Hardware provides driver authors both a strict specification of the operations a driver is allowed to do, and a highly permissive interface full of operations a driver can do. Authoring drivers that adhere to the provided hardware device protocol is challenged by dynamic definitions of what a driver should do based on the hardware's state. This is further complicated by increasingly capable hardware which may transition between states concurrently and independently from the software driver.

Wireless sensor networks (WSNs) deployed in the natural environment offer well-established benefits for prediction, modeling, timely response, and informed decision making in the face of the accelerating climate crisis. To facilitate faster experimentation and deployment, researchers have focused on developing WSN platforms that support rapid prototyping and field readiness. Despite their potential, these platforms have historically seen limited uptake both among domain scientists and the broader IoT research community. In this paper, we present insights gained from the development of ENTS (Environmental NeTworked Sensing)—a WSN platform co-designed with three distinct groups of domain scientists through an iterative development process. We describe the evolution of ENTS from a simple analog measurement tool to an extensible platform actively supporting collaborations with diverse domain experts. We synthesize our experience into a set of design principles aimed at fostering impactful and lasting research partnerships. Finally, we instantiate the outlined design principles for future interdisciplinary sensing efforts, including open-source hardware, firmware, low-cost custom weatherproof enclosures, and a web-based visualization tool.

We present a case study formally verifying process isolation in the Tock production microcontroller OS kernel. Tock combines hardware memory protection units and language-level techniques—by writing the kernel in Rust—to enforce isolation between user and kernel code. Our effort to verify Tock's process abstraction unearthed multiple, subtle bugs that broke isolation—many allowing malicious applications to compromise the whole OS. We describe this effort and TickTock, our fork of the Tock operating system kernel that eliminates isolation bugs by construction. TickTock uses Flux, an SMT-based Rust verifier, to formally specify and verify process isolation for all ARMv7-M platforms Tock supports and for three RISC-V 32-bit platforms. Our verification-guided design and implementation led to a new, granular process abstraction that is simpler than Tock's, has formal security guarantees (that are verified in half a minute), and outperforms Tock on certain critical code paths.