SibylFS: formal specification and oracle-based testing for POSIX and real-world file systems
seL4: formal verification of an OS kernel