Glossary of Multics acronyms and terms. Entries byTom Van Vleck ([THVV]) unless noted.

safety switch

Segment attribute that controls whether a segment can be deleted.

salvager

[BSG] Set of programs for reconstructingdirectory andfile system integrity after a crash. UntilNSS, the Salvager was a separate tapebooted after a crash; built of Multicssupervisor parts and running entirely inring 0, it scanned and repaired the file hierarchy instead of coming up to serve users. Eventually, more and more of its functionality was moved to code that can run while the system is up. When acrawlout occurs,locked directories are salvaged before returning to the userring. The salvager does more or less whatUnixfsck does.

SCAS

[BSG] (for "System Controller Addressing Segment") Asupervisorsegment with onepage in the memory space described by eachSCU (or other passive module) in the system. The SCAS contains no data, is not demand-paged, and itspage table is not managed bypage control. Instructions directed specifically to an SCU as opposed to the memory it controls are issued toabsolute addresses in the SCAS through pointers (in the SCS) calculated duringinitialization precisely to this end. Typical of such instructions arecioc (issue aconnect),smic (set aninterrupt), and the instructions to read and set SCU registers (including interrupt masks). On the6180,rccl (the instruction to read the SCU-resident calendarclock) did not require an absolute address, but a port number, obviating the need for the SCAS to be visible outside ring 0 to support user clock-reading as had been the case on the645. The SCAS, which is a segment but not a data base, is an example of exploiting thepaging mechanism for a purpose other than implementingvirtual memory.

scavenger

Program for finding records on aphysical volume "lost" from itsrecord stock due to crashes, and making them available again in thevolume map. Written byJohn Bongiovanni.

scheduler

[BSG] Used ambiguously, as in today's operating systems, to denote either the piece of software that manages multiprogramming or the module that allocates time slices to users. Since in Multics these are the same program, "pxss" (process exchange, switchstack), this was not a problem. This very large, complex assembly language module was highly optimized, including by many non-modular hooks intopage control. Source isonline.

[THVV] The Multicsscheduler began as a Greenberger-Corbató exponential scheduler similar to that inCTSS. About 1976, it was replaced byBob Mullen'svirtual deadline scheduler.

SCICONIC

Mathematical programming facility produced by SCICON, Ltd. for Multics in 1986.

SCOMP

Secure COMPuter. Secure front-end processor, done byHoneywell Aerospace in Tampa, first system to get anOrange Book A1 rating. Used to be called SFEP.

SCS

[BSG] (for "System Configuration Segment") Awiredring 0 data base, initialized from data in theconfig deck very early inCollection 1, describing the overall system configuration, i.e., the CPUs and otheractive devices and their connections to the SCU's and their status. The SCS'metier is knowledge of which ports of what are connected to each other, as well as how much address space is described by each SCU, which are interlaced with each other, etc. The SCS is used heavily and modified during systemdynamic reconfiguration.

Among the data in the SCS is an array of pointers into the SCAS indexed by CPU port. See the entry on theSCAS for more on related topics.

SCSI

Multics site: SCSI. Southern Company Services, Inc., Atlanta GA. Nuclear fuel inventory. Installed 1982.

SCU

[BSG] (1) System Control Unit, or Memory Controller. The multiported, arbitrating interface to each bank of memory (usually 128 or 256 KWords), each port connecting to a port of an "active device" (CPU,GIOC orIOM,bulk store ordrum controller). On the645, theclock occupied an SCU as well. The SCUs have their own repertoire of opcodes and registers, including those by which system interrupts are set by one active unit for another. (Seeconnect.) The flexibility of this architecture was significant among the reasons why the GE 600 line was chosen for Multics. SeeSCAS.

(2) Store Control Unit instruction. The645 and6180 instruction that stores an eight-word encoding of the processor state (other than register contents and the state of theEIS unit on the 6180) at the time of aninterrupt orfault. Because of potentially lengthy indirect chains and instruction modifiers with side-effects (increment-on-reference pointers), instructions must be restartable in the middle. Only some of this data is used by the software, and there are bits that are by and large not understood by the system staff: most is used by the processor upon restart. With the EIS unit data, the processor state took 40 words to encode.

SDW

Segment Descriptor Word. An element of a process'sdescriptor segment; the hardware-accessible data element that defines a segment and the process's access rights to it.

search rules

Thedynamic linking mechanism looks forsegments in a set ofdirectories specified by the user process's search rules. These rules are per-process and stored in theRNT. In addition to specifying a list of directories, there are three special values that can be specified:

-initiated-segments

specifies the use of alreadyinitiated segments (this rule should always be first)

-working_dir

search the currentworking directory (which might have changed since the search rules were set)

-referencing_dir

search "the same directory as the one holding the procedure that took the linkage fault." This is a subtle brilliance, that helps subsystems find the version of code that they are packaged with.

There is a search list facility, which generalizes the search rules to work for multiple different uses. One's "compose" search list, consisting of multiple search paths, can be different from the search list used for object segments.

second system effect

As described inThe Mythical Man-Month by Fred Brooks, the Second System Effect causes the developers of a successful system to overload their next system with features. Some say Brooks had Multics in mind when he named this syndrome. It is worth noting that Multics did not stop at being a second system.6180 Multics was easily a third system, a nearly complete rewrite with vast simplifications. TheNSS changes were a fourth system. Another major set of changes was in progress to buildtransaction processing with write-ahead-log into the virtual memory system, about the time Bull killed the system. Story:Phase One.

security

Security was one of the basic design requirements for Multics.Access control, supervisor integrity, andpasswords were present from the beginning of the design. TheAccess Isolation Mechanism was later added to supportnon-discretionary security. As a result of these features, Multics was sold to customers concerned about security, such as the military and government sites. Multics received anOrange Book rating of B2 in August, 1985. Article:B2 Security Evaluation. Story:How the Air Force broke Multics security.

security-out-of-service switch

The "soos" switch is set if thesalvager detects a directory whoseAIM classification is lower than its containing directory. Such an entry could be used as a write-down path. When the switch is set, neither the directory nor its contents can be referenced. TheSite Security Administrator can reset this switch.

SEDACS

Support Equipment Data Acquisition and Control System, application hosted onMcDonnell Douglas site in Long Beach CA. Supported the C-17 aircraft.

segfault

[BSG] Jargon for "(missing) segmentfault". What the hardware takes when a segment number is used for which there is no validSDW. The latter is not necessarily an invalid or error situation, in fact, it is the default situation when a segment has just been madeknown. Segfaults are resolved by looking in the process'sKST (table of segments known to it) to find out what segment is intended to be referenced, and theAST searched for that segment'spage table to construct theSDW. If notactive, the segment has to be activated, perhaps requiring some other segment to be deactivated to make room for itspage table. When segments are deactivated,segment control invalidates theSDWs of all processes havingSDWs for it, to start this tale at the beginning again.

segment

User-visible subdivision of a process's address space, mapped onto a storage systemfile. Each segment is 1MB long, and has a zero address. The term "segment" is used interchangeably with "file" -- except not really: the things that are files in other systems are implemented as segments; also, the term "file" includesmulti-segment files, and when talking in terms ofCOBOL,PL/I, orFORTRAN language runtime objects, one speaks of files. Programs are spoken of as stored in (procedure) segments. Correct use of the terms "file" and "segment" is a sure sign of aMultician.

Segment Loading Table

[BSG] (SLT). A database created and maintained byinitialization, vestigial anddeciduous during system operation, that describes all of the segments on theboot tape (seecollection), including all of the names to be associated with them needed topre-link thesupervisor, access attributes in theirSDWs (seeREWPUG), length,bit count and the like. The image of a the SLT entry (SLTE) for each segment on the boot tape, generated by theMST generator program, precedes it on the tape.

segmentation

[BSG] Division of a process's virtual memory into a vector of vectors, each such vector being a segment. The idea came from the Burroughs 5500 series. Different segments can have different access rights, including for different users, and other differing attributes. Multics's use of segmentation is as a basis for what are now called "memory-mapped files", hence each segment is a file and each file is a segment, in some sense, the basic idea of Multics. See"The Multics Virtual Memory: Concepts and Design."

segment control

[BSG]Ring 0 software responsible for the management of segmentation, the allocation and deallocation ofpage tables, the connection and disconnection of theSDWs of processes from the page tables, and the performing of operations (such as truncation) uponactive segments. Tightly bound up with, and requesting service ofpage control, in the "New Storage System" (NSS), segment control is tightly bound up withVTOC management as well.

Selectric

IBM mechanism for typewriters and computer terminals. The character set was on a plastic "golf ball" that struck the paper through a typewriter ribbon. This mechanism was used in the IBM1050 and2741 terminals, in various third-party terminals, and in theconsole typewriter of the6180. There were three grades of this mechanism OEM'd by IBM, light, medium, and heavy duty; the 6180 console had a heavy duty model.

SEP

Multics site:Société Européenne de Propulsion, Vernon, France, near Paris. 1986-1990. Ariane rocket engines.

Series 60, Level 68

Marketing name for a repackaged6180. Later called theDPS-68.

SET

System Environment Test. Honeywell Phoenix organization.

SFEP

[WEB] Secure Front End Processor; original name of the machine that eventually becameSCOMP.

shell

The Multics command processor used to be called theshell. This program is passed a command line for execution by thelistener; it parses the line into acommand name and arguments, locates the command andinitiates it, and calls the command program with arguments that are PL/I character strings. It is simple to replace the default system supplied shell with a user-provided program, by callingcu_$set_cp (seeabbrev). AUnixshell includes the concepts of both shell andlistener in the Multics sense.

Louis Pouzin's story of"The Origin of the Shell" describes the genesis of the concept.

An early implementation of the Multics command language is described inMSPM sectionBX.1.00.

shift

The accounting system defines up to 8 shifts, which can start at any half-hour boundary in a week, at site option.User Control charges user processess' resource usage against the slot for the current shift in a per-user vector in thePDT for the user'sproject.

Terminal devices usually have a Shift key that causes a keyboard to transmit different characters when depressed or not. The term is more generally used to describe any mode change in an output device, such as shifting from black ribbon to red.

shriek name

[BSG] Multics has a convention of convertingunique IDs into character string names:>pdd>!BqrHmpZZtL was a typical pathname of aprocess directory, generated from a 36-bit process ID. These were called "shriek names," because a colloquial pronunciation of the exclamation point was "shriek." Theunique_name_ subroutine reduced the alphabet to sixteen characters to eliminate the possibility of obscenities: all vowels were removed, "v" because you can use it to look like an "u", and "f", of course, and "y" because it's like a vowel, and 2 others. Theinitializer's process ID (777777000000) always came out!zzzzzbBBBBB, which was thus always the name of itsprocess directory.Rich Lamson suggested that this was Hebrew for "Fly of the Lord" (the Initializer's function, in some sense, cf. "Beelzebub", Heb. for "Lord of the Flies.")

SIB

Software Installation Bulletin. Installation instructions for each Multics release.

signal

PL/I name for an exception. PL/I signals have continuation semantics; that is, a condition handler can return to the point of the signal. The Multics environment maps hardware events, e.g. zerodivide, linkage fault, out-of-segment-bounds reference, into PL/I signals. When a signal is raised, the runtime searches back up thestack for a condition handler for the signal, and invokes it if found. If no handler can be found, the runtime starts over, looking for a handler for the condition "unclaimed_signal". Eachlistener on the stack establishes an unclaimed signal handler. If invoked, this handler prints a message and "caps" the stack, establishing a stack frame for a new "command level" by calling a newlistener. Issuing thestart command to the new listener returns to the signal handler, which returns to the point of error and retries the instruction that faulted.

For linkage faults, this setup is ideal: if your program calls a non-existent subroutine, the dynamic linking mechanism will signal "linkage_error," the signaller will search the stack for a handler, and finding none, will come to command level and let you write the missing routine, compile it, and then typestart to invoke it. Issuing the commands

resolve_linkage_error segname$entryname
start

patches the machine conditions in the most recent signaller frame and retries a linkage fault, so you can specify a different segment or entrypoint name, and thus redirect a call if you made a simple spelling error.

Theanswer command establishes a condition handler forcommand_question and executes a command line under it; when a program asks a question by callingcommand_query_, this subroutine signalscommand_question. The signaller finds and invokes theanswer command's handler, which supplies a canned answer to the question (by modifying the arguments tosignal_) and continues execution. Thus, for example, one can say

answer no delete **

to delete a lot of files without interaction, supplying a "no" answer if any questions are asked. Similarly, theon command can establish a handler for any condition and execute a command in the scope of the handler, and take specified action when the condition is raised.

SIMPL

Simulation language, descendant of OPS-4, compiled into MulticsPL/I. Language designed by Prof. Malcolm M. Jones of MIT Sloan School.

SIPB

[BSG, Frankston]MIT's Student Information Processing Board. A student organization founded in 1969 byBob Frankston, Gary Gut, David Burmaster, and Ed Fox. The original purpose was to provide access to computers for students, which translated into buying time on the online systems, in the days when computers were big and heavy and cost millions of dollars. To be honest, SIPB was the Student IPB when the computer center was run by the big IPB. SIPB used what is now called soft money: that is, IPSC allocated resources to SIPB by giving it a dollar amount it could spend -- only at IPSC. Of course, as any organization does, SIPB tended to become a social group as well as a service organization. Many of the youngMulticians of the late 70s were active SIPB members.

SIPB's relationship to Multics was complex: by virtue of being among its greatest admirers and promoters, they were at once among its most demanding and insistent critics. Overall they were enthusiastic, though SIPB even gave outCTSS time to a user (Paul Green!) for WTBS (now WMBR).

Before Athena, SIPB provided computer time on the MulticsprojectStudent, and operated the Educational Calculator Service (ECS) subsystem, which permitted users to program in a BASIC-like language. Theanonymous user facility was used to allow multiple limited service users. SIPB also provided a letter quality printer on Multics for text output and provided terminals to dormitories, fraternities, and the Student Center library.

Site Analysts

Heroes of Multics.GE /Honeywell employees who worked at the customer site and helped the customer use the machine, report problems, install fixes.

Site N

US National Security Agency site, Ft. Meade MD, 1980-1992. They didn't want it known that they had a Multics, so all the lists showed "Site N" and if you had questions, you were referred to some guy in FSO.

The internal name of the site was "Flagship."

NSA had another machine,DOCKMASTER, that was used for unclassified communication among security researchers.

Site Security Administrator

Designated security administration role at some sites. This individual manages themandatory access control settings for users and data.

SJU

Multics site: St John's University (Jamaica NY). 1981-1989.

slave mode

Unprivileged execution mode of the CPU. Seeprivileged mode.

SLT

SeeSegment Loading Table.

SMM

Segment Management Module. Early supervisor module, obsoleted before 1970; managedreference names.Sue Rosenbaum worked on it.

SNECMA

Multics site: Société Nationale d'Etude et de Construction de Moteurs Aéronautiques (Réau, France). 1983-1987.

SNOBOL

String processing language implemented for Multics byOlin Sibert at MIT in 1977. Story:Multics SNOBOL and the MissingEND Statement.

sort/merge

Multics has a sort/merge facility that was done as part of the COBOL support. Very batch-like, as a result of the language definition.

SOZAWE

Multics customer. SeeMinisterie van Sociale Zaken

SRB

Software Release Bulletin. Release notes for each Multics release, describing what was changed and fixed.

SSA

US Naval War Games System, Software Support Activity, Newport RI. SeeNWGS site history.

SSS

SeeStandard Service System.

SST

System Segment Table.Supervisor segment fabricated at boot, containsAST, and thus, all thepage tables of all segments in use.

STAC

Store A (accumulator) Conditional (on memory operand being zero.) The645/6180 instruction used universally in Multics to locklocks by storing aprocess 36-bit ID in a zero (unlocked) lock word. SeeRAR.

stack

[BSG] Multics has a stack segment for the stack of eachring of eachprocess (that has been referenced), in theprocess directory of that process. Thering 0 stack is actually (inevitably) a per-process data base of thesupervisor. The need for call stacks follows from thePL/I basis of the programming environment, which determines the stack discipline. The stack contains data with the PL/I AUTOMATIC storage class. Procedures have stack frames - there is no single-data-item pushing and popping (and no instructions to support such). Stacks are kept to less than the full 256k lest wrap-around not be detected. The base of the stack segment contains a table of pointers to criticaloperators, e.g., the procedure entry sequence. During somefault andinterrupt processing, thesupervisor uses the upper end of thewired, per-processor data base, the PRDS, as a stack (SeePRDS).

[THVV] Article:Multics Execution Environment.

STACQ

[BSG] Store A (accumulator) Conditional on Q (quotient register) (being equal to the contents of the memory operand.) Pronounced "stack queue". IndivisibleRAR instruction used by Multics to unlocklocks: Multics stores a zero in the word if and only if the content is currently the currentprocess's 36-bit process ID; if it is not, the supervisor orSCU RAR handling is broken. STACQ is general enough to simulate, with a little software ingenuity, any other real or desired indivisible storage update, and was often used to generate unique ID tags, event counts, and the like as well as unlocking locks. SeeRAR.

standard service system

Commands and subroutines provided with Multics, necessary for use of the system. Stored in>sss,>sl1, and>unb. Notice the mention of subroutines. Unlike many other systems, Multics makes available a large library of utility routines used to construct the standard commands. These routines are shared by all programs that call them by thedynamic linker.

[BWS] Sharing system subroutines provided two synergistic elements of cohesion for the Multics community. First, the writers knew that they would be shared, so the tendency was to do a better job defining and writing them. Second, because they were easily available and well-written, they got used and incorporated in many user programs. Since they worked the same way as the system commands, the overall effect was to increase the consistency and integration of the overall Multics environment (down to user programs). If there is one system subroutine to highlight this effect it would beconvert_date_to_binary_.Unix needs this so bad it hurts.

Along these lines, someone should mention OS source code availability. If you wanted to use a system subroutine but it didn't quite do what you needed, the source code was available for instant modification, or at least examination to see how the experts did it. Of course Unix had this too, at first, but it seems to have hurt them more than it helped given the proliferation of versions ("Unix has too many fathers").

star convention

[BSG] Convention of representing the names of multiple entries in adirectory with asterisks. Each asterisk matches either one component of the trailing characters of a component:foo.*.pl1 matchesfoo.a.pl1, but notfoo.pl1.** matches any number of components:foo.** matchesfoo,foo.pl1, andfoo.pl1.old. Although there are subroutines to do star matching and searching, it is the responsibility ofcommands to call them; star expansion is not done by theshell. See alsoequal convention.

Staran

Attached associative processor, built by Goodyear Aerospace, used on the645 and6180 atRADC in the mid 70s. Had 1000 1-bit CPUs that could be combined under program control to do vector operations.

According to Gregory Wilson'sHistory of Parallel Computing, in 1972 "Goodyear produces the STARAN, a 4x256 1-bit PE array processor using associative addressing and a FLIP network."

The RADCAP project studied the use of the Staran associative processor for AWACS radar processing.

The Starandaemon ran with aload setting of 2.

STATIC

PL/I storage class. Storage declared STATIC is initialized once per process.

static section

Region of thecombined linkage segment where STATIC storage is allocated.

STC

Multics site: Standard Telephones and Cables (New Southgate, North London, England). Originally sold as anIntellect machine. See theSTC Site History for more information.

Stratus VOS

SeeVOS.

subsystem utilities

Library of utility routines for programs that read requests from the user and executed them. Pioneered byDoug Wells in his version ofsend_mail and made part of the standard system byOlin Sibert andGary Palter in 1978.

subverter

Program written by the ProjectZARF team to test whether hardware protection mechanisms always worked. Ran as a background job trying various invalid operations to see if the hardware ever failed. One problem it found was described as follows: The subverter "found a hardware flaw in the GE-645: if anexecute instruction in one segment had as its target an instruction in location zero of a different segment, and the target instruction used index register, butnot base register modifications, then the target instruction executed with protection checking disabled. By judiciously choosing the target instruction, a user could exploit this flaw to gain control of the machine. When informed of the problem, the hardware vendor found that a field service change to fix another problem in the machine had inadvertently added this flaw. The change that introduced the flaw was in fact installed on all other machines of this type." (Paul A. Karger and R.R. Schell, 'Multics Security Evaluation: Vulnerability Analysis,' ESD-TR-74-193, Vol II, June 1974.) Story:How the Air Force broke Multics security

suffix

The last period-delimited component of an entryname. See thelist of suffixes.

SUNIST

Service Universitaire pour l'Information Scientifique et Technique, Ministère de l'Enseignement Supérieur et de la Recherche. A network service that made information available on Minitel. Installed 1984. Located in L'Isle d'Abeau, near Grenoble. A 1985 BITNET listing says "FRSUN71 SUNIST Bourgoin Jallieu" and by 1990 SUNIST still existed on BITNET but was no longer using Multics.

[Jean-Paul LeGuigner] SUNIST was (does not exist anymore) a service (with a computer center) in charge of indexing libraries catalogs and providing access to universities libraries.

supervisor

[BSG] That portion of the operating system which runs inring 0, a hardware concept on the6180. The supervisor is loaded from theboot tape, and, like the rest of Multics, consists ofsegments, but most of them, although they (mostly) are paged, exist outside of thefile system. HavingSDWs in every process, the supervisor forms a part, the same part, of every process's address space, occupying its lowest segment numbers. The supervisor's SDWs are permanent, and never incursegfaults. Some parts, e.g., the ring 0stack and theKST, are actually different segments in each process, although with identical segment numbers. The supervisor can be thought of as a shared, secure domain common to all processes: this gives it the ability to develop and store pointers that are valid across processes, a capability notably lacking from the Multics userrings.

swapping

[BSG] Performance enhancement scheme implemented about 1977 for a Multics Benchmark for Data Communications Corp. of Memphis. Based on various ideas being circulated byBob Mullen andSteve Webber, swapping was a response to the oft-aired slap, "The reason your system is so damned slow is caus' alla thosepages!" Other, less "general" or "elegant" time-sharing systems which swapped user-core to contiguous disk-tracks and the like were frequently more responsive.

The scheme was to allocate critical pages of a process'sworking set on one contiguous run of disk blocks, and transfer the whole at the time a process gained or losteligibility by a single massive scatter-gather I/O operation of theIOM, which implemented a type of control word (IONTP, "I/O non-transfer and proceed") that facilitated skipping unwanted, unmodified, or non-resident pages in these contiguous swaps.

Bernie Greenberg designed and executed the baroque, hirsute implementation atCISL, which required radical modification ofNSS at every level ofpage control andsegment control. At the peak of implementation fervor, Charles Frankston, who was in Nigeria at the time, appeared to Bernie in a dream and revealed to his horror that the IONTP control words would write zeros to the disk, a fact that no one had theretofore realized, which largely deflated the whole scheme [THAT IS 100% TRUE].

Bob Mullen took swapping toPMDC for live combat. Needless to say, bugs were discovered. While the performance gains first looked encouraging, they soon became moot. Finally, after many days and hours of running and tuning, some directory revealedpage control disease, indicating a subtle bugsomewhere that was not likely to be found overnight as required. (The problem was tradeoff between complexity of feature, shakedown time, and delivery time). The scheme and the code were abandoned after the benchmark. Seepre-paging.

[THVV] I remember that in the case of swapping, say a process needed 30 pages to work, we found that we got a savings of 29 page fault overheads per process eligibility. But this was canceled out by the need to allocate and hold a 30 page buffer before starting any work, and the increased memory pressure just about exactly canceled the fault overhead savings. The end effect would have been to add a lot of complexity and bug sites to the system for no performance gain, so we didn't.

SysAdmin

Project name for system administrators, the people who registeredusers andprojects.

SysDaemon

Multics project name thatdaemon processes runs under.

SysMaint

Project name for system maintainers, the people who installed new software on the system.

System M

Multics system inPhoenix atCRF used byHoneywell employees for Multics development,benchmarks and for other Honeywell work. See theSystem M site history.

Systeme X

Multics system in France used by Bull employees for Multics support.

[Gerard Vanderschooten] System X was dedicated to the Bull support group activity (training, developpement, validation of new releases and modifications, etc). It was installed in Louveciennes (around 1982) where the Bull Support Group was install..and then moved to INRIA platform when Honeywell Bull decided to no longer develop new Multics platform and that the Bull Support Group was reduced (down to one guy..). The System X configuration was bi-processor, with one of each of the existing technologies (68 and DPS8-Multics) to allow training of field engineers with both ones. Story:Systeme X.