The semantics are defined for a number of meta-instructions which perform operations essential to the writing of programs in multiprogrammed computer systems. These meta-instructions relate to parallel processing, protection of separate computations, program debugging, and the sharing among users of memory segments and other computing objects, the names of which are hierarchically structured. The language sophistication contemplated is midway between an assembly language and an advanced algebraic language.

The semantics are defined for a number of meta-instructions which perform operations essential to the writing of programs in multiprogrammed computer systems. These meta-instructions relate to parallel processing, protecting of separate computations, program debugging, and the sharing among users of memory segments and other computing objects, the names of which are hierarchically structured. The language sophistication contemplated is midway between an assembly language and an advanced algebraic language.

With this iniu li nuichinery (PRO is the only new instruction which is really essential) w^e have a very satisfactory system for interlocking independent processes. Short sequences of instructions can be protected by PRO; if every other sequence of instructions which is executed by another process and references the sensitive data is also covered by a PRO, it is not possible for two such sequences to be executed simultaneously. Larger operations on shared data bases can be intorlockod with locks in memory. The cost of setting and clearing such a lock is only a few instructions.The methods discussed in this paper depend on cooperation among the processes referencing a shared data base and on correct programming of each reference to the data. As Van Horn and others have pointed out, the bugs introduced by incorrect handling of this problem occur in a random and generally irreproducible manner and are very difficult to remove. Van Horn [6] has proposed a scheme which enforces proper handhng of shared data; it does however require more substantial hardware modifications than the methods suggested here.The designer of a computing system should adopt explicit criteria for accepting or rejecting proposed system features. Three possible criteria af this kind are input recardability, input specifiability, and asynchronous reproducibility of output. These criteria imply that a user can, if he desires, either know or control all the influences affecting the content and extent of his computer's output. To define the scope of the criteria, the notion of an abstract machine of a programming language and the notion of a virtual computer are explained. Examples of applications of the criteria concern the reading of a time-of-day clock, the synchronization af parallel processes, protection in multipragrammed systems, and the assignment of capability indexes.

The designer of a computing system should adopt explicit criteria for accepting or rejecting proposed system features. Three possible criteria of this kind are input recordabillty, input specifiability, and asychronous reproducibility of output. These criteria imply that a user can, if he desires, either know or control all of the influences affecting the content and extent of his computer's output. To define the scope of the criteria, the notion of an abstract machine of a programming language and the notion of a virtual computer are explained. Examples of applications of the criteria concern the reading of a time-of-day clock, the assignment of capability indices, and memory reading protection in multiprogrammed systems.