Skip to main content


seL4: Formal verification of an operating-system kernel


Gerwin Klein, June Andronick, Kevin Elphinstone, Gernot Heiser, David Cock, Philip Derrin, Dhammika Elkaduwe, Kai Engelhardt, Rafal Kolanski, Michael Norrish, Thomas Sewell, Harvey Tuch and Simon Winwood



Open Kernel Labs

Australian National University



We report on the formal, machine-checked verification of the seL4 microkernel from an abstract specification down to its C implementation. We assume correctness of compiler, assembly code, hardware, and boot code.

seL4 is a third-generation microkernel of L4 provenance, comprising 8,700 lines of C and 600 lines of assembler. Its performance is comparable to other high-performance L4 kernels. We prove that the implementation always strictly follows our high-level abstract specification of kernel behaviour. This encompasses traditional design and implementation safety properties such as that the kernel will never crash, and it will never perform an unsafe operation. It also implies much more: we can predict precisely how the kernel will behave in every possible situation.

BibTeX Entry

    doi              = {10.1145/1743546.1743574},
    journal          = {Communications of the ACM},
    author           = {Klein, Gerwin and Andronick, June and Elphinstone, Kevin and Heiser, Gernot and Cock, David and
                        Derrin, Philip and Elkaduwe, Dhammika and Engelhardt, Kai and Kolanski, Rafal and Norrish, Michael
                        and Sewell, Thomas and Tuch, Harvey and Winwood, Simon},
    year             = {2010},
    number           = {6},
    month            = jun,
    volume           = {53},
    keywords         = {sel4, microkernel, verification},
    title            = {{seL4}: Formal Verification of an Operating-System Kernel},
    pages            = {107-115}


Served by Apache on Linux on seL4.
Served by Apache on Linux on seL4.