Distributed operating systems

2002

Journal of Systems and Software, 1997

Providing reliable services is one of the primary goals in designing a distributed operating system. Nowadays, we h a ve seen a trend in distributed operating system design to shift from large kernel architectures or even monolithic architectures to microkernel architectures supported by the client server model. This means that a lot of services of an operating system originally provided by the monolithic kernel are moved out of the kernel, forming individual servers. It is then crucial to guarantee that these servers will provide reliable services. This paper describes a design, based on a twin-servers model, of fault-tolerant servers for the microkernel-based RHODOS distributed operating system. A model that supports faulttolerant services is designed. The performance of the model is simulated and analysed. A design that implements the model in the RHODOS environment is also outlined.

2001

omputer systems fail, often with costly results. Even simple errors (division by zero and buffer overruns, for instance) that can be detected easily by code inspection or testing cause havoc. More pernicious and harder to detect are timing bugs, which can lie dormant until triggered by some unusual combination of circumstances. In the mid 1980s, for instance, several cancer patients died from massive radiation overdoses from the Therac-25, a computerized therapy machine. At fault was improper synchronization between data entry and dose calculation, which failed when operators typed more quickly than had the testers. In 1990, 60 million AT&T subscribers lost telephone service for nine hours (and AT&T lost $60 million in revenue) after an electronic switch failed and set off a chain reaction in which other switches crashed, rebooted, and crashed again. More recently, software guided the Mars Pathfinder to a spectacular landing, but experienced total system resets when it began to collectbut could not transmit-meteorological data. At fault in this case was a latency problem in a preemptive priorityscheduling routine. Computer systems such as these are providing increasingly powerful services, and society is expecting increasingly strong guarantees of performance, fault tolerance, and security. At the same time, however, the environments and networks in which these systems operate are becoming larger and less predictable. It is no wonder that distributed systems, which consist of many programs running on many different computers connected via a network, have become very complicated and very difficult to get right. For years, testing has been the primary means of ascertaining whether programs behave as intended. However, as Edsger Dijkstra www.byte.com Spring 2002 BYTE 3 DISTRIBUTED SYSTEMS

2009

In this paper, we discuss the architecture of a fully modular, self-healing operating system, which exploits the principle of least authority to provide reliability beyond that of most other operating systems. The system can be characterized as a minimal kernel with the entire operating system running as a set of compartmentalized user-mode servers and drivers. By moving most of the code to unprivileged usermode processes and restricting the powers of each one, we gain proper fault isolation and limit the damage bugs can do. Moreover, the system has been designed to survive and automatically recover from failures in critical modules, such as device drivers, transparent to applications and without user intervention. We used this design to develop a highly reliable, open-source, POSIX-conformant member of the UNIX family, which is freely available and has been downloaded 50,000 times in the past 3 months.

UNIX has been around now for almost 20 years. At the time UNIX began, most departments felt themselves well-endowed indeed if they owned a single PDP-11/45 with 256K memory and a 2.5M RK05 disk. Nowadays a laptop would be embarrassed to have only that. It is our hypothesis that UNIX is no longer the appropriate kind of operating system for the 1990s. In this paper, a new system, Amoeba, will be described, that we believe meets the requirements for distributed computing in the 1990s.

ACM Computing Surveys, 1976

This paper develops four related architectural principles which can guide the construction of error-tolerant operating systems. The fundamental principle, system closure, specifies that no action is permissible unless explicitly authorized. The capability based machine is the most efficient known embodiment of this principle: it allows efficient small access domains, multiple domain processes without a privileged mode of operation, and user and system descriptor information protected by the same mechanism. System closure implies a second principle, resource control, that prevents processes from exchanging information via residual values left in physical resource units. These two principles enable a third, decision verification by failure-independent processes. These principles enable prompt error detection and cost-effective recovery. Implementations of these principles are given for process management, interrupts and traps, store access through capabilities, protected procedure entry, and tagged architecture.

2013

Abstract. We present a novel translation of systems that are tolerant of crash failures to systems that are tolerant of Byzantine failures in an asynchronous environment, making weaker assumptions than previous approaches. In particular, we assume little about how the application is coded. The translation exploits an extension of the Srikanth-Toueg protocol, supporting ordering in addition to authentication and persistent delivery. We illustrate the approach by synthesizing a version of the Castro and Liskov Practical Byzantine Replication protocol from the Oki and Liskov Viewstamped Replication protocol.

Proceedings 17th International Conference of the Chilean Computer Science Society, 1997

Processing on the Amoeba distributed operating system is not fault-tolerant. The only concern of its processing service is to perform load balancing on the existing processors, trying to find the processor that best suits a particular process in terms of memory availability and CPU speed. In this paper we introduce a fault-tolerant processing service for the Amoeba system. This service is used in the implementation of the Seljuk-Amoeba operating environment, which offers processing service with different controlled failure semantics on a perprocess basis.

ACM SIGOPS Operating Systems Review, 1985

Facilities that support distributed transactions on user-defined types can be implemented efficiently and can simplify the construction of reliable distributed programs. To demonstrate these points, this paper describes a prototype transaction facility, called TABS, that supports objects, transparent communication, synchronization, recovery, and transaction management. Various objects that use the facilities of TABS are exemplified and the performance of the system is discussed in detail. The paper concludes that the prototype provides useful facilities, and that it would be feasible to build a high performance implementation based on its ideas.

1992

This development raises the question of what kind of software will be needed for these new systems. To answer this question, a group under the direction of Prof. Andrew S. Tanenbaum at the Vrije Universiteit (VU) in Amsterdam (The Netherlands) has been doing research since 1980 in the area of distributed computer systems. This research, partlydone in cooperationwith the Centrum voor Wiskunde en Informatica (CWI), has resulted in the development of a new distributed operating system, called Amoeba, designed for an environment consisting of a large number of computers.