this paper we consider remote creation, migration, and reachability snapshot services: their specification at different levels of abstraction, and their composition. 1.1 About Actors

Communication between distributed objects may have to be protected against random failures and malicious attacks; also, communication timeliness may be essential or highly desired. Therefore, a distributed application often has to be extended with communication services providing some kind of fault-tolerance, secrecy, or quality-of-service guarantees. Ideally, such services should be defined in a highly modular and dynamically composable way, so that the combined assurance of several services can be achieved by composition in certain cases, and so that services can be added or removed from applications at runtime in response to changes in the environment. To reason about the formal properties of such composable communication services one first needs to give them a precise semantics. This paper proposes a rewriting logic semantics for the so-called "onion skin" model of distributed object reection, in which different meta-objects, providing different communication services, can be stacked on top of a basic application object. Since the correct behavior of a service depends on the type of hostile environment against which the service must protect the application, rewriting logic should also be used to specify such hostile environments. The service guarantees are then guarantees about the behavior specified by the union of the rewrite theories specifying the basic application, the services, and the hostile environment.

Open distributed systems evolve dynamically, and their components interact with environments that are not under their control. A reflective model of distributed computation supports separation of concerns (for example, functionality and different QoS properties) and dynamic adaptation to changing environments or requirements. In such an ODS, a wide range of services and activities must execute concurrently and share resources. To avoid resource conflicts, deadlocks, inconsistencies, and incorrect execution semantics, the underlying resource management system—middleware—must ensure that concurrent system activities compose in a correct manner. Designers and programmers must consider interactions within and across reflective levels, clearly spell out the semantics of shared distributed resources, and develop new notions of overall system correctness that account for a dynamic, distributed, and reflective setting. To better understand the semantic issues involved in reflective distributed systems, we developed the TLAM, 1–3 a two-level actor model based on the actor model of object-based distributed computation. 4–6 Actors is a model of distributed reactive objects and has a built-in notion of encapsulation and interaction, making it well suited to represent evolution and coordination among interacting components in distributed applications. Traditional passive objects encapsulate the execution state and a set of procedures that manipulate it; an actor encapsulates a thread of control as well. Each actor potentially executes in parallel

Systems that provide distributed multimedia services are subject to constant evolution - customizable middleware is required to effectively manage this change. In this paper we present a meta-architectural framework for customizable QoS-based middleware using Actors, a model of concurrent active objects. Middleware services for resource managementexecute concurrently with each other and with application activities--- scheduling, protocols providing security and reliability, load balancing and stream synchronization can therefore potentially interfere with each other. To ensure cost-effective QoS in distributed multimedia systems, safe composability of resource management services is essential. For instance, system protocols and activities must not cause arbitrary delays in the presence of timing based QoS constraints. Using TLAM, a semantic model for specifying and reasoning about components of open distributed systems, we show how a QoS brokerage service can be used to coordinate mu...

tors and meta actors, distributed over a network of processing nodes. Base level actors carry out application level computation, while meta-actors are part of the runtime system which manages system resources and controls the runtime semantics of the base level. Meta-actors communicate with each other via message passing as do base level actors, but meta-actors may also examine and modify the state of the base actors located on the same node. The model abstracts from the choice of a specific programming language or system architecture, providing a framework for reasoning about heterogeneous systems. The framework has a very natural representation in rewriting logic [4, 6]. A one level framework (called actor theories), restricted to purely base-level systems has been developed and applied to specification and reasoning about actor systems and languages [5, 9]. The two-level architecture naturally extends to multiple levels, with each level manipulating the level below while being prot