-

& $\approx$50 pages & Z/Eves prover\
Critical Software company [@Andre09] & A secure partitioning kernel & Specification & PIFP & B & Refinement & [$\divideontimes$]{}& Atelier B\
OS-K [@Kawamorita10] & A separation-kernel-based OS &

  ---------------
  Specification
  Verification
  ---------------

& & B, Promela &

  -----------------
  Refinement
  Theorem proving
  Model checking
  -----------------

& 2,700 proof obligations & B4free, Spin\
ARINC 653 [@zhao15] & ARINC 653 standard & Specification & Safety & Event-B &

  -----------------
  Refinement
  Theorem proving
  -----------------

& 2,700 LOC of Event-B spec. & RODIN\
EURO-MILS [@verb15] & PikeOS separation kernel & Specification & PIFP & HOL & Theorem proving & &gt; 4,000 LOC of spec. & Isabelle/HOL\
Rockwell Collins [@Greve04; @Wilding10] & AAMP7G microprocessor & Verification & GWV & ACL2 & Theorem proving & 3000 LOC ACL2 definitions & ACL2 theorem prover\
Verisoft XT project [@Baumann11] & PikeOS separation kernel & Verification & Data separation & Annotated C code & Theorem proving & [$\divideontimes$]{}& VCC tool\
SYSGO AG [@Tverdy11] & PikeOS separation kernel & Verification & GWV & HOL & Theorem proving & [$\divideontimes$]{}& Isabelle/HOL theorem prover\
Green Hills [@Richards10] & INTEGRITY-178B separation kernel & Verification & GWVr2 & ACL2 & Theorem proving & [$\divideontimes$]{}& ACL2 theorem prover\
PROSPER [@Dam13] & A Simple ARM-Based Separation Kernel & Verification & Information flow security & HOL4 & Theorem proving & 21,000 LOC & HOL4\
NICTA [@Murray12; @Murray13] & seL4 separation kernel & Verification & Information flow security & HOL & Theorem proving & 4970 LOC of spec., 27,756 LOC of proof & Isabelle/HOL theorem prover\
CMU [@Franklin10; @Franklin12] & Hypervisor (Xen and Shadowvisor) &

  ---------------
  Specification
  Verification
  ---------------

& Data separation & $PGCL^+$,$PTSL^+$ & Model checking & [$\divideontimes$]{}& CBMC\
VirtualCert project [@Barthe11] & A simple hypervisor (from Microsoft Hyper-V) & Ve