“If I had asked my customers what they wanted, they would have said faster horses.”
—Henry Ford

Keykos is an object oriented capability system. It was developed at Tymshare beginning about 1975.

These are some miscellaneous notes on Keykos. The main online information that was at Agorics is now here. The University of Pennsylvania has perhaps all of the formally published material. The paper “The Structure of Authority: Why Security Is not a Separable Concern” is a good introduction to the goals of Keykos.

Keykos is more like Mach than any other well know system. It is substantially more capability oriented even than Mach however. Like Mach it is built to run on bare hardware. Keykos exposes more of the hardware architecture delivering function available from the hardware, that even Mach denies. EROS is a system that follows Keykos in many ways, and with interesting divergent tradeoffs. See the specs. CapROS and Coyotos succeed Eros. Recently seL not directly from Keykos has captured much attention by adopt a challenging security test with a real red team and passing it. Keykos is an ancestor of seL4.

There are two engineering philosophies behind the design of computers and computer languages:

Of course no one takes either of these two extreme positions, but the spectrum between the two positions is well populated.

KeyKos is very much from the first school here. Although it not a language in the classic sense it does determine how programs for the machine must be written. While a computer language prescribes all details of the syntax of a program, Keykos prescribes how the program communicates with programs and entities outside its address space. Each of the several languages that we adapted for Keykos allowed programs to communicate at this system level, so as to employ all system functions available via the capability discipline. Moreover, most of the languages could be used to define new sorts of Keykos objects.

The Keykos Architecture (pdf) is a dense but rather complete description of the system. It seems to require several readings to absorb. Here is an introduction and link to the closest thing to a defining document.

“The KeyKos Architecture” is a paper that appeared in the October 1985 Operating Systems Review. It is a high density introduction to the architecture of KeyKos.
Here is perhaps the most complete collection of papers about Keykos.
Here are yet more.
The Keykos programming manual is here.

Here are several attempts at Keykos introductions for computer scientists:

While Keykos was originally built for the IBM 370, the 390 Principles of Operation describe a later architecture that is compatible with the 370.

Nexus on Determinism

Some of my notes that bear on Keykos:

This page from the Web Archive has been useful in maintaining this web site.