They also made a pretty big push toward formal verification of drivers, which were often the culprit for insecure/unstable machines. Their SLAM model checker [0] was avant-garde (in industry terms, at least).

[0]: https://en.wikipedia.org/wiki/SLAM_project