1. Summary of Multics
1.2 Notable features
2.2 Initial construction
2.3 Use at MIT
2.4 Use at RADC
2.5 The GE-655
3. The 70s
4. The 80s
See the Site Timeline for a chart of Multics sites by date.
For a list of significant Multics dates, see the Multics Chronology.
A 1989 ACM talk by John Gintell on Multics history is available on YouTube and the slides are available as a PDF. new
Multics (Multiplexed Information and Computing Service) is a timesharing operating system begun in 1965 and used until 2000. The system was started as a joint project by MIT's Project MAC, Bell Telephone Laboratories, and General Electric Company's Large Computer Products Division. Professor Fernando J. Corbató of MIT led the project. Bell Labs withdrew from the development effort in 1969, and in 1970 GE sold its computer business to Honeywell, which offered Multics as a commercial product and sold dozens of systems.
- a supervisor program that managed all hardware resources, using symmetric multiprocessing, multiprogramming, and paging
- an innovative segmented memory addressing system supported by hardware
- a tree structured file system
- device support for peripherals and terminals
- hundreds of command programs, including language compilers and tools
- hundreds of user-callable library routines
- operational and support tools
- user and system documentation
The design team's intention was that Multics would develop into a prototype information utility, as described in Martin Greenberger's 1964 Atlantic Monthly article, "The Computers of Tomorrow". As part of this vision, Multics was intended to provide interactive access to many remote terminal users simultaneously, in a manner similar to MIT's CTSS system. Multics combined ideas from other operating systems with new innovations. Security was a fundamental design requirement, in order to meet the utility goals. The team's ambition was that Multics would change the way people used and programmed computers.
Multics was introduced in a series of papers at the 1965 Fall Joint Computer Conference:
- "Introduction and Overview of the Multics System," F. J. Corbató and V. A. Vyssotsky
- "System Design of a Computer for Time-Sharing Applications," E. L. Glaser, J. F. Couleur, and G. A. Oliver
- "Structure of the Multics Supervisor," V. A. Vyssotsky, F. J. Corbató, and R. M. Graham
- "A General Purpose File System for Secondary Storage," R. C. Daley and P. G. Neumann
- "Communications and Input/Output Switching in a Multiplex Computing System." J. F. Ossanna, L. Mikus, and S. D. Dunten
- "Some Thoughts About the Social Implications of Accessible Computing," E. E. David, Jr. and R. M. Fano
Many books and papers describe aspects of Multics.
Multics ran on specialized expensive CPU hardware that provided a segmented, paged, ring-structured virtual memory. The supervisor implemented symmetric multiprocessing with shared physical and virtual memory. Standard Honeywell mainframe peripherals and memory were used. The operating system was programmed in PL/I.
Elliott Organick's book, The Multics System, an Examination of its Structure, describes the system as it was in about 1968. MIT started providing timesharing service on Multics to users in fall of 1969. GE sold the next system to the US Air Force, and the military use of Multics led to some of the system's security features. Honeywell sold more systems to government, and to auto makers, universities, and commercial data processing services.
In the 1980s, Multics became popular in France; Honeywell's partner Bull sold a total of 31 French Multics sites.
Honeywell decided not to create a new hardware generation for Multics in the mid-80s and stopped developing the operating system. In 1987, Honeywell Bull also chose not to build new Multics hardware, and customer sites replaced their Multics systems with more modern hardware. MIT's Multics system was shut down in January, 1988.
The last running Multics site, the Canadian National Defence site at Halifax, NS, shut down at the end of October 2000.
As described in the 1965 paper Introduction and Overview of the Multics System by Corbató and Vyssotsky, there were nine major goals for Multics:
- Convenient remote terminal use.
- Continuous operation analogous to power & telephone services.
- A wide range of system configurations, changeable without system or user program reorganization.
- A high reliability internal file system.
- Support for selective information sharing.
- Hierarchical structures of information for system administration and decentralization of user activities.
- Support for a wide range of applications.
- Support for multiple programming environments & human interfaces.
- The ability to evolve the system with changes in technology and in user aspirations.
See Multics Features for more information.
1.2.1. Segmented memory
The Multics memory architecture divides memory into segments. User programs address segments directly; segments may be shared between different processes' address spaces. Each segment has addresses from 0 to 256K words (1 MB). The file system is integrated with the memory access system so that programs access files by making memory references.
1.2.2. Virtual memory
Multics uses paged memory in the manner pioneered by the Atlas system. Addresses generated by the CPU are translated by hardware from a virtual address to a real address. A hierarchical three-level scheme, using main storage, paging device, and disk, provides transparent access to the virtual memory.
1.2.3. High-level language implementation
Multics was written in the PL/I language, which was, in 1965, a new proposal by IBM. Only a small part of the operating system was implemented in assembly language. Writing an OS in a high-level language was a radical idea at the time.
1.2.4. Shared memory symmetric multiprocessor
The Multics hardware architecture supports multiple CPUs sharing the same physical memory. All processors are equivalent.
1.2.5. Multi-language support
1.2.6. Relational database
Multics provided the first commercial relational database product, the Multics Relational Data Store (MRDS), in 1978.
1.2.8. On-line reconfiguration
As part of its computer utility orientation, Multics was designed to be able to run 7 days a week, 24 hours a day. CPUs, memory, I/O controllers, and disk drives can be added to and removed from a Multics site's configuration while the system is running.
1.2.9. Software Engineering
The development team spent a lot of effort finding ways to build Multics in a disciplined way. The Multics System Programmer's Manual (MSPM) was written before implementation started: it was 3000 or so pages and filled about 4 feet of shelf space in looseleaf binders. (Clingen and Corbató mention that we couldn't have built the system without the invention of the photocopier.) High level language, design and code review, structured programming, modularization and layering were all employed extensively to manage the complexity of the system, which was one of the largest software development efforts of its day.
In the early 1960s, large-scale computing was dominated by mainframe computers that were controlled by batch processing supervisor programs. Users submitted jobs on punched cards and tape, and received printed output, punched cards, and tape after the job was run.
"Conversational" computing, in which a single user typed commands to a computer and saw output immediately, had been done on the RAND Johnniac starting in 1953, and was the standard way of using smaller computers and research machines such as MIT's Whirlwind.
Timesharing, in which a large machine switched its attention between multiple users, giving each the impression of conversational computing with a "virtual" computer, had been proposed by John McCarthy in 1959, and by other computer scientists about the same time.
Paging had already been demonstrated on the Atlas system in the early 60s (with 16 pages), and the Burroughs B5000 incorporated segmentation. (Ted Glaser had been part of the B5000 design team.) MIT Professor Jack Dennis of MIT contributed influential architectural ideas to the beginning of Multics, especially the idea of combining paging and segmentation.
The Compatible Timesharing System (CTSS) was one of the first timesharing systems. It was developed at the MIT Computation Center by a team led by Fernando J. Corbató. CTSS was first demonstrated in November 1961 on the IBM 709, swapping to tape. In its mature form, CTSS ran on a modified IBM 7094 with a second 32K-word bank of memory, using two IBM 2301 drums for swapping, and provided remote access to up to 30 users via an IBM 7750 communications controller connected to dialup modems. Story: "The IBM 7094 and CTSS".
The PLATO system at University of Illinois and the PDP-1 timesharing system at MIT were also demonstrated in 1961. The JOSS system, running on the RAND Johnniac, began operation in 1963.
The history of Project MAC is described on a separate page. The Project MAC contract between MIT and ARPA was signed on July 1, 1963. The Computer Systems Research Group, led by Prof. Corbató, accounted for about a third of Project MAC's budget; its goal was to design and implement a successor operating system to CTSS.
Visits to vendors were made in 1963, and the Multics specifications were developed and sent out to bid. Senior management visited IBM, Digital Equipment Corporation (DEC), Univac, and Control Data. When it came time to select a vendor for the computer that would support the new OS, the folklore is that IBM pitched the machine that would become the 360/65. They were not interested in the MAC team's ideas on paging and segmentation. Professor Joseph Weizenbaum, then a lecturer at MIT, introduced the MAC team to former colleagues of his from General Electric Phoenix, who were receptive and enthusiastic, and proposed what became the GE-645. DEC also responded to the bid. The GE proposal was chosen in May 1964 (much to the surprise and chagrin of IBM) and the contract signed in August 1964.
The GE-645 was an enhanced version of the commercial GE-635, which in turn was a descendant of the GE M236 minicomputer that GE Syracuse had supplied to the US Air Force for the MISTRAM missile tracking system in the early 60s.
[Kazumasa Mine] At that time, John F. Couleur was responsible for General Electric's 600 product lines. Couleur co-operated with Edward L. Glaser of MIT on the design of the 645, adding paging, segmentation, associative memories or translation look-aside buffers (US Patent 3,412,382), and various functions MIT required, to the base GE-635. Nowadays, almost all computers supporting virtual memory have a TLB in their Memory Management Unit. Couleur's recollections are in The Core of the Black Canyon Computer Corporation, IEEE Annals of the History of Computing Vol. 17, No. 4: Winter 1995, pp. 56-60.
The family tree of GE and Honeywell large-scale computers is described in Jane King and Bill Shelly's article A Family History of Honeywell's Large-Scale Computer Systems, IEEE Annals of the History of Computing Vol. 19, No. 4, October/ December 1997..
Bell Labs joined the Multics software development effort in November of 1964 and decided to obtain a GE-645. GE also agreed to contribute software development manpower as well as hardware system engineering. The three organizations worked out a structure for cooperation. The Trinity made major policy decisions. There was one person from each organization:
The Triumvirate was in charge of actual management of the implementation. Membership changed over the years. The initial composition was
The final composition was
Bell Laboratories personnel worked on Multics from their locations in New Jersey, dialing into the Project MAC CTSS system over 110 to 150 baud phone lines. Most of the Bell folks were located in Murray Hill NJ, with a few in each of Holmdel and Whippany. Bell's GE-645 was installed in Murray Hill.
General Electric obtained office space in Technology Square for a programming team, called the Cambridge Information Systems Laboratory (CISL). Al Dean led this group. CISL was initially located on the 7th floor of Tech Sauare. The CISL people connected to CTSS using MIT's internal data switch. GE hardware engineering was located in Phoenix, AZ, along with Ed Vance and his management.
Six papers describing Multics were presented at a special session at the 1965 Fall Joint Computer Conference. At the time, some people thought the system's goals were too ambitious, and that it couldn't be built, for example H. R. J. Grosch, in DATAMATION, November 1, 1971:
Inspect now the far end, the impossible end, of the feasibility spectrum. Here we find that hecatomb called SAGE, and the other (all the other) command and control projects. We find the great corporate MIS systems-the automated board room, the self-optimizing model, the realistic management game. And, pardon my chuckles, if we turn over a few flat stones we may even find MULTICS.
Other contemporary computer scientists argued against the idea of writing a system in a high level language, or with the use of virtual memory, on the grounds of inefficiency.
Professor Fano's initial goal for the project was to have a usable Multics system running by the end of 1965, but this didn't happen. A GE-635 was delivered to Project MAC in August 1965 for use running the 645 simulator, called the "6.36". Intense software development efforts to design and build Multics began in 1965, led by Corby and Bob Daley at Project MAC. The development team used the Project MAC CTSS system for file editing, file storage, and cross-compilation. They submitted 645 simulator runs from CTSS which were run under batch mode on the 635.
CTSS had been built using the existing tool chain for the Fortran Monitor System batch environment: the assembler, loader, object format, and subroutine linkage conventions. The Multics design started from scratch for all formats, conventions, and tools.
Bell Labs contracted with Digitek, a software house with experience in compilers, in 1965 to produce a PL/I compiler for Multics. When it became clear that this project was going to fail, Doug McIlroy and Bob Morris of Bell Labs produced a compiler for EPL (Early PL/I), a subset of the full language. This compiler was written using Bob McClure's TMG language framework. It ran on CTSS and also under GECOS on the 635. Developing this compiler and learning to use it contributed to further delay.
The GE-645 was delivered to Project MAC in January 1967, later than planned. Once the 645 was in place, a revised 645 simulator, still running under GECOS, was used to execute the first major development milestone, "Phase .5," which ran an initial version of the Multics file system. The "Phase 1" milestone demonstrated native boot of Multics on the GE-645 and single-process execution in December 1967, and multi-process execution was demonstrated a few months later. These milestones represented the integration of many software components: memory management including paging, segmentation, and rings; file system including disk management; process creation, scheduling, and interrupt handling; terminal I/O; and user address space organization, command shell, and dynamic linking. Slow performance and system crashes required us to spend unplanned effort improving the system design during 1968 and 1969.
Multics was self hosting, able to compile itself on Multics using bootstrapped compilers, by the end of 1968. All Multics development, by Project MAC and GE users, moved from CTSS to Multics during 1969. Non-developer users began using Multics on a regular basis in July 1969, and MIT's Information Processing Center began providing Multics as a service in October 1969. EPL was replaced by a native compiler, Multics version 1 PL/I, in late 1969.
Two interesting and candid papers describe the difficulties we encountered while building Multics. "Multics -- the First Seven Years", by Corbató, Saltzer, and Clingen, describes problems we encountered and lessons learned. "A Managerial View of the Multics System Development", by Corbató and Clingen, describes the major problems faced by the management team, the approaches to solving the problem, and some lessons we learned.
In 1965 and 1966, while waiting for the PL/I compiler to become available, the development team wrote the Multics System Programmer's Manual (MSPM). It was about 3000 pages; every section went through serious peer review and many sections were rewritten or deeply revised several times.
The MSPM contained functional requirements, high-level design, and implementation plans for Multics. When we actually started building and integrating the system, we discovered that some of the MSPM designs were far too complex. Simpler, more efficient facilities were built instead, sometimes as interim measures intended to evolve into the full design eventually, and sometimes as recognition that the original plan attempted too much. The MSPM was updated to reflect some of the early redesigns, but quickly got behind. We did try to keep a particular section up to date, the one that documented the system module interfaces, i.e. the code that was actually in the system.
See Development Documentation for a description of documents produced during development.
PL/I was chosen as the programming language in 1964. A detailed discussion of the history and features of Multics PL/I is on a separate page. The EPL compiler produced assembly language which was processed by the EPLBSA assembler.
In 1968-69 Multics was late and under significant financial pressure and threat of cancellation. Maybe this helped esprit de corps (as opposed to surface morale). A review by a select ARPA committee in 1968 was one time we came close to cancellation; they recommended that we continue.
[Ed Fredkin] Professor Licklider, then the director of Project MAC, asked to see me. He told me, confidentially, that ARPA wanted to stop funding Multics. Licklider felt that there needed to be a graceful way for MIT to come to the conclusion, on its own, that the Multics project should be scrapped. I was sympathetic to Lick's position. He suggested to me that I serve on a committee which would study the state of the Multics project and which would obviously come to the conclusion that the best course of action was to terminate the project. I agreed.
So the committee was formed and it met at MIT's Project MAC. We decided to have the key Multics figures, Professors Corbató and Saltzer (and, to my recollection, others) explain both the state of Multics and the state of the implementation project. It seemed to me, from their behavior, that it was obvious to them that the project was likely to be terminated. As this process started there was no doubt in my mind that the committee would come to the conclusion that Lick expected. As I listened to the Multics story I was impressed by 2 things: the fantastic accomplishments of the Multics team, and the miserably poor telling of it. Corby, so much under the gun to get the next set of things done, spoke mainly about the things they were urgently working on that month (or that week)!
While I felt that the rest of the committee was leaning towards recommending termination, I began to realize that killing off Multics was a terrible idea. My reasoning was as follows: While the Multics project might have been overly ambitious, it was the sole embodiment a great number of very important ideas. The current efforts were taking advantage of lessons learned; knowledge and experience available nowhere else on the planet. If we killed off Multics, it was likely that these ideas would become lost art and would be discredited along with the whole Multics project; all to the possible detriment of many future projects. I decided that the committee had to come to the opposite conclusion to the one that Lick expected.
I was so certain that my new position was correct, that I planned and contrived to do the following: figure out exactly how it could be arranged so that the committee as a whole would decide in favor of continuing Multics. Was I manipulative? I don't remember the details but the answer is "Probably".
[THVV] (Who was on this committee besides Larry Roberts, Butler Lampson, Ed Fredkin, and Dave Evans?) See Multics -- the First Seven Years and A Managerial View of the Multics System Development.
Bell Labs chose to withdraw from the Multics project in April 1969. Their goal in joining was to obtain a timesharing system for use by members of the technical staff at Bell Labs. When the planned time had passed, Multics was not ready to use, and it was clear that there was a lot more work to do. Bell was paying rent on its GE-645 and dedicating valuable people to the Multics effort, and continuing would prolong these costs with no trustworthy end date.
"Over time, hope was replaced by frustration as the group effort initially failed to produce an economically useful system. Bell Labs withdrew from the effort in 1969 but a small band of users at Bell Labs Computing Science Research Center in Murray Hill -- Ken Thompson, Dennis Ritchie, Doug McIlroy, and J. F. Ossanna -- continued to seek the Holy Grail." -- Lucent web page
"... the problem was the increasing obviousness of the failure of Multics to deliver promptly any sort of usable system, let alone the panacea envisioned earlier." -- Dennis Ritchie, "The Evolution of the Unix Time-sharing System"
Starting in October 1969, the MIT Information Processing Center took over operational responsibility for the GE-645 computer. At that time, Multics performance exceeded that of CTSS, and was continuing to improve. The Multics system was used for MIT sponsored research projects, student computing, and departmental administration. In addition, about half of the MIT system's capacity was used by the Multics project to develop the operating system, supporting users from Project MAC and General Electric.
See the MIT Site History for more description.
The Cambridge Project was an ARPA-funded political science computing project. (Given the nature of the research, the funds probably came from one of the security agencies, and were channeled through ARPA.) They worked on stuff like survey analysis and simulation, led by MIT Professor Ithiel de Sola Pool, J. C. R. Licklider and Douwe B. Yntema. Yntema had done a system on the MIT Lincoln Labs TX-2 called the Lincoln Reckoner, and in the summer of 1969 led a Cambridge Project team in the construction of an experiment called TOSS (terminal oriented social science? anyway it was intentionally a throwaway system). TOSS was sort of like Logo, with matrix operators. Its big feature was multiple levels of undo, back to the level of the login session. This feature was cheap on the Lincoln Reckoner, but absurdly expensive on Multics. This project provided some much-needed revenue to keep the 645 going until it could go public, and was a precursor to the Consistent System (see below).
MIT's Multics was finally opened for paying customers in October 1969, several years later than planned. Pioneer users of the MIT system put up with a lot: crashes, poor response, constant change, arrogance from developers, and inexplicably missing features. The Multics developers and the MIT Information Processing Center management worked furiously to fix problems and make good on overdue promises, and to stave off abandonment of Multics by ARPA, GE, or large MIT users.
184.108.40.206 Cambridge Project
[John Klensin] MIT's Cambridge Project was a major user and revenue source. It built an application called the Consistent System, the largest application ever built on Multics and the most comprehensive data analysis modeling and analysis system ever built. Consistent System developers and users pressed for better function, reliability, and performance and contributed important code and ideas to Multics. Applications built on the CS or its components became a major portion of the workload at several customer sites and contributed to the length of time a few of those systems stayed in operation. AFDSC comes particularly to mind here, although the Human Resources databases at EDS and some of the applications at Credit Lyonnais are probably also candidates.
220.127.116.11 Operating System Development
The main usage of the new Multics system, beginning in 1969, was system programming for Multics itself. The development team was mostly comprised of MIT staff members working at Project MAC, and GE staff members working at the Cambridge Information Systems Laboratory (CISL). In addition to using the MIT system for online editing and compilation of system programs, the MIT system could be reconfigured into two systems, one of which was used for service, and the other for a "development run," in which a new version of the supervisor was booted and tested.
The GE-645 remained on the ninth floor of Technology Square's Alpha building and provided service to the MIT campus via the MIT private telephone exchange. The Project MAC members of the Multics development team were mostly on the fifth floor of the Tech Square Alpha building. CISL programmers were located on the seventh floor of the building, and later moved to the new Beta building across the courtyard. Some GE personnel in Phoenix, where the hardware was built, accessed the MIT system via GE's private phone network.
CISL's language team under Axel Kvilekval and Bob Freiburghouse produced the version 1 PL/I compiler in 1968 and 1969, and Multics was recompiled and in many cases rewritten to take advantage of the much better code produced by the new compiler.
18.104.22.168 Other MIT Usage
Project MAC supported quite a few other users of the early Multics. Many of these users used Multics for document creation and formatting and electronic mail as much as they did programming. One group at Project MAC was working on what became the ARPANet, and they designed the hardware and software that connected Multics to the ARPANet as host 0 on IMP #6 in September 1971. Other Project MAC groups that used Multics included a group doing early research in relational databases.
ARPA produced a film about computer networking in 1972, titled Computer Networks: The Heralds of Resource Sharing. Corby is the first person speaking. Much of the film is is an interview with Prof. Licklider.
Other non-MAC research projects at MIT switched over from the overloaded CTSS to Multics, hoping to take advantage of the new machine's advanced features and lower costs. Computer science research projects outside MIT also secured accounts at the MIT Information Processing Center and used Multics.
The second Multics site was at Rome Air Development Center, Griffiss AFB, Rome, New York. The computer was installed in late 1968 but was not used for Multics until 1970. Some research done at this site was classified intelligence studies. RADC also studied software engineering and software tools. They attached an associative processor, a Goodyear Staran, containing 1000 1-bit processors, to their Multics and did pattern recognition work. (The Staran daemon was assigned a load of 1.5.)
See the RADC site history.
[RFC 208] RADC was added to the ARPANet as host 18 as of 10/5/71.
The GE-645 was a very large computer, implemented in discrete component technology, that is, individual transistors, resistors, and so on soldered to circuit boards. Each CPU backplane was an enormous mass of wires, perhaps 7 feet by 3 feet, built by automated Gardner-Denver wire-wrap machines. Reliability of the large and complex machines was a continual problem, and GE systems were at a performance disadvantage compared to competitors like IBM who used integrated circuit technology.
In the late 60s, GE Engineering designed a machine known as the GE-655, which used integrated circuits instead, and was much smaller and faster. The GE-655 shared the basic asynchronous design of the GE-645.
GE sold its computer business to Honeywell in 1970. This was referred to as the "merger," and was announced to GE employees on 20 May 1970. (See Jean Bellec's story of Shangri-La.) Honeywell renamed the GE-655 to the Honeywell 6000 Series and released the Honeywell 6070 in 1973; the EIS version was known as the Honeywell 6080. GE CISL became Honeywell CISL, still located in Technology Square, Cambridge. It had about 40 employees during the 1970s.
MIT's Information Processing Center operated a Multics timesharing service with over a thousand registered users through the 1970s. Honeywell was a major customer of this service, and IPC, MIT Project MAC, and Honeywell CISL used the MIT site as the primary development tool for Multics operating system development. Project MAC's participation in Multics development gradually declined in the 1970s: its Computer System Research group widened its focus and dedicated a declining number of staff to Multics improvement. Some professors and student thesis research made valuable contributions to Multics during the 70s, and Project MAC used the Multics machine to develop and deploy its contributions to the ARPANet and TCP/IP.
Computer science papers in the 1970s by Project MAC professors and Honeywell employees continued to publicize and document the ideas and lessons of Multics.
In the early 1970s, Honeywell decided to offer Multics as a product, targeting universities (like MIT), high-tech companies (like Ford and GM), and military customers (like the US Air Force, to whom Honeywell had sold a large number of computers as part of WWMCCS). This activity brought new team members into the Multics project: Honeywell marketing and Federal Systems marketing, and development organizations in Billerica MA, Phoenix AZ, and Paris, France.
There were several commercial announcements of Multics. The Honeywell 6180 was announced in January 1973 at the Boston Museum of Science. 6180 processors were about 1 MIPS each. A two-CPU system with 768KB of memory, 8MB of bulk store, 1.6GB of disk, 8 tape drives, and two DN355s, like MIT's system, had a purchase price of about $7 million. The 6180 was faster and smaller than the 645, cost less, and included hardware architecture improvements that improved Multics efficiency and security. The first customer 6180 was delivered to MIT, and Multics system software was debugged on it by CISL and MIT programmers.
The number of Multics installations grew from one, at the beginning of the 70s, to about 25. Each installation was a multi-million dollar sale. During the 70s, there were seven major releases of Multics, about one a year.
A major system development project at Honeywell CISL during the 1970s was the implementation of the New Storage System (NSS). The initial Multics file system design had evolved from the one-huge-disk world of CTSS. When multiple disk units were used they were just assigned increasing ranges of disk addresses, so a segment could have pages scattered over all disks on a system configuration. This provided good I/O parallelism but made crash recovery expensive. NSS redesigned the lower levels of the file system, introducing the concepts of logical and physical volumes and a mapping from a Multics directory branch to a VTOC entry for each file. The new system had much better recovery performance in exchange for a small space and performance cost.
Project Guardian grew out of the ARPA support for Multics and the sale of Multics systems to the US Air Force. USAF wanted a system that could be used to handle more than one security classification of data at a time. They contracted with Honeywell and MITRE to figure out how to do this. Project Guardian led to the creation of the Access Isolation Mechanism, the forerunner of the B2 labeling and star property support in Multics. The DoD Orange Book was influenced by the experience in building secure systems gained in Project Guardian.
Multics released the first commercial relational database, the Multics Relational Data Store, implemented by Jim Weeldreyer and Oris Friesen of Honeywell Phoenix and released in June 1976. MRDS included a report writer called MRPG written by Jim Falksen. (See Paul McJones's page on MRDS on his System R website.)
MIT Project MAC (later Laboratory for Computer Science) had an active network development group, created by J. C. R. Licklider. MAC researchers wrote many of the original network RFCs and contributed to the design of the protocols. The MIT 645 was connected to the ARPANet in September 1971. The MIT 6180 was connected to the ARPANet in 1974. There is a 1972 ARPA movie online titled Computer Networks: The Heralds of Resource Sharing featuring Lick, Corby, Larry Roberts, and others. See Communications and Networking for the details of the ARPANet connection and its later evolution into TCP/IP.
Each Multics sale in the 70s was the result of intense effort by the sales team, often supported by Engineering. RFPs for large system procurements in the 70s often specified complex benchmarks, which required hard work by many Multicians. In addition, almost every sale made the development team aware of new requirements for Multics.
The AFDSC site was first installed in 1973, and became the largest single customer site. Located in the Pentagon, in Washington DC, this site had multiple Multics systems, each with multiple CPUs. Project Guardian was driven by Air Force requirements and led to substantial change to Multics security features. AFDSC site history.
General Motors Information Systems and Communications Activity installed a Multics in 1974. This site had multiple systems and used Multics for GM corporate data processing. See the GM site history.
Ford had Multics twice: the first time was in 1973-1975 as an evaluation system. Then it was uninstalled, and reinstalled at the end of the 70s. The Ford site grew to another very large installation, ending up with 19 CPUs. See the Ford site history.
Industrial Nucleonics bought a single-processor Multics and a hundred Level 6 minicomputers in 1977. They used the Level 6 machines as industrial process controllers, using nuclear sensors to measure process variables such as the thickness of paper produced by a paper mill. The Multics machine was its software factory. The company was later renamed AccuRay, after its measurement technology product, and later still was bought by Asea Brown Boveri. ABB shut down its Multics in 1991 and bought Multics time from ACTC for a while.
Several universities purchased Multics systems in the 70s. The University of Southwestern Louisiana chose Multics partly because a single system could be used for education and for administrative data processing. Their site was installed in 1975. USL site history. Story: The Louisiana State Trooper Story. Virginia Polytechnic University, Oakland University (near Detroit), and the University of Calgary also became Multics customers.
The United States Geological Survey, part of the US Department of the Interior, installed three Multics systems, in Reston VA, Denver CO, and Menlo Park CA in 1977.
Honeywell Bull had used Multics in the early 70s as a software factory for the Level 64. At the end of the 70s, several Multics systems were sold in Europe: ASEA (Sweden), Avon Universities (Bristol and Bath, England), INRA and the University of Grenoble (France).
The Puerto Rican Highway Authority bought a Multics in 1977, which was still running through the 1990s. Bell Canada installed two systems. Honeywell Corporate Network Operations installed a system in Minneapolis. The Data Communications Corporation installed a system in Memphis TN. Nippon Electric Company had a GE-645 site in the early 70s. Little is known about this system.
Internal dissension within Honeywell about LISD's large system future operating system choices led to the commissioning of this report by consulting firm Palyn Associates by HIS corporate in 1978. UCLA Professor Jerry Popek and George Rossman were principal authors. Forest Baskett, Mike Stonebraker, and John Hennessey also contributed. The report recommended capping CP-6, GCOS-3, and GCOS-4 and concentrating on Multics. LISD whitewashed and committeed the project to death and did nothing. Story: The Palyn Report.
The first half of the 80s had many new Multics sites installed, mostly due to vigorous sales in Europe. This happened despite an uncertain corporate future, aging hardware, and lack of a clear future roadmap.
4.1.1 French University System
In the 1980s, Multics became popular in France; Honeywell Bull sold a total of 31 Multics sites, many to French universities, research institutions, and government agencies.
4.1.2 US Government Sites
The US National Security Agency installed an internal Multics system in the early 80s. Little is known about this site, which we were instructed to call "Site N." NSA later installed a better-known Multics site, called DOCKMASTER, which was used by NSAto communicate with vendors of computer security projects. The US Naval War College developed the Naval War Games System on Multics, first installing a development system and then two production systems. The McDonnell Douglas corporation installed and used a Multics system in Long Beach, CA in the development of the C-17 transport aircraft for the US Air Force.
4.1.3 Canadian Government Sites
The Canadian Department of National Defence installed two systems in the 1980s. The DND Halifax site was the last Multics site to shut down, in 2000.
4.1.4 Other Europe Universities
Several European universities installed Multics in the 80s. These were the University of Mainz (Germany), Loughborough University of Technology (Loughborough, England), University of Birmingham (Birmingham, England), Brunel University (Uxbridge, Middlesex, England), and the University of Cardiff (Cardiff, Wales).
4.1.5 Other Europe
In 1980, Renault installed a 2-CPU system in Boulogne-Billancourt, France. Standard Telephones and Cables (New Southgate, London, England) installed a small system in 1982. In the Netherlands, the Ministerie van Sociale Zaken en Werkgelegenheid, known as SOZAWE installed a small system in Den Haag in 1983. The French petroleum company ELF installed a system in Pau, the Centre de Recherche ELF, in 1983. The UK Royal Aircraft Establishment (Farnborough, Hampshire, England) installed a 4-CPU system in 1984.
Toshiba installed two systems in Japan in the 1980s. Little is known about these systems. Arizona State University in Phoenix installed a small Multics in 1981. St John's University (Jamaica NY) also installed a system in 1981. Hoffman-LaRoche (Nutley, NJ) had a 4-CPU system installed in 1982. Southern Company Services, Inc. (Atlanta GA) installed a system in 1982 to build a nuclear fuel inventory system.
In 1985, Multics release 11 introduced a true atomic transaction manager, the Data Management (DM) facility, sometimes called FAMIS, and MRDS was changed to use it.
Multics development was canceled by Honeywell in July 1985. (This was Honeywell's sixth attempt to cancel the system. The decision was made in November 1984 by Gene Manno, and announced the following July.) In 1985, Multics was the only profitable product in the Office Marketing Systems Division. Story: Honeywell Management.
Honeywell's Cambridge Information Systems Laboratory was closed in June 1986. Some CISL personnel transferred to Honeywell Billerica to work on the Opus project.
A HLSUA Task Force was formed in April 1986 to look at migration from Multics to the DPS 6 Plus, following a presentation by Gene Manno at HLSUA. Members were Vince Scarafino (Ford), James Stephens (GM), Bob Kansa (EDS), Paul Amaranth (Oakland University), Norm Powroz (Canadian DND), and Norm Barnecut (University of Calgary). By 1987, Honeywell had backed away from supporting key elements of Multics function on the DPS 6 Plus.
In the mid-80s, Multics customers tried to pressure Honeywell to produce a faster and more modern Multics machine. The 8/70M was a generation behind competitors' hardware and Honeywell had no announced plans to produce new Multics processors. Many of the existing customers defected when they found that the operating system was not supported by the company.
[WOS] Flower was never produced, but was intended to be a 3-4x faster machine implemented in gate arrays as a "test case" for Honeywell Corporate's Very High Speed Integrated Circuit (VHSIC) program (which was being done under contract to the DoD). The design got quite far along, and parts of it were even running in simulation, when the project was all canned in March 1985. It was to include significant architectural enhancements, most notably 8 more pointer registers and two new indirect types: self-relative and base-of-self-relative, as well as a bunch of minor ones.
Unlike the ADP, Flower wasn't based on a GCOS processor, it didn't have the other components to inherit from GCOS, and a significant amount of work would have been required to interface it to memory and I/O systems. There was a GCOS system planned (I do not believe it ever escaped the factory, either) which was where they were looking for the other components, but that whole area never really had a good answer before the end of the effort. It would have worked with the DPS8-M hardware, but not at its full speed advantage.
[THVV] In 1984, Flower was intended to be a 3 MIP processor, almost 5 times the power of the Honeywell Level 68. Using HT5000 bi-polar gate arrays, it would have fit on three 15"x15" boards. GCOS-only instructions, indirection modes (e.g., tally modifiers), processor modes, and data types (e.g. 6-bit BCD and 4-bit decimal) were omitted from the design.
[WOS] After Multics was canceled by Honeywell in July 1985, Olin Sibert attempted to form the "Multics Company" and purchase the technology from Honeywell. This was based around resurrecting the Flower design (afterward called Merlin) and building new Multics-specific I/O hardware (called Excalibur). This effort lasted around 6 months, then petered out when Honeywell realized that, while it might be good for customers, it could never be good for Honeywell.
The Merlin processor was simply the Flower recast in slower but more commercial technology, with assorted minor adjustments. I do not believe any parts were ever simulated, but there was a fair amount of design done, all by the engineers who'd had nothing to do since Flower's demise.
[WOS, JWG] Another former Multician, Michael Tague (who managed the Opus software development), tried to resurrect Multics yet again in 1987, with the same engineers but with yet newer commercial technology (probably on a 386 base). There was some discussion with Sequent about this project. The business plan emphasized the security of Multics on commodity hardware, assuming that there was a growing security market. Tague had much more enthusiastic support from the (changed) Honeywell management, but ultimately they screwed him, too, and nothing ever came of it. The technical work done included figuring out how to support Unix binaries. Honeywell Bull management wouldn't support it because they preferred to control the Multics source code and decided to contract maintenance and support to ACTC as a "safer" proposition. I do not know how far the project got in terms of hardware design.
[WOS, John Ata] As a sop to customers after canning Multics in 1985, Honeywell promised to provide everything Multics had, plus more, plus total compatibility with the Level 6/DPS6 operating system, through a system code-named "Opus," officially named VS3 (short for HVS R3 or Honeywell Virtual System Release Three, to spell it all out). It was to run on the DPS6-plus hardware known internally as the MRX and HRX, and be all things to all people. The hardware was a dud (though it did run the native DPS6 software just fine), and the goal was, shall we say, ambitious. The effort was canceled by Honeywell Bull in 1987, in favor of another project going on in France.
An interesting postscript to this story, though, is that HFSI (formerly Honeywell Federal Systems, Inc., later a quasi independent corporate subsidiary of Bull, later known as Wang Federal and DigitalNet, and now known as BAE Systems) built a highly secure system on the same DPS6-plus hardware. This is sort of a "second generation SCOMP" (which itself was the first system ever evaluated at A1), and it's called the XTS200.
XTS200 received (May 1992?) a B3 rating from NCSC. The evaluated system runs only on that big, expensive, slow DPS6plus hardware, though they have already ported it to 80486 machines in the lab, yielding about 7-10x the performance at one-twentieth the hardware cost. It has a largely satisfactory emulation of System V (release 3) Unix as its interface, and near as I can tell will be the very first reasonable high-security system (in terms of compatibility, performance, and cost) ever delivered--once it's fully on the 486, that is.
[John Ata] The XTS-300 (STOP 4.1) has also been awarded a B3 rating after the successful completion of its RAMP cycle on May 30 of this year. As far as I'm aware, it was the first time that a product on one hardware platform was RAMPED from a similar product on another hardware platform.
[WOS] There was a brief exploration (by the Multics Development Center) in early 1985 of porting Multics to the relatively new CDC mainframe hardware. It didn't get beyond the study stage.
[WOS] Both as part of my "Multics Company" and Tague's project, there was some work devoted to porting Multics to the Intel architecture, specifically to the big Sequent multiprocessors. Again, nothing much came of it; this was late 1985 and early 1987.
[WOS] Honeywell Bull (or whatever it was called by then) explored the possibility of running Multics in emulation on the DPS90 mainframe. This was, I think, a vain attempt to sell some large customer a DPS90 or two--it actually would have worked fairly well, since the instruction sets are so similar, but it was too big a project for the sales organization to pull off.
[Vince Scarafino] There was a considerable amount of preliminary work done on this. It was a sound proposal and would have provided a reasonable environment for porting Multics applications. The proposed approach would have only recreated the ring 4 Multics environment, though. Bull wanted its customers to pay, up front, for the project. None of the customers wanted to spend the money for what looked like a stay of execution (no pun intended).
[Charles Bouchier] During the period that NEC was building the DPS90/9000 series, I was Director of Scientific/Engineering Marketing for Major Accounts out of Phoenix and we also wanted to port Multics to the DPS90s for continued revenues with some of the larger companies that were clambering for more power with the Multics OS. The bottom line was that NEC wanted $1,000,000 to do the board and firmware reworks and HIS -> HB was not willing to pony up... which became an obvious mistake as from that point on there was nowhere else to go with Multics in a competitive market.
GE bought Bull and created Compagnie Bull-General Electric in 1964. Bull engineers helped design the initial Multics. The French government was a major investor in Bull; it supported the 1975 merger of Bull with CII to create CII Honeywell Bull. See the history of Bull website for much more on this subject. CII Honeywell Bull was nationalized by the French government in 1982. Honeywell Information systems merged with Bull to create Bull HN Information Systems in 1987; NEC was a minority partner. Bull bought out the shares of Honeywell and NEC in 1991.
In April 1988, Bull transferred maintenance of Multics to the University of Calgary, which set up a separate corporation called ACTC Technologies Inc. to do this. (ACTC was later renamed Perigon Systems Inc.) ACTC had its own Multics system, and at one time said it "intends to be the last Multics machine running."
[David Schroth] Perigon Solutions was acquired by CGI Group Inc. subsidiary CGI Information Systems and Management Consultants Inc. in September 1998. CGI continued to operate a dual 8/70M in Calgary. Formal support was no longer offered to the Multics community. CGI shut down its Multics on July 7, 2000.
The US National Security Agency's DOCKMASTER machine was shut down in March, 1998, after repeated extensions. The hardware from this site, except for the hard drives, was transferred to the National Cryptologic Museum, which in turn loaned it permanently to the Computer Museum History Center in Mountain View, California.
[Jim Corey] The last Multics system running, the Canadian Department of National Defence Multics site in Halifax, Nova Scotia, Canada, shut down October 30, 2000 at 17:08Z. This system was modified to be Y2K compliant and was the main production system until Sept/00.
Bull HN has made the entire source of Multics available "for any purpose and without fee" at MIT as of November 2007.