One drawback of this reliance on formal methods is that formal languages are often a barrier to the use of assurance documentation. To avoid this, an emphasis was placed on minimizing the reliance upon formal languages to only those situations when the corresponding English statements contained possible ambiguities. In particular, formal languages are considered as an enhancement to the English language rather than a replacement for it. The emphasis on formal methods on DTOS is not an indication that the other forms of verification evidence are perceived to have no value. On the contrary, all of the listed techniques are valuable components of an overall assurance argument.
Formal methods do however provide the strongest guarantee of completeness in an assurance argument.
Completeness is especially important when verifying security properties, when even a single failure can have potentially devastating consequences. The DTOS prototype was successful as a proof of concept. While performance measurements are incomplete, the three design goals of the prototype were met sufficiently to demonstrate that, at the microkernel level, policy flexible security mechanisms need not be incompatible with other desired features. While the prototype was successful as a proof of concept, it also became clear during the program that the code base from which the DTOS prototype was developed is not a suitable code base for a secure, assured microkernel. The code is simply too complex and poorly structured to provide any meaningful assurance that it satisfies all of the required security properties.