199 lEEE 2, JUNE 1975 The Programming Language Concurrent Pascal PER BRINCH HANSEN Abstract—The paper describes a new programming language for structured programming of computer operating systems. It ex- tends the sequential programming language Pascal with concurrent programming tools called processes andmonitors. Section I explains these concepts informally by means of pictures illustrating a hier- archical design of a simple spooling system. Section IIuses the same example to introduce the language notation. The main contribution of Concurrent Pascal is to extend the monitor concept with an ex- plicit hierarchy of access rights to shared data structures that can be statedin the program text and checked by a compiler. Index Terms Abstract data types, access rights, classes, con- current processes,— concurrent programming languages, hierarchical operating systems, monitors, scheduling, structured multiprogram- ming. I. THE PURPOSE OF CONCURRENT PASCAL A. Background Fig. 2. Process. 1972 I have been working on a newprogramming programming computer SINCElanguage for structured of The next picture shows a process component in more operating systems. This language is called Concurrent detail (Fig. 2). language Pascal. It extends the sequential programming A process consists of a private data structure and a processes Pascal with concurrent programming tools called sequential program that can operate on the data. One and monitors [l]-[3]. process cannot operate on the private data of another Pascal. It This is an informal description of Concurrent process. But concurrent processes can share certain data to bring out the uses examples, pictures, and words crea- structures (such as a disk buffer) The access rights of a concepts without getting . tive aspects of newprogramming process mention the shared data it can operate on. into their finer details. I plan to define these concepts preciselyand introduce a notation for themin laterpapers. C. Monitors may imprecise from a formal This form of presentation be A disk buffer is a data structure shared by two concur- perhaps more effective from a human point of view, but is rent processes. The details of how such a buffer is con- point of view. structed are irrelevant to its users. All the processes need to they can send and receive data through it. B. Processes know is that If they try to operate on the buffer in any other way it is We will study concurrent processes inside an operating probably either a programming mistake or an example of system and look at one small problem only: how can large tricky programming. In both cases, one would like a amounts of data be transmitted from one process to compiler to detect such misuse of a shared data structure. another by means of a buffer stored on a disk? To make this possible, we must introduce a language Fig. 1 shows this little system and its three components : construct that will enable aprogrammerto tell a compiler a process that produces data, a process that consumes how a shared data structure can be used by processes. data, and a disk buffer that connects them. This kind of system component is called a monitor. A Thecircles are system components and the arrows are the monitor can synchronize concurrent processes and trans- access rights of these components. They show that both mit data between them. It can also control the order in processes can use the buffer (but they do not show that which competing processes use shared, physical resources. data flows from the producer to the consumer) . Thiskind Fig. 3 shows a monitor in detail. of picture is an access graph. A monitor defines a shared data structure and all the operations processes can perform on it. These synchroniz- Manuscript received February 1, 1975. This project is supported ing operations are called monitor procedures. A monitor by the National Science Foundation under Grant DCR74- 17331. also defines an initial operation that will be executed when The author is with the Department of Information California Institute of Technology, Pasadena, Calif. 91125. its data structure is created. Copyright © 1976by The Institute of Electrical and Electronlci Engineers, Inc. Printed in U.S.A. Annals No. 5075E007 TRANSACTIONS ON SOFTWARE ENGINEERING, VOL. SE-1,NO. aa Science, 200 lEEE TRANSACTIONS JUNE 1975 PASCAL 201 Access rights Shored data Virtual disk Card reader Disk buffers Line printer Console Synchronizing operations Console resource Disk buffer Initial operation Fig. Virtual consoles Input process Job process Output process 5. Buffer refinement. Fig. 3. Monitor. Fig. 4. Spooling system. Fig. 7. Decomposition of virtual consoles. We can define Virtual consoles a disk buffer as a monitor. Within this the disk. So a monitor can also have access rights to other monitor there will be shared variables that define the system components (see Fig. 3) . location and length of the buffer on the disk. There will Disk also be two monitor procedures, send and receive. The D - system Design Console resource initial operation Disk resource will make sure that the buffer starts as A process executes a sequential program-itis active an empty one. an component. A monitor is just a collection of procedures Virtuol consoles Processes cannot operate directly on Virtual disks shared data. They that do nothing until they are called by processes-it is a can only call monitor procedures that have access to passive component, But there are strong similarities Fig. 6. Decomposition of virtual disks. shared data. A monitor procedure is executed as part of a between a process and a monitor: both define a data calling process (just like any other procedure) . structure (private or shared) and the meaningful opera- lf concurrent processes Each virtual disk is only used by a single disk buffer simultaneously call monitor tions on it, The main difference between processes procedures and (Fig. 5). A system component that cannot be that operate on the same shared data these monitors is the way they are scheduled for execution called procedures must be executed simultaneously by several other components will be called strictly one at a time. Other- It seems natural therefore to regard processes and wise, the results of monitor a class. A class defines a data structure and the possible calls will be unpredictable, monitors as abstract data types defined in terms of the This means that the machine operations on it (just like a monitor). The exclusive must be able to delay operations one can perform on them. If a compiler can processesfor short periods access of class procedures to class variables can be guaran- of time until it is their turn to check that these operations are the only ones carried execute monitor procedures. teed completely at compile time. The virtual machine We will not be concerned out on the data structures, then we may be able to build about how this is done, does not have to schedule simultaneous calls of class but will just notice that a monitor very reliable, concurrent programs in which controlled Input process Job process Output process procedure procedures at run time, because such calls cannot occur. has exclusive access to shared data while it is access to data and physical resources is guaranteedbefore being This makes class calls considerably faster than monitor Fig. 8. Hierarchicalsystem structure. executed. these programs are put into operation. We have then to bo the (virtual) calls. machine on which concurrentprograms some extent solved the resource protection problem in the run The spooling system includes two will handle short-term scheduling of simultaneous cheapest possible manner (without hardware virtual disks but to control disk scheduling within the monitor illusory. To mechanisms onlyonereal disk. So we a monitor calls. But the programmer must also be able to and run time overhead). need single disk resource monitor give the programmercomplete control of disk scheduling, delayprocesses longer to control the order in which competing processes use processes to enter queue for periods of time if their requests So we will define processes and monitors as data types the should be able the disk during for data disk (Fig. 6). This monitor defines two procedures, request and other resources cannot be satisfied immedi- and make it possible to use several instances of the same disk transfers. Since arrival and service in the disk queueing ately. If, for example, a process and release access, to be called by a virtual disk before and system are tries to receive data from component type in a system. We can, for example, use potentially simultaneous 'Operations they must an empty disk buffer after each disk transfer. be handled by different it must be delayed until another two disk buffers to build a spooling system with an input system components, as shown in process sends more data. It would seem simpler to replace the virtual disks and Fig. 6. procesS) a job procesS; and an Qutput prQcegs (Rg 4) j Concurrent Pascal includes a simple the disk resource by a single monitor that has exclusive If the disk fails persistently during input/output this data type, called will distinguish between definitions and instances of com- a queue, that can be access to the disk and does the input/output. This would on an operator's used by monitorprocedures tocontrol ponents by calling them system types and system compo- should be reported console. Fig. 6 shows medium-term scheduling processes. certainly guarantee that processes use the disk one at a two instances of a class type, a They of A monitor can either nents. Access graphs (such as Fig. 4) will always show called virtual console. delay a process time. But this would be done according to the built-in give calling in a queue or continue another system components (not system types) the virtual disks the illusion that they have their process that is short-term scheduling policy of monitor calls.