Ironclad: Hard real-time capable POSIX-compatible kernel written in SPARK/Ada