Formal Models Of Operating System Kernels by Iain D. Craig