't just verify"}]}], "who": [], "tags": [], "use_cases": ["formally verified c compilation", "formally verified c compiler", "verified c compiler"], "compared": [{"slug": "llvm", "name": "LLVM", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "gcc", "name": "GCC", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "clang", "name": "Clang", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "sel4", "name": "seL4", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=50069499", "title": "11 year old unsoundness bugs found in Rust borrow checker", "mentions": 3}, {"url": "https://news.ycombinator.com/item?id=48916805", "title": "RISC-V Is Inevitable: State of the Union Keynote Argues", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48743462", "title": "It's not me, it's the compiler", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48719521", "title": "You Don't Know Jack About Formal Verification", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47922079", "title": "\"Why not just use Lean?\"", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47759709", "title": "Lean proved this program correct; then I found a bug", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {"compare": 1, "warn": 1}, "2026-01": {}, "2026-02": {}, "2026-03": {}, "2026-04": {"neutral": 1, "warn": 1, "recommend": 1}, "2026-05": {}, "2026-06": {"recommend": 1}, "2026-07": {"neutral": 1, "recommend": 1}, "2026-08": {}, "2026-09": {}, "2026-10": {"recommend": 1}}, "quotes": [{"id": 801743042, "item_id": 50108940, "url": "https://news.ycombinator.com/item?id=50108940", "by": "MaxBarraclough", "date": "2026-10-15", "stance": "neutral", "quote": "CompCert itself is pretty niche. It's not Free and Open Source software", "excerpt": "> I've experienced a huge amount of friction trying to enable features that cost something resembling 0.5% of fleet performance, even when they provide massive benefits. 12% loss would be laughed out of the room. A 12% difference in performance between two compilers, for some given application, is possible even between two of the best optimising compilers available. A 12% performance lag does not necessarily relegate", "context": "", "use_case": "", "switched_from": "", "story": "11 year old unsoundness bugs found in Rust borrow checker"}, {"id": 801495313, "item_id": 50093457, "url": "https://news.ycombinator.com/item?id=50093457", "by": "MaxBarraclough", "date": "2026-10-14", "stance": "neutral", "quote": "CompCert code is 7% slower than gcc-01 and 12% slower than gcc-02 on average.", "excerpt": "> That's a big gap I wouldn't say so. The gap between GCC and Clang/LLVM is bigger than that on some benchmarks, [0] although the gap between their overall performance (using geometric mean) is much less. [1] It's a very impressive result considering how much effort has gone into GCC. It highlights how compiler optimisation work can face diminishing returns. > the norm for releases being O2 if I understand correctly ", "context": "", "use_case": "", "switched_from": "", "story": "11 year old unsoundness bugs found in Rust borrow checker"}, {"id": 801224688, "item_id": 50076543, "url": "https://news.ycombinator.com/item?id=50076543", "by": "MaxBarraclough", "date": "2026-10-13", "stance": "recommend", "quote": "CompCert produces surprisingly fast native code.", "excerpt": "CompCert produces surprisingly fast native code. This 2022 article [0] says it generates binaries that run about 7% slower than what GCC produces with -O1. [0] https://www.cs.cornell.edu/courses/cs6120/2022sp/blog/compcert/", "context": "", "use_case": "", "switched_from": "", "story": "11 year old unsoundness bugs found in Rust borrow checker"}, {"id": 782689168, "item_id": 48918073, "url": "https://news.ycombinator.com/item?id=48918073", "by": "rwmj", "date": "2026-07-15", "stance": "recommend", "quote": "use a formally proven toolchain like compcert to compile it.", "excerpt": "However you can do what Airbus do and formally prove your C code and use a formally proven toolchain like compcert to compile it. Or you can take a performance hit and add bounds checking to the C code[1]. Aircraft systems are probably the best chance that CHERI has, and that's pretty niche, small runs and very expensive, and still better solved in software. [1] I literally wrote the paper on this back in 1996: https", "context": "", "use_case": "Formally verified C compilation", "switched_from": "", "story": "RISC-V Is Inevitable: State of the Union Keynote Argues"}, {"id": 780746785, "item_id": 48796674, "url": "https://news.ycombinator.com/item?id=48796674", "by": "dzaima", "date": "2026-07-05", "stance": "neutral", "quote": "CompCert apparently has 1200LoC of proving DCE", "excerpt": "Formal proofs for specific instruction sequence substitution (e.g. LLVM's instcombine) are simple-ish enough via just throwing SMT at it, ...as long as the source pattern and target replacement are in a format from which both the compiler code and verification source+target can be automatically derived from; though you'd still need manual proofs for anything with unbounded configurations that can't be exhaustively ch", "context": "", "use_case": "", "switched_from": "", "story": "It's not me, it's the compiler"}, {"id": 779651905, "item_id": 48728244, "url": "https://news.ycombinator.com/item?id=48728244", "by": "deterministic", "date": "2026-06-29", "stance": "recommend", "quote": "Check out seL4 and CompCert for real-world examples", "excerpt": "Check out seL4 and CompCert for real-world examples of complex software proven correct and used in industry.", "context": "", "use_case": "", "switched_from": "", "story": "You Don't Know Jack About Formal Verification"}, {"id": 766886561, "item_id": 47930410, "url": "https://news.ycombinator.com/item?id=47930410", "by": "deterministic", "date": "2026-04-27", "stance": "recommend", "quote": "CompCert (a proven correct C compiler used by Airbus)", "excerpt": "Check out SeL4 (a proven correct micro kernel used by billions of devices worldwide) and CompCert (a proven correct C compiler used by Airbus).", "context": "", "use_case": "formally verified C compiler", "switched_from": "", "story": "\"Why not just use Lean?\""}, {"id": 764220272, "item_id": 47763767, "url": "https://news.ycombinator.com/item?id=47763767", "by": "armchairhacker", "date": "2026-04-14", "stance": "warn", "quote": "It happened in CompCert", "excerpt": "\u201c\u2018Proven\u2019 code turns out buggy, because of a bug outside the proven specification\u201d is relatively common. It happened in CompCert: https://lobste.rs/s/qlrh1u/runtime_error_formally_verified", "context": "", "use_case": "", "switched_from": "", "story": "Lean proved this program correct; then I found a bug"}, {"id": 763960483, "item_id": 47747530, "url": "https://news.ycombinator.com/item?id=47747530", "by": "c0balt", "date": "2026-04-12", "stance": "neutral", "quote": "formally verified compilers, like compcert", "excerpt": "I don't know about running per se but practical applications (as in done for product/service) exist. A notable practitioner for Isabelle and Lean is AWS[0]. There is also TLA+ for a more practical tool. The most widely used variant of these proof assistants are probably formally verified compilers, like compcert, which are used in some highly regulated industries like aviation. [0]: https://isabelle.systems/zulip-arc", "context": "", "use_case": "Verified C compiler", "switched_from": "", "story": "A Perfectable Programming Language"}, {"id": 741873824, "item_id": 46367114, "url": "https://news.ycombinator.com/item?id=46367114", "by": "aidenn0", "date": "2025-12-23", "stance": "warn", "quote": "a formally verified C compiler generates incorrect output because of an inconsistent value", "excerpt": "See also Regehr's example[1] where a formally verified C compiler generates incorrect output because of an inconsistent value in <limits.h> (TL;DR: The compiler can pick whether \"char\" is signed or unsigned. Compcert picked one, but the linux system header used the other for CHAR_MIN and CHAR_MAX). 1: https://blog.regehr.org/archives/482 there were many issues here, not just with compcert", "context": "", "use_case": "", "switched_from": "", "story": "Test, don't just verify"}, {"id": 739333696, "item_id": 46208356, "url": "https://news.ycombinator.com/item?id=46208356", "by": "raphlinus", "date": "2025-12-09", "stance": "compare", "quote": "using tools similar to CompCert", "excerpt": "There's a straightforward answer to the \"why not\" question: because it will result in codebases with the same kind of memory unsafety and vulnerability as existing C code. If an LLM is in fact capable of generating code free of memory safety errors, then it's certainly also capable of writing the Rust types that guarantee this and are checkable. We could go even further and have automated generation of proofs, either", "context": "", "use_case": "", "switched_from": "", "story": "If you're going to vibe code, why not do it in C?"}]}