Most recent studies of file system workloads have focussed on loads imposed by general computing. This paper introduces a significantly different workload imposed by a distributed application system. The FileNet system is a distributed application system that supports document image processing. The FileNet file system was designed to support the workload imposed by this application. To characterize the read-mostly workload applied to the file system and how it differs from general computing environments, we present statistics gathered from live production installations. We contrast these statistics with previously published data for more general computing.

An orphan in a distributed transaction system is an activity executing on behalf of an aborted transaction. A method is proposed for managing orphans created by crashes and by aborts that ensures that orphans are detected and eliminated in a timely manner, and also prevents them from observing inconsistent states. The method uses timestamps generated at each site. Transactions are assigned timeouts at different sites. These timeouts are related by a global invariant, and they may be adjusted by simple two-phase protocols. The principal advantage of this method is simplicity: it is easy to understand, and to implement, and it can be proved correct. An 'eager' version of this method uses approximately synchronized real-time clocks to ensure that orphans are eliminated within a fixed duration, and a 'lazy' version uses logical clocks to ensure that orphans are eventually eliminated as information propagates through the system. The method is fail-safe: unsynchronized clocks and lost messages may affect performance, but they cannot produce inconsistencies or protect orphans from eventual elimination. Although the method is informally described in terms of two-phase locking, the formal argument shows it is applicable to any concurrency control method that preserved atomicity.>

Several research projects are studying architectures for distributed computing that are founded on the notion of atomic actions operating on objects (instances of abstract data types). Such projects as Clouds at Georgia Tech and Archons at Carnegie-Mellon University are evaluating this approach as the foundation for constructing distributed operating systems. Objects are not new to operating systems. They provide substantial benefits in such dimensions as protection and synchronization, as well as their inherent organizational characteristics. This paper is concerned with synchronization to control ordering, a function often associated with objects. Conventional approaches require substantial extension for the action environment. Typically, they are based on (or equivalent to) general semaphores. Semaphores take no account of the visibility requirements of actions however, and consequently they can allow an action to progress beyond the point at which its effects can be undone. Also, they do not account for failures.

One of the requirements for building an operating system in a high-level operating system language, such as Ada, Concurrent Pascal, or Modula, is the construction of a language support system, or kernel. This paper presents a model that generalizes the concept of a kernel, and defines a kernel and the processes it supports to be at different levels of abstraction. A high-level language mechanism, the Execute statement, is then proposed as the basis of the interface between a kernel and the processes it supports. Software capabilities control access between levels and the Execute statement controls processor context switching between levels. The mechanisms rely on data typing for reliability and protection. They encourage systems that are well protected and exhibit an explicit hierarchical structure. Software capabilities and the Execute statement are illustrated with a pilot implementation on the Prime 650. An experimental operating system that encompasses their use is discussed. Extensions are presented which manage interrupts, timeslicing and preemption, and hardware protection mechanisms.

We introduce an approach to robust computation in distributed systems. This approach is the foundation for reliability in the Clouds decentralized operating system. It is based on atomic actions operating on instances of abstract data types (objects). We present an event-based model of computation in which scheduling of responses to operation invocations is controlled by objects. We discuss an integrated strategy for synchronization and recovery which uses relationships between the abstract states of objects to track dependencies between actions. Serializability is defined in terms of the semantics of operations. This permits high concurrency to be obtained in non-serializable implementations without deviation from serializable abstract behavior. We define a class of schedulers that allows objects to make autonomous scheduling decisions. We present the use of non-serializable operation semantics. Finally, we discuss implementation of the model, including action synchronization, object operation ordering using action-based counting semaphores, and action recovery.