This book was written as a companion to my book on modelling operating system kernels. It is intended to demonstrate that the formal derivation of kernels is possible (and, actually, quite easy, or so I have found thus far). Itisimportantforthereadertounderstandthatthere?nementscontained in this book are not the only ones I have performed of microkernels. To date, I have re?ned four microkernels down to executable code and have now p- duced a kit of formally speci?ed components that can be composed to form kernels. The ?rst kernel included in this book is just one example of this work. The second kernel, the Separation Kernel, is new and was partly constructed out of the kit of parts (and the reader will see reuse in its speci?cation and re?nement) and was included for speci?c reasons that will become clear anon. Bothkernelstooklessthanthreemonths’workingtimetoproduce(theactual time is rather hard to calculate because of frequent interruptions). Previous experience in re?ning kernels also paid o? in the sense that there was l- tle revision involved in their speci?cation or re?nement; the usual process of yo-yoing between levels of the derivation was absent. This appears to be an inevitable consequence of experience.
The kernel of any operating system is its most critical component. The remainder of the system depends upon a correctly functioning and reliable kernel for its operation.
The purpose of this book is to show that the formal specification of kernels can be followed by a completely formal refinement process that leads to the extraction of executable code. The formal refinement process ensures that the code meets the specification in a precise sense.
Two kernels are specified and refined. The first is small and of the kind often used in embedded and real-time systems. It closely resembles the one modelled in our Formal Models of Operating System Kernels. The second is a Separation Kernel, a microkernel architecture devised for cryptographic and other secure applications. Both kernels are refined to the point at which executable code can be extracted. Apart from documenting the process, including proofs, this book also shows how refinement of a realistically sized specification can be undertaken.
Iain Craig is a Chartered Fellow of the BCS and has a PhD in Computer Science.
