Skip to content

Fernando Corbató and Time-Sharing

Abstract

Fernando Corbató built the Compatible Time-Sharing System (CTSS) at MIT, first shown in November 1961, which let many people use one computer at the same time by switching between their programs faster than they could notice. CTSS also brought one of the first computer passwords, and with it, in 1962, the first documented password theft. From 1964 Corbató led Multics, an operating system designed as a “computer utility” that would run like the telephone or power network, around the clock. Multics was late and expensive, and Bell Labs left the project in 1969, but its hierarchical file system, virtual memory, and protection rings ended up in nearly every later operating system. Corbató received the Turing Award in 1990 and used his lecture to explain why large systems fail.

Before Time-Sharing

Computing in 1960 was an exercise in scheduled access. A researcher who needed computation prepared a job (a deck of punched cards containing a program and its data) and submitted it to the computer center. An operator loaded the job, the computer ran it, and the researcher collected the printout hours or days later. If the program had an error, the cycle began again.

This model concentrated computing in a small professional class of operators who mediated access to scarce machines. The researcher’s interaction with the computer was indirect, and the loop between writing code and seeing results could span days. Programming was slow because debugging was slow, and debugging was slow because every run had to wait for its turn on a machine that served the whole campus in sequence.

The idea of sharing the machine instead was in the air. On 1 January 1959, John McCarthy wrote a memo to Philip Morse, director of MIT’s Computation Center, proposing that a computer serve many users at once, each at a terminal, with the machine dividing its attention among them so quickly that each would feel it was theirs alone. Christopher Strachey had presented a paper on the “time-sharing” of large fast computers in Paris, but, as McCarthy later noted, he meant something different that did not involve many users at terminals. A processor spent most of its time waiting: for a tape to spin, for a card to be read, for a human to type. Those gaps could be filled with other users’ work.

CTSS

Fernando José Corbató was born on 1 July 1926 in Oakland, California, and earned his PhD in physics from MIT in 1956. He joined MIT’s Computation Center and became its deputy director in 1960, which put him in charge of an IBM 709 that served the entire MIT research community through batch processing.

With Robert Daley and Marjorie Merwin-Daggett, Corbató built a time-sharing supervisor for that machine. In November 1961 they demonstrated it on the 709: four users at Friden Flexowriter terminals, their programs swapped in and out of memory by writing them to magnetic tape. The system was called the Compatible Time-Sharing System (CTSS) because it ran ordinary batch jobs in the background, so the Computation Center’s existing work did not stop. The three authors described it in “An Experimental Time-Sharing System” at the Spring Joint Computer Conference in May 1962.

The Computation Center replaced its 709 with an IBM 7090 in spring 1962 and upgraded that to a 7094 by 1963, modified for CTSS with two 32K banks of core memory instead of one, an interval timer, and memory boundary and relocation registers that only the supervisor could set, so user programs could not trample over each other. Swapping now went to drum and, when the drums filled, to disk, and CTSS served up to about thirty users at once. When MIT set up Project MAC in 1963, with ARPA money arranged by J.C.R. Licklider, ARPA paid for a second 7094 that arrived in October 1963. Project MAC’s founding director was Robert Fano, an electrical engineer born in Turin in 1917 whose name survives in Shannon–Fano coding (see Data Compression); he led it until 1968. The two machines were told apart by the color of their side panels, blue for the Computation Center and red for Project MAC.

CTSS introduced or pioneered:

  • The terminal as primary interface: users worked through teletypes and typewriter terminals instead of card decks
  • Files stored on disk between sessions: a user’s work persisted without the user carrying a deck of cards around
  • The command-line interface: users typed commands and read the answers
  • Passwords: each user had a private file space protected by a password
  • Electronic mail: in 1965 Tom Van Vleck and Noel Morris wrote the MAIL command, on a suggestion by Glenda Schroeder and Louis Pouzin, so users could leave each other messages (see The First Email)

CTSS ran until 20 July 1973, when Roger Roach switched off the red machine for the last time.

The First Password Thefts

Time-sharing changed who could reach whose data. In batch processing, files sat in the operators’ cabinets and privacy was physical. On a shared machine, several people’s files lived on the same disk, and software had to keep them apart. CTSS used passwords for that, and the system is usually credited with the first use of passwords for access to a computer. Corbató was more careful about the claim. “Surely there must be some antecedents for this mechanism,” he told Wired in 2012, and suggested that IBM’s SABRE airline reservation system might have been earlier. His reason for adopting it was plain: “The key problem was that we were setting up multiple terminals which were to be used by multiple persons.”

The passwords also limited how much machine time each person got, and that made them worth stealing. In spring 1962 Allan Scherr, a PhD student allotted four hours a week on CTSS, found that he could ask for a file to be printed offline by submitting a punched card. He asked for the password file, picked up the printout early the next morning, and had as much time as he wanted. To spread the guilt he handed passwords to other users; one of them, J.C.R. Licklider, logged into Robert Fano’s account and left taunting messages. Scherr confessed to Fano about twenty-five years later. Fano told him his PhD would not be revoked.

The second leak needed no thief. CTSS kept the password file and the “message of the day” in the same system directory, and as the number of system programmers grew, they persuaded Corbató to let more than one of them log into that directory at a time. They promised to be careful. The standard text editor, however, assumed that only one person ever worked in a directory and wrote its temporary file under a fixed name. In 1966 two administrators edited the two files at the same time, the editor’s temporary files crossed, and every user who logged in was greeted with the complete list of passwords. It went on for fifteen or twenty minutes until a user called the administrator; the system was shut down and the next twelve hours were spent changing everyone’s password. Corbató told the story in his Turing lecture under the heading “A Mishap.”

The Computer Utility

CTSS was a prototype. Corbató’s goal was larger: a computer utility, a central service that a whole community would draw on the way it drew on electricity or the telephone. McCarthy had used the comparison at MIT’s centennial in 1961: “Computing may someday be organized as a public utility just as the telephone system is a public utility.” Corbató and Victor Vyssotsky spelled out what that meant for the engineering in their 1965 paper introducing Multics. Such systems, they wrote, “must run continuously and reliably 7 days a week, 24 hours a day in a way similar to telephone or power systems.” They also saw the catch: “The more reliable computers become, the more their availability is depended upon.”

In September 1966 Fano and Corbató explained time-sharing to a general readership in Scientific American. The same year, the Canadian engineer Douglas Parkhill published The Challenge of the Computer Utility, a book-length treatment of computing sold as a public service (see The Cloud Computing Era).

Multics

In 1964 MIT joined with Bell Labs and General Electric to build Multics (Multiplexed Information and Computing Service). ARPA funded MIT’s share, GE supplied the hardware, and the plan was a working system within a few years. The longer story of the project is told in The Multics Story.

Multics introduced or brought together ideas that are now standard:

  • Hierarchical file system: directories containing files and other directories, with path names
  • Virtual memory: a large address space backed by physical memory plus disk, managed by the operating system
  • Segmented addressing: programs addressed memory as named segments, which made sharing code and data between programs easy
  • Protection rings: privilege levels (rings 0 through 7) that kept system components apart, the predecessor of the kernel/user mode split in modern processors
  • Dynamic linking: programs loaded and linked shared library code at run time
  • Online reconfiguration: processors and memory could be added or removed while the system kept running, as a utility should
  • Mandatory access controls: formal security policies that governed who could read what

The practical difficulties matched the ambition. The system was written in PL/I, a language designed for both systems and application programming that proved awkward for both. The GE-645 hardware, first delivered to Project MAC in January 1967, was expensive and slow, and it topped out at 128K words of 36-bit core memory, around 576 kilobytes, at a time when core still cost cents per bit. The system that was supposed to run experimentally within two years was not in service until 1969.

Bell Labs withdrew from the project in 1969, frustrated by the delays and the cost. Among the Bell Labs researchers on Multics was Ken Thompson, who went on to write a much smaller system, Unix, on a PDP-7, borrowing the hierarchical file system and the shell from Multics and leaving most of the rest behind. Even the name was a pun on Multics. That story is in Ken Thompson and Unix.

Warning

Multics worked. Honeywell, which bought GE’s computer business in 1970, sold it commercially, and MIT ran Multics until 1988; the last installation, at the Canadian Department of National Defence in Halifax, Nova Scotia, was shut down on 30 October 2000. The failure was commercial and a matter of timing: the system was too expensive and too late to dominate the market it was designed for, and by the time it was ready, minicomputers and then personal computers were taking computing away from central utilities.

On Building Systems That Will Fail

Corbató received the ACM Turing Award in 1990 for “pioneering work organizing the principles and practical implementation of large-scale, time-shared computer systems.” He used the lecture for a subject most laureates avoid: failure. Its title was “On Building Systems That Will Fail,” published in Communications of the ACM in September 1991.

His subject was what he called “ambitious systems,” and he stated the thesis early: “ambitious systems never quite work as expected. Things usually go wrong, sometimes in dramatic ways.” The question to ask when designing one, he said, is not whether something will go wrong but when. His main example was CTSS itself, including the password file that became the message of the day.

He also listed sources of trouble that had nothing to do with his own projects. One was rapid change: “The computer field is intoxicated with change.” Another was the trade of redundancy for efficiency. Fiber optic cables were replacing copper in the telephone network because one fiber could carry the traffic of thousands of wires, and the network was becoming sparser and more vulnerable to single accidents. He cited a fire at a fiber switching center near Chicago that cut off a large number of customers for weeks, and a backhoe in New Jersey that shut down the New York financial exchanges for hours: “efficiency had gotten ahead of robustness.”

His list of remedies was short. Value simplicity and elegance, “for complexity has a way of compounding difficulties and as we have seen, creating mistakes.” Use metaphors that everyone understands, and constrained languages that cannot express irrelevant ideas. Play “what if” with both human error and hardware failure and build the contingency paths. Assume from the start that the system will have to be repaired. Cross-train the team so that nearly everyone knows more than they need to. He closed with the same advice in one line: “Don’t wonder if some mishap may happen, but rather ask what one will do about it when it does occur.”

The lecture was written when computer utilities were a historical curiosity. It reads differently now that office software, mail, and logins run as cloud services for millions of organizations at once (see Famous Software Disasters).

Password Problems

In a 2014 interview with the Wall Street Journal, Corbató looked back at the mechanism he had introduced on CTSS:

“Unfortunately, it’s become kind of a nightmare with the World Wide Web. I don’t think anybody can possibly remember all the passwords that are issued or set up. That leaves people to use trigger words, which is a very large security problem.”

A scheme designed for a few hundred users of one machine had become the default for billions of people with hundreds of accounts each. The history of what replaced, or failed to replace, it is in The History of Passwords and Authentication.

Final Years

Corbató died on 12 July 2019, at the age of ninety-three, as professor emeritus at MIT. The security ideas of Multics (mandatory access controls, protection rings, privilege separation) had by then come back into use, in processors, hypervisors, and phone operating systems, decades after the machine that introduced them had been switched off.

📚 Sources