This book was written as a companion to my book on modelling operating system kernels. It is intended to demonstrate that the formal derivation of kernels is possible (and, actually, quite easy, or so I have found thus far). Itisimportantforthereadertounderstandthatthere?nementscontained in this book are not the only ones I have performed of microkernels. To date, I have re?ned four microkernels down to executable code and have now p- duced a kit...