Fischer

's

Protocol

in

Timed

Process

Algebra

Jan

Joris

Vereijken

Department

of

Computing

Science

Eindhoven

University

of

Technology

P.O.

Box

MB

Eindhoven

The

Netherlands

email

janjoris@acm.org

August

Abstract

Timed

algebraic

process

theories

can

be

developed

with

quite

different

purposes

in

mind

One

can

aim

for

theoretical

results

about

the

theory

itself

-LRB-

completeness

expressiveness

decidability

-RRB-

or

one

can

aim

for

practical

applicability

to

non-trivial

protocols

Unfortunately

these

aims

do

not

go

well

together

In

this

paper

we

take

two

theories

which

are

probably

of

the

first

kind

and

try

to

find

out

how

well

suited

they

are

for

practical

verifications

We

verify

Fischer

's

protocol

for

mutual

exclusion

in

the

settings

of

discrete-time

process

algebra

-LRB-

ACPdt

-RRB-

and

real-time

process

algebra

-LRB-

ACPur

-RRB-

We

do

this

by

transforming

the

recursive

specification

into

an

equivalent

linear

specification

and

then

dividing

out

the

maximal

bisimulation

relation

The

required

mutual

exclusion

result

can

then

be

found

by

reasoning

about

the

obtained

process

graph

Finally

we

consider

the

ease

of

the

verification

and

ways

to

adapt

the

theory

to

make

it

more

practical

It

will

turn

out

that

the

theories

investigated

are

quite

unsatisfactory

when

verifying

real-life

protocols

Mathematics

Subject

Classification

CR

Categories

D.

D.

D.

F.

F.

Note

These

investigations

were

supported

by

the

Netherlands

Computer

Science

Research

Foundation

-LRB-

SION

-RRB-

with

financial

support

from

the

Netherlands

Organisation

for

Scientific

Research

-LRB-

NWO

-RRB-

Contents

Introduction

Fischer

's

protocol

History

of

the

protocol

Proof

requirements

First

informal

description

Second

informal

description

A

verification

using

discrete-time

ACP

A

short

note

on

ACPdt

Abstraction

in

ACPdt

Fischer

's

protocol

formalized

in

ACPdt

The

correctness

of

FPdt

A

verification

using

real-time

ACP

A

short

note

on

ACPur

Abstraction

operators

on

ACPur

Expansion

theorems

for

ACPur

Fischer

's

protocol

formalized

in

ACPur

The

correctness

of

FPur

Conclusions

A

The

linearization

of

FPdt

A.

Methodology

A.

The

obtained

linear

system

B

The

linearization

of

FPur

B.

Methodology

B.

The

obtained

linear

system

Acknowledgments

Bibliography

Introduction

In

the

past

decade

a

lot

of

research

has

been

done

on

algebraic

process

theories

the

three

most

prominent

ones

being

CCS

-LSB-

-RSB-

CSP

-LSB-

-RSB-

and

ACP

-LSB-

-RSB-

Although

these

theories

are

well

established

in

their

untimed

version

there

is

no

consensus

regarding

versions

of

CCS

CSP

and

ACP

extended

with

time

Admitted

there

have

been

many

proposals

some

of

them

quite

successful

But

most

of

these

timed

theories

were

geared

towards

theoretical

results

As

a

consequence

a

lot

of

papers

have

been

published

regarding

completeness

results

expressivity

results

decidability

results

and

so

on

but

almost

no

paper

-LRB-

one

exception

is

-LSB-

-RSB-

-RRB-

gives

an

actual

verification

of

a

real

system

not

even

a

toy

system

In

this

paper

we

will

present

such

a

more-or-less

real

system

namely

Fischer

's

protocol

for

mutual

exclusion

-LSB-

-RSB-

We

will

try

to

prove

the

correctness

of

this

protocol

which

relies

heavily

on

time

aspects

using

two

timed

ACP

theories

First

we

do

a

verification

in

a

setting

of

discrete

time

using

the

theory

ACPdt

devised

by

Baeten

and

Bergstra

-LSB-

-RSB-

Secondly

a

verification

is

done

in

a

setting

of

dense

time

using

the

theory

ACPur

This

theory

was

devised

by

Klusener

-LSB-

-RSB-

and

is

closely

related

to

ACPae

the

standard

real-time

extension

of

ACP

by

Baeten

and

Bergstra

-LSB-

-RSB-

The

whole

point

of

this

exercise

lies

in

the

following

two

questions

First

How

well

suited

are

the

current

timed

extensions

of

ACP

to

verify

real-life

systems

and

secondly

With

real-life

verifications

in

mind

what

modifications

to

the

theory

are

desirable

Fischer

's

protocol

In

this

section

we

give

a

short

history

of

Fischer

's

protocol

and

discuss

the

proof

requirements

After

that

an

informal

description

of

the

protocol

is

given

together

with

an

informal

correctness

argument

History

of

the

protocol

The

protocol

we

examine

is

a

mutual

exclusion

protocol

first

proposed

by

Fischer

-LSB-

-RSB-

and

later

studied

in

-LSB-

-RSB-

of

these

studies

uses

process

algebra

to

prove

correctness

they

all

rely

on

some

form

of

temporal

logic

or

Floyd-Hoare

logic

Instead

of

using

atomic

test-and-set

instructions

or

semaphores

as

is

nowadays

often

done

to

assure

mutual

exclusion

Fischer

's

protocol

only

assumes

atomic

reads

and

writes

to

a

shared

variable

-LRB-

when

the

first

mutual

exclusion

protocols

were

developed

in

the

late

all

exclusion

protocols

were

of

the

shared

variable

kind

-LSB-

-RSB-

later

on

researchers

have

more

concentrated

on

the

semaphore

kind

of

protocol

-RRB-

Mutual

exclusion

in

Fischer

's

Protocol

is

guaranteed

by

carefully

placing

bounds

on

the

execution

times

of

the

instructions

leading

to

a

protocol

which

is

very

simple

and

relies

heavily

on

time

aspects

This

makes

it

an

ideal

candidate

for

the

purpose

we

have

in

mind

namely

to

try

to

verify

-LRB-

using

process

algebra

-RRB-

a

not

too

difficult

protocol

which

still

has

quite

intricate

timing

aspects

Proof

requirements

What

does

one

need

to

prove

in

the

case

of

a

mutual

exclusion

protocol

Strange

as

is

it

may

seem

this

is

not

all

that

clear

In

the

literature

one

sees

requirements

like

ffl

The

actual

property

of

mutual

exclusion

only

one

component

may

be

in

its

critical

section

at

any

time

ffl

Symmetry

between

the

components

ffl

No

assumptions

about

the

execution

times

of

statements

-LRB-

obviously

not

satisfied

in

our

case

-RRB-

ffl

Liveness

there

should

always

be

some

process

that

is

able

to

proceed

ffl

No

starvation

it

may

not

be

that

a

component

is

permanently

prohibited

from

entering

its

critical

section

ffl

Various

kinds

of

fairness

a

component

should

get

its

fair

share

-LRB-

in

various

senses

-RRB-

of

being

allowed

to

proceed

into

its

critical

section

ffl

Loosely

connectedness

when

one

component

deadlocks

-LRB-

outside

its

critical

section

-RRB-

this

should

not

affect

the

progress

of

the

other

components

ffl

Minimal

overhead

the

protocol

should

make

a

decision

as

soon

it

has

enough

information

to

do

so

and

even

more

requirements

Some

of

these

requirements

are

related

-LRB-

for

example

symmetry

guarantees

most

kinds

of

fairness

-RRB-

and

each

paper

about

mutual

exclusion

seems

to

have

its

own

favorite

subset

of

which

ones

to

prove

In

the

case

of

Fischer

's

protocol

we

choose

mostly

following

the

earliest

paper

on

mutual

exclusion

-LSB-

-RSB-

to

prove

the

following

three

properties

ffl

Actual

mutual

exclusion

between

the

two

critical

sections

ffl

Symmetry

between

the

two

components

ffl

No

starvation

We

will

not

try

to

formalize

these

properties

algebraically

as

they

do

not

lend

themselves

easily

to

this

This

is

more

due

to

the

shortcomings

of

the

-LRB-

current

-RRB-

algebraic

approach

than

it

is

to

unwillingness

on

our

part

note

for

example

that

the

above

properties

can

indeed

be

very

easily

formalized

using

temporal

logic

We

will

return

to

this

subject

in

our

conclusions

First

informal

description

We

will

now

describe

the

protocol

in

an

informal

way

giving

an

informal

correctness

argument

Assume

the

existence

of

a

shared

variable

x

to

which

atomic

reads

and

writes

are

possible

Initially

x

equals

zero

In

Figure

we

give

Fischer

's

protocol

expressed

in

pseudo-PASCAL

There

are

two

components

running

in

parallel

The

angle

brackets

-LRB-

h

i

-RRB-

denote

atomicity

Component

Component

repeat

repeat

repeat

repeat

await

hx

i

await

hx

i

hx

hx

hdelayi

hdelayi

until

hx

until

hx

critical

section

critical

section

hx

i

hx

i

until

false

until

false

Figure

Fischer

's

protocol

first

informal

version

The

protocol

proceeds

as

follows

Initially

the

value

of

the

shared

variable

is

When

component

observes

that

x

is

it

will

write

the

value

to

x

After

that

it

waits

for

some

time

and

if

x

then

still

has

the

value

it

is

safe

to

enter

the

critical

section

Component

works

in

a

similar

way

-LRB-

using

instead

of

-RRB-

and

both

components

run

in

parallel

The

mutual

exclusion

property

of

the

protocol

is

based

on

the

following

observation

The

delay

operation

causes

component

to

wait

sufficiently

long

so

that

if

component

had

read

the

value

of

x

in

its

await

statement

before

the

component

executed

its

x

assignment

then

component

will

have

completed

the

following

x

statement

Therefore

it

can

never

happen

that

component

falls

through

its

until

statement

entering

critical

section

while

component

is

still

about

to

execute

its

x

assignment

This

guarantees

mutual

exclusion

By

symmetry

the

argument

also

holds

the

other

way

around

Second

informal

description

Let

us

try

to

make

the

reasoning

from

the

previous

section

a

bit

more

solid

by

exactly

indicating

the

possible

durations

of

the

statements

First

of

all

the

await

statement

may

take

anywhere

between

and

time

units

after

x

becomes

The

assignments

x

i

are

supposed

to

take

between

a

and

time

units

and

the

delay

statements

between

d

and

time

units

for

fixed

non-negative

values

a

and

d

over

some

totally-ordered

time

domain

Furthermore

assume

that

d

i.e.

the

delay

always

takes

longer

than

an

assignment

For

simplicity

sake

the

read

actions

x

i

are

supposed

to

take

time

units

and

the

critical

section

may

take

any

time

including

time

units

Writing

for

an

atomic

action

that

happens

between

t

and

time

units

after

it

has

been

enabled

we

arrive

at

the

protocol

of

Figure

Component

Component

repeat

repeat

repeat

repeat

await

hx

await

hx

hx

hx

until

hx

until

hx

critical

section

critical

section

hx

hx

until

false

until

false

Figure

Fischer

's

protocol

second

informal

version

Remember

we

assumed

that

a

d

Now

we

have

that

if

component

falls

through

its

await

statement

it

will

complete

its

x

assignment

within

at

most

time

units

If

component

would

have

happened

to

complete

its

x

assignment

just

after

component

fell

through

its

await

it

will

take

component

at

least

d

time

units

to

complete

its

delay

As

d

when

component

reaches

the

until

hx

statement

component

will

have

completed

its

x

assignment

Therefore

the

value

of

x

has

stabilized

and

component

can

safely

enter

its

critical

section

As

a

final

remark

note

that

Fischer

's

protocol

can

be

trivially

generalized

to

any

number

n

of

components

This

generalization

however

we

will

not

examine

A

verification

using

discrete-time

ACP

In

this

section

we

will

prove

the

correctness

of

the

protocol

of

Figure

on

the

preceding

page

for

the

special

case

where

a

and

d

We

will

use

-LRB-

a

subset

of

-RRB-

the

discrete-time

process

algebra

ACPdt

as

described

in

-LSB-

-RSB-

This

is

the

simplest

special

case

one

can

imagine

The

resulting

proof

provides

a

clear

illustration

of

all

key

issues

without

becoming

too

cluttered

with

technicalities

A

short

note

on

ACPdt

First

we

briefly

describe

the

essential

extensions

that

ACPdt

has

to

model

time

Intuitively

ACPdt

is

very

much

like

plain

ACP

-LSB-

-RSB-

with

the

exception

that

a

process

may

have

the

ability

to

let

time

pass

for

one

time

unit

If

in

an

ACPdt

process

some

component

still

wants

to

do

an

action

it

can

and

no

time

passes

If

however

all

components

agree

to

let

time

pass

one

unit

of

time

will

pass

-LRB-

in

other

words

the

current

time

slice

ends

or

the

clock

ticks

-RRB-

This

willingness

to

let

time

pass

is

expressed

with

the

discrete

time

unit

delay

operator

oed

The

expression

oed?X

denotes

the

process

that

can

do

no

action

anymore

in

the

current

time

slice

but

has

the

ability

to

let

time

pass

for

one

time

unit

If

that

unit

of

time

finally

happens

-LRB-

time

does

not

really

pass

in

a

discrete

setting

it

just

happens

-RRB-

the

process

oed?X

turns

into

the

process

X

This

is

denoted

by

oed?X

oe

X

as

if

oe

were

a

special

action

denoting

a

tick

of

the

clock

In

Table

the

operational

semantics

of

BPAdt

is

given

BPAdt

is

the

subset

of

ACPdt

that

only

has

and

oed

as

operators

For

the

full

axiomatization

and

semantics

of

ACPdt

see

-LSB-

-RSB-

Besides

the

oed

operator

we

will

only

use

one

more

special

operator

a

a

p

x

a

x

y

a

y

x

a

p

x

y

a

y

x

a

x

y

a

y

x

a

x

a

p

x

y

a

p

y

x

a

p

oed?x

oe

x

x

oe

x

y

oe

y

x

oe

y

oe

x

y

oe

x

oe

y

x

y

oe

y

x

oe

Table

Operational

semantics

of

BPAdt

from

ACPdt

namely

the

unbounded

start

delay

of

a

process

X

denoted

by

bXc

The

expression

bXc

is

the

process

that

can

do

exactly

the

same

things

that

X

can

and

it

is

also

always

willing

to

let

time

pass

This

is

shown

in

the

operational

semantics

in

Table

x

a

bxc

a

x

a

p

bxc

a

p

bxc

oe

bxc

Table

Operational

semantics

of

the

unbounded

start

delay

Abstraction

in

ACPdt

Abstraction

from

internal

actions

in

ACPdt

is

defined

as

expected

It

is

axiomized

as

shown

in

Table

If

A

denotes

the

set

of

all

possible

actions

we

have

that

I

A

a

A

-LSB-

fffi

og

and

oe

AE

A

The

variables

x

and

y

denote

processes

oI?a

a

if

a

AE

I

oI?a

o

if

a

I

oI?x

y

oI?x

oI?y

oI?x

y

oI?x

oI?y

oI?oed?x

oed?oI?x

Table

Axioms

for

the

abstraction

operator

oI

in

ACPdt

There

exists

an

operator

ooe

that

abstracts

from

time

steps

but

we

do

not

describe

it

here

because

we

will

not

need

it

The

non-consecutive

numbering

of

the

axioms

is

due

to

historical

reasons

Fischer

's

protocol

formalized

in

ACPdt

Having

introduced

the

relevant

operators

for

ACPdt

we

are

now

ready

to

give

a

formal

specification

of

Fischer

's

protocol

FPdt

using

ACPdt

in

Figure

on

the

following

page

As

said

before

we

specify

the

special

case

where

a

and

d

This

specification

can

be

understood

intuitively

in

the

following

way

There

are

three

processes

running

concurrently

namely

A

B

and

V

The

processes

A

and

B

model?Component

and

Component

of

Figure

respectively

and

the

process

V

models

the

variable

x

The

process

V

can

be

in

one

of

three

states

or

corresponding

to

the

possible

values

of

x

In

any

state

Vi

V

is

capable

of

sending

the

message

x

i

signaling

that

the

value

of

x

is

currently

i

after

which

V

will

continue

in

state

Vi

Furthermore

V

is

in

any

state

Vi

capable

of

receiving

the

message

x

j

for

any

j

indicating

that

x

is

being

assigned

with

the

value

j

After

such

an

assignment

V

will

continue

in

state

Vj

Finally

V

is

always

capable

of

letting

time

pass

The

process

V

constructed

in

this

way

behaves

as

a

variable

server

if

process

A

or

B

wants

to

assign

a

value

i

to

x

it

performs

the

action

A

br?x

c

s?x

r?x

r?x

r?x

s?x

B

br?x

c

s?x

r?x

r?x

r?x

s?x

V

r?x

s?x

r?x

r?x

r?x

s?x

r?x

r?x

r?x

s?x

r?x

r?x

fl?r?ff

s?ff

c?ff

for

f

x

i

x

i

j

i

g

H

f

r?ff

s?ff

j

f

x

i

x

i

j

i

g

g

FPdt

@H

A

k

B

k

V

Figure

Fischer

's

protocol

in

discrete

time

-LRB-

ACPdt

-RRB-

s?x

i

If

it

wants

to

check

if

x

has

the

value

i

it

performs

the

action

r?x

i

-LRB-

The

idea

to

construct

the

variable

server

in

this

way

was

taken

from

-LSB-

-RSB-

-RRB-

The

process

A

is

constructed

as

follows

First

-LRB-

in

state

-RRB-

it

waits

for

an

undetermined

amount

of

time

till

x

is

-LRB-

br?x

c

-RRB-

Then

-LRB-

in

state

-RRB-

it

sets

x

to

-LRB-

s?x

-RRB-

After

that

-LRB-

in

state

-RRB-

it

waits

till

the

end

of

the

time

slice

-LRB-

-RRB-

When

it

has

arrived

in

state

it

will

examine

the

contents

of

x

and

either

jump

back

to

-LRB-

if

x

or

x

-RRB-

or

continue

with

state

-LRB-

if

x

-RRB-

Thereafter

it

enters

its

critical

section

leaves

it

again

and

resets

x

back

to

in

state

after

which

it

repeats

the

whole

procedure

over

again

The

process

B

is

constructed

in

the

same

way

as

A

is

The

entire

protocol

FPdt

now

consists

of

the

processes

A

B

and

V

running

concurrently

Note

that

the

assignment

takes

no

time

-LRB-

a

-RRB-

and

the

delay

takes

one

time

unit

-LRB-

d

-RRB-

The

correctness

of

FPdt

In

order

to

prove

the

protocol

FPdt

correct

we

first

rewrite

the

recursive

equations

of

Figure

into

an

equivalent

linear

system

of

equations

-LRB-

i.e.

one

that

does

not

contain

the

operators

k

@H

or

oI

anymore

-RRB-

We

arrive

at

the

system

of

equations

given

in

Appendix

A

-LRB-

where

also

the

details

of

the

linearization

are

given

-RRB-

Using

this

linear

system

we

then

construct

the

process

graph

of

FPdt

given

in

Figure

on

the

next

page

-LRB-

Note

that

all

c

edges

remain

unlabelled

as

labelling

them

would

obscure

the

picture

and

that

is

abbreviated

to

The

other

Enter

and

Leave

actions

are

abbreviated

in

a

similar

way

-RRB-

oe

oe

oe

oe

oe

Figure

The

process

graph

of

FPdt

Now

define

the

set

I

of

internal

actions

as

I

f

c?ff

j

f

x

i

x

i

j

i

g

g

-LRB-

i.e.

all

communication

actions

-RRB-

and

rename

these

actions

into

o

yielding

the

process

graph

of

oI?FPdt

On

this

graph

we

compute

the

maximal

rooted

branching

auto

bisimulation

which

gives

us

the

equivalence

classes

XA

XH

given

below

XA

XE

XB

XF

XC

XG

XD

XH

When

we

divide

out

this

equivalence

relation

we

arrive

at

the

reduced

process

graph

given

in

Figure

On

this

graph

we

will

now

be

able

to

check

all

required

properties

very

easily

XB

XC

XD

XE

XH

XF

XG

XA

oe

oe

oe

Figure

The

reduced

process

graph

of

oI?FPdt

The

three

requirements

for

mutual

exclusion

we

chose

in

Section

are

satisfied

for

the

following

reasons

ffl

Actual

mutual

exclusion

It

can

be

easily

seen

from

the

graph

of

Figure

that

an

action

is

always

immediately

followed

by

a

action

and

the

same

holds

for

and

Therefore

it

can

not

be

the

case

that

both

components

are

in

their

critical

section

at

the

same

time

ffl

Symmetry

As

the

graph

is

symmetrical

with

respect

to

the

paths

from

the

root

through

the

critical

sections

of

the

components

back

to

the

root

it

is

clear

that

the

the

protocol

is

symmetrical

with

respect

to

the

components

ffl

No

starvation

Whichever

state

the

protocol

is

in

there

is

always

a

path

leading

to

each

component

's

critical

section

Therefore

using

fairness

it

can

not

be

the

case

that

one

component

is

permanently

prohibited

from

entering

its

critical

section

This

completes

the

proof

of

the

correctness

of

FPdt

A

verification

using

real-time

ACP

In

this

section

we

will

prove

the

correctness

of

the

protocol

of

Figure

for

the

almost

completely

general

case

where

a

d

-LRB-

this

is

only

a

very

minor

restriction

of

the

general

case

but

it

reduces

the

state-space

significantly

-RRB-

We

will

use

-LRB-

a

subset

of

-RRB-

the

real-time

process

algebra

ACPur

-LRB-

ACP

with

urgent

actions

and

relative

time

-RRB-

as

described

in

-LSB-

-RSB-

A

short

note

on

ACPur

Again

we

briefly

describe

the

essential

extensions

that

ACPur

has

to

model

time

To

begin

with

every

action

is

postfixed

with

a

non-negative

real

number

between

square

brackets

One

could

have

for

example

a

meaning

the

process

that

performs

the

action

a

at

exactly

time

units

from

now

If

the

parameter

is

e.g.

a

it

means

execute

the

action

immediately

Sequential

composition

and

the

choice

operator

behave

as

expected

So

for

example

the

process

a

b

started

at

time

does

a

at

time

and

b

at

time

The

process

a

b

started

at

time

can

either

do

a

at

time

or

b

at

time

if

at

any

moment

after

the

action

a

has

not

been

observed

one

knows

that

the

choice

has

been

made

for

b

at

time

While

this

is

all

very

intuitive

the

exact

semantics

of

ACPur

is

still

quite

intricate

and

we

will

make

no

attempt

at

making

it

formal

here

Please

see

-LSB-

-RSB-

and

-LSB-

-RSB-

The

single

most

important

construct

in

ACPur

is

the

integral

construct

It

is

a

generalized

sum

over

an

interval

of

time

For

example

R

a?v

denotes

the

process

that

can

do

the

action

a

at

any

time

between

and

time

units

from

now

inclusively

The

upper

bound

may

be

infinity

R

a

denotes

the

process

that

can

do

a

once

at

some

time

including

right

now

and

all

moments

arbitrarily

far

into

the

future

-LRB-

Please

note

that

the

integral

construct

as

described

here

is

a

rather

crude

simplification

of

the

one

given

by

Klusener

This

simplified

one

however

is

all

we

need

-RRB-

For

the

special

cases

where

for

an

integral

R

qv?p

P?v

we

do

not

have

p

q

we

will

use

the

convention

that

Z

q

v?p

P?v

R

qv

P?v

if

p

and

q

ffi

if

q

or

p

q

This

means

that

every

integral

can

be

written

in

a

normal

form

in

the

following

way

Z

q

v?p

P?v

q

and

p

q

Z

q

v?max

;p

P?v

Here

is

used

to

form

a

so

called

guarded

command

For

a

boolean

expression

OE

and

a

process

P

the

guarded

command

is

defined

dependent

on

the

current

valuation

V

of

the

free

variables

as

OE

P

P

if

OE

true?V

ffi

otherwise

This

normal

form

for

integrals

will

be

called

guard-prefixed

normal

form

The

usefulness

of

this

normal

form

lies

in

the

fact

that

is

immediate

clear

from

the

guard

expression

whether

or

not

the

integral

is

empty

This

will

be

important

when

defining

abstraction

operators

Abstraction

operators

on

ACPur

We

define

two

abstraction

operators

First

a

general

abstraction

operator

oI

ACPur

ACPur

that

renames

actions

in

I

into

o-actions

and

secondly

a

time

abstraction

operator

ot

ACPur

ACP

that

transforms

a

-LRB-

timed

-RRB-

ACPur-term

into

an

-LRB-

untimed

-RRB-

ACP-term

by

throwing

away

all

timing

information

The

general

abstraction

operator

is

axiomized

as

shown

in

Table

We

have

that

I

A

a

A

-LSB-

fffi

og

v

R

and

OE

a

boolean

expression

that

may

contain

free

variables

The

variables

x

and

y

denote

processes

oI?a?v

a?v

if

a

AE

I

oI?a?v

o?v

if

a

I

oI?x

y

oI?x

oI?y

oI?x

y

oI?x

oI?y

oI?OE

x

OE

oI?x

Table

Axioms

for

the

general

abstraction

operator

oI

in

ACPur

The

time

abstraction

operator

is

axiomized

as

shown

in

Table

We

have

that

a

A

-LSB-

fffi

og

OE

a

boolean

expression

that

may

contain

free

variables

and

p

q

v

R

with

p

q

The

variables

x

and

y

denote

processes

and

FV?x

stands

for

the

set

of

all

free

variables

x

contains

ot?a?v

a

ot?x

y

ot?x

ot?y

ot?x

y

ot?x

ot?y

ot?R

qv?p

a?v

a

ot?R

qv?p

a?v

x

a

ot?x

if

v

AE

FV?x

ot?R

qv?p

a?v

x

a

ot?R

qv?p

x

if

v

FV?x

ot?OE

x

ot?x

if

OE

true?V

Table

Axioms

for

the

time

abstraction

operator

ot

in

ACPur

Axiom

where

V

denotes

a

valuation

of

the

free

variables

is

formulated

this

way

because

we

do

not

want

that

ot?OE

x

would

equal

ot?x

if

there

is

no

way

to

satisfy

OE

On

the

other

hand

we

want

that

ot?OE

x

does

equal

ot?x

if

OE

can

be

satisfied

by

some

valuation

of

the

free

variables

even

if

there

are

other

valuations

that

do

not

satisfy

OE

Expansion

theorems

for

ACPur

Before

we

are

able

to

do

the

actual

verification

we

first

need

to

have

an

expansion

theorem

which

becomes

quite

intricate

as

real

time

gets

involved

We

start

by

giving

a

version

that

assumes

there

is

no

communication

at

all

The

expansion

theorem

for

ACPur

-LRB-

without

communication

-RRB-

k

i

n

Z

qi

vi?pi

ai?vi

Pi?vi

X

i

n

Z

minfqj

j

j

n

g

vi?pi

ai?vi

BB@Pi?vi?

k

k

j

n

j?i

Z

qj?vi

vj?pj?vi

aj?vj

Pj?vj

CCA

This

theorem

can

be

understood

in

the

following

way

We

have

n

processes

of

the

form

R

qivi

pi

ai?vi

Pi?vi

running

in

parallel

where

ai

is

an

action

and

Pi?vi

is

an

arbitrary

process

expression

in

vi

The

action

ai

is

enabled

in

the

interval

pi

qi

from

the

start

of

the

process

How

does

this

big

merge

of

n

processes

expand

Obviously

the

first

thing

that

is

going

to

happen

is

some

action

ai

so

we

sum

over

all

those

At

what

time

can

this

action

happen

No

earlier

than

the

time

when

it

gets

enabled

but

also

not

later

than

the

minimum

of

the

latest

times

of

all

other

actions

This

explains

the

bounds

pi

and

min

qj

j

n

on

the

integral

preceeding

ai

What

remains

is

Pi?vi

running

in

parallel

with

the

other

components

albeit

that

vi

time

units

have

passed

hence

the

pj

vi

and

qj

vi

bounds

on

the

inner

integrals

To

make

this

somewhat

clearer

we

give

the

special

case

where

n

Z

q

v?p

a?v

P?v

k

Z

s

w?r

b?w

Q?w

Z

min?q

s

v?p

a?v

P?v

k

Z

s?v

w?r?v

b?w

Q?w

Z

min?q

s

w?r

b?w

Z

q?w

v?p?w

a?v

P?v

k

Q?w

When

we

allow

handshaking

-LRB-

communication

with

the

restriction

that

ajbjc

is

always

ffi

for

all

actions

a

b

and

c

-RRB-

we

arrive

at

the

following

theorem

The

expansion

theorem

for

ACPur

-LRB-

with

handshaking

-RRB-

k

i

n

Z

qi

vi?pi

ai?vi

Pi?vi

X

i

n

Z

minfqj

j

j

n

g

vi?pi

ai?vi

BB@Pi?vi?

k

k

j

n

j?i

Z

qj?vi

vj

pj?vi

aj?vj

Pj?vj

CCA

X

i

j

n

Z

minfqj

j

j

n

g

v?max?pi

pj

ai

j

aj

v

BB@Pi?v?

k

Pj?v

k

k

k

n

k?i

k?j

Z

qk?v

vk?pk?v

ak?vk

Pk?vk

CCA

This

theorem

can

be

understood

in

much

the

same

way

as

the

previous

one

although

this

time

there

are

extra

summands

corresponding

to

all

possible

-LRB-

necessarily

two-way

-RRB-

communications

At

what

time

can

such

a

communication

ai

j

aj

take

place

The

first

possible

time

is

when

both

ai

and

aj

are

enabled

so

we

get

max?pi

pj

as

the

lower

bound

of

the

integral

The

upper

bound

is

min

qj

j

n

just

as

it

was

in

the

previous

theorem

Here

the

special

case

for

n

is

as

follows

Z

q

v?p

a?v

P?v

k

Z

s

w?r

b?w

Q?w

Z

min?q

s

v?p

a?v

P?v

k

Z

s?v

w?r?v

b?w

Q?w

Z

min?q

s

w?r

b?w

Z

q?w

v?p?w

a?v

P?v

k

Q?w

Z

min?q

s

u?max?p

r

a

j

b

u

P?u

k

Q?u

We

will

not

give

proofs

for

the

above

theorems

as

that

would

go

beyond

the

scope

of

the

paper

-LRB-

Our

goal

is

to

find

out

which

problems

arise

when

applying

existing

theories

and

consequently

which

adaptions

to

these

theories

are

desirable

It

is

not

our

goal

to

prove

theorems

in

these

theories

-RRB-

Fischer

's

protocol

formalized

in

ACPur

We

are

now

ready

to

give

a

formally

specified

implementation

of

Fischer

's

protocol

FPur

using

ACPur

in

Figure

on

the

next

page

The

protocol

FPur

consists

just

like

in

the

discrete-time

case

of

three

concurrent

processes

A

B

and

V

The

process

V

models

the

variable

x

in

such

a

way

that

assignments

and

reads

can

take

place

at

any

moment

The

process

A

is

also

constructed

much

the

same

as

in

discrete

time

the

only

difference

being

the

execution

time

interval

bounds

on

all

actions

In

state

we

do

a

R

r?x

v

meaning

that

we

will

wait

at

least

till

x

is

but

possibly

longer

After

that

by

performing

R

v?a

s?x

v

we

assign

the

value

to

x

somewhere

within

the

interval

a

and

so

on

The

values

a

d

and

are

positive

constants

such

that

a

d

Note

that

this

time

the

delay

actions

are

explicit

modelled

and

The

correctness

of

FPur

Using

the

material

from

Sections

and

we

are

now

able

to

rewrite

the

specification

for

FPur

in

Figure

into

an

equivalent

linear

system

of

equations

The

way

to

do

this

however

is

far

more

complex

than

it

was

in

the

case

of

FPdt

see

Appendix

B

for

full

details

We

ultimately

arrive

at

the

linear

system

of

equations

given

in

Section

B.

Unfortunately

the

process

graph

of

FPur

induced

by

this

linearization

is

to

complex

to

draw

it

without

obscuring

most

of

the

crucial

parts

so

we

will

not

give

it

here

Continuing

with

the

verification

we

define

the

set

of

internal

actions

as

I

f

c?ff

j

f

x

i

x

i

j

i

g

g

-LSB-

A

Z

v

r?x

v

Z

v?a

s?x

v

Z

v?d

r?x

r?x

r?x

Z

v

Z

v?a

s?x

v

B

Z

v

r?x

v

Z

v?a

s?x

v

Z

v?d

r?x

r?x

r?x

Z

v

Z

v?a

s?x

v

V

Z

v

r?x

v

s?x

v

r?x

v

r?x

v

Z

v

r?x

v

s?x

v

r?x

v

r?x

v

Z

v

r?x

v

s?x

v

r?x

v

r?x

v

fl?r?ff

s?ff

c?ff

for

f

x

i

x

i

j

i

g

H

f

r?ff

s?ff

j

f

x

i

x

i

j

i

g

g

FPur

@H

A

k

B

k

V

Figure

Fischer

's

protocol

in

real

time

-LRB-

ACPur

-RRB-

i.e.

all

communication

actions

and

and

-LRB-

the

delay

actions

-RRB-

As

we

have

made

sure

that

all

guarded

commands

in

the

linearization

can

be

satisfied

it

is

very

easy

to

compute

ot

ffi

oI?FPur

On

the

process

graph

of

ot

ffi

oI?FPur

we

then

compute

the

maximal

rooted

branching

auto

bisimulation

which

gives

us

the

following

equivalence

classes

XA

XB

XC

XD

XE

When

we

divide

out

this

equivalence

relation

we

arrive

at

the

reduced

process

graph

given

in

Figure

On

this

graph

we

can

now

check

all

required

properties

in

almost

XA

XD

XE

XB

XC

Figure

The

reduced

process

graph

of

ot

ffi

oI?FPur

exactly

the

same

way

as

we

did

earlier

for

oI?FPdt

ffl

Actual

mutual

exclusion

It

can

be

easily

seen

from

the

graph

of

Figure

that

an

action

is

always

immediately

followed

by

a

action

and

the

same

holds

for

and

Therefore

it

can

not

be

the

case

that

both

components

are

in

their

critical

section

at

the

same

time

ffl

Symmetry

As

the

graph

is

symmetrical

with

respect

to

the

paths

from

the

root

through

the

critical

sections

of

the

components

back

to

the

root

it

is

clear

that

the

the

protocol

is

symmetrical

with

respect

to

the

components

ffl

No

starvation

Whichever

state

the

protocol

is

in

there

is

always

a

path

leading

to

each

component

's

critical

section

Therefore

using

fairness

it

can

not

be

the

case

that

one

component

is

permanently

prohibited

from

entering

its

critical

section

We

find

that

all

properties

hold

which

completes

the

proof

of

the

correctness

of

FPur

Conclusions

As

we

have

seen

Fischer

's

protocol

can

be

proven

correct

quite

satisfactorily

using

algebraic

techniques

This

however

does

not

mean

too

much

it

is

an

almost

trivial

protocol

that

has

been

solved

time

and

time

again

using

all

kinds

of

formalisms

But

it

is

not

all

that

bad

either

see

for

example

-LSB-

-RSB-

where

an

-LRB-

incomplete

-RRB-

proof

is

given

of

Fischer

's

protocol

When

it

would

be

written

out

in

full

detail

that

proof

would

be

about

as

long

and

tedious

as

ours

is

-LSB-

-RSB-

and

the

same

probably

holds

for

a

detailed

temporal

logic

proof

-LSB-

-RSB-

Looking

at

our

proof

one

observes

that

although

conceptually

very

clear

and

easy

the

inner

workings

required

a

lot

of

bothersome

and

failure-prone

computations

It

seems

valid

to

doubt

whether

all

these

calculations

were

really

necessary

Much

of

their

complexity

results

from

the

fact

that

the

theories

we

used

are

based

on

bisimulation

semantics

which

preserves

very

many

moments

of

choice

while

that

was

not

at

all

required

for

the

proof

we

were

constructing

Furthermore

the

so-called

algebraic

advantage

i.e.

the

ability

to

calculate

with

processes

without

having

to

write

out

the

entire

state

space

is

almost

absent

This

is

disappointing

although

the

algebraic

advantage

manifests

itself

very

clearly

when

verifying

protocols

that

do

not

exhibit

much

internal

parallelism

such

as

the

Alternating

Bit

Protocol

-LRB-

see

for

example

-LSB-

-RSB-

-RRB-

it

seems

to

be

lost

in

the

verification

of

Fischer

's

protocol

which

has

very

much

internal

parallelism

As

a

result

we

get

the

worst

of

both

worlds

the

state

explosion

from

naive

model

checking

and

the

complicated

term

rewriting

from

real-time

process

algebra

Let

us

however

not

become

too

pessimistic

It

has

become

clear

that

algebraic

theories

can

indeed

be

applied

to

protocols

with

intricate

real-time

aspects

It

would

be

unrealistic

to

expect

that

these

theories

which

were

designed

without

much

regard

for

their

practical

application

would

in

their

unmodified

form

be

splendidly

suited

for

real-life

verifications

There

is

a

lot

of

room

for

tuning

these

theories

towards

more

practicality

We

see

at

least

three

directions

in

which

we

would

like

to

proceed

preferably

in

all

three

at

the

same

time

ffl

First

of

all

it

would

be

nice

to

have

a

real-time

process

algebra

that

does

not

lean

on

bisimulation

semantics

only

It

is

simply

not

always

a

good

idea

to

preserve

all

internal

moments

of

choice

If

we

had

a

theory

based

on

say

ready

semantics

or

failure

semantics

we

would

probably

gain

some

of

our

algebraic

advantage

back

But

maybe

abandoning

bisimulation

semantics

altogether

would

be

too

crude

A

more

sophisticated

and

subtle

approach

could

be

to

abstract

only

from

those

internal

moments

of

choice

we

really

want

to

abstract

from

This

could

be

implemented

by

introducing

a

special

choice

operator

next

to

the

ordinary

For

example

the

delayed

choice

of

-LSB-

-RSB-

or

a

o-angelic

choice

ffl

Secondly

it

might

be

profitable

to

augment

process

algebra

with

a

-LRB-

limited

-RRB-

form

of

temporal

logic

Looking

at

the

linearization

process

of

FPur

in

Appendix

B

it

is

clear

that

much

of

the

calculations

involved

are

needed

to

manage

the

exact

ranges

of

the

parameters

of

the

variables

Or

on

a

conceptually

higher

level

the

calculations

get

complicated

because

we

do

not

have

adequate

tools

for

denoting

the

precise

flow

of

time

When

working

with

a

hybrid

process

algebra-temporal

logic

theory

-LRB-

still

predominantly

algebraic

-RRB-

these

complications

would

probably

not

have

arisen

See

for

example

-LSB-

-RSB-

where

this

approach

is

investigated

ffl

Thirdly

we

might

just

as

well

admit

that

real-time

verifications

are

difficult

and

probably

will

remain

so

for

some

years

to

come

Therefore

it

may

be

advisable

to

have

computer

tools

at

our

disposal

One

could

for

example

imagine

an

process

algebra

calculator

which

like

an

ordinary

arithmetic

calculator

could

assist

in

performing

complex

calculations

This

way

we

could

put

the

human

back

into

the

driver

's

seat

of

the

verification

process

instead

of

having

him

stumble

in

the

dark

while

juggling

complex

process

terms

Assuming

we

can

indeed

exploit

our

algebraic

advantage

this

approach

could

be

very

interesting

A

combination

of

easy

process

term

manipulation

and

powerful

algebraic

techniques

could

lead

to

verifications

that

are

both

short

and

easy

to

construct

Concluding

we

can

say

that

the

verification

of

Fischer

's

protocol

by

algebraic

means

as

given

in

this

paper

is

not

very

straightforward

But

nonetheless

there

are

several

promising

directions

for

future

research

that

could

lead

to

new

algebraically

oriented

theories

that

may

perform

much

better

for

real-life

verifications

A

The

linearization

of

FPdt

A.

Methodology

Finding

a

linear

specification

for

FPdt

is

very

easy

-LRB-

at

least

in

principle

-RRB-

one

just

repeatedly

applies

the

expansion

theorem

for

ACPdt

All

new

states

reached

are

numbered

consecutively

using

process

variables

Xi

Linearizing

in

a

depth-first

fashion

we

arrive

at

the

processes

given

below

in

Section

A.

The

protocol

FPdt

itself

corresponds

to

the

variable

Please

note

that

the

equations

in

the

following

section

were

produced

by

hand

and

therefore

initially

had

several

mistakes

in

them

To

attempt

to

find

these

we

have

performed

several

computerized

sanity

checks

on

the

hand-generated

data

file

For

example

it

is

obvious

that

the

entire

system

is

symmetrical

with

respect

to

the

A

and

B

component

and

this

can

be

quite

easily

checked

This

means

that

if

there

are

any

mistakes

left

it

must

be

that

we

have

made

exactly

the

same

mistake

two

times

over

in

a

symmetrical

way

Some

more

checks

were

made

exploiting

similar

intuitively

known

facts

about

the

process

graph

and

by

old-fashioned

human

proofreading

Finally

the

data

file

was

automatically

converted

to

TEX-format

by

means

of

a

computer

in

order

to

minimize

the

chances

of

mistakes

in

that

step

of

the

process

A.

The

obtained

linear

system

FPdt

@H

A

k

B

k

V

@H

k

k

@H

k

k

c?x

@H

k

k

c?x

@H

k

k

k

k

c?x

c?x

@H

k

k

c?x

@H

k

k

c?x

@H

k

k

c?x

c?x

@H

k

k

c?x

@H

k

k

c?x

@H

k

k

c?x

c?x

@H

k

k

c?x

@H

k

k

c?x

@H

k

k

c?x

c?x

@H

k

k

k

k

@H

k

k

c?x

@H

k

k

c?x

@H

k

k

@H

k

k

@H

k

k

@H

k

k

@H

k

k

c?x

@H

k

k

c?x

@H

k

k

c?x

@H

k

k

c?x

@H

k

k

c?x

@H

k

k

c?x

@H

k

k

k

k

@H

k

k

c?x

@H

k

k

c?x

@H

k

k

c?x

c?x

@H

k

k

@H

k

k

c?x

@H

k

k

c?x

@H

k

k

c?x

@H

k

k

c?x

@H

k

k

@H

k

k

@H

k

k

@H

k

k

@H

k

k

c?x

@H

k

k

c?x

@H

k

k

@H

k

k

c?x

@H

k

k

c?x

@H

k

k

c?x

@H

k

k

c?x

@H

k

k

c?x

c?x

@H

k

k

c?x

@H

k

k

c?x

@H

k

k

c?x

c?x

@H

k

k

c?x

@H

k

k

c?x

@H

k

k

c?x

c?x

@H

k

k

c?x

@H

k

k

c?x

@H

k

k

k

k

@H

k

k

k

k

@H

k

k

c?x

@H

k

k

c?x

@H

k

k

c?x

c?x

@H

k

k

c?x

@H

k

k

@H

k

k

c?x

@H

k

k

c?x

@H

k

k

@H

k

k

c?x

@H

k

k

c?x

@H

k

k

c?x

@H

k

k

c?x

c?x

@H

k

k

c?x

@H

k

k

c?x

@H

k

k

c?x

c?x

@H

k

k

c?x

@H

k

k

c?x

@H

k

k

c?x

c?x

@H

k

k

c?x

@H

k

k

c?x

B

The

linearization

of

FPur

B.

Methodology

Finding

a

linear

specification

for

FPur

is

a

lot

more

difficult

than

it

was

in

the

discretetime

case

This

is

caused

by

the

fact

that

most

of

the

variables

used

in

the

linear

recursive

system

are

parameterized

with

a

time

stamp

v

R

So

in

order

to

perform

calculations

on

these

parameterized

variables

a

lot

of

bookkeeping

has

to

be

done

There

are

three

things

that

have

to

be

watched

ffl

First

when

introducing

new

parameterized

variables

one

has

to

compute

the

range

the

parameter

might

take

The

range

will

always

take

the

form

of

a

non-empty

closed

interval

t

R

It

is

important

that

all

points

of

this

interval

can

actually

be

reached

by

the

protocol

For

example

when

expanding

-LRB-

where

v

-RRB-

on

page

we

need

to

introduce

new

parameterized

variables

and

The

summand

for

is

v

a

Z

u?a

c?x

u

v

To

determine

the

range

the

parameter

of

can

take

we

first

observe

that

although

v

the

guarded

command

v

a

effectively

limits

this

range

to

v

a

As

u

can

range

from

a

to

v

this

means

that

u

v

ranges

from

a

-LRB-

when

v

and

u

a

-RRB-

to

-LRB-

when

u

v

and

v

is

anything

between

and

a

-RRB-

So

if

we

substitute

the

fresh

variable

for

u

v

the

parameter

range

for

is

a

This

range

is

indicated

just

above

the

definition

of

on

page

ffl

Secondly

two

parameterized

variables

that

both

represent

the

same

subprocess

but

differ

in

the

range

which

their

parameter

may

take

have

to

be

considered

different

variables

and

get

different

names

This

happens

for

example

between

variables

and

and

Both

are

defined

as

@H

Z

w?d?v

k

k

but

for

we

have

v

while

for

we

have

v

ffl

Thirdly

at

some

points

in

the

calculation

it

is

crucial

that

the

information

provided

by

the

range

of

a

parameter

be

used

to

simplify

the

equations

involved

Often

this

manifests

itself

as

a

guarded

command

evaluating

to

false

These

steps

are

the

essence

of

the

verification

the

paths

that

are

cut

off

because

the

guarded

command

never

evaluates

to

true

represent

paths

that

would

violate

the

safety

properties

such

as

actual

mutual

exclusion

we

are

trying

to

prove

This

can

be

observed

for

example

in

the

expansion

of

where

a

v

There

we

arrive

at

a

summand

v

d

Z

u?d

@H

k

Z

w?a?v?u

s?x

w

k

Because

d

-LRB-

intuitively

a

delay

always

takes

longer

than

an

assignment

-RRB-

As

a

v

we

have

v

d

so

the

condition

is

always

false

Therefore

the

whole

summand

vanishes

into

ffi

This

is

just

what

we

need

because

choosing

that

summand

would

lead

us

onto

a

path

where

both

components

could

enter

the

critical

section

simultaneously

At

this

point

it

becomes

clear

why

we

put

in

the

extra

restriction

-LRB-

see

page

-RRB-

Although

this

restriction

is

irrelevant

for

the

correctness

of

the

protocol

it

does

ensure

that

d

a

This

greatly

reduces

the

size

of

the

linear

specification

as

it

intuitively

cuts

off

all

paths

where

the

one

component

is

delaying

forever

while

the

other

component

is

repeatedly

entering

and

leaving

its

critical

section

See

the

expansion

of

for

an

example

of

this

After

linearizing

in

a

depth-first

fashion

we

arrive

at

the

processes

given

in

Section

B.

The

protocol

FPur

itself

corresponds

to

the

variable

We

have

made

sure

to

indicate

exactly

the

range

the

parameters

may

take

Furthermore

we

ultimately

put

all

integrals

in

guard-prefixed

normal

form

As

in

the

discrete-time

case

several

computerized

sanity

checks

were

made

on

the

hand-generated

data

This

time

we

also

had

the

opportunity

to

exploit

the

information

provided

by

the

parameter

ranges

Translating

the

data

file

into

TEX-format

was

again

done

automatically

although

some

final

manual

editing

was

necessary

to

achieve

a

satisfactory

layout

B.

The

obtained

linear

system

FPur

@H

A

k

B

k

V

@H

k

k

@H

k

k

Z

v

c?x

v

@H

k

k

Z

v

c?x

v

@H

k

k

Z

v

c?x

v

Z

v

c?x

v

true

Z

v

c?x

v

true

Z

v

c?x

v

@H

k

k

Z

v?a

c?x

v

@H

k

k

Z

v

c?x

v

@H

Z

w?a?v

s?x

w

k

k

Z

v?a

c?x

v

Z

v

c?x

v

Z

v?a

c?x

v

Z

v

c?x

v

true

Z

v?a

c?x

v

true

Z

v

c?x

v

@H

k

k

Z

v

c?x

v

@H

k

Z

w?a?v

s?x

w

k

Z

v?a

c?x

v

@H

k

k

Z

v

c?x

v

Z

v?a

c?x

v

true

Z

v

c?x

v

true

Z

v?a

c?x

v

For

all

v

v

@H

k

Z

w?a?v

s?x

w

k

Z

u?a

c?x

u

@H

k

Z

w?a?v?u

s?x

w

k

Z

w?a?v

c?x

w

@H

Z

u?a?w

s?x

u

k

k

Z

u?a

c?x

u

@H

k

Z

w?a?v?u

s?x

w

k

Z

w?a?v

c?x

w

@H

Z

u?a?w

s?x

u

k

k

Z

u?a

c?x

u

v

Z

w?a?v

c?x

w

v

a

Z

u?a

c?x

u

v

true

Z

w?max

a?v

c?x

w

@H

k

k

Z

v?d

@H

k

k

Z

v?d

true

Z

v?d

@H

k

k

c?x

@H

k

k

c?x

@H

k

k

@H

k

k

@H

k

k

Z

v

@H

k

k

Z

v

true

Z

v

@H

k

k

Z

v?a

c?x

v

@H

k

k

Z

v?a

c?x

v

true

Z

v?a

c?x

v

For

all

v

a

v

@H

k

Z

w?a?v

s?x

w

k

Z

u?d

@H

k

Z

w?a?v?u

s?x

w

k

Z

w?a?v

c?x

w

@H

Z

u?d?w

k

k

Z

u?d

@H

k

Z

w?a?v?u

s?x

w

k

Z

w?a?v

c?x

w

@H

Z

u?d?w

k

k

Z

u?d

@H

Z

w?a?v

c?x

w

v

d

Z

u?d

@H

true

Z

w

c?x

w

false

Z

u?d

@H

true

Z

w

c?x

w

true

Z

w

c?x

w

For

all

v

v

@H

Z

w?a?v

s?x

w

k

k

Z

w?a?v

c?x

w

@H

k

Z

u?d?w

k

Z

u?d

@H

Z

w?a?v?u

s?x

w

k

k

Z

w?a?v

c?x

w

@H

k

Z

u?d?w

k

Z

u?d

@H

Z

w?a?v?u

s?x

w

k

k

Z

w?a?v

c?x

w

Z

u?d

@H

true

Z

w?max

a?v

c?x

w

v

d

Z

u?d

@H

true

Z

w?max

a?v

c?x

w

false

Z

u?d

@H

true

Z

w?max

a?v

c?x

w

For

all

v

v

@H

k

Z

w?d?v

k

Z

u?d

@H

k

Z

w?d?v?u

k

Z

w?d?v

@H

Z

u?d?w

k

k

Z

u?d

@H

k

Z

w?d?v?u

k

Z

w?d?v

@H

Z

u?d?w

k

k

Z

u?d

v

Z

w?d?v

v

d

Z

u?d

v

true

Z

w?d?v

For

all

v

d

v

@H

k

Z

w?d?v

k

c?x

@H

k

Z

w?d?v

k

v

d

@H

k

k

c?x

v

d

c?x

true

c?x

For

all

v

d

v

@H

Z

w?d?v

k

k

v

d

@H

k

k

c?x

@H

Z

w?d?v

k

k

v

d

c?x

@H

k

k

c?x

@H

k

k

c?x

@H

k

k

c?x

c?x

For

all

v

d

v

@H

Z

w?d?v

k

k

Z

w?d?v

@H

k

k

Z

w?d?v

true

Z

w?max

;d

v

@H

k

k

c?x

@H

k

k

c?x

@H

k

k

@H

k

k

@H

k

k

Z

v

@H

k

k

Z

v

true

Z

v

@H

k

k

Z

v?a

c?x

@H

k

k

Z

v?a

c?x

v

true

Z

v?a

c?x

v

@H

k

k

@H

k

k

c?x

@H

k

k

c?x

@H

k

k

@H

k

k

c?x

@H

k

k

c?x

@H

k

k

c?x

@H

k

k

c?x

For

all

v

d

v

@H

k

Z

w?d?v

k

@H

k

Z

w?d?v

k

v

d

@H

k

k

v

d

true

For

all

v

d

v

@H

k

Z

w?d?v

k

Z

min

u

@H

k

Z

w?d?v?u

k

Z

min

w?d?v

@H

k

k

Z

u

@H

k

Z

w?d?v?u

k

Z

w?d?v

@H

k

k

Z

u

v

Z

w?d?v

true

Z

u

v

true

Z

w

For

all

v

d

v

@H

k

Z

w?d?v

k

Z

u?a

c?x

u

@H

Z

w?d?v

@H

Z

u?a?w

s?x

u

k

k

Z

u?a

c?x

u

@H

Z

w?d?v

@H

Z

u?a?w

s?x

u

k

k

Z

u?a

c?x

u

@H

Z

w?d?v

v

a

Z

u?a

c?x

u

@H

true

Z

w

false

Z

u?a

c?x

u

@H

true

Z

w

true

Z

w

For

all

v

v

d

@H

Z

w?a?v

s?x

w

k

k

v

a

c?x

@H

k

k

c?x

@H

Z

w?a?v

s?x

k

k

v

a

c?x

@H

c?x

false

c?x

@H

c?x

c?x

For

all

v

v

d

@H

Z

w?a?v

s?x

k

k

Z

w?a?v

c?x

w

@H

k

k

Z

w?a?v

c?x

w

true

Z

w?a?v

c?x

w

For

all

v

v

a

@H

Z

w?d?v

k

k

Z

w?d?v

@H

k

Z

u?d?w

k

Z

u?d

@H

Z

w?d?v?u

k

k

Z

w?d?v

@H

k

Z

u?d?w

k

Z

u?d

@H

Z

w?d?v?u

k

k

Z

w?d?v

Z

u?d

true

Z

w?d?v

v

d

Z

u?d

v

For

all

v

d

a

v

@H

k

Z

w?d?v

k

c?x

@H

k

Z

w?d?v

k

v

d

@H

k

k

c?x

v

d

For

all

v

d

v

@H

Z

w?d?v

k

k

v

d

@H

k

k

c?x

@H

Z

w?d?v

k

k

@H

k

k

c?x

@H

Z

w?d?v

k

k

c?x

@H

k

k

c?x

@H

k

k

c?x

@H

k

k

c?x

c?x

For

all

v

d

v

@H

Z

w?d?v

k

k

v

d

@H

k

k

@H

Z

w?d?v

k

k

v

d

true

@H

k

k

c?x

@H

k

k

@H

k

k

c?x

For

all

v

d

v

@H

Z

w?d?v

k

k

Z

w?d?v

@H

k

k

Z

u

@H

Z

w?d?v?u

k

k

Z

w?d?v

@H

k

k

Z

u

@H

Z

w?d?v?u

k

k

Z

w?d?v

Z

u

v

true

Z

w

true

Z

u

v

@H

k

k

c?x

@H

k

k

@H

k

k

c?x

For

all

v

d

v

@H

Z

w?d?v

k

k

Z

w?d?v

@H

k

Z

u?a?w

s?x

u

k

Z

u?a

c?x

u

@H

Z

w?d?v

@H

k

Z

u?a?w

s?x

u

k

Z

u?a

c?x

u

@H

Z

w?d?v

Z

u?a

c?x

u

@H

true

Z

w

v

a

Z

u?a

c?x

u

@H

true

Z

w

false

Z

u?a

c?x

u

@H

true

Z

w

For

all

v

v

d

@H

k

Z

w?a?v

s?x

w

k

c?x

@H

k

Z

w?a?v

s?x

w

k

v

a

c?x

@H

k

k

c?x

v

a

c?x

@H

c?x

false

c?x

@H

c?x

For

all

v

v

d

@H

k

Z

w?a?v

s?x

w

k

Z

w?a?v

c?x

w

@H

k

k

Z

w?a?v

c?x

w

true

Z

w?a?v

c?x

w

@H

k

k

c?x

@H

k

k

c?x

For

all

v

d

a

v

@H

k

Z

w?d?v

k

Z

w?d?v

@H

k

k

Z

w?d?v

true

Z

w?d?v

@H

k

k

Z

v?d

@H

k

k

Z

v?d

true

Z

v?d

For

all

v

v

@H

Z

w?a?v

s?x

w

k

k

Z

w?a?v

c?x

w

@H

k

Z

u?a?w

s?x

u

k

Z

u?a

c?x

u

@H

Z

w?a?v?u

s?x

w

k

k

Z

w?a?v

c?x

w

@H

k

Z

u?a?w

s?x

u

k

Z

u?a

c?x

u

@H

Z

w?a?v?u

s?x

w

k

k

Z

w?a?v

c?x

w

Z

u?a

c?x

u

v

true

Z

w?max

a?v

c?x

w

v

a

Z

u?a

c?x

u

v

For

all

v

v

@H

k

Z

w?a?v

s?x

w

k

Z

u?d

@H

k

Z

w?a?v?u

s?x

w

k

Z

w?a?v

c?x

w

@H

Z

u?d?w

k

k

Z

u?d

@H

k

Z

w?a?v?u

s?x

w

k

Z

w?a?v

c?x

w

@H

Z

u?d?w

k

k

Z

u?d

@H

Z

w?a?v

c?x

w

v

d

Z

u?d

@H

true

Z

w?a?v

c?x

w

false

Z

u?d

@H

true

Z

w?a?v

c?x

w

true

Z

w?a?v

c?x

w

For

all

v

a

v

@H

Z

w?a?v

s?x

w

k

k

Z

w?a?v

c?x

w

@H

k

Z

u?d?w

k

Z

u?d

@H

Z

w?a?v?u

s?x

u

k

k

Z

w?a?v

c?x

w

@H

k

Z

u?d?w

k

Z

u?d

@H

Z

w?a?v?u

s?x

u

k

k

Z

w?a?v

c?x

w

Z

u?d

@H

true

Z

w

c?x

w

v

d

Z

u?d

@H

true

Z

w

c?x

w

false

Z

u?d

@H

true

Z

w

c?x

w

For

all

v

v

a

@H

k

Z

w?d?v

k

Z

u?d

@H

k

Z

w?d?v?u

k

Z

w?d?v

@H

Z

u?d?w

k

k

Z

u?d

@H

k

Z

w?d?v?u

k

Z

w?d?v

@H

Z

u?d?w

k

k

Z

u?d

Z

w?d?v

v

d

Z

u?d

u

true

Z

w?d?v

For

all

v

d

a

v

@H

Z

w?d?v

k

k

c?x

@H

Z

w?d?v

k

k

v

d

@H

k

k

c?x

v

d

For

all

v

d

a

v

@H

Z

w?d?v

k

k

Z

w?d?v

@H

k

k

true

Z

w?max

;d

v

For

all

v

v

@H

Z

w?d?v

k

k

Z

w?d?v

@H

k

Z

u?d?w

k

Z

u?d

@H

Z

w?d?v?u

k

k

Z

w?d?v

@H

k

Z

u?d?w

k

Z

u?d

@H

Z

w?d?v?u

k

k

Z

w?d?v

Z

u?d

v

true

Z

w?d?v

v

d

Z

u?d

v

For

all

v

d

v

@H

k

Z

w?d?v

k

c?x

@H

k

Z

w?d?v

k

v

d

@H

k

k

c?x

v

d

For

all

v

a

v

@H

k

Z

w?d?v

k

Z

w?d?v

@H

k

k

Z

w?d?v

true

Z

w?max

;d

v

Acknowledgments

We

would

like

to

thank

Mart

n

Abadi

Jos

Baeten

Roland

Bol

Jozef

Hooman

Hans

Mulder

Michel

Reniers

and

Fred

Schneider

for

their

various

comments

and

fruitful

discussions

and

Jan

Friso

Groote

for

kindly

providing

the

PASCAL

source

of

his

bisimulation-checking

tool

-LRB-

which

is

described

in

-LSB-

-RSB-

-RRB-

Bibliography

-LSB-

-RSB-

M.

Abadi

Personal

communication

-LSB-

-RSB-

M.

Abadi

and

L.

Lamport

An

old-fashioned

recipe

for

real

time

Technical

Report

Systems

Research

Center

Digital

Equipment

Corporation

October

To

appear

in

ACM

Transactions

on

Programming

Languages

and

Systems

An

earlier

version

appeared

as

-LSB-

-RSB-

-LSB-

-RSB-

M.

Abadi

and

L.

Lamport

An

old-fashioned

recipe

for

real

time

In

-LSB-

-RSB-

pages

-LSB-

-RSB-

J.C.M.

Baeten

editor

Applications

of

Process

Algebra

Number

in

Cambridge

Tracts

in

Theoretical

Computer

Science

Cambridge

University

Press

-LSB-

-RSB-

J.C.M.

Baeten

and

J.A.

Bergstra

Real

time

process

algebra

Journal

of

Formal

Aspects

of

Computing

-LRB-

-RRB-

-LSB-

-RSB-

J.C.M.

Baeten

and

J.A.

Bergstra

Discrete

time

process

algebra

Technical

Report

CSN

Eindhoven

University

of

Technology

Computing

Science

Department

An

extended

abstract

appeared

as

-LSB-

-RSB-

-LSB-

-RSB-

J.C.M.

Baeten

and

J.A.

Bergstra

Discrete

time

process

algebra

In

-LSB-

-RSB-

pages

Extended

abstract

-LSB-

-RSB-

J.C.M.

Baeten

J.A.

Bergstra

and

R.N.

Bol

A

real-time

process

logic

Technical

Report

CSN

Eindhoven

University

of

Technology

Computing

Science

Department

An

extended

abstract

appeared

as

-LSB-

-RSB-

-LSB-

-RSB-

J.C.M.

Baeten

J.A.

Bergstra

and

R.N.

Bol

A

real-time

process

logic

In

-LSB-

-RSB-

pages

-LSB-

-RSB-

J.C.M.

Baeten

and

S.

Mauw

Delayed

choice

an

operator

for

joining

message

sequence

charts

To

appear

in

the

proceedings

of

FORTE

Berne

Switzerland

October

-LSB-

-RSB-

J.C.M.

Baeten

and

W.P.

Weijland

Process

Algebra

Number

in

Cambridge

Tracts

in

Theoretical

Computer

Science

Cambridge

University

Press

-LSB-

-RSB-

W.R.

Cleaveland

editor

CONCUR

Third

International

Conference

on

Concurrency

Theory

Number

in

Lecture

Notes

in

Computer

Science

Springer-Verlag

Proceedings

of

CONCUR

Stony

Brook

NY

USA

August

-LSB-

-RSB-

N.G.

de

Bruijn

Additional

comments

on

a

problem

in

concurrent

programming

control

Communications

of

the

ACM

-LRB-

-RRB-

-LSB-

-RSB-

J.W.

de

Bakker

C.

Huizing

W.P.

de

Roever

and

G.

Rozenberg

editors

RealTime

Theory

in

Practice

Number

in

Lecture

Notes

in

Computer

Science

Springer-Verlag

Proceedings

of

the

REX

Workshop

Mook

The

Netherlands

June

-LSB-

-RSB-

E.W.

Dijkstra

Solution

of

a

problem

in

concurrent

programming

control

Communications

of

the

ACM

-LRB-

-RRB-

-LSB-

-RSB-

M.

Fischer

Re

where

are

you

Electronic

mail

message

from

Michael

Fischer

to

Leslie

Lamport

Arpanet

message

sent

on

June

EDT

number

8506252257.AA07636@yale-bulldog.yale.arpa

-LRB-

lines

-RRB-

-LSB-

-RSB-

D.M.

Gabbay

and

H.J.

Ohlbach

editors

Temporal

Logic

First

International

Conference

Number

in

Lecture

Notes

in

Artificial

Intelligence

-LRB-

Subseries

of

Lecture

Notes

in

Computer

Science

-RRB-

Springer-Verlag

Proceedings

of

ICTL

Bonn

Germany

July

-LSB-

-RSB-

J.F.

Groote

Process

Algebra

and

Structured

Operational

Semantics

PhD

thesis

University

of

Amsterdam

-LSB-

-RSB-

J.

Hillebrand

The

ABP

and

the

CABP?a

comparison

of

performances

in

real

time

process

algebra

In

-LSB-

-RSB-

pages

-LSB-

-RSB-

C.A.R.

Hoare

Communicating

Sequential

Processes

International

Series

in

Computer

Science

Prentice

Hall

-LSB-

-RSB-

W.

Janssen

M.

Poel

Q.

Xu

and

J.

Zwiers

Layering

of

real-time

distributed

processes

To

appear

in

the

proceedings

of

the

Third

International

School

and

Symposium

on

Formal

Techniques

in

Real

Time

and

Fault

Tolerant

Systems

L?ubeck

Germany

September

-LSB-

-RSB-

A.S.

Klusener

Models

and

Axioms

for

a

Fragment

of

Real

Time

Process

Algebra

PhD

thesis

Eindhoven

University

of

Technology

Computing

Science

Department

-LSB-

-RSB-

D.E.

Knuth

Additional

comments

on

a

problem

in

concurrent

programming

control

Communications

of

the

ACM

-LRB-

-RRB-

-LSB-

-RSB-

L.

Lamport

A

new

solution

of

Dijkstra

's

concurrent

programming

problem

Communications

of

the

ACM

-LRB-

-RRB-

-LSB-

-RSB-

L.

Lamport

A

fast

mutual

exclusion

algorithm

ACM

Transactions

on

Computer

Systems

-LRB-

-RRB-

-LSB-

-RSB-

R.

Milner

Communication

and

Concurrency

International

Series

in

Computer

Science

Prentice

Hall

-LSB-

-RSB-

E.R.

Nieuwland

Proving

mutual

exclusion

with

process

algebra

In

-LSB-

-RSB-

pages

-LSB-

-RSB-

A.

Ponse

C.

Verhoef

and

S.F.M.

van

Vlijmen

editors

workshop

on

algebra

of

communicating

processes

Technical

Report

University

of

Amsterdam

Programming

Research

Group

May

-LSB-

-RSB-

F.

Schneider

B.

Bloom

and

K.

Marzullo

Putting

time

into

proof

outlines

In

-LSB-

-RSB-

pages

-LSB-

-RSB-

F.

Schneider

Personal

communication

Typeset

by

LATEX

in

Lucida

Bright

acp
discrete time
mutual exclusion
process algebra
real time
verification


ARGONNE NATIONAL LABORATORY 9700 South Cass Avenue Argonne , IL 60439 ANL/MCS-TM -223 FLIC : A Translator for Same-Source Parallel Implementation of Regular Grid Applications by John Michalakes Mathematics and Computer Science Division Technical Memorandum No. 223 February 1997 This work was supported by the Mathematical , Information , and Computational Sciences Division subprogram of the Office of Computational and Technology Research , U.S. Department of Energy , under Contract W-31-109-Eng-38 . Contents Abstract 1 1 Introduction 1 2 Overview 2 2.1 FLIC Input and Output : : : : : : : : : : : : : : : : : : : : : : : : : : : : 3 2.1.1 Loop Statements : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 3 2.1.2 Global and Local Indices : : : : : : : : : : : : : : : : : : : : : : : : 4 2.1.3 Boundary Tests : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 6 2.2 Iterative Scope : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 7 2.3 FLIC Macros : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 7 3 Usage 8 3.1 Obtaining FLIC : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 8 3.2 Command Line Arguments : : : : : : : : : : : : : : : : : : : : : : : : : : : 9 3.3 Directives File : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 9 3.4 Environment : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 9 3.5 Compiling with FLIC : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 10 4 Conclusion 10 References 11 iii FLIC : A Translator for Same-Source Parallel Implementation of Regular Grid Applications by John Michalakes Abstract FLIC , a Fortran loop and index converter , is a parser-based source translation tool that automates the conversion of program loops and array indices for distributedmemory parallel computers . This conversion is important in the implementation of gridded models on distributed memory because it allows for decomposition and shrinking of model data structures . FLIC does not provide the parallel services itself , but rather provides an automated and transparent mapping of the source code to calls or directives of the user 's choice of run-time systems or parallel libraries . The amount of user-supplied input required by FLIC to direct the conversion is small enough to fit as command line arguments for the tool . The tool requires no additional statements , comments , or directives in the source code , thus avoiding the pervasiveness and intrusiveness imposed by directives-based preprocessors and parallelizing compilers . FLIC is lightweight and suitable for use as a precompiler and facilitates a same-source approach to operability on diverse computer architectures . FLIC is targeted to new or existing applications that employ regular gridded domains , such as weather models , that will be parallelized by data-domain decomposition . 1 Introduction Adapting simulation codes to distributed-memory parallel computing is difficult and error prone , since it involves replacing the single-address space memory model with a distributed one . The task is especially demanding if one wishes to preserve source compatibility with the non-distributed memory version of the model . Such a same-source approach is desirable because it lessens the burden of maintaining the software . It is , however , is difficult to achieve because the modifications required for distributed memory are usually extensive . One critical problem is the handling of loops that iterate over decomposed dimensions , for example , the north/south and east/west loops in an atmospheric model . The starting and ending indices must be adjusted for the fact that each processor has only a section of the original domain . Another is the loss of the identity relationship between global and local indices . A reference U -LRB- i , j -RRB- in the source model will be wrong on distributed memory because the i ; jth element on the processors is not the i ; jth element of the logical domain . Although the loss of global/local index identity can be avoided by retaining the original dimensions of the model 's data structures , doing so defeats memory scaling . The model will not be able to take advantage of the larger aggregate memory available from more processors unless array dimensions are shrunken to allocate only the memory needed on each processor . Finally , boundary conditions specified implicitly as loop ranges do not hold , because the loop ranges are global whereas the loop variable is used as a local index . All of these problems have been successfully addressed using run-time systems and parallel libraries . A number of available packages -LSB- 2 , 3 , 5 , 6 -RSB- provide the necessary looping and index translation information to the program at run time . However , looping statements and index expressions must be modified from their original form to use this run-time information , introducing enough parallel artifact to hinder a same-source software approach . FLIC , a Fortran loop and index converter , is a parser-based pre-compiler that bridges the gap between the non-parallel source code and the parallelized version by automatically generating the calls or directives needed by the run-time system . FLIC requires no directives of its own in the source code ; the amount of input required to guide the translation is small enough to fit on the FLIC command line -LRB- within a UNIX Make file , for example -RRB- and general enough to be specifiable once for all the modules of the program . FLIC requires only that the user enumerate the Fortran-defined constants that are used to specify the size of decomposed array dimensions in the program . If , for example , the state arrays for model variables such as temperature , wind velocity , and moisture are dimensioned IX for the north/south dimension and JX for the east/west dimension , it is sufficient to specify flic - mdim = ix - ndim = jx file.F From this specification , and by looking at the array references in each loop body , FLIC will identify and convert all the loops that iterate over the m and n dimensions . FLIC will also identify decomposed arrays that are being indexed by nonloop-variable expressions and generate the correct global-to-local index translation | all without touching the source file . Thus , the tool avoids the pervasiveness and intrusiveness imposed by directives-based preprocessors and parallelizing compilers , in which directives must be scattered throughout the source code . Another critical problem for implementing single-address space codes on distributed memory architectures is interprocessor communication . FLIC does not analyze data dependencies and generate communication . However , this is well within the capability of source translators -LSB- 1 , 4 -RSB- and is a future enhancement for the FLIC tool . 2 Overview FLIC is a precompiler , as distinguished from a preprocessor . Unlike macro preprocessors | M4 , CPP , or Perl | which rely on pattern matching , FLIC is built atop UNIX lex and yacc and contains the full lexical , syntactic , and semantic specification for Fortran77 with extensions -LRB- such as Cray POINTER statements -RRB- . The translator works from an abstract syntax tree and is fully capable of disambiguating Fortran nuances -LRB- e.g. , when is an assignment statement actually a statement function ? -RRB- , and it has full access to type , class , and dimension information for all identifiers in the program . Preprocessors do play a role in the translation process . FLIC is more powerful than a preprocessor , but it is also more difficult to modify . Therefore , FLIC does not generate a full Fortran expansion of the distributed-memory target code . Doing so would unnecessarily limit the range of possible target expansions . Rather , it generates FLIC macros that are expanded by using M4 , CPP , or another preprocessor . Users who do not wish to write expansions for the macros FLIC generates can take advantage of the ready-made sets of macro expansions included in the FLIC distribution . Users who develop new macro expansions and wish to have them included are invited to contact the author . 2.1 FLIC Input and Output In addition to a file containing Fortran source code , FLIC requires a small amount of additional information from the user . The primary information required is a list of the defined constants that are used to declare the decomposed dimensions of model arrays . Additionally , FLIC also needs to know whether the routine being translated is called from within a loop over a decomposed dimension . The principal advantage of this approach is that a great deal of relevant knowledge about the program can be inferred from a very small amount of information , namely , the set of defined constants that are used to declare decomposed array dimensions . Even in a large model , the number of these constants is comparatively quite small . For example , in the 50,000-line PSU/NCAR MM5 code , about a dozen defined constants , easily listed on the FLIC command line , are used to declare the north/south and east/west dimensions of the hundreds of arrays in the model . 2.1.1 Loop Statements To properly translate loop statements , FLIC needs enough information to be able to tell whether a given loop in the routine is over one of the decomposed dimensions . If it is , it should be translated ; otherwise it is left alone . The current version of FLIC allows up to two dimensions of a domain to be decomposed ; these are referred to as M and N . In an atmospheric model , for example , the north/south and east/west dimensions are candidates for decomposition over processors ; one of these would be designated M and the other N. FLIC uses this rule : A loop is over a decomposed dimension if , within the body of the loop , a decomposed dimension of an array is indexed by an expression that depends on the value of the loop variable . The loop is converted provided the ending loop range is not an expression of the defined constant that declared the array dimension . Since FLIC has ready access to the loop variable from the source code and can statically infer whether index expressions are dependent on it , the only missing piece of information is which dimensions of the array being indexed are over decomposed dimensions . Providing FLIC with the list of defined constants that are used to declare the M and N decomposed dimensions of model arrays allows it to look for these among the array declarations in the routine and to categorize each array accordingly . For example , REAL UA -LRB- IX , JX , KX -RRB- ... DO 10 J = 2 , JL-1 DO 10 K = 1 , KL DO 10 I = 2 , IL-1 UA -LRB- I , J , K -RRB- = ... 10 CONTINUE ... is a fragment containing a triply nested loop that contains a reference to the three-dimensional model array UA . The tool has no way of inferring from the code itself that the I loop and the J loop are decomposed over M and N , respectively . If , however , we inform the tool that IX is used to declare the M dimension and JX is used to declare the N dimension , the tool can infer everything else from the rule stated above , generating REAL UA -LRB- IX , JX , KX -RRB- ... FLIC_DO_N -LRB- J,2,JL-1 -RRB- DO K = 1 , KL FLIC_DO_M -LRB- I,2,IL-1 -RRB- UA -LRB- I , J , K -RRB- = ... 10 CONTINUE FLIC_ENDDO ENDDO FLIC_ENDDO ... The beginnings and ends of the loops over I and J are replaced with FLIC macros ; the K loop is left alone . In the case of the I loop , an index expression dependent on the loop variable was found as the first index of UA in the loop body . The first dimension of UA is known to be over M because it is defined with IX . Therefore , the I loop is inferred to be over M , a decomposed dimension . Since the ending loop range is not an expression of IX -LRB- which would imply that the loop is already specified over the local and not global dimension -RRB- , the loop is translated -LRB- likewise , with the J loop -RRB- . Within the body of the converted loop , the loop variable is considered to be local and hence may be used as-is to index local arrays . If the loop variable appears in a logical expression , it may be converted to global . Note that the tool also unravels the common termination on a labeled CONTINUE statement . That statement is left intact , within the innermost loop body , on the chance that the loop body contains a GOTO statement to that label . 2.1.2 Global and Local Indices In addition to identifying and translating loops over decomposed dimensions , FLIC must identify and correctly handle instances where global indices must be converted to local indices , and vice versa . Global values appearing as indices to local arrays must be converted to the correct local value , for example , REAL UA -LRB- IX , JX , KX -RRB- ... DO J = 1 , JX DO K = 1 , KX UA -LRB- 3 , J , K -RRB- = ... END DO END DO This construct would be found in sections of code that set boundary values . The value used as the first index of UA is wrong because \ 3 '' refers to the position in the undecomposed domain , whereas that index in local memory refers to another cell entirely . FLIC is able to recognize this situation using the following rule : When a decomposed array dimension is indexed by an expression that is not dependent on the value of a loop variable , that expression will be considered global and in need of conversion . In the example above , the first dimension of UA is a decomposed dimension , and the constant \ 3 '' is clearly not dependent on either of the loop variables , J or K. Therefore , the expression \ 3 '' must be treated as global and transformed accordingly . A simple transformation would be to replace the index in-place . However , for efficiency , FLIC defines and sets temporary variables outside the loop , if possible , to avoid recalculating the constant index expression each time through the K loop : REAL UA -LRB- IX , JX , KX -RRB- ... IFLIC_0 = FLIC_G2L_M -LRB- 3 , IX -RRB- DO J = 1 , JX DO K = 1 , KX UA -LRB- IFLIC_0 , J , K -RRB- = ... END DO END DO With regard to the actual generation of local indices from global indices , this is up to the particular set of macro expansions . The ready-made set of macros that maps to the RSL parallel library will expand FLIC G2L M -LRB- 3 , IX -RRB- to min -LRB- max -LRB- 3 + idif ,1 -RRB- , IX -RRB- IDIF is a variable whose value is set by RSL at run time to the difference between a global index and a local index on each processor . Adding IDIF to \ 3 '' gives the local index . Of course , this is the local index only if the processor actually has the subrange of the M dimension containing the third element ; hence , the min/max calls . If the processor has this element from the global dimension , the local index will fall between 1 and IX , the size of the local dimension . Otherwise , the resulting value will be either 1 or IX , and these can be treated as garbage values in the decomposed data structure . Again , this is an example of one possible expansion for the G2L macro ; certainly other techniques are possible , depending on the needs of the underlying parallel software . The important point , however , is that the appearance of the source code is unaffected . 2.1.3 Boundary Tests Boundary tests present the inverse problem : local indices will appear in statements where they should be global . In the case where the boundary conditions are implicit in a loop range , the conversion is handled as part of the overall loop conversion , since the starting and ending ranges are included as arguments to the FLIC DO M and FLIC DO N macros that replace the loop statements . However , expressions that depend on loop variables often may be found in the logical expressions of conditional statements to test for position in the global domain before executing -LRB- or not executing -RRB- a set of statements : REAL UA -LRB- IX , JX , KX -RRB- ... DO 100 J = 1 , JX DO 100 K = 1 , KX IF -LRB- J . EQ . 1 -RRB- THEN UA -LRB- I , J , K -RRB- = ... ... ENDIF 100 CONTINUE FLIC will generate the following transformation , using the rule : An instance a loop-variable over a decomposed dimension occurring in a logical expression will be converted from local to global . FLIC will translate the above code to REAL UA -LRB- IX , JX , KX -RRB- ... FLIC_DO_N -LRB- J ,1 , JX -RRB- DO K = 1 , KX IF -LRB- FLIC_L2G_N -LRB- J -RRB- . EQ . 1 -RRB- THEN UA -LRB- I , J , K -RRB- = ... ... ENDIF 100 CONTINUE END DO FLIC_ENDDO A possible expansion for FLIC L2G N -LRB- J -RRB- , again from the RSL/FLIC mapping , is -LRB- J-JDIF -RRB- . 2.2 Iterative Scope FLIC automatically handles routines that contain iteration over both the M and N dimensions using the rules described in the preceding sections . Sometimes , however , a routine may be called from within a loop ; in other words , at least one of the loop statements that sets indices within the routine is outside the definition of the routine . For example , a routine containing I loops may be called from within a J loop of another routine and have the J index passed in as an argument . Such a routine is slab callable , since a full sweep of the domain involves calling the routine once for each J-indexed I slab . Although only the I loops are visible to the translator , the J index must also be handled , even though the J loop itself is inaccessible . Whole program analysis , such as is performed by the APR tools , is the ultimate solution to this problem . However , with some additional guidance from the command line , FLIC can handle this situation . The - m = list and - n = list options provide a way of specifying an externally defined loop and loop variable on the command line . For example , for the routine described in the previous paragraph , the external J loop is be specified as flic - n = j file.f This indicates that the routine in file.f is called from within a loop over the decomposed dimension N and that the loop variable is J inside the routine . Specifications may be given for files containing more than one routine using entries of the form routine : variable , for example , flic - n = sub1 : j , sub2 : j file.f In this case , only the routines SUB1 and SUB2 would be considered slab callable . Other routines in the file would be unaffected by the option . 2.3 FLIC Macros This section describes the macros that FLIC generates in the target code : FLIC DO M -LRB- var , start , end -RRB- Replaces DO loops over the M decomposed dimension . Var is the loop variable ; start and end are the starting and ending global indices . FLIC DO N -LRB- var , start , end -RRB- Replaces DO loops over the N decomposed dimension . FLIC ENDDO Replaces ENDDO or labeled CONTINUE statement at the end of a converted loop . FLIC G2L M -LRB- index-expr -RRB- Converts index-expr from global to local for M indices . FLIC G2L N -LRB- index-expr -RRB- Converts index-expr from global to local for N indices . FLIC L2G M -LRB- index-expr -RRB- Converts index-expr from local to global for M indices . FLIC L2G N -LRB- index-expr -RRB- Converts index-expr from local to global for N indices . define -LRB- INSIDE MLOOP -RRB- This M4 definition is generated by FLIC for routines that are callable within a loop over M . It is a flag to the preprocessor that the FLIC DO N macros may need to be expanded differently . define -LRB- INSIDE NLOOP -RRB- This M4 definition is generated by FLIC for routines that are callable within a loop over N . It is a flag to the preprocessor that the FLIC DO M macros may need to be expanded differently . These macros are then expanded to the appropriate distributed-memory target code by using a macro preprocessor such as CPP or M4 -LRB- preferred because it allows multiline expansions -RRB- . FLIC is distributed with ready-made macro packages . This section provides the specification for the FLIC macro interface , which may be used to construct new macros . Users who develop new macro expansions and wish to have them included are invited to contact the author . 3 Usage This section describes how FLIC can be integrated and used in the compilation mechanism for a model . Input to the tool includes the source code and specifications that will be used to direct the transformation . These specifications may come from the command line , a file , or the user environment . 3.1 Obtaining FLIC FLIC is available on the World Wide Web at http://www.mcs.anl.gov/Projects/FLIC This page also contains installation information and the latest usage information for the tool . 3.2 Command Line Arguments The following is a command line summary for the tool . - extend Allow extended source lines -LRB- to 132 characters -RRB- . - m = list - n = list Specify externally set loop indices for slab-callable routines called from within an M or N loop . List is a comma separated list of -LSB- routine : -RSB- loop-var items . Loop-var is the name of the externally set loop variable as it is known within the routine . Routine is the name of the routine the specification applies to . If routine is not given , the specification applies to all routines in the source file . - mdim = list - ndim = list Specify a comma-separated list of identifiers that are used to specify the M or N decomposed dimension when arrays are declared . - F = file Specify a file containing FLIC directive information . Specifications in the file will supersede command line settings . - H = string Include string , indented to column 7 , at the beginning of the declarations section of the module . - CPP = string Include string , prepended with a # character , at the beginning of the declarations section of the module . - toolname = string Use a different string than FLIC in the macro names . 3.3 Directives File FLIC may read the transformation specifications from a file whose name is specified using the - F option on the command line . The specifications in the file will supersede those from the command line or the environment . FLIC directives begin with C in the first column so that they may be treated as comments , should the user opt to include these in the Fortran source . In this case , the - F option must specify the source file itself ; otherwise the directives will be ignored . The syntax for the directives is as follows : cflic m = list cflic n = list Same effect as the - m and - n command line options . cflic mdim = list cflic ndim = list Same effect as the - mdim and - ndim command line options . 3.4 Environment The transformation specifications may be specified in the environment by using shell environment variables . Settings from the environment are superseded by command line settings and by input from a directives file . FLIC M string FLIC N string Same effect as - m and - n command line options . FLIC MDIM string FLIC NDIM string Same effect as the - mdim and - ndim command line options . 3.5 Compiling with FLIC FLIC is designed to be used during compilation of a model , typically from within a UNIX Make file . The following fragment is an example rule for make that compiles model source files name.F down to relocatable object form name.f . OBJ = solver.o ... all : $ -LRB- OBJ -RRB- $ -LRB- LINK -RRB- - o model $ -LRB- OBJ -RRB- ... . F.o : cpp $ -LRB- INCLUDES -RRB- - C - P $ * . F | flic - F = FLICFILE > $ * . flic m4 FLIC2RSL.m4 $ * . flic | cpp - C - P > $ * . f $ -LRB- FC -RRB- - c $ -LRB- OPTIM -RRB- $ -LRB- DEBUG -RRB- $ -LRB- F77_FLAGS -RRB- $ * . f In this example , the source file solver.F contains CPP directives that are independent of the parallelization -LRB- #include directives and conditional compilation directives , for example -RRB- . The first line passes solver.F through the C preprocessor , cpp ; the output is piped into FLIC . 1 The piped-in code that FLIC sees will be entirely Fortran -LRB- no CPP directives -RRB- and completely expanded . FLIC recognizes and expands normal Fortran INCLUDE statements , so it is not necessary to use CPP as a preprocessor to FLIC if the only concern is expansion of included files . FLIC transforms the source file , using directives in the file FLICFILE ; output is directed to a temporary file , solver.flic . This file is then input to the M4 macro preprocessor , along with a set of macros targeting RSL , in the file FLIC2RSL.m4 . This particular set of macro expansions generates a small number of additional directives that are expanded by piping M4 output to a second call to cpp . Output is directed to a file solver.f , which is then input to the Fortran compiler . 4 Conclusion FLIC transforms loops and array indices in a Fortran source file for implementation on distributed-memory parallel computers . FLIC analyzes the code , identifying loops over decomposed dimensions and local and global index expressions , and generates a small set of 1Note the use of the - C and - P options to cpp . The - C option makes the preprocessor ignore and pass through things that might look like C-style comments . This prevents occurrences of the string \ / * '' in a Fortran FORMAT statement from voiding the remainder of the file . The - P option suppresses the generation of line control information in the cpp output . These are highly recommended whenever cpp is used to preprocess Fortran source . in-line macros that are then easily expanded to target the user 's distributed-memory library or run-time system of choice . A number of macro-expansions are provided with the FLIC distribution . The tool is lightweight enough to be included in a Make file , so that only the compiler need ever see the transformed code . The tool does not address data dependency or interprocessor communication , but still provides considerable savings in programmer time and effort , since loop and index translations are by far the most extensive and error-prone modifications required to convert a code to distributed memory . Providing access to these program loops and index expressions through macros as a precompiling step also facilitates other translations such as cache blocking . Because it is built using a fully enabled Fortran parser , FLIC is able to perform the necessary transformations using unaltered Fortran source files and a very small amount of input data from the command line or a small file , as opposed to tools that rely on pattern matching and that require directives scattered throughout the code . This capability eliminates the need to modify the source code , and enables a same-source approach to development and maintenance of codes for multiple computer architectures . References -LSB- 1 -RSB- R. Friedman , J. Levesque , and G. Wagenbreth , Fortran Parallelization Handbook , Applied Parallel Research Inc. , Sacramento , California , June 1995 . -LSB- 2 -RSB- R. Hempel and H. Ritzdorf , The GMD communications library for grid-oriented problems , Tech . Rep. GMD-0589 , German National Research Center for Information Technology , 1991 . -LSB- 3 -RSB- S. R. Kohn and S. B. Baden , A Parallel Software Infrastructure for Structured Adaptive Mesh Methods , in Proceedings of Supercomputing ' 95 , IEEE Computer Society Press , 1996 . -LSB- 4 -RSB- S. Kothari , Parallelization Agent for Legacy Codes , draft technical report , Iowa State University , Ames , Iowa , 1996 . -LSB- 5 -RSB- J. Michalakes , RSL : A Parallel Runtime System Library for Regular Grid Finite Difference Models Using Multiple Nests , Tech . Rep. ANL/MCS-TM -197 , Mathematics and Computer Science Division , Argonne National Laboratory , Argonne , Illinois , December 1994 . -LSB- 6 -RSB- B. Rodriguez , L. Hart , and T. Henderson , A Library for the Portable Paralllelization of Operational Weather Forecast Models , in Coming of Age : Proceedings of the Sixth ECMWF Workshop on the Use of Parallel Procesors in Meteorology , World Scientific , River Edge , NJ , 1995 , pp. 148 -LCB- 161 .

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O

distributed-memory parallel computing
parallel tools
regular grids
same-source strategy
weather modeling