Using Crash Hoare logic for certifying the FSCQ file system
seL4: formal verification of an OS kernel