Safe to the Last Instruction: Automated Verification of a Type-Safe OS
microsoft.com