Email Record: Formal models of operating systems kernels /