Formal design of a real-time operating system kernel door R.M. Tol