From comments below. Just one more comment: I think we should make a distinction between a tool that can verify threaded code and a tool that can verify the code that implements threading. The latter is what you are looking for here and it is much more difficult. Furthermore it is arguably unnecessary — a…

Updated below! Years ago I proposed the following code snippet as a minimal standard for a useful verification method. Still not quite there. /* you are not expected to understand this */ if(save()){ load_memory_management(); /* map in new current */ return; }else { current = new; resume(); panic(“RESUME RETURNED! KERNEL BROKENn”); } Not so complicated,…

[fixed a couple of typos, Dec. 20 2007] John Regehr writes: On the other hand, there is plenty of useful work to be done on supporting time sensitive applications (I’ll just avoid saying “soft real-time”) even when no guarantees are made. Let’s take the example of an OS that disables interrupts when any process is…