Trusting the trust TCB: Pokemon, big hack, compiler Inductive definition Encoding: simplify the problem Invariants: solve the infiniteness Abstraction -> prove by refinement Modularity -> prove by composition