Matthias Daum Jan Dörrenbächer Burkhart Wolff Proving Fairness and Implementation Correctness of a Microkernel Scheduler. 349-388 2009 42 J. Autom. Reasoning 2-4 http://dx.doi.org/10.1007/s10817-009-9119-8 db/journals/jar/jar42.html#DaumDW09