The Secure Ada Target (SAT) machine is designed to meet or exceed the DoD requirements for multi-level secure systems. This paper describes the require-ments on such designs, our approach to meeting these requirements by introducing tagged objects, and a specialized tagged object processor (TOP) that handles all operations involving tagged objects. Basic system security is achieved using a small software kernel and the TOP. The structure of our proofs, such that the system satisfies appropriate security properties, will be outlined. Brief remarks concerning the implementation of user Ada programs on the SAT system conclude the paper. Our design approach is largely independent of CPU selection, though implementation details necessarily depend on the processor selection.

This paper discusses the issues involved in building a real-time control system using a message-directed distributed architecture. We begin with a discussion of the nature of real-time soft ware, including the viability of using hierarchical models to organize the software. Next we discuss some realistic design objectives for a distributed real-time system including fault isolation, independent module verification, context independence, decentralized control and partitioned system state. We conclude with some observations concerning the general nature of distributed system software.

This paper describes the kernel of an Executive being implemented for the Honeywell Experimental Distributed Processor (HXDP) -- a vehicle for research in distributed computers for real-time control. The kernel provides message transmission primitives for use by application programs or higher level executive functions. In the paper we describe the message transmission primitives provided by the kernel and the rationale for their selection based upon the objectives and constraints described in a companion paper.