Correctness in operating systems