3 ms·EwoK: secure embedded micro-kernel using SPARK/Ada formal verification5 points by gusthoff 8y ago