We present a two-level model of distributed computation based on the actor model. This two-level model is the basis for developing a semantic framework that supports dynamic customizability and separation of concerns in designing and reasoning about components of open distributed systems (ODS). ODS evolve dynamically and components of ODS interact with an environment that is not under their control. In particular, we would like to be able to consider separately issues such as: functional behavior of a service; failure semantics and fault tolerance protocols; and resource management issues such as memory management, migration, load balancing, and scheduling. In this report we consider remote creation, migration, and reachability snapshot services: their specification at different levels of abstraction, and their composition.

Communication between distributed objects may have to be protected against random failures and malicious attacks; also, communication timeliness may be essential or highly desired. Therefore, a distributed application often has to be extended with communication services providing some kind of fault-tolerance, secrecy, or quality-of-service guarantees. Ideally, such services should be defined in a highly modular and dynamically composable way, so that the combined assurance of several services can be achieved by composition in certain cases, and so that services can be added or removed from applications at runtime in response to changes in the environment. To reason about the formal properties of such composable communication services one first needs to give them a precise semantics. This paper proposes a rewriting logic semantics for the so-called "onion skin" model of distributed object reection, in which different meta-objects, providing different communication services, can be stacked on top of a basic application object. Since the correct behavior of a service depends on the type of hostile environment against which the service must protect the application, rewriting logic should also be used to specify such hostile environments. The service guarantees are then guarantees about the behavior specified by the union of the rewrite theories specifying the basic application, the services, and the hostile environment.

Research in software architecture has emphasized compositional development, where the computational aspects of a system are modularly separated from communication and coordination aspects. Typically, software architectures are factored into a set of components, which encapsulate computation, and connectors, which encapsulate interactions. In terms of design, development and debugging, this separation has several important advantages. In particular, by separating application code from the protocols used for interaction, software components may be independently developed and tested. Moreover, as requirements change, existing architectural elements may be modularly replaced by new elements with appropriate properties. A fundamental problem with these abstractions is their interaction with "cross-cutting" architectural features such as heterogeneity, availability, and adaptability. Availability, for example, requires protocols that manipulate both communication and resources. Controlling architectural resources, however, requires access to the internal resource usage patterns of components and connectors. Unfortunately, current architectural abstractions have inflexible interfaces which obscure these patterns. This loss of information forces the implementation of such features to be hard-coded within architectural elements, eliminating many advantages of the modular approach. In this thesis, we propose a model for distributed software architectures that exposes resource access in a modular fashion. Our model extends current architectural abstractions by providing a meta-architecture for customization. This meta-architecture augments the functional interface of architectural elements with an operational interface for controlling resources. We also develop a formal semantic...

Data Type Specification, in combination with modal logics for formalizing the process of building systems from interconnected components. This combination of logical and categorical techniques has also been applied to parallel program design languages in the style of UNITY [14] and IP [41], providing semantics for modularization techniques based on the notion of superposition. This has resulted in the development of a programming design language called Community [33]. Two formalisms that provide explicit support for object systems and can reason about their rewriting logic specifications have been recently developed. One is a version of the modal -calculus proposed by Lechner [48, 49] for reasoning about object-oriented Maude specifications. Another is Denker's objectoriented distributed temporal logic DTL + [24, 22], that extends the DTL and D 1 distributed object temporal logics of Ehrich and Denker [30, 23, 29]. Lechner [48, 49] uses her version of the modal -calculus to identif...

tors and meta actors, distributed over a network of processing nodes. Base level actors carry out application level computation, while meta-actors are part of the runtime system which manages system resources and controls the runtime semantics of the base level. Meta-actors communicate with each other via message passing as do base level actors, but meta-actors may also examine and modify the state of the base actors located on the same node. The model abstracts from the choice of a specific programming language or system architecture, providing a framework for reasoning about heterogeneous systems. The framework has a very natural representation in rewriting logic [4, 6]. A one level framework (called actor theories), restricted to purely base-level systems has been developed and applied to specification and reasoning about actor systems and languages [5, 9]. The two-level architecture naturally extends to multiple levels, with each level manipulating the level below while being prot