Security Kernel Validation in Practice.
Reflections on an Operating System Design.
VMIN-An Optimal Variable-Space Page Replacement Algorithm.
Modularization and Hierarchy in a Family of Operating Systems.
Verifying Properties of Parallel Programs: An Axiomatic Approach.
Characteristics of Program Localities.
A Lattice Model of Secure Information Flow.
Analysis of the PFF Replacement Algorithm via a Semi-Markov Model.
Proving Monitors.