Skip to main content


File systems deserve verification too!


Gabriele Keller, Toby Murray, Sidney Amani, Liam O'Connor-Davis, Zilin Chen, Leonid Ryzhyk, Gerwin Klein and Gernot Heiser



University of Toronto


File systems are too important, and current ones are too buggy, to remain unverified. Yet the most successful verification methods for functional correctness remain too expensive for current file system implementations -- we need verified correctness but at reasonable cost. This paper presents our vision and ongoing work to achieve this goal for a new high-performance flash file system, called BilbyFs. BilbyFs is carefully designed to be highly modular, so it can be verified against a high-level functional specification one component at a time. This modular implementation is captured in a set of domain specific languages from which we produce the design-level specification, as well as its optimised C implementation. Importantly, we also automatically generate the proof linking these two artefacts. The combination of these features dramatically reduces verification effort. Verified file systems are now within reach for the first time.

BibTeX Entry

    doi              = {10.1145/2525528.2525530},
    author           = {Keller, Gabriele and Murray, Toby and Amani, Sidney and O'Connor-Davis, Liam and Chen, Zilin and
                        Ryzhyk, Leonid and Klein, Gerwin and Heiser, Gernot},
    year             = {2013},
    month            = nov,
    slides           = {},
    title            = {File Systems Deserve Verification Too!},
    booktitle        = {Workshop on Programming Languages and Operating Systems (PLOS)},
    pages            = {1-7},
    address          = {Farmington, Pennsylvania, USA}


Served by Apache on Linux on seL4.
Served by Apache on Linux on seL4.