Visible to the public The Ectokernel Approach: A Composition Paradigm for Building Evolvable Safety-critical Systems from Unsafe Components