With the acknowledged benefits of microservices architectures, such as scalability, flexibility, improved maintenance, and deployment, legacy software systems are increasingly being reengineered into microservices. Recently, a plethora of methods, techniques, tools, and evaluation criteria for reengineering software systems into microservices have been proposed without being systematized. The objective of this work is to conduct an in-depth systematic literature review to identify and analyze methods, techniques, and tools for reengineering software systems into microservices and the ways for evaluating such reengineering initiatives and their results. A systematic literature review of works on reengineering software systems into microservices was performed, yielding 117 primary studies. The review focused on addressing key research questions concerning the evolution of microservices reengineering, methodologies employed, tools available, and the challenges faced in the reengineering process. We used a taxonomy development method to systematize knowledge in these areas. The analysis revealed multiple reengineering approaches: static, dynamic, hybrid, and artifact-driven. Significant evaluation criteria identified include coupling, cohesion, and modularity. Key paradigms for microservices reengineering, such as domain-driven design and interface analysis, were identified and discussed. The study also highlights that incremental and iterative transitions are favored in practice. This study provides a structured overview of the current state of research on reengineering software systems into microservices. It highlights challenges in existing reengineering methodologies. Future directions include validating behavioral equivalence of original and reengineered systems, automating microservices generation, and refining database layer partitioning. The findings emphasize the need for further work to enhance the reengineering process and evaluation of the transition between monolithic and microservices architectures.

Breakthroughs in edge computing offer new prospects for businesses to extend Industrial Internet of Things (IIoT) networks beyond analytics to actionable processing. In particular, cloud-based business processes, which provide administrative actions and rules through workflow-sequenced activities, can be streamlined on the edge for low-latency access in physical spaces. Although this advances business controls, particularly for critical events of industrial applications, it faces operational barriers. Edge devices, which support high volume and competing demands from a large number of sensors, vary in capacity, reliability, and proximity to sensors and cloud gateways. This warrants a highly efficient placement of process activities, from cloud to edge, given a variety of constraints, including resource demand, capacity, and compatibility, to satisfy timeliness constraints. In contrast to the related IIoT optimization research underway, including those of singleton service placements, business processes pose new challenges. Not only do sets of dependent activities have to be considered for co-deployment, but the meaning of timing constraints needs to be respected, given alternative, parallel, and iterative control-flow paths in processes. In addition, instantiation (replication) to scale activities for increasing data volumes poses further deployment constraints, i.e., on sets of nodes supporting dynamic instantiation of order-dependent activities. Here we present an optimization strategy for business processes that addresses these challenges. We first conceptualize processes in coherent fragments to precisely derive both responsiveness and throughput execution time heuristics and formulate a multi-objective process placement problem. Next, we develop a genetic algorithm-based process placement procedure. To adapt to fluctuating event frequencies, we support an interplay between scaling algorithms for service instances and process placement optimization. Validation through an industrial safety monitoring use case drawn from the construction industry shows that our approach improves timeliness responses by almost one-third and more than doubles execution throughput compared to existing methods.

Fog computing offers increased performance and efficiency for Industrial Internet of Things (IIoT) applications through distributed data processing in nearby proximity to sensors. Given resource constraints and their contentious use in IoT networks, current strategies strive to optimise which data processing tasks should be selected to run on fog devices. In this paper, we advance a more effective data processing architecture for optimisation purposes. Specifically, we consider the distinct functions of sensor data streaming, multi-stream data aggregation and event handling, required by IoT applications for identifying actionable events. We retrofit this event processing pipeline into a logical architecture, structured as a service function tree (SFT), comprising service function chains. We present a novel algorithm for mapping the SFT into a fog network topology in which nodes selected to process SFT functions (microservices) have the requisite resource capacity and network speed to meet their event processing deadlines. We used simulations to validate the algorithm’s effectiveness in finding a successful SFT mapping to a physical network. Overall, our approach overcomes the bottlenecks of single service placement strategies for fog computing through composite service placements of SFTs.

In a multimode industrial control system, mode switching decisions have to follow standard operating procedures which are set for the safety of the system based on the operating limitations of equipment. A rich literature can be found on monitoring multimode systems. However, that work is mainly focused on mode identification and monitoring anomalies in the process running under each mode. Instead, we present a data-driven method for monitoring the modes’ switching constraints. This article is based on state-transition matrix and decision-tree methods to discover data-driven mode switching conditions. Moreover, our approach is not limited to only threshold based condition learning. To capture data trajectory-based conditions, we adopt a functional data descriptors method. In practical experiments, we showed that our approach can discover anomalous mode-switching decisions which cannot be discovered by previous multimode process-monitoring methods.

Due to the rise of Industrial Control Systems (ICSs) cyber-attacks in the recent decade, various security frameworks have been designed for anomaly detection. While advanced ICS attacks use sequential phases to launch their final attacks, existing anomaly detection methods can only monitor a single source of data. However, analysis of multiple security data could provide more comprehensive and system-wide anomaly detection in industrial networks. In this paper, we present an anomaly detection framework for ICSs that consists of two stages: i) blockchain-based log management where the logs of ICS devices are collected in a secure and distributed manner, and ii) multi-source anomaly detection where the blockchain logs are analysed using multi-source deep learning which in turn provides a system wide anomaly detection method. We validated our framework using two ICS datasets: a factory automation dataset and a Secure Water Treatment (SWaT) dataset. These datasets contain physical and network level normal and abnormal traffic. The performance of our new framework is compared with single-source machine learning methods. The precision of our framework is 95% which is comparable with single-source anomaly detectors. However, multi-source analysis is more robust because it can detect anomalies from multiple sources simultaneously, while achieving comparable precision for each of the sources.

The widespread adoption of Electronic Health Records (EHR) increases the requirement for sufficient auditing mechanisms enabled with health information technologies to protect against deliberate and accidental information misuses. Shared information environments improve the quality of healthcare. Healthcare environments are characterized by unanticipated emergency situations where access to information is essential. The ordinary work-flow of the health system may need to be violated in emergency situations in a \textit{break-the-glass} approach. Hence, a purely preventive approach for information access use is not adequate for the current trends of electronic healthcare systems. Instead, after-the-fact justification of patient data access violations is required. Assessing root causes for unusual human behaviours is feasible through maintenance and analysis of appropriate event logs. Here we describe the challenges of detecting information privacy violations of current EHR systems during emergency situations. We define how a log file with additional information could be used to detect deviations from expected sequences of events during emergency situations in healthcare.

Due to the growing use of digital technologies and Electronic Health Record systems, new auditing mechanisms are needed to help protect stakeholders from information misuse, both deliberate and accidental. Electronic storage of health records and use of sensor networks, wearable and ubiquitous health tracking devices raise numerous privacy related threats for both healthcare providers and their patients. A purely preventive approach to information access is not appropriate in healthcare scenarios, especially during emergencies, so after-the-fact justifications are needed to manage information handling risks in such an environment. To allow such justifications we need to analyse the root causes for unusual human actions or behaviours but current system event logs are inadequate for this purpose. Hence, a better solution would be to generate audit logs sufficient for analysing information use anomalies. Here we explain the limitations of existing event logs in clinical settings when attempting to perform after-the-fact justifications as part of a clinical Information Accountability system. From this we recommend additional features that must be added to event logs to support a healthcare-based Information Accountability Framework.

Capturing data from various data repositories and integrating them for productivity improvements is common in modern business organisations. With the well-accepted concept of achieving positive gains through investment in employee health and wellness, organisations have now started to capture both employee health and non-health data as Employer Sponsored electronic Personal Health Records (ESPHRs). However, non-health related data in ESPHRs has hardly been taken into consideration, with outcomes such as employee productivity potentially being suited for further validation and stimulation of ESPHR usage. Here we analyse selected employee demographic information (age, gender, marital status, and job grade) and employee health-related outcomes (absenteeism and presenteeism) to support evidence-based decision making. Our study considered demographic and health-related outcomes of 700 employees. Surprisingly, the analysis shows that employees with high sick leave rates are also high performers. A factor analysis shows 92% of the variance in the data can be explained by three factors, with the job grade capable of explaining 62% of the variance. Work responsibilities may drive employees to maintain high work performance despite signs of sickness, so ESPHRs should focus attention on high performers. This finding suggests new ways of extracting value from ESPHRs to support organisational health and wellness management to help assure sustainability in organisational productivity.

The requirement of distributed computing of all-to-all comparison (ATAC) problems in heterogeneous systems is increasingly important in various domains. Though Hadoop-based solutions are widely used, they are inefficient for the ATAC pattern, which is fundamentally different from the MapReduce pattern for which Hadoop is designed. They exhibit poor data locality and unbalanced allocation of comparison tasks, particularly in heterogeneous systems. The results in massive data movement at runtime and ineffective utilization of computing resources, affecting the overall computing performance significantly. To address these problems, a scalable and efficient data and task distribution strategy is presented in this paper for processing large-scale ATAC problems in heterogeneous systems. It not only saves storage space but also achieves load balancing and good data locality for all comparison tasks. Experiments of bioinformatics examples show that about 89% of the ideal performance capacity of the multiple machines have be achieved through using the approach presented in this paper.

Automated marking of student programming assignments has long been a goal of IT educators. Much of this work has focused on the correctness of small student programs, and only limited attention has been given to systematic assessment of the effectiveness of student testing. In this work, we introduce SAM (the Seeded Auto Marker), a system for automated assessment of student submissions which assesses both program code and unit tests supplied by the students. Our central contribution is the use of programs seeded with specific bugs to analyse the effectiveness of the students' unit tests. Beginning with our intended solution program, and guided by our own set of unit tests, we create a suite of minor variations to the solution, each seeded with a single error. Ideally, a student's unit tests should not only identify the presence of the bug, but should do so via the failure of as small a number of tests as possible, indicating focused test cases with minimal redundancy. We describe our system, the creation of seeded test programs and report our experiences in using the approach in practice. In particular, we find that students often fail to provide appropriate coverage, and that their tests frequently suffer from their poor understanding of the limitations imposed by the abstraction.

Summary Many software applications extend their functionality by dynamically loading libraries into their allocated address space. However, shared libraries are also often of unknown provenance and quality and may contain accidental bugs or, in some cases, deliberately malicious code. Most sandboxing techniques that address these issues require recompilation of the libraries using custom tool chains, require significant modifications to the libraries, do not retain the benefits of single address space programming, do not completely isolate guest code, or incur substantial performance overheads. In this paper, we present LibVM, a sandboxing architecture for isolating libraries within a host application without requiring any modifications to the shared libraries themselves, while still retaining the benefits of a single address space and also introducing a system call inter‐positioning layer that allows complete arbitration over a shared library's functionality. We show how to utilize contemporary hardware‐virtualization support towards this end with reasonable performance overheads, and, in the absence of such hardware support, our model can also be implemented using a software‐based mechanism. We ensure that our implementation conforms as closely as possible to existing shared library manipulation functions, minimizing the amount of effort needed to apply such isolation to existing programs. Our experimental results show that it is easy to gain immediate benefits in scenarios where the goal is to guard the host application against unintentional programming errors when using shared libraries, as well as in more complex scenarios, where a shared library is suspected of being actively hostile. In both cases, no changes are required to the shared libraries themselves. Copyright © 2014 John Wiley & Sons, Ltd.

Distributed computation and storage have been widely used for processing of big data sets. For many big data problems, with the size of data growing rapidly, the distribution of computing tasks and related data can affect the performance of the computing system greatly. In this paper, a distributed computing framework is presented for high performance computing of All-to-All Comparison Problems. A data distribution strategy is embedded in the framework for reduced storage space and balanced computing load. Experiments are conducted to demonstrate the effectiveness of the developed approach. They have shown that about 88% of the ideal performance capacity can be achieved in multiple machines through using the approach presented in this paper.

This paper presents a new framework for distributed intrusion detection based on taint marking. Our system tracks information flows between applications of multiple hosts gathered in groups (i.e. sets of hosts sharing the same distributed information flow policy) by attaching taint labels to system objects such as files, sockets, Inter Process Communication (IPC) abstractions, and memory mappings. Labels are carried over the network by tainting network packets. A distributed information flow policy is defined for each group at the host level by labeling information and defining how users and applications can legally access, alter or transfer information towards other trusted or untrusted hosts. As opposed to existing approaches, where information is most often represented by two security levels (low/high, public/private etc.), our model identifies each piece of information within a distributed system, and defines their legal interaction in a fine-grained manner. Hosts store and exchange security labels in a peer to peer fashion, and there is no central monitor. Our IDS is implemented in the Linux kernel as a Linux Security Module (LSM) and runs standard software on commodity hardware with no required modification. The only trusted code is our modified operating system kernel. We finally present a scenario of intrusion in a web service running on multiple hosts, and show how our distributed IDS is able to report security violations at each host level.

An Application Specific Instruction-set Processor (ASIP) is a specialized processor tailored to run a particular application/s efficiently. However, when there are multiple candidate applications in the application's domain it is difficult and time consuming to find optimum set of applications to be implemented. Existing ASIP design approaches perform this selection manually based on a designer's knowledge. We help in cutting down the number of candidate applications by devising a classification method to cluster similar applications based on the special-purpose operations they share. This provides a significant reduction in the comparison overhead while resulting in customized ASIP instruction sets which can benefit a whole family of related applications. Our method gives users the ability to quantify the degree of similarity between the sets of shared operations to control the size of clusters. A case study involving twelve algorithms confirms that our approach can successfully cluster similar algorithms together based on the similarity of their component operations.

Real-time networked control systems (NCSs) over data networks are being increasingly implemented on a massive scale in industrial applications. Along with this trend, wireless network technologies have been promoted for modern wireless NCSs (WNCSs). However, popular wireless network standards such as IEEE 802.11/15/16 are not designed for real-time communications. Key issues in real-time applications include limited transmission reliability and poor transmission delay performance. Considering the unique features of real-time control systems, this paper develops a conditional retransmission enabled transport protocol (CRETP) to improve the delay performance of the transmission control protocol (TCP) and also the reliability performance of the user datagram protocol (UDP) and its variants. Key features of the CRETP include a connectionless mechanism with acknowledgment (ACK), conditional retransmission and detection of ineffective data packets on the receiver side.

Refactoring focuses on improving the reusability, maintainability and performance of programs. However, the impact of refactoring on the security of a given program has received little attention. In this work, we focus on the design of object-oriented applications and use metrics to assess the impact of a number of standard refactoring rules on their security by evaluating the metrics before and after refactoring. This assessment tells us which refactoring steps can increase the security level of a given program from the point of view of potential information flow, allowing application designers to improve their system's security. at an early stage.

Wireless network technologies, such as IEEE 802.11 based wireless local area networks (WLANs), have been adopted in wireless networked control systems (WNCS) for real-time applications. Distributed real-time control requires satisfaction of (soft) real-time performance from the underlying networks for delivery of real-time traffic. However, IEEE 802.11 networks are not designed for WNCS applications. They neither inherently provide quality-of-service (QoS) support, nor explicitly consider the characteristics of the real-time traffic on networked control systems (NCS), i.e., periodic round-trip traffic. Therefore, the adoption of 802.11 networks in real-time WNCSs causes challenging problems for network design and performance analysis. Theoretical methodologies are yet to be developed for computing the best achievable WNCS network performance under the constraints of real-time control requirements. Focusing on IEEE 802.11 distributed coordination function (DCF) based WNCSs, this paper analyses several important NCS network performance indices, such as throughput capacity, round trip time and packet loss ratio under the periodic round trip traffic pattern, a unique feature of typical NCSs. Considering periodic round trip traffic, an analytical model based on Markov chain theory is developed for deriving these performance indices under a critical real-time traffic condition, at which the real-time performance constraints are marginally satisfied. Case studies are also carried out to validate the theoretical development.

Type unions, pointer variables and function pointers are a long standing source of subtle security bugs in C program code. Their use can lead to hard-to-diagnose crashes or exploitable vulnerabilities that allow an attacker to attain privileged access over classified data. This paper describes an automatable framework for detecting such weaknesses in C programs statically, where possible, and for generating assertions that will detect them dynamically, in other cases. Exclusively based on analysis of the source code, it identifies required assertions using a type inference system supported by a custom made symbol table. In our preliminary findings, our type system was able to infer the correct type of unions in different scopes, without manual code annotations or rewriting. Whenever an evaluation is not possible or is difficult to resolve, appropriate runtime assertions are formed and inserted into the source code. The approach is demonstrated via a prototype C analysis tool.

Traditional access control models protect sensitive data from unauthorised direct accesses; however, they fail to prevent indirect inferences. Information disclosure via inference channels occurs when secret information is derived from unclassified (non-secure) information and other sources like metadata and public observations. Previously, techniques using precise and fuzzy functional dependencies were proposed to detect inference channels. However, such methods are inappropriate when probabilistic relationships exist among data items that may be used to infer information with a predictable likelihood of accuracy. In this paper, the authors present definitions and algorithms for detecting inference channels in a probabilistic knowledge base and maximising an attacker’s uncertainty by restricting selected inference channels to comply with data confidentiality and privacy requirements. As an illustration, a healthcare scenario is used to show how inference control can be performed on probabilistic relations to address patients’ privacy concerns over Electronic Medical Records. To limit an attacker’s ability to know secret data selected inference channels are restricted by using a Bayesian network that incorporates the information stored within a medical knowledge base to decide which facts must be hidden to limit undesired inferences.

We present a new penalty-based genetic algorithm for the multi-source and multi-sink minimum vertex cut problem, and illustrate the algorithm's usefulness with two real-world applications. It is proved in this paper that the genetic algorithm always produces a feasible solution by exploiting some domain-specific knowledge. The genetic algorithm has been implemented on the example applications and evaluated to show how well it scales as the problem size increases.

This paper reports on a replication of earlier studies into a possible hierarchy of programming skills. In this study, the students from whom data was collected were at a university that had not provided data for earlier studies. Also, the students were taught the programming language Python, which had not been used in earlier studies. Thus this study serves as a test of whether the findings in the earlier studies were specific to certain institutions, student cohorts, and programming languages. Also, we used a non–parametric approach to the analysis, rather than the linear approach of earlier studies. Our results are consistent with the earlier studies. We found that students who cannot trace code usually cannot explain code, and also that students who tend to perform reasonably well at code writing tasks have also usually acquired the ability to both trace code and explain code.

Security-critical communications devices must be evaluated to the highest possible standards before they can be deployed. This process includes tracing potential information flow through the device's electronic circuitry, for each of the device's operating modes. Increasingly, however, security functionality is being entrusted to embedded software running on microprocessors within such devices, so new strategies are needed for integrating information flow analyses of embedded program code with hardware analyses. Here we show how standard compiler principles can augment high-integrity security evaluations to allow seamless tracing of information flow through both the hardware and software of embedded systems. This is done by unifying input/output statements in embedded program execution paths with the hardware pins they access, and by associating significant software states with corresponding operating modes of the surrounding electronic circuitry.

Discrete event-driven simulations of digital communication networks have been used widely. However, it is difficult to use a network simulator to simulate a hybrid system in which some objects are not discrete event-driven but are continuous time-driven. A networked control system (NCS) is such an application, in which physical process dynamics are continuous by nature. We have designed and implemented a hybrid simulation environment which effectively integrates models of continuous-time plant processes and discrete-event communication networks by extending the open source network simulator NS-2. To do this a synchronisation mechanism was developed to connect a continuous plant simulation with a discrete network simulation. Furthermore, for evaluating co-design approaches in an NCS environment, a piggybacking method was adopted to allow the control period to be adjusted during simulations. The effectiveness of the technique is demonstrated through case studies which simulate a networked control scenario in which the communication and control system properties are defined explicitly.

In this paper we show how to use a computer processor's time stamp counter register to provide a precise and stable time reference, via a high-precision relative clock synchronization protocol. Existing clock synchronization techniques, such as the network time protocol, were designed for wide-area networks with large propagation delays, but the millisecond-scale precision they offer is too coarse for local-area applications such as instrument monitoring systems, high-quality digital audio systems and sensor networks. Our new clock synchronization technique does not require specialized hardware but instead uses the Time stamp counter already available in the widely-used Intel Pentium processor. Experimental results show that we can achieve a synchronization precision in the order of 10 microseconds in a small-scale local area network using TSC registers, which is much higher than can be achieved by using a computer processor's time-of-day clock.

Abstract High-level language program compilation strategies can be proven correct by modelling the process as a series of refinement steps from source code to a machine-level description. We show how this can be done for programs containing recursively-defined procedures in the well-established predicate transformer semantics for refinement. To do so the formalism is extended with an abstraction of the way stack frames are created at run time for procedure parameters and variables.

Embedded control programs are hard to analyse because their behaviour depends on how they interact with hardware devices. In particular, embedded code typically uses interrupts to respond to external events in a timely manner. Such asynchronous control constructs make static analysis difficult due to the potentially large number of alternative control-flow paths they allow. We show how model checking can be used to effectively analyse the behaviour of interrupt-dependent programs. This is done by developing an abstraction of the code that captures its essential timing and functional properties, including those related to external interrupts. The model is made efficient by grouping program instructions into basic blocks whose behaviour is atomic with respect to interrupts.

Information security devices must preserve security properties even in the presence of faults. This in turn requires a rigorous evaluation of the system behaviours resulting from component failures, especially how such failures affect information flow. We introduce a compositional method of static analysis for fail-secure behaviour. Our method uses reachability matrices to identify potentially undesirable information flows based on the fault modes of the system's components.

Previous work on formally modelling and analysing program compilation has shown the need for a simple and expressive semantics for assembler level programs. Assembler programs contain unstructured jumps and previous formalisms have modelled these by using continuations, or by embedding the program in an explicit emulator. We propose a simpler approach, which uses techniques from compiler theory in a formal setting. This approach is based on an interpretation of programs as collections of program paths, each of which has a weakest liberal precondition semantics. We then demonstrate, by example, how we can use this formalism to justify the compilation of block-structured high-level language programs into assembler.

Abstract. We present an abstract model of the leader election protocol used in the IEEE 1394 High Performance Serial Bus standard. The model is expressed in the probabilistic Guarded Command Language . By formal reasoning based on this description, we establish the probability of the root contention part of the protocol successfully terminating in terms of the number of attempts to do so. Some simple calculations then allow us to establish an upper bound on the time taken for those attempts.

Abstract. This paper defines an algorithm for predicting worst-case and best-case execution times, and determining execution-time constraints of control-flow paths through real-time programs using their partial correctness semantics. The algorithm produces a linear approximation of path traversal conditions, worst-case and best-case execution times and strongest postconditions for timed paths in abstract real-time programs. Also shown are techniques for determining the set of control-flow paths with decidable worst-case and best-case execution times. The approach is based on a weakest liberal precondition semantics and relies on supremum and infimum calculations similar to standard computations from linear programming and Presburger arithmetic. The methodology is applicable to any executable language with a predicate transformer semantics and hence provides a verification basis for both high-level language and assembly code execution-time analysis.

Abstract The refinement calculus is a well-established theory for deriving program code from specifications. Recent research has extended the theory to handle timing requirements, as well as functional ones, and we have developed an interactive programming tool based on these extensions. Through a number of case studies completed using the tool, this paper explains how the tool helps the programmer by supporting the many forms of variables needed in the theory. These include simple state variables as in the untimed calculus, trace variables that model the evolution of properties over time, auxiliary variables that exist only to support formal reasoning, subroutine parameters, and variables shared between parallel processes.

Many automated programming environments construct software by integrating predefined components from a software library. A fundamental challenge in this process is to match the programmer's specified requirements against the stated capabilities of the components. We explain how the chances of successfully achieving a match can be increased by taking the program context surrounding each requirement into consideration. Formal rules, based on program refinement theory, are defined for context-based matching. The rules allow properties that can be proven to hold at a particular point in the program to justify matching with components that operate correctly only in such a context.

Refinement is the process of deriving verifiably-correct software from its specification. In practice, however refinement steps are complex and difficult to prove correct. We show how animation can be used to provide insights into the correctness, or otherwise, of refinement steps for the most general form of data refinement in which the whole system design can be changed in a single step.

Computer software now controls critical systems worldwide. International standards require such programs to be produced from mathematically-precise specifications, but the techniques and tools involved are highly complex and unfamiliar to most programmers. We present a formal basis for extending a tool already used by software developers, the program compiler, to undertake much of the task automatically. This is done by devising a code generation strategy, based on program refinement theory, capable of translating specification constructs embedded in programs into executable code, without the need for programmer intervention.

We show how familiar mathematical concepts from differential and integral calculus can be represented in the Z specification language. Digital computer systems involve hardware devices and software variables that can adopt a limited range of values only, and may be temporarily inaccessible or ill-defined. Emphasis is therefore given to supporting discrete range types and partial functions.

Abstract Action systems are a formalism for representing concurrent behaviours, based on interleaved atomic actions. We show how this model can be used to represent time-consuming, pre-emptible actions with real-time constraints. A development procedure is described which captures the steps programmers typically undertake in the design of real-time multi-tasking systems.

The process models of Ada and occam are formally based on the CSP process algebra. However, for fine-tuning real-time performance, they include “prioritized” constructs that have no counterparts in CSP. These constructs therefore lack any formal definition, a situation that leaves room for misunderstandings. We extend CSP with a formal definition of the notion of priority. The definition is then used to assess the transputer implementation of priority in occam and the definition of priority in Ada.

Abstract To explain his abstract model of Communicating Sequential Processes, Hoare includes an implementation of the concepts being expounded as a set of LISP functions. However, the final sections are only described sketchily. This paper completes the missing details, and briefly discusses experience with the system. The usefulness of the implementation is enhanced by the addition of features to ensure that incomplete program fragments can be executed, and that no restrictions are placed on the way operators may be combined.