A quick comparison of MIDP3 and OSGi

A number of times I heard the argument, that JSR-271 MIDP 3.0 provides a solution for everything that OSGi provides, maybe less elegantly, so JSR-232 is not needed. It had a been a while since I last read JSR-271, so now I took the time and read the Public Review version of the specification. So here I provide a brief comparison of the two specifications. I don't want to claim that OSGi is better or worse than MIDP 3. It would be comparing apples to peaches, they are meant for different purposes. I just want to prove, that OSGi does add value, even to MIDP 3, so it makes sense to use them together. And the added value is not only by providing more elegance.

Device Management

I mention Device Management only briefly, as this is clearly the apples to peaches category. A significant part of JSR-232 is dealing with operational management of the components throughout their complete lifecycle, from deployment to removal. I think operational management is a very important added value. It is easy to see that manageability of software assets is essential for enterprise applications, where the financial success of a company can directly depend on the proper operation of an applications. However, it is equally important for mobile operators to reduce their customer care costs and improve customer satisfaction. Just consider the recent release of Sprint Titan platform.

MIDP 3 on the other hand hardly contains anything related to management of the applications. The only exception is the over the air provisioning of MIDlets. So there is a lot of value to add here.

Component Platform

As remote management is so clearly out of the scope of MIDP 3, people were referring to the component model of the two platforms when they said that MIDP3 has everything that OSGi has.

In earlier releases, MIDlets used to be monolithic applications running in isolated silos. There was no interaction between MIDlets and it wasn't possible to share code either, well except by copying the classes from one version to the other. MIDP 3 introduced some new concept to improve in these ares:

• Liblets are class library like packages, which can be used to share code between MIDlet suites
• Inter Midlet Communication using a special ICM protocol
• Autostart MIDlets are MIDlets that the AMS must start when the device starts and restart if they fail.

These are the technologies that now form the "MIDP 3 component platform". Let's see how these realize some common characteristics of such platforms.

Encapsulation

One characteristic of a module system is encapsulation, the ability of a component to hide the specifics of its implementation and selectively export its internals. OSGi bundles can decide on Java package level which classes to make available for other components. Liblets are completely transparent, all resources in a Liblet are available for its clients. Additionally, the Liblet is executed in the namespace of the MIDlet using it - together with all other dependent Liblets as well - and it is the responsibility of the Liblet and MIDlet developers to avoid name collisions between these entities.

Dependency Management

In OSGi, the dependencies are expressed in terms of Java packages and their versions. The dependencies are resolved at runtime, the whole system is so dynamic that the components can be updated even at runtime, without breaking the operation of the platform.

MIDlet suites have to express their dependencies on Liblets in the MIDlet descriptor and manifest. During the installation, these dependencies are recursively resolved, and if the resolution succeeds, all required Liblets and the MIDlet suite will be installed.

OK, MIDP 3 is "less elegant" than OSGi. But it still handles dependencies, doesn't it? Well, there is a "small" difference between OSGi and MIDP 3 dependency model. As I said, OSGi uses package names and versions to express dependencies. MIDP 3 uses Liblet name, vendor name, version and the SHA-1 hash of the Liblet package as the means of expressing dependencies.

What does this mean? All dependencies refer to an exact compilation of a a particular Liblet, as sometime even a recompilation gives slightly different byte code, which results in a completely different hash value. So if you want to update a Liblet on a device, you have to update all Liblets and MIDlets that depend on it. Even if you corrected a small bug or just lost the binary copy of the earlier compilation.

So yes, literally speaking there is dependency handling, but the true purpose of managing dependencies - i.e. the ability to mix and match components while ensuring their proper interoperability - is completely lost, due to the rigid mechanism, which prevents any mixing.

Besides, this solution greatly reduces the value of Liblets in decomposition as well. You cannot change a Liblet individually. If there is a bug in a Liblet, you have to redeploy all dependent applications and Liblets to fix it.

Security Model

In OSGi, each bundle has its own associated permissions, its own protection domain. Bundles coming from a trusted source can obtain high privileges and expose services for less trusted components in a controlled manner. For example the permission to load native code should not be available for all components. But a component from trusted source can expose a native service to all other components by wrapping it with a Java interface. The clients of this interface will not need the permission to load any native code to use this service. This enables the creation of bundles that extend the platform with new services.

MIDP 3 Liblets are executed in the protection domain of their client MIDlets, which means that the code in the Liblet is executed with the exact same privileges as the host MIDlet. Therefore a Liblet cannot do anything that the host MIDlet could not do either.

Component Interactions

OSGi components interact via services. Services can be found via the central service registry, where any component can register its services. A service is then accessed via method simple calls and arbitrary data types can be used as parameters.

Apart from shared files or shared databases, MIDlets can interact via events. MIDP 3 defined an eventing mechanism, which allows MIDlets to publish and listen to events. An event can carry a single scalar or String value and an additional byte array as data.

I guess it's pretty clear which mechanism is more developer-friendly.

Summary

I have no problem with MIDP 3. Honestly! I do respect the work they did in the expert group and I understand how heavy burden the backwards compatibility requirement with MIDP 2.1 and CLDC was. I just wanted to point out that JSR-232 can add value, even to MIDP 3. And this value is not only marginal improvement of some existing features of MIDP 3. The means provided by MIDP 3 to decompose and manage complex applications are not suitable. JSR-232 can complement these weaknesses by its well-established component model and rich features in operational management.

A Comparision of OSGi and Android

Author's note: this article was originally posted to the ProSyst blog. I just publish it here as well, without changing the content.

Introduction

Google and the Open Handset Alliance announced the Android platform late last year. Shortly after that the Android SDK was published to the developer community and an exciting 10 million dollar developer challenge was announced too, which generated lots of developer interest. Due to this interest and the support of a number of industry players, Android is expected to gain significant market share in the future.

OSGi is a technology that has been developed for 10 years. Originally created to be the core platform of home gateways, slowly it was adapted in a number of verticals, including automotive industry or enterprise applications. In 2006, Release 4 of OSGi was published, which includes support for mobile phones and other handheld devices. Based on this technology, JSR-232 defines a dynamic, manageable component platform for mobile devices. Nokia eRCP platform, which is available for E90 and some other S60 3.1 devices, is based on JSR-232. The same technology is used by the Sprint Titan platform, for which devices will hit the market in 2008.

Both OSGi and Android define a development platform for component-based development and provide an implementation for the service-oriented architecture, within the mobile device. So, are they the same or completely different?

Admittedly, there are a number of similarities as well as some key differences. This article provides a high-level comparison of the two platforms, highlighting these key differences.

Comparison

Runtime Environment

Though somewhat external to the platforms, it worths to have a look at the runtime environments in which the two platforms are used.

OSGi can be used in a number of standard Java environments. It defines the minimum runtime requirements – so called Minimum Execution Environment – and any Java implementation that meets those requirements is sufficient to run OSGi. Minimum EE is a quite small API subset, which ensures that OSGi is usable in a wide variety of Java Runtimes, including JSE 1.1 or JME CDC1.0/FP1.0 as examples. This gives OSGi the required flexibility, which makes it applicable in a wide range of verticals from home automation to mobile devices. Frankly, OSGi extends a Java VM by introducing additional runtime execution environment features like the component model.

Android is an operating system with a new and proprietary application runtime technology. Though the applications are developed using the Java language, they are then compiled to a proprietary byte code format and are executed on the Dalvik Virtual Machine, a special VM created for Android. It is interesting to note that if converted to a Dalvik Executable, OSGi can be run on Android.

A key difference between the two platforms is that while Android applications are executed in separate instances of the DVM, OSGi executes all applications in the same JVM. Executing application in separate DVM instances – i.e. separate OS processes – has the advantage of easier resource management and resource reclamation, when applications need to be stopped forcefully. On the other hand, it requires more memory and communication between components is more complex and more expensive.

Component Model

Though both OSGi and Android are component platforms, there are a number of differences between their approaches. Probably the most important difference is the class-sharing ability of OSGi. Android components are executed in separate processes, which are fully isolated. It is not possible for a component to load a class from another one. This means that when a component uses the services of another component, all the service interfaces and parameter classes must be part of the client component as well, which creates a strong coupling between components and leads to unnecessary code duplication, which makes the maintenance very complicated. OSGi uses a classloader-based isolation model, which allows the components (bundles in OSGi terminology) to selectively export some of their internal packages to other bundles. Bundles can declare their package dependencies and the framework is responsible for matching the required and provided packages and make sure that the system is consistent. These mechanisms ensure that there’s no need to duplicate code among bundles and it helps to reduce the coupling of bundles and simplifies maintenance.

A related difference between the two models is component versioning. In OSGi, everything is versioned, while Android provides no support for versioning at all. Though at first glance, the extensive use of versioning may seem to be annoying in OSGi, the use of version numbers and version ranges enables the platform to very elaborately manage dependencies between components and thereby ensure that the whole system is in a consistent shape. This is extremely important for post-shipment maintenance of the platform.

Service Model

The key difference between the two platform’s service models is the service access. In OSGi, services are lightweight. They are accessed using direct method calls, they are easy and cheap to use. In Android, services are heavyweight. They are accessed using inter-process communication, which makes service access slower and more expensive. This leads to a different style of using services. In OSGi, services are used extensively and they play a very important role in keeping components lightweight and loosely coupled. In Android, services are coarse grained and will likely be used much less frequently. While in OSGi services can be used as plugins to other applications, in Android they are closer to the traditional web service model.

Application Model

Android defines its own application model. Applications can be constructed from components of four types. Activities are components, which interact with the device user. Services are background execution tasks. Content Providers are data stores and Intent Listeners are event handlers for system-wide events.

OSGi is application model agnostic. It defines a component model, where components – bundles – have a lifecycle, but it doesn’t define a concrete application model. Rather, it can host a number of application model. Eclipse Foundation defined (embedded) Rich Client Platform, an application model based on OSGi bundles. JSR-232 defines the Foreign Application Model, which allows OSGi to host any existing application model. This is particularly interesting in the light of the next wave of mobile application fragmentation. The number of open mobile application platforms grows rapidly. A variety of different Linux systems (LiMO, Qt, etc.) and Java platforms (Android, JavaFx, CDC Java) add to the well known “oldies” like MIDP, S60 and Win Mobile. How could a carrier or an enterprise ever support such a fleet? OSGi is one answer – pick the application model you like and run it on any platform!

Manageability

One of the key requirements for mobile devices – especially in the smart-phone segment – is remote manageability (often also referred to as MDM, Mobile Device Management). MDM includes device configuration, application deployment and maintenance, status monitoring, data backup and replication services. While device complexity, use cases and volumes increase, the ability to remotely manage devices becomes vital for mobile operators and enterprises. JSR-232 defines a mobile service platform, which is designed from the ground up to support device management. As a result, a device administrator is in full control of all components running on the device, he can monitor and control all aspects of the device without requiring the application developer to deal with this complexity. Device management is not visible in Android. Presumably, it is left up to OEMs and operators to take care of. Though a platform should make MDM as transparent to developers as possible, still there are some aspects developers are concerned with:

• Versioning – it is a simple feature but it’s the key for manageability. Without versioning support, it is impossible to manage updates and dependencies.
• Management-related APIs – though some basic APIs (configuration, logging) are present, there are a number of APIs missing, like deployment, lifecycle management or monitoring.

How can enterprises update their Android devices with a newer application version?

Standards

An important difference between the two platforms is their grounding on standards. OSGi is a standard that has been developed for ten years and reached a high level of maturity. It has been adopted by a number of JSR in JCP and there are number of independent commercial and open source implementations, optimized for different fields of use. In addition, the OSGi Alliance has very strong backwards compatibility requirements.

Android is an open source initiative, where APIs are defined by the implementation itself, which is currently managed by a single company. Though this approach is a lot more flexible, the lack of a specification standard, the lack of backwards compatibility and the lack of acceptance tests bear significant fragmentation risks to the community. How does Android look like tomorrow?

Does Open Mean Undefined?

The biggest challenge of comparing Android to another platform is the large number of open questions. Android so far published the SDK for application developers, which focuses on the areas that Google thinks are of developers’ concern. As long as you want to develop simple end user applications, you probably have what you need. But if you happen to develop a complex application package, maybe an enterprise application or an application suite, where security, deployment, configuration and other management functions are important, you realize that all these are left open i.e. the platform doesn’t specify them and you have to build your application on assumptions. Cross-implementation compatibility of Android will be an interesting topic to observe.

Conclusion

The two platforms give very different solutions for the same question. Process-based isolation model in Android is an advantage in resource management on the other hand the lack of class-sharing ability seriously limits the sharing of components and makes platform management very difficult. The lack of versioning and lack of management APIs is a further limitation. Presumably, OEMs will provide some solutions for these important requirements; however those will be proprietary and will lead to fragmentation of the platform. The lack of standard and acceptance testing also increase the fragmentation risk. Though Android has some promising features, there seems to be a long way to go to reach maturity.