On Why it is Impossible to Prove that the BDX930 Dispatcher Implements a Time-Sharing System (1983)

by R S Boyer, JS Moore
Venue:In Investigation, Development, and Evaluation of Performance Proving for Fault-Tolerant Computers. SRI International