Formal Methods: A Practical Tool For OS Implementors