An I O Separation Model for Formal Verification of Kernel Implementations