Safe kernel extensions without run-time checking
Guarded commands, nondeterminacy and formal derivation of programs