viewpoints

VDOI:10.1145/2880150 Peter J. Denning The Profession of IT Fifty Years of Operating Systems A recent celebration of 50 years of research yields lessons for all professionals in designing offers for their clients.

PERATING SYSTEMS ARE a systems research yield important les- ˲˲ Interactive systems: many users on major enterprise within sons for all computing professionals multiple systems constantly interact- computing. They are host- who design systems for customers. ing, communicating, and sharing re- ed on a billion devices sources (1960–1975); connected to the Internet. Timeline ˲˲ Desktop systems: Immersive per- OThey were a $33 billion global market A remarkable feature of our history sonalizable distributed systems to man- in 2014. The number of distinct new is that the purposes and functions of age work in an office (1975–2005); and operating systems each decade is an operating system have changed so ˲˲ Cloud-mobile systems: Immersive growing, from nine introduced in the much, encompassing four stages: personalizable systems to manage all 1950s to an estimated 350 introduced ˲˲ Batch systems: one job at a time aspects of one’s life, work, and social in the 2010s.a (1950–1960); relations (2005 onward) Operating systems became the The accompanying figure depicts a subject of productive research in late Memory layout of an early batch operating memory layout of an early batch oper- system. 1950s. In 1967, the leaders of operating ating system. systems research organized the SOSP (symposium on operating systems prin- Interrupt The Great Confluence of 1965 ciples), starting a tradition of biannual processing The very first operating systems were SOSP conferences that has continued little more “manual operating proce- 50 years. The early identification of op- Device dures” for the first in the erating system principles crystallized drivers 1950s. These procedures established a support in 1971 for operating systems queue of jobs waiting to be executed; Job

to become part of the science Monitor an operator put the jobs on the ma- core curriculum (see the sidebar). sequencing chine one by one and returned output In October 2015, as part of SOSP- to the requesting users. These pro- 25, we celebrated 50 years of OS Control language cedures were soon automated in the history. Ten speakers and a panel interpreter late 1950s; IBM’s 1401 front end to the discussed the evolution of major seg- IBM 709x number crunchers was the ments of OS, focusing on the key in- best known of commercial “spooling” sights that were eventually refined Boundary systems. From that time on, computer into OS principles (see http://sigops. system engineers became interested org/sosp/sosp15/history). A video User in automating all aspects of comput- record is available in the ACM Digi- program ing including in-execution job sched- tal Library. I write this summary not area uling, resource allocation, and user only because we are all professional interaction, and pre-execution job de- users of operating systems, but also sign, preparation, testing, and debug- because these 50 years of operating ging. By 1965, their experiments yield- ed a set of eight principles that became a See https://en.wikipedia.org/wiki/Timeline_ the starting point for a new generation of_operating_systems of operating systems:

30 COMMUNICATIONS OF THE ACM | MARCH 2016 | VOL. 59 | NO. 3 viewpoints viewpoints

˲˲ Interactive computing (time-sharing) Box 1. Examples of Laws ˲˲ Hierarchical file systems ˲˲ Fault tolerant structures Semaphore invariant c(t) = min(a(t), s(t)+I) [5] Founding ˲˲ Interrupt systems Space-time law: memory used = (spacetime per ˲˲ Automated overlays (virtual memory) job)x(system throughput) History ˲˲ Multiprogramming Mean value equations for throughput and response time in a queueing network ˲˲ Modular programming My first volunteer position in ACM was editor of the SICTIME newsletter in ˲˲ Locality principle Controlled information sharing 1968. SICTIME was the special interest V The MIT project (http:// committee on time-sharing, a small multicians.org) and the IBM System Box 2. Examples of Design Wisdom group of engineers and architects of 360 project were the first to bring experimental time-sharing systems Information hiding during the 1960s. Jack Dennis (SICTIME) forth systems with all these charac- and Walter Kosinski (SICCOMM) teristics; Multics emphasized inter- Levels or layers of abstraction organized the first symposium on activity and community, System 360 Atomic transactions operating systems principles (SOSP) a complete line of low to high-end Virtual machines in 1967 to celebrate the emergence of principles from the experimental machines with a common instruc- Least privilege systems and to promote research that tion set. Moreover, Multics used a would clearly articulate and validate high-level language (a subset of PL/I) Of the many possible candidates for future operating system principles. It is significant that they recognized the to program the operating system be- principle statements, which ones are synergy between operating systems and cause the designers did not want to worthy of remembering? Our late col- networks before the ARPANET came tackle a system of such size with as- league Jim Gray proposed a criterion: online; Larry Roberts presented the sembly language. Developed from A principle is great if it is “Cosmic”—it ARPANET architecture proposal at the conference. The conference inspired 1964 to 1968, these systems had an is timeless and incredibly useful. Oper- such enthusiasm that the leaders enormous influence later genera- ating systems contributed nearly one- of SICTIME wanted to convert their tions of operating systems. third of the 41 great principles listed SIC to a SIG (special interest group); they recruited me to spearhead the and Ken Thomp- in a 2004 survey (see http://greatprinci- conversion. I drafted a charter and son at loved the services ples.org). The accompanying table gives bylaws and proposed to rename the available from Multics, but loathed examples—OS is truly a great contribu- group to operating systems because the size and cost. They extracted the tor to the CS field. time-sharing was too narrow. The ACM Council approved SIGOPS in 1969 best ideas and blended with a few of and ACM President Bernard Galler their own to produce (1971), Lessons appointed me as the first chair. One of which was small enough to run on As I looked over the expanse of results my projects was to organize a second a minicomputer and was written in achieved by the over 10,000 people who SOSP at Princeton University in 1969. That conference also inspired much a new portable language C that was participated in OS research over the enthusiasm, and every two years since close enough to code to be efficient past 50 years, I saw some lessons that then SIGOPS has run SOSP, which and high level enough to manage OS apply to our daily work as professionals. evolved into the premier conference on operating systems research. SIGOPS program complexity. Unix became a Even though it seems that research has identified 48 Hall of Fame papers ubiquitous standard in the configura- is academic and does not apply to since 1966 that had a significant shaping tion interfaces of operating systems professional work, a closer look at influence on operating systems (see and in the middleware of the Internet. http://www.sigops.org/award-hof.html). Following these successes, in 1970 In 1987, Andy Tanenbaum released Bruce Arden, representing COSINE Minix, a student-oriented version of Both the researcher (computer science in engineering), an Unix. His student, Linus Torvalds, NSF-sponsored project of the National and professional Academy of Engineering, asked me launched Linux from Minix. to chair a task force to propose an search for answers. undergraduate core course on operating OS Principles system principles. A non-math core By the late 1960s OS engineers be- The one pushes course was a radical idea at the time, but the existence of so many OS principles lieved they had learned a basic set the frontier of gave them confidence it could be of principles that led to reliable and done. Our small committee released dependable operating systems. The knowledge, its recommendation in 1971.1 Many SOSP institutionalized their search computer science and engineering the other makes departments adopted the course and for OS principles. In my own work, I soon there were several textbooks. I wrote broadened the search for principles systems more a follow-on paper in 1972 that explained to include all computing3,4 (see http:// the significance of the paradigm shift of valuable putting systems courses in the CS core.2 greatprinciples.org). After that, ACM curriculum committees I am often asked, “What is an OS (or to customers. began to include other systems courses in CS) principle?” A principle is a state- the core recommendations. The place of ment either of a law of computing (Box OS in the CS core has gone unchallenged for 45 years. 1) or of design wisdom for computing —Peter J. Denning (Box 2).

MARCH 2016 | VOL. 59 | NO. 3 | COMMUNICATIONS OF THE ACM 31 viewpoints

Examples of computing principles contributed by operating systems.

Process A program in execution on a virtual processor. A process can be started, stopped, scheduled, and interacted with. Operating systems and networks comprise many interacting processes that never terminate. Interactive Processes can receive inputs or generate outputs at any time—contrasts Computation with the Turing view that processes get all their input at the start and produce all their output at the end. Interactive computations can implement functions that non-interactive computations cannot. Concurrency controls To avoid pathologies such as race conditions, buffer overflows, and deadlocks, processes need explicit mechanisms to wait for and receive signals. Locality Processes use small subsets of their address spaces for extended periods. Caches and memory managers detect working sets, position them for significantly improved performance, and protect them to prevent thrashing. Naming and mapping Objects can be assigned location-independent names; mappers translate names to object physical locations when needed. Hierarchical naming systems (such as directories and URLs) scale to very large name spaces. A Fistful of Bitcoins: Protection and Sharing The global name space is visible to everyone (for example, the space of all Web URLs). Objects are by default accessible only to their owners. Characterizing Owners explicitly state who is allowed to read or write their objects. Payments Among System Languages System programming languages yield systems that are well structured, more easily verified, and fault tolerant. Men with No Names Levels of Abstraction System software can be simplified and verified by organizing the functions as a hierarchy that can make only downward calls and upward returns. Security Multiparty Virtual machines A set of related functions can be implemented as a simulation of a machine whose interface is an “instruction set” and whose internal Computations structure and data are hidden. on Bitcoin COMMUNICATIONS

Forty Years what actually happens reveals a great The results of their work were almost of Suffix Trees deal of overlap. Both the researcher always systems that others could use and and the professional seek answers experiment with. After the messy pro- Does the Use of Color to questions. The one aims to push cess of learning what worked, they wrote on Business Dashboards the frontier of knowledge, the other neat stories about what they learned. to make a system more valuable to a Before they produced theories, they first Affect Decision Making? customer. If we want to find out what produced prototypes and systems. it is like to explore a question, our Professionals do this too. When Multimodal Biometrics main sources are academic research sitting around the fire spinning yarns for Enhanced papers; there are very few written of what they did for their customers, Mobile Device Security professional case studies. The typi- they too tell neat stories and graciously cal research paper tells a tidy story spare their clients their struggles with of an investigation and a conclusion. their designs. Beyond Viral But the actual investigation is usually untidy, uncertain, and messy. The un- References 1. COSINE Task Force 8 report. An Undergraduate Why Logical Clocks certainty is a natural consequence of Course on Operating Systems Principles. National Academy of Engineering, 1971; http://denninginstitute. Are Easy numerous contingencies and unpre- com/pjd/PUBS/cosine-8.pdf

Coming Next Month in in Next Month Coming dictable circumstances through which 2. Denning, P. Operating systems principles and  the investigator must navigate. We can undergraduate computer science curricula. In More Encryption Proceedings of AFIPS Conference. 40 (SJCC), 1972, never know how a design proposal will 849–855; http://denninginstitute.com/pjd/PUBS/ Means Less Privacy OSprinciples.pdf be received until we try it and see how 3. Denning, P. Great principles of computing. Commun. people react. ACM 46, 11 (Nov. 2003), 15–20. 4. Denning, P. and Martell, C. Great Principles of How SysAdmins You can see this in the presenta- Computing. MIT Press, 2015. tions of the speakers at the conference, 5. Habermann, A.N. Synchronization of communicating Devalue Themselves processes. Commun. ACM 15, 3 (Mar. 1972), 171–176. as they looked back on their struggles

to find answers to the questions they Peter J. Denning ([email protected]) is Distinguished asked. They were successful because Professor of Computer Science and Director of the Plus the latest news they allowed themselves to be begin- Cebrowski Institute for information innovation at the about automating Naval Postgraduate School in Monterey, CA, is Editor ners constantly searching for what of ACM Ubiquity, and is a past president of ACM. proofs, mobile-assistive The author’s views expressed here are not necessarily technologies, and works and what does not work: build- those of his employer or the U.S. federal government. search engine biases. ing, tinkering, and experimenting. From this emerged many insights. Copyright held by author.

32 COMMUNICATIONS OF THE ACM | MARCH 2016 | VOL. 59 | NO. 3