Implementing new operating systems is tedious, costly, and often impractical except for large projects. The Flux OSKit addresses this problem in a novel way by providing clean, well-documented OS components designed to be reused in a wide variety of other environments, rather than defining a new OS structure. The OSKit uses unconventional techniques to maximize its usefulness, such as intentionally exposing implementation details and platform-specific facilities. Further, the OSKit demonstrates a technique that allows unmodified code from existing mature operating systems to be incorporated quickly and updated regularly, by wrapping it with a small amount of carefully designed “glue” code to isolate its dependencies and export well-defined interfaces. The OSKit uses this technique to incorporate over 230,000 lines of stable code including device drivers, file systems, and network protocols. Our experience demonstrates that this approach to component software structure and reuse has a surprisingly large impact in the OS implementation domain. Four real-world examples show how the OSKit is catalyzing research and development in operating systems and programming languages. 1

To an unappreciated degree, research both in operating systems and their programming languages has been severely hampered by the lack of cleanly reusable code providing mundane low-level OS infrastructure such as bootstrapcode and device drivers. The Flux OS Toolkit solves this problem by providing a set of clean, well-documented components. These components can be used as basic buildingblocks both for operating systems and for booting language run-time systems directly on the hardware. The toolkit’s implementation itself embodies reuse techniques by incorporating components such as device drivers, file systems, and networking code, unchanged, from other sources. We believe the kit also makes feasible the production of highly assured embedded and operating systems: by enabling reuse of low-level code, the high cost of detailed verification of that code can be amortized over many systems for critical environments. The OS toolkit is already heavily used in several different OS and programming language projects, and has already catalyzed research and development that would otherwise never have been attempted.

Advances in networking, communication, storage, computing, and multimedia technologies coupled with many emerging application areas is fueling the merger of computing and communication systems. This will result in a global information infrastructure of the size and magnitude erstwhile unimaginable. Such an infrastructure will have numerous services and hundreds of thousands of subscribers. A key issue in developing a global information infrastructure is that of effective management and utilization of resources. Increasingly, applications require delivery of multifaceted digital information services with stringent requirements on the delivery of information. For instance, multimedia applications have QoS (Quality of Service) parameters that define the extent to which performance specifications such as responsiveness, reliability, availability, security and cost-effectiveness may be violated. Varying requirements posed by applications, customers, and service providers makes the task of resource management in the evolving global information infrastructure a challenging research problem- one with significant commercial impact as well. In this thesis, we present a new paradigm for developing safe, customizable middleware

We present a two-level model of distributed computation based on the actor model. This two-level model is the basis for developing a semantic framework that supports dynamic customizability and separation of concerns in designing and reasoning about components of open distributed systems (ODS). ODS evolve dynamically and components of ODS interact with an environment that is not under their control. In particular, we would like to be able to consider separately issues such as: functional behavior of a service; failure semantics and fault tolerance protocols; and resource management issues such as memory management, migration, load balancing, and scheduling. In this report we consider remote creation, migration, and reachability snapshot services: their specification at different levels of abstraction, and their composition.

Computing systems in which the consequences of failure are very serious are termed safety-critical. Many such systems exist in application areas such as aerospace, defense, transportation, power-generation, and medicine. The software in these systems is typically large and complex, critical to system safety, and difficult to implement and verify. Even when great effort is expended to develop the software, there is no assurance that the software will operate with the required level of dependability. We have investigated a safety kernel architecture that addresses part of the problem of building and verifying dependable safety-critical software. An analogous construct, the security kernel, has been used successfully to enforce security policies in classified-information systems. Similar requirements known as safety policies must be enforced in safetycritical systems. Other researchers have developed some basic safety kernel concepts and have proposed safety kernel designs. However, man...

ions can be difficult to design properly the first time and parts of a framework may have to be redesigned and reimplemented as the abstractions become better understood [Pree, 1995]. Parts of the framework may undergo redesign even while other parts are being implemented. In order to refine the abstractions, reviews of the design are recommended [Sparks et al., 1996]. Reviews examine not only the functionality the design provides, but also the hooks and means of client interaction provided by the framework. Specific techniques that aid in the design of frameworks will be discussed later in the chapter. However some general guidelines have been identified through experience by framework developers working on the Taligent frameworks and ET++. In order to develop easy to use and flexible frameworks, Taligent [1995] suggests: ffl reduce the number of classes and methods users have to override ffl simplify the interaction between the framework and the application extensions ffl isolate p...