seL4: Formal Verification of an OS Kernel
The work
| Authors | Gerwin Klein; Kevin Elphinstone; Gernot Heiser; June Andronick; David Cock; Philip Derrin; Dhammika Elkaduwe; Kai Engelhardt; Rafal Kolanski; Michael Norrish; Thomas Sewell; Harvey Tuch; Simon Winwood |
|---|---|
| Editors | |
| Type | inproceedings |
| Year | 2009 |
| Citekey | klein2009sel4 |
Where it appeared
| Published in | Proceedings of the ACM SIGOPS 22nd symposium on Operating systems principles |
|---|---|
| Publisher | Association for Computing Machinery |
| Pages | 207--220 |
Identifiers
| DOI | 10.1145/1629575.1629596 |
|---|
Access
| Landing page | https://doi.org/10.1145/1629575.1629596 |
|---|
Related
| Distinct from | ge2019time |
|---|---|
| Distinct from | klein2018formally |
| Distinct from | sewell2026escaping |
Abstract
Complete formal verification is the only known way to guarantee that a system is free of programming errors. We present our experience in performing the formal, machine-checked verification of the seL4 microkernel from an abstract specification down to its C implementation. We assume correctness of compiler, assembly code, and hardware, and we used a unique design approach that fuses formal and operating systems techniques. To our knowledge, this is the first formal proof of functional correctness of a complete, general-purpose operating-system kernel. Functional correctness means here that the implementation always strictly follows our high-level abstract specification of kernel behaviour. This encompasses traditional design and implementation safety properties such as the kernel will never crash, and it will never perform an unsafe operation. It also proves much more: we can predict precisely how the kernel will behave in every possible situation. seL4, a third-generation microkernel of L4 provenance, comprises 8,700 lines of C code and 600 lines of assembler. Its performance is comparable to other high-performance L4 kernels.
A copy is held
pdf, 718.3 kB. Not published — it may be under copyright. The facts and links here are.
How it got here
| How it got here | agent via crossref |
|---|---|
| Added | 2026-08-05 00:00 UTC |
| Approved by | a person 2026-08-16 15:23 UTC |
Cite it as
@inproceedings{klein2009sel4,
title = {seL4: Formal Verification of an OS Kernel},
author = {Gerwin Klein and Kevin Elphinstone and Gernot Heiser and June Andronick and David Cock and Philip Derrin and Dhammika Elkaduwe and Kai Engelhardt and Rafal Kolanski and Michael Norrish and Thomas Sewell and Harvey Tuch and Simon Winwood},
year = {2009},
booktitle = {Proceedings of the ACM SIGOPS 22nd symposium on Operating systems principles},
publisher = {Association for Computing Machinery},
pages = {207--220},
doi = {10.1145/1629575.1629596},
}
This record lives at https://refs.drheap.org/klein2009sel4/ and will keep doing so.