You can deal with timing attacks using Kemmerer&#x27;s Shared Resource Matrix to find those and other covert channels. Then, you just look at the bandwidth of them along with design alternatives that don&#x27;t leak timing. You can sometimes make the timing predictable or non-data-driven at interface level to nullify that. An example comes from military-grade stuff way back that transmitted in fixed-length, fixed-rate packets. Markus Ottela added that to Tinfoil Chat at my recommendation.<p>Far as correctness proofs, a combo of Ada 2012 with Design-by-Contract and SPARK is probably best at that. Far as app level, just program in a functional style with abstract state machines. Make it more concrete and detailed, replicating analysis or tests at each level. Eventually, you run the code checkers on the result and throw in some fuzz testing.<p>No easy route, though, that I&#x27;m aware. Highly assured software and system design is a painstaking process. Avoiding risky stuff, defining all success&#x2F;fail traces, failing safe, and static analysis to preempt bugs are the strongest route. Plus source-to-object correspondence to be sure compiler didn&#x27;t eliminate safety checks or introduce problems. Spark Pro supports that.