Transiently-powered systems featuring non-volatile memory as well as external peripherals enable the development of new low-power sensor applications. However, as programmers, we are ill-equipped to reason about systems where power failures are the norm rather than the exception. A first challenge consists in being able to capture all the volatile state of the application-external peripherals included-to ensure progress. A second, more fundamental, challenge consists in specifying how power failures may interact with peripheral operations. In this paper, we propose a formal specification of intermittent computing with peripherals, an axiomatic model of interrupt-based checkpointing as well as its proof of correctness, machine-checked in the Coq proof assistant. We state the correctness of the checkpointing mechanism as a trace refinement property between the model and the specification, which accounts for peripheral device operations replays due to power failures. Our proof methodology relies on intermediate oracle semantics to tame the non-determinism of power failures scenarios.