Title: Formal design of a real-time operating system kernel