John Penix Willem Visser Eric Engstrom Aaron Larson Nicholas Weininger Verification of time partitioning in the DEOS scheduler kernel. 488-497 2000 conf/icse/2000 ICSE http://doi.acm.org/10.1145/337180.337364 db/conf/icse/icse2000.html#PenixVELW00