The researchers used an executable specification written in Haskell, C code that mapped to the Haskell, and the Isabelle theorem prover to generate a machine-checked proof that the C code in the kernel matches the executable and the formal specification of the system.