Eumel and its advanced successor L3 are operating systems built by GMD which have been used, for 13 years and 4 years respectively, as production systems in business and education. More than 2000 Eumel systems and 500 L3 systems have been shipped since 1979 and 1988. Both systems rely heavily on the paradigm of persistence (including fault-surviving persistence). Both data and processes, in principle all objects are persistent, files are implemented by means of persistent objects (not vice versa) etc. In addition to the principles and mechanisms of Eumel /L3, general and specific experiences are described: these relate to the design, implementation and maintenance of the systems over the last 13 years. For general purpose timesharing systems the idea is powerful and elegant, it can be efficiently implemented, but making a system really usable is hard work.

ions are costly and restrict flexibility. The -kernel should only multiplex hardware primitives in a secure way. The current exokernel is tailored to the Mips architecture and gets excellent performance for kernel primitives. It is based on the philosophy that a kernel should not provide abstractions but only a minimal set of primitives (although the Exokernel includes device drivers). Consequently, the Exokernel interface is architecture dependent, in particular dedicated to software-controlled TLBs. The basic communication primitive is the protected control transfer which crosses address spaces but does not transfer arguments. A lightweight remote procedure call based on this primitives takes 10 s on an R3000 while Mach RPC needs 95 s. The open question: might the right abstractions perform better and lead to better structured and more efficient applications than Exokernel's primitives ? L4 has been developed at GMD. It is based on the theses that ffl Efficiency and flexibility r...