Matthias Daum Jan Dörrenbächer Sebastian Bogan Model Stack for the Pervasive Verification of a Microkernel-based Operating System. 2008 VERIFY http://ceur-ws.org/Vol-372/paper07.pdf conf/cade/2008verify db/conf/cade/verify2008.html#DaumDB08