An “Automated, Static Safety Verifier” uses typed
assembly language (TAL) and Hoare logic to achieve highly automated, static
verification of type and
memory safety of an
operating system (OS). Various techniques and tools mechanically verify the safety of every
assembly language instruction in the OS, run-
time system, drivers, and applications, except the boot
loader (which can be separately verified). The OS includes a “
Nucleus” for accessing hardware and memory, a kernel that builds services running on the
Nucleus, and applications that run on top of the kernel. The
Nucleus, written in verified
assembly language, implements allocation,
garbage collection, multiple stacks, interrupt handling, and device access. The kernel, written in C# and compiled to TAL, builds higher-level services, such as preemptive threads, on top of the Nucleus. A Hoare-style verifier with automated theorem prover verifies safety and
correctness of the Nucleus. A TAL checker verifies safety of the kernel and applications.