I might. My idea is to use either it or more pure ML&#x2F;Ocaml to code the prototype up then convert each function into imperative C, Rust, or Ada. I figure a subset of Haskell should make that achievable. So, I can use all the tools like QuickCheck and QuickSpec for Haskell along with functional style to knock out many issues. Then, direct translation to imperative with no global issues, equivalence testing generated from Haskell tests, and static analysis to ensure local code is proper.<p>That seL4 matched Haskell and C... along with open-sourcing a key tool (AutoCorres)... makes me think this is achievable. My method isn&#x27;t formal proof but would be more accessible. What do you think?