Gerwin Klein Philip Derrin Kevin Elphinstone Experience report: seL4: formally verifying a high-performance microkernel. 91-96 2009 ICFP http://doi.acm.org/10.1145/1596550.1596566 conf/icfp/2009 db/conf/icfp/icfp2009.html#KleinDE09