Finite resource allocator with intrinsically subordinate operating system

A device for running application programs, comprising:

• one or more memories having instructions stored thereon;
• one or more processors addressing the memories and configured to execute the instructions;
• and
• a finite nonempty set of resources, each resource being a connection from one of the processors to an external device outside the memories and processors;
• wherein the instructions include a finite resource allocator (FRA) which is a program of a first type and one or more intrinsically subordinate operating system (ISOS), each ISOS being a program of a second type which is configured to run one or more application programs on it, wherein the FRA and each ISOS are independent Communicating Sequential Processes (CSP) processes which communicate with each other only by strict CSP channel message passing without any buffering, interruptibility, or exceptions, wherein the FRA instructions are configured to always run at a high privilege, and each ISOS is configured to perform all of its substantive actions at a low privilege and without any substantive privilege change in its execution traces, and wherein only the FRA communicates with or controls any resources, and any ISOS communicates with any resource only indirectly through the FRA or by explicit permission of the FRA.