This paper describes the motivation, architecture and performance of SPIN, an extensible operating system. SPIN provides an extension infrastructure together with a core set of extensible services that allow applications to safely change the operating system's interface and implementation. These changes can be specified with fine-granularity, allowing applications to achieve a desired level of performance and functionality from the system. Extensions are dynamically linked into the operating system kernel at application runtime, enabling them to access system services with low overhead. A capability-based protection model that relies on language and link-time mechanisms enables the system to inexpensively export fine-grained interfaces to system services. SPIN and its extensions are written in Modula-3 and run on DEC Alpha workstations.