4 ms·

formal proofs of correctness