CoGENT: Verifying High-Assurance File System Implementations
seL4: formal verification of an OS kernel