Formal Models Of Operating System Kernels door Iain D. Craig