581 has been used to establish the correctness of some quite large |
581 has been used to establish the correctness of some quite large |
582 programs (for example an <A HREF="http://ertos.nicta.com.au/research/l4.verified/">operating system</A>). |
582 programs (for example an <A HREF="http://ertos.nicta.com.au/research/l4.verified/">operating system</A>). |
583 Together with colleagues from Nanjing, I used this theorem prover to establish the correctness of a |
583 Together with colleagues from Nanjing, I used this theorem prover to establish the correctness of a |
584 scheduling algorithm, called |
584 scheduling algorithm, called |
585 <A HREF="http://en.wikipedia.org/wiki/Priority_inheritance">Priority Inheritance</A>, |
585 <A HREF="http://en.wikipedia.org/wiki/Priority_inheritance">Priority Inheritance</A>, |
586 for real time operating systems. This scheduling algorithm is part of the operating |
586 for real-time operating systems. This scheduling algorithm is part of the operating |
587 system that drives, for example, the |
587 system that drives, for example, the |
588 <A HREF="http://en.wikipedia.org/wiki/Mars_Exploration_Rover">Mars rovers</A>. |
588 <A HREF="http://en.wikipedia.org/wiki/Mars_Exploration_Rover">Mars rovers</A>. |
589 Actually, the very first Mars rover mission in 1997 did not have this |
589 Actually, the very first Mars rover mission in 1997 did not have this |
590 algorithm switched on and it almost caused a catastrophic mission failure (see |
590 algorithm switched on and it almost caused a catastrophic mission failure (see |
591 this youtube video <A HREF="http://www.youtube.com/watch?v=lyx7kARrGeM">here</A> |
591 this youtube video <A HREF="http://www.youtube.com/watch?v=lyx7kARrGeM">here</A> |