The purpose of this book is to show that the formal specification of kernels can be followed by a completely formal refinement ...