Proving a real time algorithm for ATM in Coq | doi.page