Fault Tolerant Operating Systems
Peter J. Denning · ACM Computing Surveys · 1976
This paper develops four related architectural principles which can guide the construction of error-tolerant operating systems.The fundamental principle, system closure, specifies that no action is permissible unless explicitly authorized.The capability based machine is the most efficient known embodiment of this principle: it allows efficient small access domains, multiple domain processes without a privileged mode of operation, and user and system descriptor information protected by the same mechanism.System closure implies a second principle, resource control, that prevents processes from exchanging information via residual values left in physical resource units.These two principles enable a third, decision verification by failure-independent processes.These principles enable prompt error detection and cost-effective recovery.Implementations of these principles are given for process management, interrupts and traps, store access through capabilities, protected procedure entry, and tagged architecture.