Using Crash Hoare logic for certifying the FSCQ file system
Formal verification of a realistic compiler