Visible to the public Parametric Verification of Address Space Separation