Distributed Strategic Interleaving with Load Balancing

Transcription

1 Distributed Strategic Intereaving with Load Baancing J.A. Bergstra 1,2 and C.A. Middeburg 1,3 1 Programming Research Group, University of Amsterdam, P.O. Box 41882, 1009 DB Amsterdam, the Netherands 2 Department of Phiosophy, Utrecht University, P.O. Box 80126, 3508 TC Utrecht, the Netherands 3 Computing Science Department, Eindhoven University of Technoogy, P.O. Box 513, 5600 MB Eindhoven, the Netherands [email protected],[email protected] Abstract. In a previous paper, we deveoped an agebraic theory of threads, intereaving of threads, and interaction of threads with services. In the current paper, we assume that the threads and services are distributed over the nodes of a network. We extend the theory deveoped so far to the distributed case by introducing distributed intereaving strategies that support expicit thread migration and see to oad baancing or capabiity searching by impicit thread migration. Keywords: thread agebra, distributed strategic intereaving, thread migration, oad baancing, capabiity searching CR Categories: C.2.4, D.1.3,.1.2, Introduction The objective of this paper is to deveop an agebraic theory of threads, intereaving of threads, and interaction of threads with services that covers the case where the threads and services are distributed over the nodes of a network and both expicit thread migration and impicit thread migration take pace. A thread is the behaviour of a deterministic sequentia program under execution. Muti-threading refers to the concurrent existence of severa threads in a program under execution. Muti-threading is the dominant form of concurrency provided by contemporary object-oriented programming anguages such as Java [14] and C# [15]. Arbitrary intereaving, on which theories about concurrent processes such as ACP [1, 11], CCS [17] and CSP [16] are based, is not an appropriate abstraction when deaing with muti-threading. In the case of mutithreading, some deterministic intereaving strategy is used. In [7], we introduced a number of pausibe deterministic intereaving strategies for muti-threading. We proposed to use the phrase strategic intereaving for the more constrained form of intereaving obtained by using such a strategy. We aso introduced a feature for interaction of threads with services. The agebraic theory of threads,

2 intereaving of threads, and interaction of threads with services is caed thread agebra. In the current paper, we assume that the threads and services are distributed over the nodes of a network. We extend the theory deveoped so far to the distributed case by introducing distributed intereaving strategies that support expicit thread migration and see to oad baancing or capabiity searching by impicit thread migration. These distributed intereaving strategies are adaptations of the simpest intereaving strategy introduced in [7], to wit pure cycic intereaving, to the distributed case. The other intereaving strategies from [7] can be adapted in a simiar way. Load baancing and capabiity searching are considered impicit forms of thread migration that may be part of distributed intereaving strategies. Load baancing is intended for equaizing the execution speed of the different threads that exist concurrenty in a distributed system. Capabiity searching is intended for achieving that the different threads that exist concurrenty in a distributed system are executed where the services needed are avaiabe. A main assumption made in this paper is that, in the case where systems are networks of nodes over which threads and services are distributed, a singe intereaving strategy determines how the threads that exist concurrenty at the different nodes are intereaved. This is a drastic simpification, as a resut of which intuition may break down. We beieve however that some such simpification is needed to obtain a manageabe theory about the behaviour of such systems and that the resuting theory wi sometimes be adequate and sometimes be inadequate. Moreover, cycic intereaving is a simpification of the intereaving strategies actuay used. Because of the compexity of those strategies, we consider a simpification ike this one desirabe to start with. Our work on thread agebra marks itsef off from much work on the subject of muti-threading because we abandon the usua point of view that arbitrary intereaving is an appropriate abstraction when deaing with muti-threading. The foowing points iustrate why that point of view is untenabe: (i) whether the intereaving of certain threads eads to deadock depends on the intereaving strategy used; (ii) sometimes deadock takes pace with a particuar intereaving strategy whereas arbitrary intereaving woud not ead to deadock and vice versa. We give demonstrations of (i) and (ii) in [7] and [5], respectivey. The thread-service dichotomy made in thread agebra is usefu for the foowing reasons: (i) for services, a state-based description is generay more convenient than an action-based description whereas it is the other way round for threads; (ii) the interaction of threads with services is of an asymmetric nature. In [5], evidence of both (i) and (ii) is produced by the estabished connections of threads and services with processes as considered in an extension of ACP with conditions introduced in [4]. Thread agebra is a design on top of an agebraic theory of the behaviour of deterministic sequentia programs under execution introduced in [3] under the name Basic Poarized Process Agebra (BPPA). Prompted by the deveopment of thread agebra, it has been renamed to Basic Thread Agebra (BTA). 2

3 This paper is organized as foows. Before we take up intereaving strategies for threads that are distributed over the nodes of a network, we review BTA and guarded recursion in the setting of BTA (Sections 2 and 3). We aso discuss the approximation induction principe in this setting (Section 4). After that, we introduce a very simpe intereaving strategy for threads that are distributed over the nodes of a network which supports expicit thread migration (Section 5). Then, we provide a cassification of services that wi be used in subsequent sections (Section 6). oowing this, we introduce a variation of the very simpe intereaving strategy that prevents threads from migrating whie they keep ocks on shared services (Section 7). Thereupon, we introduce three variations of the second intereaving strategy that see to oad baancing by means of impicit migration (Sections 8, 9 and 10). Next, we introduce a variation of the second intereaving strategy that takes care of capabiity searching by means of impicit migration (Section 11). After that, we introduce thread-service composition to aow for threads to be affected by services (Section 12). Then, because it adds to the need for oad baancing, we introduce a basic form of thread forking (Section 13). inay, we make some concuding remarks and mention some options for future work (Section 14). 2 Basic Thread Agebra In this section, we review BTA (Basic Thread Agebra), introduced in [3] under the name BPPA (Basic Poarized Process Agebra). BTA is a form of process agebra which is taiored to the description of the behaviour of deterministic sequentia programs under execution. The behaviours concerned are caed threads. In BTA, it is assumed that there is a fixed but arbitrary set of basic actions A with tau A. We write A τ for A {tau}. The members of A τ are referred to as actions. The intuition is that each basic action performed by a thread is taken as a command to be processed by a service provided by the execution environment of the thread. The processing of a command may invove a change of state of the service concerned. At competion of the processing of the command, the service produces a repy vaue. This repy is either T or and is returned to the thread concerned. Athough BTA is one-sorted, we make this sort expicit. The reason for this is that we wi extend BTA with additiona sorts in Section 5. The agebraic theory BTA has one sort: the sort T of threads. BTA has the foowing constants and operators: the deadock constant D : T; the termination constant S : T; for each a A τ, the binary postconditiona composition operator a : T T T. Terms of sort T are buit as usua. Throughout the paper, we assume that there are infinitey many variabes of sort T, incuding x, y, z. 3

4 Tabe 1. Axiom of BTA x tau y = x tau x T1 Tabe 2. Axioms for guarded recursion X E = t X E if X =t X E RDP E X = X E if X V(E) RSP We use infix notation for postconditiona composition. We introduce action prefixing as an abbreviation: a p, where p is a term of sort T, abbreviates p a p. Let p and q be cosed terms of sort T and a A τ. Then p a q wi perform action a, and after that proceed as p if the processing of a eads to the repy T (caed a positive repy) and proceed as q if the processing of a eads to the repy (caed a negative repy). The action tau pays a specia roe. Its execution wi never change any state and aways ead to a positive repy. BTA has ony one axiom. This axiom is given in Tabe 1. Using the abbreviation introduced above, axiom T1 can be written as foows: x tau y = tau x. The structura operationa semantics of BTA can be found in [7, 8]. 3 Guarded Recursion We proceed to recursion in the current setting. We extend BTA with guarded recursion by adding constants for soutions of guarded recursive specifications and axioms concerning these additiona constants. We wi write BTA+REC for the resuting theory. A recursive specification over BTA is a set of equations E = {X = t X X V }, where V is a set of variabes of sort T and each t X is a term of sort T from the anguage of BTA+REC that ony contains variabes from V. We write V(E) for the set of a variabes that occur on the eft-hand side of an equation in E. Let t be a term of sort T from the anguage of BTA+REC containing a variabe X of sort T. Then an occurrence of X in t is guarded if t has a subterm of the form t a t containing this occurrence of X. A recursive specification E is guarded if a occurrences of variabes in the right-hand sides of its equations are guarded or it can be rewritten to such a recursive specification using the equations of E. We are ony interested in modes of BTA in which guarded recursive specifications have unique soutions. or each guarded recursive specification E and each X V(E), we add a constant of sort T standing for the unique soution of E for X to the constants of BTA. The constant standing for the unique soution of E for X is denoted by X E. Moreover, we add the axioms for guarded recursion given in Tabe 2 to BTA, where we write t X E for t X with, for a Y V(E), a occurrences of Y in t X repaced by Y E. In this tabe, X, t X and E stand for an arbitrary variabe of sort T, an arbitrary term of sort T from the anguage of BTA+REC and an 4

5 Tabe 3. Approximation induction principe n 0 πn(x) = πn(y) x = y AIP Tabe 4. Axioms for projection operators π 0 (x) = D π n+1 (S) = S π n+1 (D) = D P0 P1 P2 π n+1 (x a y) = π n(x) a π n(y) P3 arbitrary guarded recursive specification over BTA, respectivey. Side conditions are added to restrict the variabes, terms and guarded recursive specifications for which X, t X and E stand. The equations X E = t X E for a fixed E express that the constants X E make up a soution of E. The conditiona equations E X = X E express that this soution is the ony one. RDP stands for recursive definition principe and RSP stands for recursive specification principe. 4 Approximation Induction Principe Each cosed term of sort T from the anguage of BTA denotes a finite thread, i.e. a thread of which the ength of the sequences of actions that it can perform is bounded. However, not each cosed term of sort T from the anguage of BTA+REC denotes a finite thread: recursion gives rise to infinite threads. Cosed terms of sort T from the anguage of BTA+REC that denote the same infinite thread cannot aways be proved equa by means of the axioms of BTA+REC. In this section, we introduce the approximation induction principe to remedy this. The approximation induction principe, AIP in short, is based on the view that two threads are identica if their approximations up to any finite depth are identica. The approximation up to depth n of a thread is obtained by cutting it off after performing a sequence of actions of ength n. AIP is the infinitary conditiona equation given in Tabe 3. Here, foowing [3], approximation of depth n is phrased in terms of a unary projection operator π n. The axioms for the projection operators are given in Tabe 4. In this tabe, a stands for an arbitrary member of A τ. Let T stand for either BTA, BTA+REC or any other extension of BTA introduced in this paper. Then we wi write T +AIP for T extended with the projections operators π n and the axioms P0 P3 and AIP. RDP, RSP and AIP originate from work on ACP [1]. In the setting of ACP, these principes were first formuated in [2]. Like in the setting of ACP, RSP foows from RDP and AIP. 5

6 5 Distributed Strategic Intereaving of Threads In this section, we take up the extension of BTA to a theory about threads and distributed muti-threading by introducing a very simpe distributed intereaving strategy. The resuting theory is caed TA dsi. In order to dea with threads and services that are distributed over the nodes of a network, it is assumed that there is a fixed but arbitrary finite set L of ocations such that L N. The set LA of ocated basic actions is defined by LA = {.a L a A}. Henceforth, basic actions wi aso be caed unocated basic actions. We write LT for the set {.tau L}. The members of LA LT are referred to as ocated actions. Performing an unocated action a is taken as performing a at a ocation sti to be fixed by the distributed intereaving strategy. Performing a ocated action.a is taken as performing a at ocation. Performing an action a at ocation brings with it processing of a by a service at ocation. Threads that perform unocated actions ony are caed unocated threads and threads that perform ocated actions ony are caed ocated threads. The behaviour of a distributed system of the kind considered in this paper is supposed to be a ocated thread. However, the threads that exist concurrenty at the different ocations in the system are unocated threads. It is assumed that the coection of a threads that exist concurrenty at the same ocation takes the form of a sequence of unocated threads, caed the oca thread vector at the ocation concerned. It is assumed that the coection of oca thread vectors that exist concurrenty at the different ocations takes the form of a sequence of pairs, one for each ocation, consisting of a ocation and the oca thread vector at that ocation. Such a sequence is caed a distributed thread vector. Distributed strategic intereaving operators turn a distributed thread vector of arbitrary ength into a singe ocated thread. This singe ocated thread obtained via a distributed strategic intereaving operator is aso caed a distributed muti-thread. In this paper, we cover adaptations of the simpest intereaving strategy, namey pure cycic intereaving, which support expicit thread migration and see to oad baancing or capabiity searching by impicit thread migration. In the distributed case, cycic intereaving basicay operates as foows: at each stage of the intereaving, the first thread in the first oca thread vector in the distributed thread vector gets a turn to perform an action at the ocation at which the first oca thread vector is and then the distributed thread vector undergoes cycic permutation. We mean by cycic permutation of a distributed thread vector that the first thread in the first oca thread vector becomes the ast thread in the first oca thread vector, a other threads in the first oca thread vector move one position to the eft, the resuting oca thread vector becomes the ast oca thread vector in the distributed thread vector, and a other oca thread vectors in the distributed thread vector move one position to the eft. If a thread in one of the oca thread vectors deadocks, the whoe does not deadock ti a others have terminated or deadocked. An important 6

7 property of cycic intereaving is that it is fair, i.e. there wi aways come a next turn for a active threads. Other pausibe intereaving strategies for the case where threads and services are not distributed are treated in [7]. They can aso be adapted to the case where threads and services are distributed. When discussing intereaving strategies on distributed thread vectors, we use the term current thread to refer to the first thread in the first oca thread vector in a distributed thread vector and we use the term current ocation to refer to the ocation at which the first oca thread vector in a distributed thread vector is. TA dsi has the sort T of BTA and in addition the foowing sorts: the sort LT of ocated threads; the sort LTV of oca thread vectors; the sort DTV of distributed thread vectors. To buid terms of sort T, TA dsi has the constants and operators of BTA and in addition the foowing operators: for each n N, the binary migration postconditiona composition operator mg(n) : T T T. To buid terms of sort LT, TA dsi has the foowing constants and operators: the deadock constant D : LT; the termination constant S : LT; for each L and a A τ, the binary postconditiona composition operator.a : LT LT LT; the unary deadock at termination operator S D : LT LT; the unary cycic distributed strategic intereaving operator :DTV LT. To buid terms of sort LTV, TA dsi has the foowing constants and operators: the empty oca thread vector constant : LTV; the unary singeton oca thread vector operator : T LTV; the binary oca thread vector concatenation operator :LTV LTV LTV. To buid terms of sort DTV, TA dsi has the foowing constants and operators: the empty distributed thread vector constant : DTV; for each L, the unary singeton distributed thread vector operator [ ] : LTV DTV; the binary distributed thread vector concatenation operator : DTV DTV DTV. Terms of the different sorts are buit as usua for a many-sorted signature (see e.g. [18, 20]). Throughout the paper, we assume that there are infinitey many variabes of sort LT, incuding u, v, w, infinitey many variabes of sort LTV, incuding α, α 1, α 2, and infinitey many variabes of sort DTV, incuding β, β 1, β 2. 7

8 We introduce ocated action prefixing as an abbreviation:.a p, where p is a term of sort LT, abbreviates p.a p. The overoading of D, S, and coud be resoved, but we refrain from doing so because it is aways cear from the context which constant or operator is meant. Essentiay, the sort DTV incudes a sequences of pairs consisting of a ocation and a oca thread vector. The ones that contain a unique pair for each ocation are the proper distributed thread vectors in the sense that the cycic distributed intereaving strategy outined above is intended for them. Improper distributed thread vectors that do not contain dupicate pairs for some ocation are needed in the axiomatization of this strategy. Improper distributed thread vectors that do contain dupicate pairs for some ocation appear to have more than one oca thread vector at the ocation concerned. Their excusion woud make it necessary for concatenation of distributed thread vectors to be turned into a partia operator. The cycic distributed intereaving strategy never turns a proper distributed thread vector into an improper one or the other way round. Simiar remarks appy to the enriched distributed thread vectors introduced in subsequent sections and wi not be repeated. Let p and q be cosed terms of sort LT from the anguage of TA dsi, L and a A τ. Then p.a q wi perform action a at ocation, and after that proceed as p if the processing of a eads to the repy T (caed a positive repy) and proceed as q if the processing of a eads to the repy (caed a negative repy). The deadock at termination operator S D is an auxiiary operator used in the axioms for cycic distributed intereaving introduced beow to turn termination into deadock. Let p be a cosed term of sort LT from the anguage of TA dsi. Then S D (p) behaves the same as p, except that it deadocks whenever p woud terminate. The cycic distributed strategic intereaving operator serves for intereaving of the threads in a proper distributed thread vector according to the strategy outined above, but with support of expicit thread migration. In the case where a oca thread vector of the form p mg(n) q α with n L is encountered as the first oca thread vector, α becomes the ast oca thread vector in the distributed thread vector and p is appended to the oca thread vector at ocation n. If n L, then α q becomes the ast oca thread vector in the distributed thread vector. The migration postconditiona composition operators have the same shape as the postconditiona composition operators introduced earier. However, formay no action is invoved in migration postconditiona composition. Notice that, in case of improper distributed thread vectors, threads that are expicity migrated to some ocation may evaporate or appear in the first of severa oca thread vectors at the ocation concerned. In the axioms for cycic distributed intereaving introduced beow, a binary function app ( L) from unocated threads and distributed thread vectors to distributed thread vectors is used which maps each unocated thread x and distributed thread vector β to the distributed thread vector obtained by appending 8

9 Tabe 5. Definition of the functions app app (x, ) = app (x, [α] β) = [α x ] β if = app (x, [α] β) = [α] app (x, β) if Tabe 6. Axioms for postconditiona composition u t v = u t u LT1 Tabe 7. Axioms for deadock at termination S D (S) = D S2D1 S D (D) = D S2D2 S D (.tau u) =.tau S D (u) S2D3 S D (u.a v) = S D (u).a S D (v) S2D4 Tabe 8. Axioms for cycic distributed intereaving ( ) = S CDI1 ([ ] 1... [ ] k ) = S CDI2 ([ ] β) = (β [ ] ) CDI3 ([ S α] β) = (β [α] ) CDI4 ([ D α] β) = S D ( (β [α] )) CDI5 ([ tau x α] β) =.tau (β [α x ] ) CDI6 ([ x a y α] β) = (β [α x ] ).a (β [α y ] ) CDI7 ([ x mg(n) y α] β) =.tau (app n (x, β [α] )) if n L CDI8 ([ x mg(n) y α] β) =.tau (β [α y ] ) if n L CDI9 x to the oca thread vector at ocation in β. The functions app are defined in Tabe 5. The axioms for postconditiona composition on ocated threads, deadock at termination and cycic distributed intereaving are given in Tabes 6, 7 and 8. In these tabes, t stands for an arbitrary action from LT, 1,..., k and stand for arbitrary ocations from L, a stands for an arbitrary action from A, and n stands for an arbitrary natura number. Axioms CDI1 CDI9 set out the detais of the simpe cycic distributed intereaving strategy introduced in this section in a cear and concise way. To be fuy precise, we shoud give axioms concerning the constants and operators to buid terms of the sorts LTV and DTV as we. We refrain from doing so because the constants and operators concerned are the usua ones for sequences the singeton distributed thread vector operators invove an impicit pairing of their operand with a ocation. 4 Simiar remarks appy to the sorts 4 This amounts to ooking upon [α] as syntactic sugar for (, α). 9

10 of oca thread vectors and distributed thread vectors introduced in subsequent sections and wi not be repeated. Guarded recursion can be added to TA dsi as it is added to BTA in Section 3. We wi write TA dsi +REC for the resuting theory. The axioms for cycic distributed strategic intereaving given in Tabe 8 constitute a definition by recursion on the sum of the depths of a threads in the distributed thread vector with case distinction on the structure of the first thread in the first oca thread vector. Hence, it is obvious that the axioms are consistent and that every cosed term of the sort LT from the anguage of TA dsi is derivaby equa to one that does not contain the cycic distributed strategic intereaving operator. Moreover, it foows easiy that every projection of a cosed term of the sort LT from the anguage of TA dsi +REC is derivaby equa to one that does not contain the cycic distributed strategic intereaving operator. Simiar remarks appy to the other distributed strategic intereaving operators introduced in this paper and wi not be repeated. We refrain from giving the structura operationa semantics of TA dsi. The transition rues for the postconditiona composition operators on ocated threads constitute a trivia adaptation of the transition rues for the postconditiona composition operators on unocated threads. The transition rues for the deadock at termination operator can be found in [7, 8]. The transition rues for the cycic distributed strategic intereaving operator, as we as the transition rues for the distributed strategic intereaving operators that wi be introduced ater in this paper, are simiar to the transition rues for the strategic intereaving operator for cycic intereaving found in [7, 8]. However, the transition rues for a distributed strategic intereaving operator are so much more invoved that they might be caed unreadabe. This impies that they cannot add to a better understanding of the distributed intereaving strategy concerned. Henceforth, we wi write TA dsi (A) for TA dsi with the set of basic actions A fixed to be the set A. 6 A Cassification of Services In this section, we provide a usefu cassification of services present at each of the ocations over which the threads and services of a system are distributed. This cassification is a sighty adapted version of the cassification given in [7] and wi be used in subsequent sections. A major distinction is between target services and para-target services: A service is a target service if the resut of the processing of commands by the service is party observabe externay. Printing a document, sending an emai message, showing data on a dispay or writing persistent data in permanent memory are typica exampes of using a target service. A service is a para-target service if the resut of the processing of commands by the service is whoy unobservabe externay. Setting a timer or transferring data by means of a Java pipe are typica exampes of using a para-target service. 10

11 In the case of para-target services, a further distinction is between private services and shared services: A private service provides its service to a singe thread ony. A timer is usuay a private service. Private services exist to support a singe thread in creating intended behaviour in reation to target services. A shared service provides its service to a threads existing at some ocation. A Java pipe is an exampe of a shared para-target service. Shared services exist to support a threads existing at the same ocation in creating intended behaviour in reation to target services. To simpify matters, it wi be assumed that a para-target services at some ocation are either private or shared, thus disregarding the possibiity that a service provides its service to some of the threads existing at the ocation ony. This eaves us with execution architectures that provide target services, shared services and private services. Private services are caed oca services in [7]. We use the phrase private service here because oca service may be confusing in the current setting where services are ocated. The overa intuition about threads, target services and para-target services is that: a thread is the behaviour of a sequentia deterministic program; a distributed muti-threaded system consists of a number of threads, which are intereaved according to some deterministic distributed intereaving strategy and which interact with a number of services; the intentions about the resuting behaviour pertain ony to interaction with target services; interaction with para-target services takes pace ony in as far as it is needed to obtain the intended behaviour in reation to target services. One of the assumptions made in thread agebra is that para-target services are deterministic. The excusion of non-deterministic para-target services, ike the excusion of non-deterministic intereaving strategies, is a simpification. We beieve however that this simpification is adequate in the cases that we address: services that keep private data for a thread or shared data for a number of threads. Of course, it is inadequate in cases where services such as dice-paying services are taken into consideration. Another assumption is that target services are non-deterministic. The reason for this assumption is that the dependence of target services on externa conditions make it appear to threads that they behave non-deterministicay. Henceforth, to simpify matters, it is assumed that each thread has a unique private service. This service has to move aong with the thread if it migrates to another ocation. 11

12 7 Distributed Strategic Intereaving and Locking In this section, we introduce a variation of the distributed intereaving strategy from Section 5 that prevents threads from migrating whie they keep ocks on shared services. This resuts in a theory caed TA ck dsi. In order to dea with ocking of shared services, it is assumed that there is a fixed but arbitrary finite set of foci and a fixed but arbitrary finite set of methods M. Each focus pays the roe of a name of a service provided by the execution environment that can be requested to process a command. Each method pays the roe of a command proper. We write M for the set {f.m f, m M}. or the set A of unocated actions, we take the set M. Performing an unocated action f.m is taken as making a request to the service named f at a ocation sti to be fixed by the distributed intereaving strategy to process command m. Performing a ocated action.f.m is taken as making a request to the service named f at ocation to process command m. It is aso assumed that t, s 1, s 2,.... The foci t, s 1, s 2,... pay a specia roe: for each thread, t is the focus of the unique private service of that thread; for each ocation, s 1, s 2,... are the foci of the services shared by a threads from the oca thread vector at that ocation. We write s for the set {s 1, s 2,...} of shared service foci. or each ocation, a threads from the oca thread vector at that ocation are supposed to be abe to ock and unock the services with foci from s at that ocation. It is assumed that ock, unock M. We write M for the set {ock, unock} of ocking methods. When processing a command, the services with foci from s do nothing but changing a state and producing repies on the basis of the state. In every state, either the processing of ock eads to a positive repy or the processing of unock eads to a positive repy, but not both, and if the processing of one of them eads to a positive repy, then the processing concerned moves the service to a state in which the processing of the other one eads to a positive repy. In this way, successive ockings without intermediate unocking is prevented. It is assumed that initiay the processing of ock eads to a positive repy. Moreover, it is assumed that a request to process ock or unock is rejected by services with foci other than foci from s. Rejecting a request to process a command brings with it deadocking of the thread making the request. If a thread successfuy performs the action s i.ock, it acquires the ock of the service with focus s i. It keeps the ock unti it is reeased by performing s i.unock. A threads are supposed to work as foows. or each focus s i, a commands s i.m different from s i.ock must be performed in a phase in which the thread keeps the ock of the service with focus s i. If a threads adhere to this rue, it is guaranteed that a thread keeping the ock on a service has excusive access to that service. The distributed intereaving strategy introduced in this section permits of no deviation from this rue. 12

13 Tabe 9. Definition of the functions app app (x, ) = app (x, [α] β) = [α x ] β if = app (x, [α] β) = [α] app (x, β) if In the presence of ocking and unocking of shared services, axiom CDI8 (Tabe 8) is not satisfactory. A thread from the oca thread vector at one ocation shoud not be permitted to migrate to another ocation if the thread keeps the ock of one or more shared services at the former ocation. To dea with that, we have to enrich distributed thread vectors by repacing each thread in each oca thread vector by a pair consisting of the thread and the set of a foci naming shared services on which the thread keeps a ock. We mention that, when the intereaving of the threads in a distributed thread vector makes a start, the threads are supposed to keep no ock. TA ck dsi has the same sorts as TA dsi(m). To buid terms of the sorts T, LT and DTV, TA ck dsi has the same constants and operators as TA dsi(m). To buid terms of sort LTV, TA ck dsi has the foowing constants and operators: the empty oca thread vector constant : LTV; for each s, the unary singeton oca thread vector operator : T LTV; the binary oca thread vector concatenation operator :LTV LTV LTV. That is, the operator is repaced by the operators. Simiar to the singeton distributed thread vector operators [ ], the singeton oca thread vector operators invove an impicit pairing of their operand with a set of foci naming shared services. In the axioms for cycic distributed intereaving with ocking introduced beow, a binary function app ( L) from unocated threads and distributed thread vectors to distributed thread vectors is used which maps each unocated thread x and distributed thread vector β to the distributed thread vector obtained by appending x to the oca thread vector at ocation in β and associating the empty set as set of foci with x. The functions app are defined in Tabe 9. The axioms for cycic distributed intereaving with ocking are given in Tabe 10. In this tabe, 1,..., k and stand for arbitrary ocations from L, f stands for an arbitrary focus from, m stands for an arbitrary method from M, stands for an arbitrary subset of s, and n stands for an arbitrary natura number. Axiom CDI7 of the strategy from the previous section is repaced by four axioms to make distinction between ock actions, unock actions and other actions. This distinction must be made to keep track of the ocks that the different threads keep and to precude the possibiity of deviation from the rue that threads must adhere to in order to guarantee excusive access to ocked services. Guarded recursion can be added to TA ck dsi as it is added to BTA in Section 3. 13

14 Tabe 10. Axioms for cycic distributed intereaving with ocking ( ) = S CDIck1 ([ ] 1... [ ] k ) = S CDIck2 ([ ] β) = (β [ ] ) CDIck3 ([ S α] β) = (β [α] ) CDIck4 ([ D α] β) = S D ( (β [α] )) CDIck5 ([ tau x α] β) =.tau (β [α x ] ) CDIck6 ([ x f.m y α] β) = (β [α x ] ).f.m (β [α y ] ) if f s (f m M ) CDIck7a ([ x f.ock y α] β) = (β [α x {f} ] ).f.ock (β [α x f.ock y ] ) if f s \ CDIck7b ([ x f.unock y α] β) = (β [α x \{f} ] ).f.unock (β [α y ] ) if f CDIck7c ([ x f.m y α] β) = S D ( (β [α] )) if f s (f m ock) (f s \ m = ock) CDIck7d ([ x mg(n) y α] β) =.tau (app n (x, β [α] )) if n L = CDIck8 ([ x mg(n) y α] β) =.tau (β [α y ] ) if n L CDIck9 8 Distributed Strategic Intereaving and Load Baancing In this section, we introduce a variation of the distributed intereaving strategy from Section 7 with impicit migration of threads to achieve oad-baancing. This resuts in a theory caed TA ba dsi. Immediatey after the current thread has performed an action, impicit migration of that thread to another ocation may take pace. Whether migration reay takes pace, depends on three parameters of the strategy: k 1, k 2 and k 3. A three parameters are natura numbers greater than 0. The current thread is impicity migrated if the foowing conditions are fufied: the current thread is migration compatibe; the current thread keeps no ocks; the number of steps that the current thread has performed at its current ocation is at east k 1 ; the argest number of steps that the current thread wi perform before termination, deadock or expicit migration is at east k 2 ; the ength of the oca thread vector that contains the current thread, say n, is greater than k 3 and there is another oca thread vector whose ength times 2 is ess than n. The purpose of these conditions is as foows: 14

15 the first condition is to excude migration of threads whose interaction with services is in whoe or in part bound to services at the ocations they are; the second condition is to prevent threads from migrating whie they keep ocks on shared services; the third condition is to guard threads against hopping around useessy; the fourth condition is to precude the possibiity that threads are migrated whie they wi necessariy terminate, deadock or migrate expicity soon; the ast condition is to achieve that threads from ocations with ong oca thread vectors are migrated to ocations with short oca thread vectors. If the current thread is impicity migrated, then it wi be migrated to the first among the ocations with a shortest oca thread vector. To understand why oad baancing strategic intereaving may be usefu, assume that: (i) time is divided into sices of equa ength; (ii) during each sice, a oca thread vectors get a turn to perform an action of one thread. Thus, a ong oca thread vector gives rise to sow execution per thread whereas a short oca thread vector gives rise to fast execution per thread. Load baancing wi equaize the execution speed of the threads in the different oca thread vectors. To dea with both ocking and oad baancing, we have to enrich distributed thread vectors by repacing each thread in each oca thread vector by a tripe consisting of the thread, the set of a foci naming services on which the thread keeps a ock, and the minimum of k 1 and the number of steps that the thread has performed at the ocation it is. We mention that, when the intereaving of the threads in a distributed thread vector makes a start, the threads are supposed to keep no ock and to have performed no steps at the ocation they are. It is assumed that each method can be cassified as either functiona or nonfunctiona, so that the set M fn M of functiona methods can be distinguished. Moreover, it is assumed that ock M fn and unock M fn. A method is a functiona method if its processing by a shared service never change the state of the shared service. Migration compatibiity is a criterion to excude migration of threads whose interaction with services is in whoe or in part bound to services at the ocation they are. Interaction of threads with target services is aways bound, interaction of threads with their private service is never bound, and interaction of threads with shared services using functiona methods ony is never bound. However, interaction of threads with shared services may be bound if non-functiona methods are used. In this paper, a thread is considered migration compatibe if its interaction with services incudes nothing but interaction with private services and interaction with shared services using functiona methods. This makes migration compatibiity rather restrictive. We can take a ess restrictive criterion instead if we assume that ocked sessions with shared services can aso be cassified as either functiona or nonfunctiona. The criterion in question is compicated in such a way that it woud distract the attention from the main issues treated in this paper. 15

16 Tabe 11. Definition of the functions app app (x, ) = app (x, [α] β) = [α x 0 ] β if = app (x, [α] β) = [α] app (x, β) if TA ba dsi has the same sorts as TA ck dsi. To buid terms of the sorts T, LT and DTV, TA ba dsi has the same constants and operators as TA ck dsi. To buid terms of sort LTV, TA ba dsi has the foowing constants and operators: the empty oca thread vector constant : LTV; for each s and c N such that c k 1, the unary singeton oca thread vector operator c : T LTV; the binary oca thread vector concatenation operator :LTV LTV LTV. That is, the operator is repaced by the operators c. Simiar to the singeton distributed thread vector operators [ ], the singeton oca thread vector operators c invove an impicit tuping of their operand with a set of foci naming shared services and a natura number ess than or equa to k 1. In the axioms for cycic distributed intereaving with oad baancing introduced beow, a binary function app ( L) from unocated threads and distributed thread vectors to distributed thread vectors is used which maps each unocated thread x and distributed thread vector β to the distributed thread vector obtained by appending x to the oca thread vector at ocation in β and associating the empty set as set of foci and zero as step count with x. The functions app are defined in Tabe 11. Moreover, a unary function pv on distributed thread vectors is used which permutes distributed thread vectors cycicy with impicit migration as outined above. The unary function pv on distributed thread vectors is defined using a number of auxiiary functions: a unary function mgc from unocated threads to Booeans, mapping each unocated thread that is migration compatibe to T and each unocated thread that is not migration compatibe to ; for each n N, a unary function nps n from unocated threads to Booeans, mapping each unocated thread to T if the argest number of steps that it wi perform before termination, deadock or expicit migration is at east n, and to otherwise (nps stands for number of potentia steps); a unary function stv from distributed thread vectors to pairs consisting of a ocation and a oca thread vector, mapping each distributed thread vector to the pair consisting of the first among the ocations with a shortest oca thread vector and the oca thread vector at that ocation; a unary function oc from pairs consisting of a ocation and a oca thread vector to ocations, mapping each such pair to its first component; 16

17 Tabe 12. Definition of the functions mgc n and mgc mgc 0 (x) = T mgc n+1 (S) = T mgc n+1 (D) = T mgc n+1 (tau x) = mgc n (x) mgc n+1 (x f.m y) = mgc n (x) mgc n (y) if f = t (f s m M fn ) mgc n+1 (x f.m y) = if f t (f s m M fn ) mgc n+1 (x mg(n ) y) = T n 0 mgc n (x) = T mgc(x) = T n 0 mgc n (x) = mgc(x) = a unary function tv from pairs consisting of a ocation and a oca thread vector to oca thread vectors, mapping each such pair to its second component; a unary function imc from distributed thread vectors to Booeans, mapping each distributed thread vector that fufis the conditions for impicit migration to T and each distributed thread vector that does not fufi these conditions to. The function mgc in turn is defined using, for each n N, an auxiiary unary function mgc n from unocated threads to Booeans, mapping each unocated thread whose approximation up to depth n is migration compatibe to T and each thread whose approximation up to depth n is not migration compatibe to. The function mgc, as we as the auxiiary functions mgc n, are defined in Tabe 12. The function pv, as we as the auxiiary functions nps n, stv, oc, tv and imc, are defined in Tabe 13. In the definition of stv, 0 stands for a fixed but arbitrary ocation from L. In the definitions of nps n, stv, imc and pv, as we as in many subsequent definitions, we use the usua basic functions on Booeans and natura numbers. Moreover, we write b e, where b is a Booean expression and e is an equation, for the conditiona equation b = T e. A simpe unary function ic on natura numbers is used as we in the axioms for cycic distributed intereaving with oad baancing introduced beow. It is defined by ic(c) = min(c + 1, k 1 ) for a c N. The axioms for cycic distributed intereaving with oad baancing are given in Tabe 14. In this tabe, 1,..., k and stand for arbitrary ocations from L, f stands for an arbitrary focus from, m stands for an arbitrary method from M, stands for an arbitrary subset of s, c stands for an arbitrary natura number ess than or equa to k 1, and n stands for an arbitrary natura number. The differences with the axioms of the strategy from the previous section are mainy found in axioms CDIba6 and CDIba7a CDIba7d. In those axioms, pv is used to achieve the variant of cycic permutation with impicit migration outined above. Guarded recursion can be added to TA ba dsi as it is added to BTA in Section 3. 17

18 Tabe 13. Definition of the functions nps n, stv, oc, tv, imc, and pv nps 0 (x) = T nps n+1 (S) = nps n+1 (D) = nps n+1 (tau x) = nps n (x) nps n+1 (x f.m y) = nps n (x) nps n (y) nps n+1 (x mg(n ) y) = stv( ) = ( 0, ) stv([α] ) = (, α) en(α 1 ) en(α 2 ) stv([α 1 ] 1 [α 2 ] 2 β) = stv([α 1 ] 1 β) en(α 1 ) > en(α 2 ) stv([α 1 ] 1 [α 2 ] 2 β) = stv([α 2 ] 2 β) oc((, α)) = tv((, α)) = α imc( ) = imc([ ] β) = imc([ x k 1 α] β) = mgc(x) nps k 2 (x) en(α) > k 3 2 en(tv(stv(β))) < en(α) imc([ x c α] β) = if c k 1 pv( ) = pv([ ] β) = β [ ] imc([ x c α] β) pv([ x c α] β) = app oc(stv(β)) (x, β [α] ) imc([ x c α] β) pv([ x c α] β) = β [α x c ] The distributed intereaving strategy with impicit migration of which the axioms are given in Tabe 14 does not count faied attempts of a thread to acquire a ock on a shared service as steps performed by the thread. Counting the faied attempts is pausibe as we. However, it resuts in ooking at past steps and future steps from a different ange because the number of potentia faied attempts in the future is generay indefinite. Because it is assumed that ock is a non-functiona method, it is impossibe that a thread is impicity migrated to another ocation after repeated faied attempts of the thread to acquire a ock on a shared service. At first sight, continuing the attemps at another ocation after repeated faied attempts appears to make sense, but by doing so the thread runs the risk of hopping around useessy whie attempting to acquire a ock. Therefore, we have not considered the rather counter-intuitive assumption that ock is a functiona method. Migration compatibiity is defined such that interaction with services after expicit migration is not taken into account, for that interaction is intended to be with services at another ocation. Take a thread that cannot be migrated impicity because of interaction with a target service before termination, deadock or expicit migration. If that thread woud migrate back expicity before the interaction with a target service instead, then it coud be migrated impicity. 18

19 Tabe 14. Axioms for cycic distributed intereaving with oad baancing ( ) = S ([ ] 1... [ ] k ) = S ([ ] β) = (β [ ] ) ([ S c α] β) = (β [α] ) ([ D c α] β) = S D( (β [α] )) ([ tau x c α] β) =.tau (pv([ x ic(c) α] β)) ([ x f.m y c α] β) = (pv([ x ic(c) α] β)).f.m (pv([ y ic(c) α] β)) if f s (f m M ) ([ x f.ock y c α] β) = (β [α x ic(c) {f} ] ).f.ock (pv([ x f.ock y c α] β)) if f s \ ([ x f.unock y c α] β) = (pv([ x ic(c) \{f} α] β)).f.unock (pv([ y ic(c) α] β)) if f ([ x f.m y c α] β) = S D( (β [α] )) if f s (f m ock) (f s \ m = ock) CDIba1 CDIba2 CDIba3 CDIba4 CDIba5 CDIba6 CDIba7a CDIba7b CDIba7c CDIba7d ([ x mg(n) y c α] β) =.tau (app n (x, β [α] )) if n L = CDIba8 ([ x mg(n) y c α] β) =.tau (β [α y c ] ) if n L CDIba9 Thus, oad baancing is feasibe and usefu because expicit migration is present as an option. The foowing might be considered: a thread transformation that inserts oad baancing migration actions to obtain oad baancing triggered by actions instead of the distributed intereaving strategy. However, there appear to be no obvious candidate for such a transformation. It can be done, but the state space of the thread may expode. 9 Load Baancing with Impicit Migration Back In the distributed intereaving strategy with oad baancing from Section 8, the current thread is impicity migrated ony if it is migration compatibe. Athough it is a simpe criterion, migration compatibiity is undecidabe. This makes the distributed intereaving strategy with oad baancing from Section 8 unconvincing. In this section, we introduce a variation of that strategy which does without migration compatibiity. This resuts in a theory caed TA bb dsi. The approach foowed is to precude the need for migration compatibiity on impicit migration of a thread by migrating the thread impicity back before interaction with a target service or interaction with a shared service using a nonfunctiona method can take pace. Because ocking is an instance of interaction with a shared service using a non-functiona method, impicit migration back does not happen whie the thread keeps one or more ocks. 19

20 Immediatey after the current thread has performed an action, impicit migration back may take pace. The current thread is impicity migrated back if the foowing conditions are fufied: the most recent migration of the current thread was an impicit migration; the next action that the current thread wi perform concerns an interaction with a target service or an interaction with a shared service using a nonfunctiona method; the ocation at which the current thread is differs from the ocation from which its odest impicit migration that was not foowed by an expicit migration has taken pace. If the current thread is impicity migrated back, it wi be migrated to the ocation from which its odest impicit migration that was not foowed by an expicit migration has taken pace. Whether impicit migration of the current thread takes pace, depends as before on the three parameters k 1, k 2 and k 3. The current thread is impicity migrated if the foowing conditions are fufied: the second condition for impicit migration back is not fufied; the current thread keeps no ocks; the number of steps that the current thread has performed at its current ocation is at east k 1 ; the argest number of steps that the current thread wi perform before termination, deadock, expicit migration, interaction with a target service or interaction with a shared service using a non-functiona method is at east k 2 ; the ength of the oca thread vector that contains the current thread, say n, is greater than k 3 and there is another oca thread vector whose ength times 2 is ess than n. To dea with impicit migration back, we have to enrich distributed thread vectors by repacing each thread in each oca thread vector by a quadrupe consisting of the thread, the set of a foci naming services on which the thread keeps a ock, the minimum of k 1 and the number of steps that the thread has performed at the ocation it is, and the ocation from which the odest impicit migration of the thread that was not foowed by an expicit migration has taken pace if it exists and the ocation at which the thread is otherwise. We wi use the term migration-back ocation to refer to this ocation. We mention that, when the intereaving of the threads in a distributed thread vector makes a start, the threads are supposed to keep no ock, to have performed no steps at the ocation they are, and to have not been impicity migrated. TA bb dsi has the same sorts as TA ba dsi. To buid terms of the sorts T, LT and DTV, TA bb dsi has the same constants and operators as TA ba dsi. To buid terms of sort LTV, TA bb dsi has the foowing constants and operators: the empty oca thread vector constant : LTV; for each s, c N such that c k 1 and L, the unary singeton oca thread vector operator c, : T LTV; 20

21 Tabe 15. Definition of the functions app,o app,o (x, ) = app,o (x, [α] β) = [α x 0,o ] β if = app,o (x, [α] β) = [α] app,o (x, β) if the binary oca thread vector concatenation operator :LTV LTV LTV. That is, the operator c is repaced by the operators c,. Simiar to the singeton distributed thread vector operators [ ], the singeton oca thread vector operators c, invove an impicit tuping of their operand with a set of foci naming shared services, a natura number ess than or equa to k 1, and a ocation. In the axioms for cycic distributed intereaving with oad baancing and impicit migration back introduced beow, a binary function app,o (, o L) from unocated threads and distributed thread vectors to distributed thread vectors is used which maps each unocated thread x and distributed thread vector β to the distributed thread vector obtained by appending x to the oca thread vector at ocation in β and associating the empty set as set of foci, zero as step count and o as migration-back ocation with x. The functions app,o are defined in Tabe 15. Moreover, a unary function pv on distributed thread vectors is used which permutes distributed thread vectors cycicy with impicit migration and impicit migration back as outined above. The unary function pv on distributed thread vectors is defined using auxiiary functions nps n, stv, oc, tv and imc which are essentiay the same as the ones used before in the case of the strategy from Section 8, with the exception of the functions nps n and imc. The functions nps n and imc become sighty different: for each n N, nps n maps each unocated thread to T if the argest number of steps that it wi perform before termination, deadock, expicit migration, interaction with a target service or interaction with a shared service using a non-functiona method is at east n, and to otherwise; imc maps each distributed thread vector that fufis the adapted conditions for impicit migration to T and each distributed thread vector that does not fufi these conditions to. We aso use the foowing auxiiary functions: a unary function imgc from unocated threads to Booeans, mapping each unocated thread that does not fufi the second condition for impicit migration back to T and each unocated thread that fufis the second condition for impicit migration back to (imgc stands for initiay migration compatibe); a unary function imbc from distributed thread vectors to Booeans, mapping each distributed thread vector that fufis the conditions for impicit migration back to T and each distributed thread vector that does not fufi the conditions for impicit migration back to. 21

22 Tabe 16. Definition of the functions nps n, stv, oc, tv, imgc, imbc, imc, and pv nps 0 (x) = T nps n+1 (S) = nps n+1 (D) = nps n+1 (tau x) = nps n (x) nps n+1 (x f.m y) = nps n (x) nps n (y) if f = t (f s m M fn ) nps n+1 (x f.m y) = if f t (f s m M fn ) nps n+1 (x mg(n ) y) = stv( ) = ( 0, ) stv([α] ) = (, α) en(α 1 ) en(α 2 ) stv([α 1 ] 1 [α 2 ] 2 β) = stv([α 1 ] 1 β) en(α 1 ) > en(α 2 ) stv([α 1 ] 1 [α 2 ] 2 β) = stv([α 2 ] 2 β) oc((, α)) = tv((, α)) = α imgc(s) = T imgc(d) = T imgc(tau x) = T imgc(x f.m y) = T if f = t (f s m M fn ) imgc(x f.m y) = if f t (f s m M fn ) imgc(x mg(n ) y) = T imbc( ) = imbc([ ] β) = imbc([ x c, α] β) = imbc([ x c,o α] β) = imgc(x) if o imc( ) = imc([ ] β) = imc([ x k 1,o α] β) = imgc(x) nps k2 (x) en(α) > k 3 2 en(tv(stv(β))) < en(α) imc([ x c,o α] β) = if c k 1 pv( ) = pv([ ] β) = β [ ] imbc([ x c,o imc([ x c,o imbc([ x c,o pv([ x c,o α] β) pv([ x c,o α] β) = app o,o (x, β [α] ) α] β) = app oc(stv(β)),o (x, β [α] ) α] β) pv([ x c,o α] β) imc([ x c,o α] β) α] β) = β [α x c,o ] The function pv, as we as the auxiiary functions nps n, stv, oc, tv, imgc, imbc and imc, are defined in Tabe 16. In the definition of stv, 0 stands for a fixed but arbitrary ocation from L. The axioms for cycic distributed intereaving with oad baancing and impicit migration back are given in Tabe 17. In this tabe, 1,..., k, and o stand 22

23 Tabe 17. Axioms for cycic distributed intereaving with oad baancing and impicit migration back ( ) = S ([ ] 1... [ ] k ) = S CDIbb1 CDIbb2 ([ ] β) = (β [ ] ) CDIbb3 ([ S c,o α] β) = (β [α] ) CDIbb4 ([ D c,o α] β) = S D( (β [α] )) CDIbb5 ([ tau x c,o α] β) =.tau (pv([ x ic(c),o α] β)) ([ x f.m y c,o α] β) = (pv([ x ic(c),o α] β)).f.m (pv([ y ic(c),o α] β)) if f s (f m M ) ([ x f.ock y c,o α] β) = (β [α x ic(c),o {f} ] ).f.ock (pv([ x f.ock y c,o α] β)) if f s \ ([ x f.unock y c,o α] β) = (pv([ x ic(c),o \{f} α] β)).f.unock (pv([ y ic(c),o α] β)) if f ([ x f.m y c,o α] β) = S D( (β [α] )) if f s (f m ock) (f s \ m = ock) ([ x mg(n) y c,o ([ x mg(n) y c,o CDIbb6 CDIbb7a CDIbb7b CDIbb7c CDIbb7d α] β) =.tau (app n,n (x, β [α] )) if n L = CDIbb8 α] β) =.tau (β [α y c,o ] ) if n L CDIbb9 for arbitrary ocations from L, f stands for an arbitrary focus from, m stands for an arbitrary method from M, stands for an arbitrary subset of s, c stands for an arbitrary natura number ess than or equa to k 1, and n stands for an arbitrary natura number. There seems to be no essentia difference with the axioms of the strategy from the previous section. However, the defining equations of the function pv used here (Tabe 16) show that in this case pv deas with the variant of cycic permutation with impicit migration and impicit migration back outined above. Guarded recursion can be added to TA bb dsi as it is added to BTA in Section 3. Like in the strategy with oad baancing from Section 8, it is impossibe that a thread is impicity migrated to another ocation after repeated faied attempts to acquire a ock on a shared service. Using impicit migration back, continuing the attemps at another ocation after repeated faied attempts becomes rather troubesome: it may undo a necessary impicit migration back that has taken pace before the first attempt to acquire the ock. 10 Handing Nodes with Different Processing Speeds In Sections 8 and 9, oad baancing is impicity based on the assumption that the speed with which actions are processed at the different ocations are the same. In this section, we introduce a variation of the distributed intereaving 23

24 strategy with oad baancing and impicit migration back from Section 9 where oad baancing is based on the assumption that the speed with which actions are processed at the different ocations is not necessariy the same. This resuts in a theory caed TA bs dsi. Like before, assume that time is divided into sices of equa ength. Suppose that during each sice, each oca thread vector gets a turn to perform a number of actions of one thread where that number depends upon the ocation of the oca thread vector. This means that the speed with which actions are processed at the different ocations is not necessariy the same. Ceary, the execution speed of the threads in a oca thread vector depends upon the speed with which actions are processed. This must be deat with in equaizing the execution speed of the threads in the different oca thread vectors of a distributed thread vector. It is assumed that there is an action processing capacity function apc from ocations to natura numbers. This function is regarded to give for each ocation the number of actions that are performed by the oca thread vector at that ocation during one turn. To dea in oad baancing with the situation that actions are processed with different speeds at different ocations, we consider the ength of every oca thread vector in proportion to the number of actions that are performed by the oca thread vector during one turn. Moreover, we add the foowing condition to the conditions for impicit migration: the oca thread vector at the current ocation is not in the midde of a turn to perform a number of actions. The purpose of this additiona condition is to take care that processing capacity is not wasted. We have to enrich distributed thread vectors once more. The new distributed thread vectors are sequences of tripes, one for each ocation, consisting of a ocation, the oca thread vector at that ocation, and the number of actions that has been performed during one turn of that oca thread vector after it has performed the foowing action. We repeat that, when the intereaving of the threads in a distributed thread vector makes a start, the threads are supposed to keep no ock, to have performed no steps at the ocation they are, and to have not been impicity migrated. has the same sorts as TAbb dsi. To buid terms of the sorts T, LT and LTV, TA bs dsi has the same constants and operators as TAbb dsi. To buid terms of sort DTV, TA bs dsi has the foowing constants and operators: TA bs dsi the empty distributed thread vector constant : DTV; for each L and i N such that i apc(), the unary singeton distributed thread vector operator [ ] i : LTV DTV; the binary distributed thread vector concatenation operator : DTV DTV DTV. That is, the operator [ ] is repaced by the operators [ ] i. The singeton distributed thread vector operators [ ] i invove an impicit tuping of their operand with a ocation and a natura number. 24

25 Tabe 18. Definition of the functions app,o app,o (x, ) = app,o (x, [α] i β) = [α x 0,o ]i β if = app,o (x, [α] i β) = [α]i app,o (x, β) if In the axioms for cycic distributed intereaving with oad baancing and impicit migration back in case of different processing speeds introduced beow, a binary function app,o (, o L) from unocated threads and distributed thread vectors to distributed thread vectors is used which maps each unocated thread x and distributed thread vector β to the distributed thread vector obtained by appending x to the oca thread vector at ocation in β and associating the empty set as set of foci, zero as step count and o as migration-back ocation with x. The functions app,o are defined in Tabe 18. Moreover, a unary function pv on distributed thread vectors is used which permutes distributed thread vectors cycicy with impicit migration and impicit migration back, deaing with the situation that actions are processed with different speeds at different ocations as outined above. The unary function pv on distributed thread vectors is defined using auxiiary functions nps n, stv, oc, tv, imgc, imbc and imc which are the same or essentiay the same as the ones used before in the case of the strategy from Section 9, with the exception of the functions stv and imc. The functions stv and imc become sighty different: stv maps each distributed thread vector to the pair consisting of: (i) the first among the ocations with a shortest oca thread vector in proportion to the number of actions that are performed by the oca thread vector at that ocation during one turn; (ii) the oca thread vector at that ocation; imc maps each distributed thread vector that fufis the adapted conditions for impicit migration to T and each distributed thread vector that does not fufi these conditions to. The functions nps n, oc, tv and imgc are the ones defined before in Tabe 16. The function pv, as we as the auxiiary functions stv, imbc and imc, are defined in Tabe 19. In the definition of stv, 0 stands for a fixed but arbitrary ocation from L. The axioms for cycic distributed intereaving with oad baancing and impicit migration back in case of different processing speeds are given in Tabe 20. In this tabe, 1,..., k and o stand for arbitrary ocations from L, f stands for an arbitrary focus from, m stands for an arbitrary method from M, stands for an arbitrary subset of s, c stands for an arbitrary natura number ess than or equa to k 1, n stands for an arbitrary natura number, and and i stand for an arbitrary ocation from L and an arbitrary natura number such that i apc(). Most axioms of the strategy from the previous section are now repaced by two axioms to make distinction between the cases i apc() and i = apc(). This distinction must be made because permutation shoud ony take pace after the current thread has performed apc() actions. 25

26 Tabe 19. Definition of the functions stv, imbc, imc, and pv stv( ) = ( 0, ) stv([α] i ) = (, α) en(α 1 ) apc( 2 ) en(α 2 ) apc( 1 ) stv([α 1 ] i 1 1 [α 2 ] i 2 2 β) = stv([α 1 ] i 1 1 β) en(α 1 ) apc( 2 ) > en(α 2 ) apc( 1 ) stv([α 1 ] i 1 1 [α 2 ] i 2 2 β) = stv([α 2 ] i 2 2 β) imbc( ) = imbc([ ] i β) = imbc([ x c, α]i β) = imbc([ x c,o α]i β) = imgc(x) if o imc( ) = imc([ ] i β) = imc([ x k 1,o α] 1 β) = imgc(x) nps k2 (x) en(α) > k 3 apc() 2 en(tv(stv(β))) apc() < en(α) apc(oc(stv(β))) imc([ x c,o α]i β) = if c k 1 i 1 pv( ) = pv([ ] i β) = β [ ]1 imbc([ x c,o imc([ x c,o imbc([ x c,o pv([ x c,o α]i β) pv([ x c,o α]i β) = app o,o (x, β [α]1 ) α]i β) pv([ x c,o α]i β) = app oc(stv(β)),o (x, β [α]1 ) α]i β) imc([ x c,o α]i β) α]i β) = β [α x c,o ]i Guarded recursion can be added to TA bs dsi as it is added to BTA in Section 3. In the strategy introduced here, different processing speeds at different ocations are taken into account by giving the oca thread vectors at different ocations different numbers of actions of one thread to perform during one turn. Aternativey, they can be taken into account by giving the oca thread vectors at different ocations one action of different numbers of threads to perform during one turn. 11 Distributed Strategic Intereaving with Capabiity Searching In preceding sections, it was assumed that the same services are avaiabe at each ocation. In the case of execution architectures where this assumption hods, distributed intereaving strategies with impicit migration of threads to achieve oad baancing are pausibe. In the case of execution architectures where this assumption does not hod, distributed intereaving strategies with impicit migration of threads to achieve avaiabiity of services needed by the thread are pausibe. We say that such distributed intereaving strategies take care of capabiity searching. 26

27 Tabe 20. Axioms for cycic distributed intereaving with oad baancing in case of different processing speeds ( ) = S ([ ] i [ ] i k k ) = S ([ ] i β) = (β [ ]1 ) ([ S c,o CDIbs1 CDIbs2 CDIbs3 α]i β) = (β [α]1 ) CDIbs4 ([ D c,o α]i β) = S D( (β [α] 1 )) CDIbs5 ([ tau x c,o α]i β) =.tau ([ x ic(c),o ([ tau x c,o α]i ([ x f.m y c,o α]i β) = β) =.tau (pv([ x ic(c),o ([ x ic(c),o if (f s (f m M )) i apc() α] i+1 β).f.m ([ y ic(c),o α] i+1 β) α] 1 β)) α] i+1 β) if i apc() CDIbs6a if i = apc() CDIbs6b CDIbs7aa ([ x f.m y c,o α]i β) = (pv([ x ic(c),o α] 1 β)).f.m (pv([ y ic(c),o α] 1 β)) if (f s (f m M )) i = apc() CDIbs7ab ([ x f.ock y c,o α]i β) = ([ x ic(c),o {f} α]i+1 β).f.ock ([ x f.ock y c,o α]i+1 β)) if f s \ i apc() CDIbs7ba ([ x f.ock y c,o α]i β) = (β [α x ic(c),o {f} ]1 ).f.ock (pv([ x f.ock y c,o α]1 β)) if f s \ i = apc() CDIbs7bb ([ x f.unock y c,o α]i β) = ([ x ic(c),o \{f} α]i+1 β).f.unock ([ y ic(c),o α] i+1 β) if f i apc() CDIbs7ca ([ x f.unock y c,o α]i β) = (pv([ x ic(c),o \{f} α]1 β)).f.unock (pv([ y ic(c),o α] 1 β)) if f i = apc() CDIbs7cb ([ x f.m y c,o α]i β) = S D( (β [α] 1 )) if f s (f m ock) (f s \ m = ock) CDIbs7d ([ x mg(n) y c,o α]i β) =.tau (app n,n (x, β [α]1 )) if n L = CDIbs8 ([ x mg(n) y c,o α]i β) =.tau ([ y c,o α]i+1 β) if n L i apc() CDIbs9a ([ x mg(n) y c,o α]i β) =.tau (β [α y c,o ]1 ) if n L i = apc() CDIbs9b 27

28 Tabe 21. Definition of the functions app L app L (x, ) = app L (x, [α] β) = [α x ] β if L app L (x, [α] β) = [α] app L (x, β) if L In this section, we introduce a variation of the distributed intereaving strategy from Section 7 with capabiity searching. This resuts in a theory caed TA cs dsi. The distributed intereaving strategy with capabiity searching has one parameter: k. This parameter is greater then 0. Immediatey after the current thread has performed an action, impicit migration of that thread to another ocation may take pace. Whether migration reay takes pace, depends on the services present at the current ocation. The current thread is impicity migrated if the foowing conditions are fufied: the action that the current thread wi perform next has to be processed by a service that is not present at the current ocation; the current thread keeps no ocks. If these conditions are fufied, then the current thread wi be migrated to the first among the ocations where the east number of steps that its approximation up to depth k must perform to encounter an action that has to be processed by a service that is not present at that ocation is maxima. If the first condition is fufied, but the second condition is not fufied, then the current thread wi deadock on its next turn to perform an action. Notice that the distributed intereaving strategy with capabiity searching does not fit in with the view that interaction of threads with services may in whoe or in part be bound to services at the ocation the threads are. It is assumed that there is a function foci from ocations to sets of foci. This function is regarded to give for each ocation the set of a foci naming services present at that ocation. It is assumed that, for a f \ {t}, there exists an L such that f foci(). Moreover, it is assumed that, for a f \( s {t}), there exists a unique L such that f foci(). The ast two assumptions mean that each service is avaiabe somewhere and each target service is avaiabe at no more than one ocation. We beieve that the heatiness of the distributed intereaving strategy introduced here is questionabe without these assumptions. TA cs dsi has the sorts, constants and operators of TA ck dsi. In the axioms for cycic distributed intereaving with capabiity searching introduced beow, a binary function app L (L L) from unocated threads and distributed thread vectors to distributed thread vectors is used which maps each unocated thread x and distributed thread vector β to the distributed thread vector obtained by appending x to the first oca thread vector at a ocation from L in β and associating the empty set as set of foci with x. The functions app L are defined in Tabe 21. Moreover, a unary function pv on distributed thread vectors is used which permutes distributed thread vectors cycicy with impicit migration as outined 28

29 Tabe 22. Definition of the functions ocs n, ocs n, and pv ocs 0 (x) = L ocs n+1 (S) = L ocs n+1 (D) = L ocs n+1 (tau x) = ocs n(x) ocs n+1 (x f.m y) = ocs n(x) { f foci()} ocs n(y) ocs n+1 (x mg(n ) y) = ocs n (y) ocs 0 (x) = ocs n+1 (x) ocs n+1(x) = ocs n+1 (x) ocs n+1 (x) = ocs n+1(x) = ocs n(x) imc( ) = imc([ ] β) = imc([ S α] β) = imc([ D α] β) = imc([ tau x α] β) = imc([ x f.m y α] β) = imc([ x f.m y α] β) = T imc([ x mg(n ) y α] β) = if f foci() if f foci() = pv( ) = pv([ ] β) = β [ ] imc([ x α] β) pv([ x α] β) = app ocsk (x) (x, β [α] ) imc([ x α] β) pv([ x α] β) = β [α x ] above. The unary function pv on distributed thread vectors is defined using a number of auxiiary functions: for each n N, a unary function ocs n from unocated threads to sets of ocations, mapping each unocated thread to the set of a ocations at which a services are present that may be needed to process the actions performed by its approximation up to depth n; for each n N, a unary function ocs n from unocated threads to sets of ocations, mapping each unocated thread to the set of a ocations where the east number of steps that its approximation up to depth n must perform to encounter an action that has to be processed by a service that is not present at the ocation is maxima; a unary function imc from distributed thread vectors to Booeans, mapping each distributed thread vector that fufis the adapted conditions for impicit migration to T and each distributed thread vector that does not fufi these conditions to. The function pv, as we as the auxiiary functions ocs n, ocs n and imc, are defined in Tabe

30 Tabe 23. Axioms for cycic distributed intereaving with capabiity searching ( ) = S CDIcs1 ([ ] 1... [ ] k ) = S CDIcs2 ([ ] β) = (β [ ] ) CDIcs3 ([ S α] β) = (β [α] ) CDIcs4 ([ D α] β) = S D ( (β [α] )) CDIcs5 ([ tau x α] β) =.tau (pv([ x α] β)) CDIcs6 ([ x f.m y α] β) = (pv([ x α] β)).f.m (pv([ y α] β)) if f foci() (f s (f m M )) CDIcs7a ([ x f.ock y α] β) = (pv([ x {f} α] β)).f.ock (pv([ x f.ock y α] β)) if f foci() f s \ CDIcs7b ([ x f.unock y α] β) = (pv([ x \{f} α] β)).f.unock (pv([ y α] β)) if f foci() f CDIcs7c ([ x f.m y α] β) = S D ( (β [α] )) if f foci() (f s (f m ock) (f s \ m = ock)) CDIcs7d ([ x mg(n) y α] β) =.tau (app {n} (x, β [α] )) if n L = CDIcs8 ([ x mg(n) y α] β) =.tau (pv([ y α] β)) if n L CDIcs9 The axioms for cycic distributed intereaving with capabiity searching are given in Tabe 23. In this tabe, 1,..., k and stand for arbitrary ocations from L, f stands for an arbitrary focus from, m stands for an arbitrary method from M, stands for an arbitrary subset of s, and n stands for an arbitrary natura number. Like with the axioms for the strategy from Section 8, the differences with the axioms for the strategy from Section 7 are mainy found in axioms CDIcs6 and CDIcs7a CDIcs7d. In those axioms, pv is used to achieve the variant of cycic permutation with capabiity searching outined above. Guarded recursion can be added to TA cs dsi as it is added to BTA in Section Interaction of Threads with Services A thread may perform certain actions ony for the sake of getting repy vaues returned by para-target services and that way having itsef affected by that service. In this section, we introduce thread-service composition, which aows for threads to be affected by para-target services in this way. We introduce yet another sort: the sort PTS of para-target services. However, we wi not introduce constants and operators to buid terms of this sort. PTS is a parameter of theories with thread-service composition. PTS is considered to stand for the set of a para-target services. It is assumed that each para-target service can be represented by a function H : M + {T,, B} with the property that H(γ) = B H(γ m ) = B for a γ M + and m M. This function 30

31 S /.f H = S D /.f H = D Tabe 24. Axioms for thread-shared-service composition TSSC1 TSSC2 (.tau u) /.f H =.tau (u /.f H) TSSC3 (u.f.m v) /.f H = (u /.f H).f.m (v /.f H) if f f TSSC4 (u.f.m v) /.f H =.tau (u /.f H) m if H( m ) = T TSSC5 (u.f.m v) /.f H =.tau (v /.f H) m if H( m ) = TSSC6 (u.f.m v) /.f H = D if H( m ) = B TSSC7 is caed the repy function of the para-target service. Given a repy function H and a method m M, the derived repy function of H after processing m, written mh, is defined by mh(γ) = H( m γ). The connection between a repy function H and the para-target service represented by it can be understood as foows: if H( m ) = T, the request to process command m is accepted by the service, the repy is positive and the service proceeds as m H; if H( m ) =, the request to process command m is accepted by the service, the repy is negative and the service proceeds as m H; if H( m ) = B, the request to process command m is not accepted by the service. Henceforth, we wi identify a repy function with the para-target service represented by it. or each L and f s, we introduce the binary thread-shared-service composition operator /.f : LT PTS LT. Intuitivey, p /.f H is the thread that resuts from processing a ocated actions performed by thread p that are of the form.f.m by shared service H at ocation. When a ocated action performed by thread p is processed by shared service H at ocation, it is turned into the action.tau and postconditiona composition is removed in favour of ocated action prefixing on the basis of the repy vaue produced. We aso introduce the binary thread-private-service composition operator / t : T PTS T. Intuitivey, p / t H is the thread that resuts from processing a unocated actions performed by thread p that are of the form t.m by the private service H of thread p. When an unocated action performed by thread p is processed by the private service H of p, it is turned into the action tau and postconditiona composition is removed in favour of unocated action prefixing on the basis of the repy vaue produced. The axioms for the thread-shared-service composition operators are given in Tabe 24. In this tabe, and stand for arbitrary ocations from L, f stands for an arbitrary focus from s, f stands for an arbitrary focus from, m stands for an arbitrary method from M, and n stands for an arbitrary natura number. Axiom TSSC3 shows that the action.tau is aways accepted. Axioms TSSC5 and TSSC6 make it cear that.tau arises as the residue of processing actions at ocation. Therefore,.tau is not connected to a particuar focus and is aways 31

32 S / t H = S Tabe 25. Axioms for thread-private-service composition D / t H = D (tau x) / t H = tau (x / t H) TPSC1 TPSC2 TPSC3 (x f.m y) / t H = (x / t H) f.m (y / t H) if f t TPSC4 (x t.m y) / t H = tau (x / t m H) if H( m ) = T TPSC5 (x t.m y) / t H = tau (y / t m H) if H( m ) = TPSC6 (x t.m y) / t H = D if H( m ) = B TPSC7 (x mg(n) y) / t H = (x / t H) mg(n) (y / t H) TPSC8 accepted. Axiom TSSC7 expresses that deadock takes pace when an action is not accepted. The axioms for the thread-private-service composition operator are given in Tabe 25. In this tabe, f stands for an arbitrary focus from, m stands for an arbitrary method from M, and n stands for an arbitrary natura number. Axiom TPSC3 shows that the action tau is aways accepted. Axioms TPSC5 and TPSC6 make it cear that tau arises as the residue of processing unocated actions. Therefore, tau is not connected to a particuar focus and is aways accepted. Axiom TPSC7 expresses that deadock takes pace when an action is not accepted. Axiom TPSC8 makes it cear that thread-private-service composition is not affected by thread migration. Let T stand for either TA ck dsi, TAba dsi, TAbb dsi, TAbs dsi or TAcs dsi. Then we wi write T + TSC for T extended with the thread-shared-service composition operators, the thread-private-service composition operator, and the axioms from Tabes 24 and 25. In TA ba dsi +TSC, we do not have something ike (β 1 [ x c ] β 2) /.f H = (β 1 [ x / f H c ] β 2). 5 This fais because both expicit migration and oad baancing may add threads to the oca thread vector at ocation. or simiar reasons, we do not have such equations in TA bb dsi +TSC or TA bs dsi+tsc either. This shows the key difference with the muti-eve intereaving strategies from [5]. 13 Thread orking The presence of thread forking adds to the need for oad baancing, for the ength of some oca thread vectors may in that case increase soey by thread forking. In this section, we introduce a basic form of thread forking. We wi do so ike in [7]. We introduce the ternary forking postconditiona composition operator nt( ) : T T T T. The forking postconditiona composition operator has the same shape as the other postconditiona composition operators. ormay, no action is invoved in forking postconditiona composition. However, 5 The right-hand side of this equation is not a egitimate term from the anguage of TA ba dsi+tsc. The addition of the useess thread-shared-service operators / f is simpe. 32

33 Tabe 26. Additiona axioms for thread forking ([ x nt(z) y c α] β) =.tau (pv([ x ic(c) α z 0 ] β)) CDIba10 (x nt(z) y) / t H = (x / t H) nt(z / t H) (y / t H) TPSC9 π n+1 (x nt(z) y) = π n(x) nt(π n(z)) π n(y) P4 for an operationa intuition, in p nt(r) q, nt(r) can be considered a thread forking action. It represents the act of forking off thread r. Like with rea actions, a repy is produced. We consider the case where forking off a thread wi never be bocked or fai. In that case, it aways produces a positive repy. The action tau arises as the residue of forking off a thread. If thread forking is added to TA ba dsi, then one additiona axiom is needed: axiom CSIba10 from Tabe 26. If thread forking is added to TA ba dsi +TSC, then two additiona axioms are needed: axioms CSIba10 and TPSC9 from Tabe 26. If thread forking is added to TA ba dsi +TSC+AIP, then three additiona axioms are needed: axioms CSIba10, TPSC9 and P4 from Tabe 26. If thread forking is added to TA ck dsi, TAbb dsi, TAbs dsi or TAcs dsi, then an obvious variation on axiom CDIba10 is needed. In [7], we treat severa intereaving strategies for threads that support a basic form of thread forking. A of them dea with cases where forking may be bocked and/or may fai. We beieve that perfect forking is a suitabe abstraction when deaing primariy with oad baancing. In [7], nt(r) was formay considered a thread forking action. We experienced afterwards that this eads to unnecessary compications in expressing definitions and resuts concerning modes for thread agebras featuring thread forking. 14 Concusions In [7], we have pursued the object to deveop a theory about threads, intereaving of threads and interaction of threads with services that is usefu for: (i) gaining insight into the semantic issues concerning the muti-threading reated features found in contemporary object-oriented programming anguages such as Java and C#; (ii) simpified forma description and anaysis of programs in which muti-threading is invoved. In [6], we have extended the theory deveoped in [7] with features that aow for detais of muti-threading that come up where it is intertwined with object-orientation to be deat with. In this paper, we have extended the theory deveoped in [7] with features that aow for detais that come up with distributed muti-threading to be deat with. The features incude expicit thread migration, oad baancing and capabiity searching. We have taken oad baancing and capabiity searching for impicit forms of thread migration that are part of distributed intereaving strategies. The work presented in this paper can be extended in severa directions. We mention ony macode migration and impicit migration in grids. We think of an extension in the direction of macode migration that opens a semantica perspective on issues of computer viruses. It is customary to ook upon computer 33

34 viruses from a syntactica perspective, see e.g. [9, 10]. We agree with [19] that being a computer virus is basicay a property of behaviours of programs and hence semantica by nature. We think of an extension in the direction of impicit migration in grids that resuts in a theory reevant to grid computing [12, 13]. A great dea of work in the fied of grid computing has been done on the deveopment of software for initia impementations of a grid. Litte work has been done on the deveopment of mathematica modes and theories reevant to grid computing. We beieve that an extension of the work presented in this paper in the direction of impicit migration in grids might be a usefu contribution to the fied of grid computing. References 1. J. C. M. Baeten and W. P. Weijand. Process Agebra, voume 18 of Cambridge Tracts in Theoretica Computer Science. Cambridge University Press, Cambridge, J. A. Bergstra and J. W. Kop. Process agebra: Specification and verification in bisimuation semantics. In M. Hazewinke, J. K. Lenstra, and L. G. L. T. Meertens, editors, Proceedings Mathematics and Computer Science II, voume 4 of CWI Monograph, pages North-Hoand, J. A. Bergstra and M. E. Loots. Program agebra for sequentia code. Journa of Logic and Agebraic Programming, 51(2): , J. A. Bergstra and C. A. Middeburg. Spitting bisimuations and retrospective conditions. Information and Computation, 204(7): , J. A. Bergstra and C. A. Middeburg. Thread agebra with muti-eve strategies. undamenta Informaticae, 71(2/3): , J. A. Bergstra and C. A. Middeburg. A thread cacuus with moecuar dynamics. Computer Science Report 06-24, Department of Mathematics and Computer Science, Eindhoven University of Technoogy, August J. A. Bergstra and C. A. Middeburg. Thread agebra for strategic intereaving. To appear in orma Aspects of Computing, Preiminary version: Computer Science Report 04-35, Department of Mathematics and Computer Science, Eindhoven University of Technoogy. 8. J. A. Bergstra and C. A. Middeburg. A thread agebra with muti-eve strategic intereaving. To appear in Theory of Computing Systems, Vo. 41(1), Preiminary version: Computer Science Report 06-28, Department of Mathematics and Computer Science, Eindhoven University of Technoogy. 9.. Cohen. Computer viruses theory and experiments. Computers and Security, 6:22 35, Cohen. A Short Course on Computer Viruses. John Wiey and Sons, New York, second edition, W. J. okkink. Introduction to Process Agebra. Texts in Theoretica Computer Science, An EATCS Series. Springer-Verag, Berin, I. oster and C. Kesseman, editors. The Grid: Bueprint for a New Computing Infrastructure. Morgan Kaufmann, San rancisco, I. oster, C. Kesseman, and S. Tuecke. The anatomy of the grid: Enabing scaabe virtua organizations. Journa of High Performance Computing Appications, 15(3),

35 14. J. Gosing, B. Joy, G. Steee, and G. Bracha. The Java Language Specification. Addison-Wesey, Reading, MA, second edition, A. Hejsberg, S. Witamuth, and P. Gode. C# Language Specification. Addison- Wesey, Reading, MA, C. A. R. Hoare. Communicating Sequentia Processes. Prentice-Ha, Engewood Ciffs, R. Miner. Communication and Concurrency. Prentice-Ha, Engewood Ciffs, D. Sannea and A. Tarecki. Agebraic preiminaries. In E. Astesiano, H.-J. Kreowski, and B. Krieg-Brückner, editors, Agebraic oundations of Systems Specification, pages Springer-Verag, Berin, H. Thimbeby, S. Anderson, and P. Cairns. A framework for modeing trojans and computer virus infection. Computer Journa, 41(7): , M. Wirsing. Agebraic specification. In J. van Leeuwen, editor, Handbook of Theoretica Computer Science, voume B, pages Esevier, Amsterdam,