seL4

TLDR

"The proof establishes that seL4 behaves exactly as specified, enabling precise predictions, and shows its performance is comparable to other high-performance L4 kernels." Might be okay. Let's craft each sentence concisely. Background sentence: "Formal verification is the only known method to guarantee a system is free of programming errors, and this work demonstrates its application to the seL4 microkernel." That covers background context and safety properties. Might mention safety properties: "ensuring the kernel never crashes or performs unsafe operations." Could combine: "Formal verification is the only known method to guarantee a system is free of programming errors, and this work demonstrates its application to the seL4 microkernel, ensuring it never crashes or performs unsafe operations." That's one sentence.

Abstract

Complete formal verification is the only known way to guarantee that a system is free of programming errors.We present our experience in performing the formal, machine-checked verification of the seL4 microkernel from an abstract specification down to its C implementation. We assume correctness of compiler, assembly code, and hardware, and we used a unique design approach that fuses formal and operating systems techniques. To our knowledge, this is the first formal proof of functional correctness of a complete, general-purpose operating-system kernel. Functional correctness means here that the implementation always strictly follows our high-level abstract specification of kernel behaviour. This encompasses traditional design and implementation safety properties such as the kernel will never crash, and it will never perform an unsafe operation. It also proves much more: we can predict precisely how the kernel will behave in every possible situation.seL4, a third-generation microkernel of L4 provenance, comprises 8,700 lines of C code and 600 lines of assembler. Its performance is comparable to other high-performance L4 kernels.