June 2010
3 posts
“We prove that the implementation always strictly follows our high-level abstract...”
– Bold claims from a proof of correctness of the seL4 kernel 