Gerwin Klein Kevin Elphinstone Gernot Heiser June Andronick David Cock Philip Derrin Dhammika Elkaduwe Kai Engelhardt Rafal Kolanski Michael Norrish Thomas Sewell Harvey Tuch Simon Winwood seL4: formal verification of an OS kernel. 207-220 2009 SOSP http://doi.acm.org/10.1145/1629575.1629596 conf/sosp/2009 db/conf/sosp/sosp2009.html#KleinEHACDEEKNSTW09