1968 12_#33_Part_1 12 #33 Part 1

1968-12_#33_Part_1 1968-12_%2333_Part_1

User Manual: 1968-12_#33_Part_1

Open the PDF directly: View PDF PDF.
Page Count: 932

Download1968-12_#33_Part_1 1968-12 #33 Part 1
Open PDF In BrowserView PDF
AFIPS
CONFERENCE
PROCEEDINGS
VOLUME 33
PART ONE

1968
FALL JOINT
COMPUTER
CONFERENCE
December 9·11, 1968
San Francisco, California

The ideas and opinions expressed herein are solely those of the authors and are
not necessarily representative of or endorsed by the 1968 Fall Joint Computer
Conference Committee or the American Federation of Information Processing
Societies.

Library of Congress Catalog Card Number 55-44701
THOMPSON BOOK COMPANY
National Press Building
Washington, D.C. 20004

© 1968 by the American Federation of Information Processing Societies, New York,
New York, 10017. All rights reserved. This book, or parts thereof, may not be
reproduced in any form without permission of the publisher.

Printed in the United States of Arnel ica

CONTENTS
PART I
TIME SHARING
The Pitt time-sharing system for the IBM systems 360 .............. .

1

Debugging in a time-sharing environment .......................... .

7

TSS /360: A time-shared operating system .......................... .

15

G. F. Badger, Jr.,
E. A. Johnson,
R. W. Philips
W. A. Bernstein,
J. T. Owens
A. S. Lett,
W. L. Konigsford

MIS VALUE ANALYSIS/JUSTIFICATION (A Panel Session-Papers
not included in this volume)
RELIABILITY, MAINTENANCE AND ERROR RECOVERY IN
THIRD GENERATION SYSTEMS
Considerations for software protection and recovery from hardware
failures in a multiaccess, multiprogramming, single processor
system ................ '" .................................. " .
Error recovery through programming .................... , ......... .
OPTS-600-0n line Peripheral Test System ........................ .
Fail-safe power and environmental facilities for a large computer
installation ................................................... .

29
39
45

G. Oppenheimer,
K. P. Clancy
A. Higgins
G. W. Nelson

51

R. C. Cheek

57
67
75

G. Chingari

81

J. A. Gosden
J. I. Schwartz
T. B. Steel, Jr.

~UMERICAL

CONTROL
Methodology for computer simulation ............................. .
Subsets and modular features of standard APT ..................... .
A remote batch processing system for APT .. , ...................... .

THE COMPUTER FIELD: WHAT WAS PROMISED, WHAT WE
HAVE, WHAT WE NEED (SOFTWARE SESSION)
Software compatibility: What was promised, what we have and what
we need ...................................................... .
Interactive systems: Promises, present and future ................... .
Multiprogramming: Promises, performance and prospects ............ .

89
99

APPLIED lVIATHEMATICS
An algorithm for finding a solution of simultaneous nonlinear
equations .... " .... " .......... , .... , ........................ .
An economical method for calculating the discrete fourier transform ... .
Nonlinear interactive stepwise regression analysis ................... .

105
115
127

Recursive fast fourier transforms .................................. .

141

THE IlVIPACT OF THE FCC INTERDEPENDENCE INQUIRY ON
THE COlVIPUTER INDUSTRY (A Panel Session-Papers not
included in this volume)

C. G. Feldman
M. E. White

R. Hardaway
R. Yavne
L. Edwin,
A. Edwin
G. Epstein

MIS DESIGN
Design and implementation of a general purpose management
information systems data bank. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
OMNIBUS: A large data base management system... .. . . . . . . . . . .. . .
A design approach to user customized information systems. . . . . . . . . . . .

145
157
171

H. Liu
R. P. Allen
R. G. Rangel

TERMIN AL LANGUAGES
Computer graphic language. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Tymshare conversational language . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

179
193

META PI-An interactive on-line compiler-compiler. . . . . . . . . . . . . . . . .

201

A. J. Frank
R. K. Moore,
W. Main
J. T. O'Neill, Jr.

FRONTIER DIRECTIONS IN INTERACTIVE GRAPHICS
The organization and formatting of hierarchical displays. . . . . . . . . . . . . .

219

Projection of multiditnensional data for use in man-computer graphics. .
The on-line firing squad simulator. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

227
233

Interactive telecommunications. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Computer-driven display facilities for an experimental computer
based library. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Response time in man-computer conversational transactions. . . . . . . . . . .

243

G. T. Uber,
P. E. Williams,
B. L. Hisey,
R. G. Wiekert
T. W. Calvert
R. M. Balzer,
R. W. Shirey
D. W. Cardwell

255
267

D. R. Haring
R. Miller

COMPUTER MODELS OF VISION AND SPEECH
Linguistic methods in picture processing: A survey. . . . . . . . . . . . . . . . . . .

279

Decomposition of a visual scene into bodies. . . . . . . . . . . . . . . . . . . . . . . . .
A limited speech recognition system. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Computer models for speech and music appreciation. . . . . . . . . . . . . . . . . .

291
305
319

A computer with hands, eyes, and ears. . . . . . . . . . . . . . . . . . . . . . . . . . . . .

329

W. Miller,
A. Shaw
A. Guzman
D. Bobrow
P. Denes,
M. V. Mathews
J ..ZlfcCarthy,
D. Reddy,
L. Earnest,
P. J. Vicens

DIGITAL SIlVIULATION OF CONTINUOUS DYNAMIC SYSTEMSWHERE IS IT? WHERE IS IT GOING?
Digital simulation of continuous dynamic systems: An overview ...... .
lVIathematics of continuous system simulations ...................... .
SALEM-A programming system for the simulation of systems
described by partial differential equations ........................ .

339
345

J. C. Strauss
D. H. Brandin

353

S. M. Morris,
W. E. Schiesser

TAF-A steady state frequency response and time response
simulation program ........................................... .

359

T. E. Springer,
O. A. Farmer

MEDICAL INFORMATION SYSTEMS
The automated medical history ................................... .

371

W. Weksel,
P. N. Sholtz,
J. Mayne

The key to a nationwide capability for computer analysis of medical
signals. . . . . . ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

381

A legal structure for a national medical data center. . . . . . . . . . . . . . . . . .

387

A RESEARCH CENTER FOR AUGlVIENTING HUMAN INTELLECT
A research center for augmenting human intellect. . . . . . . . . • . . . . . . . . . .

395

D. C. Engelbart,
W. K. English

PLANNING MODELS FOR MANAGElVIENT
An approach to simulation model development for improved planning. .
Operations research in a conversational environment. . . . . . . . . . . . . . . . .
lVIEDIAC-On-line media planning system..... . . . . . . . . .. . . . . . . . . . . .

411
417
425

J. McKenney
M. Conners
L. Lodish,
J. Little

Development and use of computer models for the Southern Pacific
Company. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

431

A. Seelenfreund,
E. P. Anderson,
R. K. McAfee

PLAIN TALK: MACHINES THAT SPEAK YOUR LANGUAGE
A computational model of verbal understanding. . . . . . . . . . . . . . . . . . . . .

441

Procedural semantics for a question-answeririg machine. . . . . . . . . . . . . . .
N aturallanguage compiler for on-line data management. . . . . . . . . . . . . .

457
473

R. Simmons,
J. Burger,
R. Schwarcz
W. A. Woods
C. Kellogg

PRICING COMPUTER SERVICES-WHAT? WHY? HOW?
Prices and the allocation of computer time. . . . . .. . . . . . . . . . . . . . . . . . . .

493

The use of hard and soft money budgets and prices. . . . . . . . . . . . . . . . . .
Priority pricing with application to time-shared computers. . . . . . . . . . . .
Flexible pricing: An approach to the allocation of computer resources. . .

499
511
521

DATA STRUCTURES FOR COMPUTER GRAPHICS
Data structures and techniques for remote computer graphics. . . . . . . . .

533

I. Cotton,
F. S. Greatorex, Jr.

Graphical systems communications: An associative memory
approach. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

545

Description of a set-theoretic data structure. . . . . . . . . . . . . . . . . . . . . . . . .

557

E. H. Sibley,
R. W. Taylor,
D. G. Gordon
D. L. Childs

HYBRID SYSTElVIS FOR PARTIAL DIFFERENTIAL EQUATIONS
Applications of functional optimization techniques for the serial
hybrid computer solution of partial differential equations .......... .

565

H. H. Hara,
W. J. Karplus

Hybrid assumed mode solution of non-linear partial differential
equations ....................................... , ............. .

575

J. C. Strauss,
D. J. Newman

Hybrid computer integration of partial differential equations by use of
an assumed sum separation of variables .......................... .

585

J. R. Ashley,
T. E. Bullock

C. H. Caceres,
G. Kishner,
D. E. Winer,
A. L. Weihrer
R.N. Freed

N. Singer,
H. Kantor,
A. Moore
S. Smidt
M. llfarchand
N. Nielsen

A hybrid computational method for partial differential equations. . . . . . .

593

G. A. Coulman,
J. F. Svetlik

Preliminary investigation of a hybrid method for solving partial
differential equations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

601

R. M. Howe,
S. K. Hsu

PROGRAMMING SYSTEMS I
QUIP-A system for automatic program generation.. . . . . . . . . . . . . . . . .
The XPL compiler generator system. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

611
617

F. C. Bequaert

A syntax directed processor writing system. . . . . . . . . . . . . . . . . . . . . . . . . .

637

THE MINI-COMPUTER
The Mini-computer: A programming challenge..... . . . . . . . . . . . . . . . . . .
The Mini-computer: A new approach to computer design. . . . . . . . . . . . .

649
655

W. McKeeman,
J. Horning,
E. Nelson,
D. Wortman
E. F erentzy,
1,. Gabura
R. Hooper
G. Ottaway,'

R. Shirk,
D. Hitt

EXECUTIVE SYSTEMS FOR HYBRID SIMULATION
The Lockheed hybrid system (A giant step). . . . . . . . . . . . . . . . . . . . . . . . .

663

C. K. Bedient,
L. L. Dike

A priority interrupt oriented hybrid executive. . . . . . . . . . . . . . . . . . . . . . .

683

Growing pains in the evolution of hybrid executives. . . . . . . . . . . . . . . . . .
The Boeing/Vertol hybrid executive system. . . . . . . . . . . . . . . . . . . . . . . . .
Family I: Software for NASA Ames simulation systems.... . . . . . . . . . . .

701
709
719

SYSTEMS TECHNIQUES FOR INTERACTIVE GRAPHICS
Stand-alone/remote graphic system. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

731

NI. D. Rapkin,
O. M. Abu-Gheida

An interactive graphics terminal for generation and display of 2D and
3D structured images. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

747

A head mounted three dimensional display. . . . . . . . . . . . . . . . . . . . . . . . . .
A clipping divider... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

757
765

A low cost computer graphic terminal. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
The Rand video based graphic communications system (Paper not
included in this volume) ....................................... .

777

T. G. Hagan,
R. J. Nixon,
L. J. Schaeffer
I. E. Sutherland
1. E. Sutherland,
R. F. Sproull
M. Macaulay

G.N. Soma,
J. D. Crunkleton,
R. E. Lord
M. D. Thompson
D. A. Willard
J. S. Raby,
E. A. Jacoby,
D. E. Robinson

T. O. Ellis

PROBLEMS IN THE IMPLElVIENTATION OF INTELLIGENT
ROBOTS (A Panel Session-Papers not included in this volume)
COlVIPUTERS IN BIOlVIEDICAL RESEARCH
Computer simulation of a non-linear blood flow model. .............. .

787

H. A. Crosby,
M. K. Klukis

A computer system for real-time monitoring and management of the
critically ill .................................. , ................ .

797

Computer'system for research and clinical application to medicine .....

809

The use of computers to improve biomedical image quality ........... .

817

D. Stewart,
D. Erbech,
H. Shubin
R. M. Gardner,
T. A. Pryor
R. H. Selzer

PROCESS CONTROL PROGRAlVIlVIING LANGUAGES (A Panel
Session-Papers not included in this volume)
LARGE SCALE INTEGRATION
A computer system designer's view of large scale integration .......... .
A high-speed modular multiplier and digital filter for LSI
development ............................................ .
Efficient partitioning for the batch-fabricated fourth-generation
computer ...................... " ...... " .................... .

825

L. M. Spandorfer,
M. E. Conway

847

D. F. Calhoun

857

Engineering for systems using large scale integration (LSI) ........... .

867

B. Scheff,
O. Lowenschuss,
N. Cserhalmi
C. F. 0" Donnell,

1\;10S GP computer ............................ '.' ................ .

877

R. H. Booher

OPERATING SYSTEMS I/OPERATING SYSTEMS II
Hardware / software interaction on the Honeywell 8200 ............... .

891

T. Hatch,
J. Geyer

lVleasurement and analysis of large operating systems during system
development .................................................. .

903

Thrashing: Its causes and prevention .............................. .

915

D. J. Campbell,
W. J. Heffner
P. J. Denning

PART II
PROGRAIVIMING SYSTElVIS II
WRITEACOURSE: An educational programming language. . . . . . . . . . .

923

A table driven compiler for use with automatic test equipment. . . . . . . .

929

On the basis for ELF: An extensible language facility. . . . . . . . . . . . . . . . .

937

lVIElVlORY TECHNIQUES-HERE TODAY
Associative processing for general purpose computers through the use
of modified memories .......................................... .
Addressing patterns and memory handling algorithms ............... .

949
957

Design of a 100-nanosecond read cycieNDRO plated wire memory .....
High speed, high current word matrix using charge storage diodes for
rail selectioIl .................................................. .

969
981

E. Hunt,
M. Zosel
R. L. Mattison,
R. T. Mitchell
T. E. Cheatham,
A. Fisher,
P. Jorrand

H. Stone
S. Sisson,
M. Flynn
T.lshidate
S. Waaben,
P. Carmody

AUTOMATED lVIAINTENANCE AND CHECKOUT OF HYBRID
SIMULATION FACILITIES
Automatic Checkout of a large hybrid computing system. . . . ........ .
Hybrid diagnostic techniques ..................................... .

987
997

DYNAMIC RESOURCE ALLOCATION
Demand paging in perspective .................................... .

1011

Program behavior in a paging environment ... , ..................... .

1019

JANUS; A flexible approach to real-time time-sharing ............... .

1033

A parallel process definition and control system ..................... .

1043

J. C. Richards
T. K. Seehuus,
W. M aasberg,
W. A. Harmon

B. Randell,
C. Kuehner
B. Brawn,
F. Gustavson
J. Kopi,
P. Plauger
D. Cohen

HUl\IAN AUGlVIENTATION THROUGH COlVIPUTERS AND
TELEOPERATOB,S (A Panel Session-No papers included in
this volume)
LABORATORY AUTOMATION
A computer system for automation of the analytical laboratory . . . . . . ..

Real-time tinle-sharing, the desirability and economics. . . . . . . . . . . . .
A modular on-line computer system for data acquisition and
experimental control. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..

1051

1061
1065

P. J.
C. H.
T. R.
B. E.

Friedl,
Sederholm,
Lusebrink
F. Macefield

H. P. Lie,
R. W. Kerr,

G. L.

1~liller,

D. A. H. Robinson
I. N. Hooton,
R. C. Af. Barnes
J. F. W. Mallett,
T. H. Gossling

A standardised data highway for on-line computer applications. . . . . . ..

1077

Use of a computer in a molecular biology laboratory ................. ,

1089

A small computer as an on-line multiparameter analyzer for a neutron
spectrometer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..

1099

.:11. G. Silk,
S. B. fVright

Applications of digital computers to the long term measurement of
blood pressure and the management of patients in intensive care
situations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

1105

J. L. Corbett

HAND PRINTED CHARACTER RECOGNITION
Some conclusions on the use of adaptive linear decision functions. . . . ..

t 117

E. R. Ide,
C. E. Kiessling,
C. J. Tunis

Experiments in the recognition of hand-printed text: Part I-Character
recognition. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. 1125
Experiments in the reoognition of hand printed text Part II-Context
analysis ..................................................... " 1139
The design of an OCR system for reading handwritten numerals ...... ,

1151

J. H. Munson

R. O. Duda,
P. E. Hart
P. J. Hurley,
W. S. Rohland,
P. J. Traglia

OPERATING SYSTEMS I/OPERATING SYSTEMS II
The dynamic behavior of programs ................................ . 1163
Resource allocation with interlock detection in a multi-task system .... . 1169
Cage dual processing ............................................ . 1177
An operating system for a central real-time data processing
computer .................... " ................... , .......... . 1187

NEW MEMORY TECHNIQUES
Holographic read -only memories accessed by light-emitting diodes ..... .

1197

Semiconductor memory circuits and technology ....... , . , .... , .. , .. ,.
2Yr-D Core search memory .................. , ................ '"

1205
1213

Design of a small multi-turn magnetic thin film memory. . . . . . . . . . . . .. 1219
HYBRID SIMULATION TECHNIQUES
An adaptive sampling system for hybrid computation. . . . . . . . . . . . . . ..

I. F. Freibergs
J. E. Murphy
K. C. Smith
P.Day,
H. Krejci

D.H .R. V ilkomerson,
R. S. Mezrich,
D. I. Bostwick
W. B. Sander
.ill. W. Rolund,
P. A. Harding
W. Simpson

1225

G. A. Rahe,
W. Karplus

1233

B. K. Conant

1251

R. A. Moran,
E. G. Gilbert

1259

A. Kasa:hara

1273

F. Gilbert,
G. Backus

COMPUTER GENERATED PICTURES-PERILS, PLEASURES,
PROFITS
Computer animation and the fourth dimension ..................... .
Computer displays in the teaching of physics ....................... .

1279
1285

Art, computers and mathematics ........................ '.' ........ .

1292

CAMP-Computer assisted movie production ...................... .

1299

What good is a baby? ........................................... .

1307

A computer aninlation movie language ............................. .

1317

A. M. Noll
J. L. Schwartz,
E. E. Taylor
C. Csuri,
J. Shaffer
J. WhitneY,
J. Citron
N. Winkles8,
P. Honore
D. Weiner,
S. E. Anderson

NEW TRENDS IN PROGRAMMING LANGUAGES
CABAL-Environmental design of a compiler-compiler .............. .
Cage test language-An interpretive language designed for aerospace .. .
An efficient system for user extendible languages .................... .

1321
1329
1339

A new solid state electronic iterative differential analyzer making
maximum use of integrated circuits. . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..
A general method for programming synchronous logic in analog
computation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..

APPLICATIONS OF COMPUTERS TO PROBLEMS OF THE
ATMOSPHERE AND GEOPHYSICS
Computer experiments in the global circulation of the earth's
atmosphere ................. " . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..
Computational problems encountered in the study of the earth's
normal modes ............................................... "

PROGRESS IN DISPLAYS (A Panel Session-No papers in this volume)

R. K. Dove
G. S. Metsker
M. C. Newey

Program composition and editing with an on-line display. . . . . . . . . . . . ..

1349

H. Bratrnan,
H. G. Martin,
E. C. Perstein

BULK MEMORY DEVICES
New horizons for magnetic bulk storage devices ..................... .
Laser recording unit for high density permanent digital data storage ... .

1361
1369

A magnetic random access terabit magnetic memory ................ .

1381

F. D. Risko
K. McFarland,
M. H ashiguchi
S. Damron,
J. Miller,
E. Salbu,
M. Wildman,
J. Lucas

Diagnostics and recovery programs for the IBM 1360 photo-digital
storage system ................................................ .

1389

D. P. Gustlin,
D. D. Prentice

SIMULATION IN THE DESIGN AND EVALUATION OF DIGITAL
COMPUTER SYSTEMS
Simulation design of a multiprocessing system ...................... .

1399

A simulation study of resource management in a time-sharing system ...

1411

Performance of a simulated multiprogramming system ............... .

1431

R. A. Merikallio,
F. C. Holland
S. L. Rehmann,
S. G. Gangwere, Jr.
M. M. Lehman,
J. L. -Rosenfeld

THE COMPUTER FIELD: WHAT WAS PROMISED, WHAT WE
HAVE, WHAT WE NEED (HARDWARE SESSION)
Hardware design reflecting software requirements ................... . 1443
What was promised, what we have and what is being promised in
character recognition ................ _.................. _...... . 1451
High speed logic and memory: Past, present and future ........... _- .. 1459
REAL-TIME INFORMATION SYSTEMS AND THE PUBLIC
INTEREST
Real-time systems and public information .......................... .
National and international information networks in science and
technology ................................................... .
Real-time computer communications and the public interest .......... .

S. Rosen

A. W. Holt
A. W.Lo

1467

C. W. Churchman

1469
1473

Toward education in real-time .................................... .
A public philosophy for real-time information systems. _ ............. .

1479
1491

H. Borko
M. M. Gold,
L. L. Selwyn
P. E. Rosove
H. Sackman

COMPUTER DESIGN AUTOMATION: WHAT NOW AND WHAT
NEXT?
Introduction ................................................... .
Functional design and evaluation .................... _............ .
Interface between logic and hardware .............................. .
Hardware implementation ........................................ .
Hardware fault detection ........................................ .

1499
1500
1501
1502
1502

J. M. Kurtzberg
D. F. Gorman
R. L. Russo
W. E. Donath
M. A. Breuer

The Pitt time-sharing system for the IBM system
360: Two year's experience
by GEORGE F. BADGER, JR., E. ANDREW JOHNSON
and RICHARD W. PHILIPS·
University of Pittsburgh
Pittsburgh) Pennsylvania

INTRODUCTION
Overview of the system

anda portion of the OS macro compiler capability,
a FORTRAN IV compiler with a pre-editor, a conversational contex editor, and a file maintenance
package. Again in the case of the shared file system, great care was exercised in preserving ease
of use.
During his use of the system the user may take
advantage of any or all of the facilities. He may
switch processors as often as desired, and may
intermix certain command language statements
while working within a processor, e.g., list part of
a file while preparing a program which will work
with it.
This entire set of services runs on an IBM System/360 Model 50, utilizing a 2361 large capacity
storage (LeS) unit. The configuration and some
idea of the storage utilization are presented in
Figure 1. The most imlJOrtant components of this
system are the large capacity storage and the 2314
disk system. The system .runs with the user storage being contained in LCS, both while the user is
idle and while he is in execution. 2 The high speed
storage of the machine is utilized for one processor and. the operating system as can be seen
from Figure 1. The primary processor resident
in high speed storage is the interactive language
processor. Because input to the assembler forms
:l large part of the service of the system, the assembler also is resident, but in LCS. Assembly is
an I/O bound process compared to PIL which is
compute bound.

The University of Pittsburgh has developed a
console-based Time-Sharing System,l and has had
it in service since March of 1966. This paper is
to serve as a report on the utilization of such a system and on certain conclusions we have come to
regarding Time-Sharing Systems.
First, we would like to describe the services
available under this system. The services range
from a highly conversational and interactive language called the Pitt Interpretive Language (PIL)
to languages on which no substantial advantage is
gained by use of a console. PIL is fully interpretitive and has placed heavy emphasis on making things easy for the user. A great deal of care
is placed on giving meaningful diagnostics and
easy error correction. Decisions in the initial implementation between coding efficiency and ease
of use were always made in favor of the user. In
8, second version of the interpreter some emphasis
is being put on efficiency while retaining the error
handling facility. The ability to service a number
of programs such as PIL, with the required speed
of interaction, is our justification for calling this
a Time-Sharing System.
The second class of services are those which are
partially interactive or in which the user gains
some advantage by working from a console. These
include an OS compatible Assembly Language,
*Currently with White, Weld & Company

2When neCE'ssary, the system will resort to memory swaprin~
onto an IBM 2314 disk. This happens with approximatf'ly 30
users signed on, otherwise memory is allocated in ('ontjguou~
blocks from a free pool when the user signs on.

lThis system was completely written by Computer Center
Staff and has no dependencies on other operating systems. Parts
of the system are compatible with OS/360, and several language
processors are fully compatible.

1

2

Fall Joint 'Computer Conference, 1968

(a) Confiquration
28K CORE
1024K
LCS-2361

SELECTOR

CR. 1

into this queue, the user will follow all those who
arrived in the queue beforehand, and then receives one-quarter second of central processing
time. .During the one-quarter second, he may
either run out of things to do (for example, because of issuing requests for further I/O and
waiting for their completion), or he may use the
entire one-quarter second. In the latter case, he
goes into a lower priority queue which receives
service on a time available basis. The quantum of
time given in this lower priority queue is increased
to two seconds. This then is a general description
of the system and its services.

Patterns of sy'stem utilization
(b)

Memory Utilization
SYSTEM ,

TABLES

SMALL BUFFERS (1 line

~ 2,A MEMORY(l28K Bytes)

~;;:::;:~V=I=CE:::...S- - - - - I J

j~~~:-:::' -:~~:
USER

~-.----

- ---

>8,;(.f MEMORY(LCS-1024KBytes)

LARGE DISK BlI1"FRR<:
ASSEMBLER

FIGURE 1

The system services something identified as a
user who consists of a principal input file end a
principal output file. Of the 32 users on the system, as of April, 1968, 31 have a remote console
for these principal files. We currently support
IBM 2741 and 1050, Teletype 33 or 35, Friden
7100 or 7102, and Sanders 720 scopes.
Because of the structure of the system, it is also
possible to introduce one or several pseudo-batch
background users whose principal input and output files could be any devices on the system. As
of April, 1968, one such user runs in the system
from a 2540 card reader to a 1403 printer. The
services available to this batch user are identical
to those available from the remote console. The
only difference in his treatment is that a fatal
error results in going to the next job-rather than
allowing further input which, in the case of "a con~,
sole, could be attempts at correction.
The system' favors those who are working in a
conversational mode, and has a simple queueing
system to allow very rapid response to minimal
requests. Because of the emphasis on interaction,
the completion of any I/O results in the user being dispatched to a high priority queue which will
get service as quickly as possible. Upon being put

The use of the system has increased very rapidly during the two years that the system has been
in use. As of April, 1968, we run approximately
5000 console sessions per month, and approximately 3000 of the batCh jobs. The console sessions use
all of the services, but the batch user typically restricts himself to the use of either the Assembly
Language or the Fortran Processor. In the conclusions of this paper we will make some comment
on the choice by the user as to whether he runs in
the interactive -or pseudo-batch mode.
As far as the time utilization within the system,
PIL accounts for approximately 23 % of the Central Processor time available. That is, during a
ten~hour day, 21h hours ·are actually devoted to
the execution of PIL programs. s User execution
of other processors and generated code accounts
for an additional 20 0/0. The processing of supervisor calls and general system overhead accounts
for 15 %, and the Central Processor is in the idle
state 17% of the time. The servicing of I/O interrupts, and disk unblocking with data transfer,
accounts for the remaining 24 %.4,5 (The CPU is
busy 83 % of the time.)
Within this pattern of utilization we are interested in the demands put upon the system in
SPIL, being fully interpretive, is very slow in execution. On a
matrix inversion, for example, a PIL program will execute at 1/75
the speed of a Fortran program. excluding its compilation. A
second implementation of PIL will significantly modify this
ratio.
'All .statistics in this paper are representative, but do not
necessarily hold for long periods, e.g., a month.
5Because of the extremely heavy dependence of the System on
the IBM 2314 disk with an associated file system, the CPU is devoted to blocking variable length records. This is explained later in
the paper.

Pitt Time-Sharing Systems for IBM System 360
more basic units. In particular, there is the question of how much CPU time is required as a time
slice, since this partially determines the ability of
a given system to support conversational users.
Table 2 and Graph 1 present this data in some
detail.
These figures show an average time slot of
(20±5)/300 seconds. The data, however, do not
show the reason for termination of user execution.
Since the user is primarily interested in being
termiiIated because his work is complete, more
important data are presented in Table 3. The data
present the system as a finite Markov process 6
with the transition probabilities for the set of all
users (the system) being given.
The data presented in Tables 3 and 4 represent
a composite of two periods, one relatively light
and the other extremely busy.7 Values with the
superscript (1) varied considerably with the probability of going from user execution to SVC varying from .7 to .3, the probability to I/O from .3
to .7, and the average time spent in user execution
taking the values 3.89 and .65 respectively. All
other values of interest remain relatively stable.
Since the user is frequently taken out of execution due to an I/O interrupt, we are currently attempting to study the impact of masking these
interrupts for a short period of time (approximately 25/300 seconds-the level at which Graph 1
flattens out). By doing this, approximately 95 %
of all requests for service would be serviced in a
single slice and without interruption. This should
preserve the response time of the system for short
requests, as well as utilizing peripherals effectively. This would make response time only slightly dependent on the system loading. On the other
hand, it might allow quicker preparation of work
which will finally require computation of longer
duration.
We could consider the strategy above as minimizing the maximum response time for a request
up to some limited size. Since a stable level of response time appears to be at least as important
as fast response, we are also considering the re8Treating this as a Markov chain, finding the steady state
vector, and using this to predict percentages of time spent in
the various states yields surprisingly accurate results. This will be
studied further in a later paper.
?The system seems· to be representable as a Markov chain,
i.e., the transition matrix is constant for extended periods of time.
It does seem to vary over time, but the variation is basically
related to level of activity, or time in the idle state.

3

verse. That is, never respond in a period less than
the period the system is capable of sustaining.
Such a level, if it fell between one and two seconds
would give very good performance from the conyersational users point of view. Further, it would
provide increased flexibility in choice of scheduling. This last might be of great importance if a
swapping or paging mechanism were in use since
you could reduce channel activity by choosing
opportune times for the transfer.
The data presented above are representative
but are not system parameters. They are intended
only to give a picture of the relative activities
within a time-shared environment.
System states for Tables 1-4
User execution-The system is running a user
program including use of compilers, assemblers
or interpreters or the file system. PIL execution
plus other user executions.
SVC-A request has been made for supervisor
services via the SVC instruction-mainly I/O requests.
I/O-An I/O interrupt is being processed.
Overhead-A clock trap is being processed, the
scheduler is running, or certain overhead routines
are in use (queueing etc.).
Idle-The CPU is in wait status, i.e., not running.
TABLE I-CPU Utilization
STATE.
PIL Execution
Other User Exec.
SVC Processing
I/O Processing
System Overhead
Idle (CPU waiting)

PERCENT OF TIME

23
20
5

24
10
17

Some conclusions
The utilization of the LCSs unit has proved to
be extremely successful on the Model 50. Because
of the overlapping of the rewrite cycle on core
with Central Processor execution, many programs
run almost as fast out of LCS as they did in CenSLCS is an 8p. memory with a 4 byte fetch when used by a
Model 50. In all other respects it is identical to main memory.

Fall Joint Computer Conference, 1968

,4

*
TABLE 2-Frequency of time slots actually given prior to
seeking another user to execute

Time in 1/60 Second

Percent of Slots
Percent of Slots
Exactly This Size This Size or Smaller

1 or less
2
3
4
5
6to 14
15
16 to 120

48
20
6
3

48
68
74
77
79
87
97
100

2

8
10
~'

GRAPH 1
Frequency of Time Slots Actually GiVen
Prior to Seeking Another User to Execute
versus Size of Slot in Percent
4

3

2
1

1/4 sec.

O'~Ml21~~======--~____-=======~
15

201

TABLE 3---:Transition probabilities of the system states
Next State
User
Exec SVC
User
Executing
SVC
Current I/O
State Overhead
Idle

0
.45
.90
.82
0

I/O

(1)
(1)
.32
.66
.45
0
0
0
.0
0
0
95

Overhead Idle

.01

.10
.10
.10
0.1

0
0
0
.08
.04

TABLE 4-Average time spent in current state before moving to
next state in 1/300 second
Next State
User
Exec SVC
User
Executing
Current SVC
State I/O
Overhead
Idle

0
.75
.92
.20
0

I/O

Overhead Idle Mean

(1)
1.77 1.17 49.29
0 1.49
3.08
0
.91
0 1.81
0
0 1.25
0
97
0
0
1.0 1.54
.38
0 14.65 237.39 8.73 15.74

tral Memory. In the case of PIL, the interpreter
itself is resident in the main storage while its
data, or the text of the user's program, is resident
in LCS. Timing tests have indicated that while
there is some degradation of PIL's speed due to
this (20% or less), it probably is not significant
when compared to either swap or batch mechanisms for other Time-Sharing Systems. 9 While the
LCS proves to be very economical on the Model
50, its effectiveness would be somewhat reduced
on a M'Odel 65, and probably greatly reduced on
a Model 75 because of their greatly increased internal speeds. If we were to move the system to a
Model 75, it is quite likely. that rather than executing out of LCS, we would use the LCS as a swap
device analogous to a drum. One of the reasons
that the LCS has proved very effective is that
many 'Of the requests within a Time-Sharing System are for very minimal amounts of Central
Processor time. Of all the times when a user' is
put into execution, the majority of these times he
has requested execution for the purpose of entering a single line to a processor such as the assembler 'Or the interpreter. These requests can be
serviced in a matter of several thousandths of a
second, and the relative lack of speed on the large
capacity storage has no significant effect on performance.
The second area in which we have drawn some
conclusions with regard to the Time-Sharing System is that the file system is probably the most
important single part of the system. This is true
both 'in the sense of being a major concern, of
users, and of being a major potential bottleneck
if handled poorly. Consistent with data presented
in earlier papers by other auth'Ors, each request
for' service by a user generates a demand for
several thousand characters of data to be transmitted from the disk system. 10 Our early implementation of the file system was a very straightforward, unblocked and unbuffered tape simulation. The file' system· was sequentially structured.
It soon became evident that the pattern of requests
by users was such that a tremendous amount of
head movement was necessary for this unblocked
'Considerable work has been done on the use of LCS as the
swap/paging mechanism, and this provides great promise for
future development. It is currently not possible to page on the
Model 50, and this limits the value of this alternative.
lOThis is user owned data and does not include any "overhead"
transmission.

Pitt Time-Sharing Systems for IBM System 360
mechanism. To improve the performance we have
come to quite a different concept on the disk system. The basic unit of physical activity on the
disk system is now the reading or writing of 2,048
character rec'Ords. The logical records, as seen by
the user, are all treated as being variable length
and are blocked automatically by the system. Here
also LCS is of great value since 50-lOOK of buffers
make system performance more efficient.
A descriptor, prQviding a record of the blQcking, is associated with each 2,048 byte recQrd and
the system can pull these records apart very rapidly UPQn request by the users. On a single physical
read 'Or write, the user nQW makes available tQ
himself 25 card images, fQr example, thereby
causing 1/25th 'Of the number 'Of seeks and interrupts tQ be prQcessed. This has had a tremendous
impact 'On the perfQrmance of the system both in
the amQunt of time that the system has kept idle
because of having tQ access disk recQrds, and the
amQunt of elapsed time while a user is doing
sQmething such as assembling, IQading 'Or CQm.
piling. The imprQvement was 'On the order 'Of 30
tQ 1. Given a high speed file system such as this,
a.nd a very easy mechanism for using it, the users
rapidly learn tQ take advantage 'Of the facility.
This is important nQt 'Only to the user whQse time
is saved, but it is alsQ extremely impQrtant tQ the
system since it can accQmplish much more wQrking frQm disks than it could wQrking frQm 'Other
devices. Further, it expands the size 'Of jobs which
are feasible under the system. Als'O, it greatly decreases the prQbability that an I/O request will
require physical activity, entailing possible changing 'Of users which may alsQ require swapping 'Or
paging. It will alsQ reduce the number 'Of inter
rupts.
A third area in which we have drawn SQme conclusions regards the integrity 'Of perfQrmance 'Of
a Time-Sharing System. We have learned 'Over
the CQurse 'Of tWQ years, nQt always in a painless
manner, that the user 'Of a Time-Sharing System
is quite different in his demands than the user of
any other system. He expects the system tQ be on
when it is scheduled tQ be 'On, and to perform in
a rather stable manner while it is 'On. In particular, he expects the file system tQ perform perfectly
at all times S'O that any wQrk he dues will never
have tQ be redQne. The user 'Of such a system typically has a scheduled time at which he and the
system are tQ wQrk tQgether and if the system is
nQt available at the time, he cares very little why

5

'Or what kind 'Of excuses you can present. The user
is typically quite reasQnable if yQU give him adequate warning that the system will not be available at any given time.
Maintaining the sQftware prQgrams 'Of such a
system is of considerable difficulty and shQuld nQt
be further cQmplicated by the intrQductiQn 'Of machine perfQrmance prQblems. The area in which
we have incurred the mQst difficulty is that manufacturers dQ nQt understand systems which are to
run reliabily fQr extended periQds 'Of time. There
seems tQ be no cQmfQrtable middle grQund between
extreme safety built into systems such as the FAA
and 'Other military systems, and thQse systems of
the secQnd generatiQn which ran adequately fQr a
batch processing envirQnment. This lack 'Of understanding is found 'On many levels but perhaps
most significant is the lack of any facility fQr infQrming the user when malfunctiQns have 'Occurred and the system is 'Off the air. In general,
there are many small rQugh edges in present
equipment. An area of difficulty is that SQme part
of the configuratiQn usually is in marginal conditiQn. The installatiQn does nQt wish to terminate
service cQmpletely fQr an extended periQd. The
Inaintenance 'Of the machine typically requires
this. The machine nQrmally runs in a partially
crippled cQnditiQn 'Or not at all. An 'Overall change
in the maintenance methQdQlogy must 'Occur SQQn.
A fQurth area 'Of experience relates to the use
'Of the consQle system versus the use 'Of its batch
equivalent. Since the user has accessible identical
facilities under each envirQnment, we CQuld expect him tQ mQve tQ that manner 'Of QperatiQn
which perfQrmed best fQr his jQb. This experience must be regarded carefully since the batch
system often requires a IQng walk whereas, CQnsole service is available IQcally.
Clearly, in the area 'Of interactive languages
with emphasis 'On CQnversatiQn, yQU would expect
the user tQ remain 'On the CQnsQle and this has
been 'Our experience. It is very unusual tQ find
any user submitting a batch jQb which is a PIL
'Or cQntext editQr run. One 'Other use 'Of batch is
the creatiQn 'Of tape and disk files fQr use frQm
the cQnsQle.
The Assembler and FQrtran are nQt 'Overly CQnversatiQnal and dQ nQt take great advantage 'Of
the fact that the user is available. In the case 'Of
FQrtran, the work is ab'Outequally divided between
jobs submitted under the batch system, and j'Obs
executed from the c'Ons'Ole. The Assembler, which

6

Fall Joint Computer Conference, 1968

gets its main use by students in beginning programming courses, is probably used more under
the batch system than under the console system.ll
After programs are running in either of these
languages, the user typically will leave his object
program on disk and will revert back to using the
console for execution or for final debugging. It
should be noted here that in addition to the TimeSharing System on the Model 50, the Center makes
available a batch processing system on an IBM
7090. There seems to be a rather clear dividing
line rapidly discovered by the users between the
jobs which should be done on the 7090, and jobs
which should be done on the Model 50. The two
machines are of approximately the same ctapabilities as far as speed and storage space are concerned. Those jobs which are heavily compute
bound remain on the 7090 as do any jobs which
gain little 'Or nothing by interaction.
Because of the lack of success of other installations in using a Time-Sharing System for all of
their computing and because 'Of our own success
with the two independent systems, we plan to
provide a 360 batch system (OS/360) on a second
M'Odel 50 to maintain systems which are fitted to
th.e differing demands by our users. Running the
two facilities in parallel should give a clearer picture in the future of the relative advantages of
time-sharing and batch processing.

Future direction8
The system is still under development and we
are continuing to add facilities if we find them
useful as manpower permits. We are in the process of adding other pr'Ocessors including Algol,
PL/1 and further extensions of Fortran. We als'O
plan to implement some kind of a random access
llThis is at least partly due to the fact that some understanding
is required to be able to effectively debug machine language at a
console.

and index sequential file structure although it is
not clear that these will be implemented within
the shared file structure we currently use.
Another useful service that we plan to implement is the ability t'O submit jobs to either Model
50 system from the remote consoles. In order to
implement this, we will· put channel-to-channel
attachment between the two Model 50's as well as
making parts 'Of the 2314 disk available t'O both
systems. How far we will push this effort is undetermined at present. Finally, in an effort t'O
reduce the number 'Of interrupts presented to the
system, and in 'Order t'O maintain effective utilization of unit rec'Ord equipment, we are putting together a spooling package for the printer, punch
and card reader. This will allow blocking to be
done by the channel program with one interrupt
per block. These sp'Oolers will w'Ork in such a way
as to present a j 'Ob stream which runs from one
disk file t'O another in the same manner as the
batch job stream currently runs from the card
reader to the printer.

a

BIBLIOGRAPHY
1 The Pitt time-sharing systemjor the IBM system/360

Computer Center University of Pittsburgh March 1968
2 --The Pitt interpretive language for the IBM System/360

March 1968
3 DWFIFE
A n optimization model for time-sharing
Proceedings SJCC 1966 pp 97-104
4 JDFOLEY
A Markovian model of the University of Michigan executive
sy.stem
CACM V011 0 No 9 September 1967
5 T J O'CONNOR
Analysis of a time-sharing system
Stanford University Unpublished PhD Dissertation
6 EPARZEN
Stochastic processes
Holden-Day San Fra,ncisco 1965 Chapter 6
7 ALSCHERR
An analysis oj time-shared computer systems
The MIT Press 1967

Debugging in a time-sharing environment
by WILLIAM A. BERNSTEIN and JAlVIES T. OWENS
International Business Machines Corporation
Kingston, New York

INTRODUCTION
In the past 10 years, rapid advances have been made in
computer engineering and programming. Among the
significant achievements have been the development of
more powerful computers, multiprocessing systems,
high-level language compilers, multiprogramming operating systems, and time-sharing systems.
But there is one area in programming in which progress has been comparatively slow. This is the area of
program debugging aids. The problem of finding and
correcting program bugs remains perplexing and costly.
When computers were used to run stand-alone programs or to run programs under small operating systems, conventional debugging tools - such as console
key procedures and system-provided dump, trace, and
status information - met most debugging needs. But,
as programming systems have become more complex,
existing debugging tools have become barely adequate
for tracking down and correcting program bugs.
With the introduction of time-sharing systems, the
conventional tools have become almost worthless. This
has forced a reappraisal of debugging procedures. It has
become apparent that a new type of debugging tool is
needed to handle the special problems created by a
time-sharing system. These special problems result from
the dynamicoharacter of a time-sharing system - a
system in which the program environment is continually changing, a system in which a user is unaware
of the actions of other users, a system in which program
segments are r~Iled in and out of storage locations, and a
system in which one copy of code can be shared by
many users. To debug in this dynamic environment,
the programmer needs a debugging support system - a
set of debugging programs that operate largely independently from the operating syste~ they service.
This paper examines conventional debugging tools
and appraises their adequacy in view of programming
advances. It then discusses the characteristics of a support system that meets the debugging and program mod-

ification needs of a time-sharing system. This support
system can be an important vehicle for advancing debugging technology.

Currem debugging tools
Two kinds of debugging tools have been available to
programmers running stand -alone programs or running
programs under an operating system; machine-level tools
and system-level tools.
Machine-level tools consist of procedures available at
the system operator's console. These include such
items as the stop key, start key, instruction step,
address stop, and displaying and altering the machine
state.
System-level tools are debugging tools provided as part
of the programming system itself - including facilities
to produce such things as storage dumps, traces, and·
system error recovery data.
These tools could be used to obtain the information
needed to start debugging. To be useful, this information must include:
• The hardware configuration at the time the error
occurred.
• The version of the operating system that was
being used.
• The input parameters for the program.
• The condition that indicated the error (stop,
loop, erroneous output, etc.).
With this information, the programmer begins debugging. He is likely to follow the four classical steps in
the debugging procedure:
1. Attempt to duplicate the failing condition so he
can obtain status information at the point of failure.
2. Initiate system-level debugging procedures, including acquisition of storage maps and collection
of intermediate results from internal tables and/or
data areas.

7

8

Fall Joint Computer Conference, 1968

3. Initiate machine-level debugging procedures to
isolate the cause of the error. This step is neceS.5ary
when a peculiar condition (such as a timing dependency) produced the error but was not reflected in
the system-level debugging data.
4. Correct the error.
To summarize, the solution of a program bug requires:
(1) a complete report of the conditions under which the
error occurred, (2) use of system-level debugging tools,
and (3) if necessary, use of machine-level debugging
tools.

Evolution oj debugging tools
Each step forward in computer operations has produced the need for new and better debugging tools. This
has been evident in the transition from stand -alone execution to operating system execution, and now in the
transition to time-sharing execution.
Before the existence of operating systems, the programmer was concerned with a single program with
which he was totally familiar. In most cases, he could
debug that program with machine-level tools. But the
process was time-consuming and many programmers
started to build hooks into their programs to obtain
intermediate results for later analysis. This marked the
beginning of system-level debugging tools.
The introduction of operating systems - and especially multiprogramming systems-has forced programmers to be more reliant on system-level debugging tools.
The use of console debugging has been discouraged and
in many cases, it has been prohibited entirely. Without
aCcess to the console, programmers learned to rely on
debugging aids built into the operating system.
Today, the operating system programmer assigned to
the debugging task must depend upon a fixed set of system-level debugging tools. These tools and their output
are predefined - often consisting of a dump in a prescribed format. The tools lack flexibility, and they provide only limited information.
These built-in tools have a major drawback. As an
operating system grows, system-level tools must constantly be updated (or new tools must be created) to
serve the new functions being added to the system.
It is apparent that the growth of operating systems
has already obsoleted the once effective and efficient
debugging tools originally designed for their maintenance. The addition of more tools merely forestalls the
inevitable - the appearance of one more bug, one
more unanticipated situation.
It becomes necessary, therefore, to turn to a new
type of debugging tool - a debugging support system.
Such a system should be part of, but function separately
from, the operating system it services. The support system must be flexible enough to cover the widest range of

potential debugging and maintenance needs of the "parent system/' yet it must be simple enough in structure
to be bug-free within itself.

N eedJor a debugging support system
Impetus for the development of a debugging support
system has resulted primarily from the introduction of
time-sharing systems. Several major considerations
have fostered design of such a system.
First, the three most important pieces of informa tion
required to start debugging (hardware configuration,
description of input parameters, and description of
output condition) are not available in a time-sharing
system. Note the following:

• Hardware Configuration: Because there are many
users of a time-sharing system, it is impossible
for an installation to report the number of
devices, central processing units, storage elements, channels, etc., that were in use at the
moment the problem occurred.
• Description oj Input Parameters: In an extreme
case (such as an error in a shared program), it is
important to know the input parameters introduced by all users of the system. Depending on
the number of users the chance of obtaining this
information ranges from the remotely possibl e
to the literally impossible.
• Description of Output Condition: A description of
the state of the machine at the moment the problem occurred is needed. If a user does not know
what caused a bug, the contents of all storage devices for all users must be printed. Using the fastest available printing devic~, this action is prohibitively time-consuming and cumbersome.
A second major consideration is the need for an "onsite" debugging tool for each terminal user in a timesharing system. When a bug is detected, a time-sharing
user does not want to transmit the problem to a central
location and await its solution. The tool must be immediately available for debugging at the moment and under
the conditions in which the problem occurs.
Another major consideration is the· need for a "conversational" tool that permits the terminal user to make
repeated attempts to locate and correct his bug. If the
user fails in his first attempt to locate the bug, he can
try again and again and again without interfering with
other users of the system.
And finally, there is a need for total flexibility. The
debugging support system should provide generalized
functions that the user can then employ as necessary.
This circumvents the problem of predefined tools and
gives the l,lser a high degree of flexibility in defining his
own debugging procedures. Provision of generalized

Debugging in a Time-Sharing Environment
functions also increases the life-span of the support
system by making it unnecessary to add to the support
system as the parent system grows.

Definition of a ,time-sharing support system.
Since the authors' experience has been in writing
general purpose control programs, assemblers, compilers, input/output supervisors, and similar programs,
the term "system program" has take~ on a particular
meaning. In this discussion, the term "system program" is used to designate those programs not functioning directly to solve a specific data processing problem
(e.g., data reduction, payroll processing, model simulation, etc.) but rather those general-purpose programs
that perform generalized functions for many users (e.g.,
a supervisor, a program loader, a compiler, etc.).
The support system described in this paper need not,
however, be limited to this type of system progra.m. The
function of the support system requires that it be at
least relatively independent of (i.e., not utilize) those
programs being supported. An axiom of the concept of
support systems is that an functions upon which the
support system depends must work perfectly. It is,
therefore, technically simpler to construct a support
system for "non-system" programs since the functions
of the parent system (e.g., the I/O supervisor, the program loader) are readily available for use ..
The terms "debug" and "bug" are and will be widely
used alUong progralUlners and in other development environments. In this discussion, the term "bug" is used
to mean any programming failure due to faulty logic,
clerical errors, or timing considerations. It does not refer
to failures of hardware.
By now is it apparent that the debugging tools that
served us so well in the past are no longer adequate.
They must be replaced by a meaningful debugging system - a system that can be used to solve the perplexing
problems posed by the time-sharing environment.
It is feasible to produce that system today. The
talent, experience, and knowledge needed to create a
highly sophisticated on-line debugging system are available.
What IS needed for time-sharing. is a debugging suppt",rt system that meets the following requirements:
• The system should permit a system progralUlner
at a user terminal to debug system progralUs
associated with his task. When used in this manner, the support system should operate in a timesliced mode.
• When used to debug a separate task, the support
system should provide the facility to modify a
system progra.m in relation to that task, without

9

affecting the program as executed in relation to
other tasks.
• When a system program bug cannot be located
and repaired from a user terminal, the support
system should permit a skilled system programmer at a central location to suspend time-sharing
activity until the error is located and repaired.
The support system should then permit timesharing activity to be resumed as though there
had been no interruption.
• The support system should permit a system
programmer to monitor the progress of any task
from a remote terminal or from the user's terminal.
• The support system should contain the facility
to remain dormant until activated by a specified
condition. When activated by the condition, the
system should be able to gather specified data
automatically and then permit processing to continue.
• In its dormant state, the support system should
not impact the perfonnance of the parent tinlesharing system.
• The support system should use a minimum of
main storage and reside primarily on high-speed
external storage.
• The support system should be completely independent of the time-sharing system (that is, it
must use none of the facilities of the parent system), and it must be simple enough to eliminate
any requirement for a support system of its own.
An effort is currently under way to produce a timesharing support system that meets these requirements.
The next section describes the characteristics of that
system.

Description of a time-sharing support system.
This section describes a time-sharing support system
in very general terms, concentrating more on the user
interface than either the parent system or the specific
implementation.; While the discussion is general and
applicable to the time-sharing system concept, it should
be noted that the authors' experience has been with only
one time-sharing system and is limited in scope.
The support system consists of a command language,
a set of verb-processing programs, and supporting elements (such as an independent input/output supervisor).
The support system is interrupt-driven as are all
time-sharing systems. The primary driving force is supplied by an input/output interruption that originates
at a system progranuner's terminal, where the system

10

Fall Joint Computer Conference, 1968

programmer directs the debugging activity by using a
conversational command language.
Any time -sharing system consists of a set of programs
that dynamically reconfi~e themselves to fit the demands of a variable set of terminal users. No other programming system has presented thedata-capturingproblems posed by a time-sharing system. The design of
a debugging support system must, therefore, approach
the data-capturing problem with new techniques. These
techniques must be oriented to and operate with the
.. total time-sharing system.
The inclusion of the support system requires very few
additions, extensions, or changes to the basic time-sharing program. The most important change is in the technique of handling interruptions from input/output
channels and passing them to the processing programs.
When the support system is dormant, the time-sharing
system stacks all interruptions and processes them immediately. But, when the support system is active, the
support system interruptions are filtered out of the interrupt stream and passed to the support system for immediate processing. The parent system interruptions
are stacked, but they are not serviced until the system
programmer allows production processing to resume.
The support system consists of two major components
- a Supervisor Support System which interfaces with
the Supervisor of the time-sharing system and Problem
Program Support System which interfaces with those
portions o~ the system available to the user (system
services, shared code, "virtual storage," compilers, assemblers, etc.).
The "user" of the support system can be either of the
following:
j'

• A Master System Programmer (M SP) : This is a system-oriented user at a single terminal assigned to
the Supervisor Support System. He has the privilege of examining or altering information or setting
up controls anywhere in the system. This gives him
the power to alter control programs that perform
services for all tasks in the system.
• A Task System Programmer (T SP): This is a systemoriented user at a terminal associated with a task
currently active in the time-sharing system. Task
debugging operations can be performed concurrently from more than one terminal. The debugging
operations at each terminal are under control of the
Problem Program Support System. The task system programmer may perform actions that affect
only the task with which he is identified.
NOTE: In the remainder of this paper, the term
system programmer is used to refer to both the
master system programmer and the task system
programmer.

The support system is designed to aid a system programmer in finding the cause of a failing system component. It is intended, to help uncover logical flaws or
clerical errors in the system software. Thus, its function goes far beyond that of a built-in error correction
routine (such as an input/output error routine) that is
used merely to correct a transient failure.
The system programmer uses a terminal command language to control the support system. The commands enable the system programmer to perform a variety of functions. They allow him to check on the progress of the
time-sharing system, to modify the parent system during its execution, to capture static data from a fluid system for dump or display, and to localize a system programming problem in the parent system. The commands provide a set of generalized functions that the
system programmer can use to perform a wide range of
debugging procedures.
~1ore specifically, the system programmer has the
ability to do the following:
• Display data fields and instruction locations anywhere within the system.
• Display contents of machine registers.
• l\lodify variables within the system.
• Specify instruction locations within the parent
system at which execution is to be stopped. The
user can then intervene to alter or display data
before time-sharing execution is resumed.
• Specify locations within the parent system at
which data displays, alter actions, or dumps are to
be executed automatically.
• Establish logical expressions to control continuation or termination of execution of a support system command string.
The most-difficult of all program bugs to analyze are
timing errors. This difficulty arises primarily because
the exact conditions causing the error are not known or
are,not reproducible. The injection of a support system
activity into an operating system, wherein multiple
events are occurring simultaneously, will obviously alter
the time relationships. The SCOPE command which
would attempt to minimize this alteration is discussed
under" Future prospects for the support system."
By its very nature, the support system is limited to
.the conversational mode. Interpretation and execution
of commands entered by the system programmer are
performed in a manner similar to that of an interpretive
compiler. First, the syntax and symbols in a command
are checked. Errors are reported immediately to the system programmer's terminal, along with the appropriate 'diagnostic messages to guide him in correcting
the command.
Commands may be executed in immediate or delayed

Debugging in a Time-Sharing Environment
modes. In the immediate mode, each command is edited
and executed as it is encountered in the input command
string. That string may consist of single or multiple
commands.
When the system programmer specifies delayed
mode, the entire command string is saved to be executed
subsequently. In this mode, the system programmer
designates an event that is to trigger that execution.
The event is usually arrival of processor control at a
given machine instruction.
The support system vocabulary contains most of our
old functional friends from machine-level debuggingDISPLAY, PATCH, STOP, RUX, etc. The DISPLAY
and DUMP commands specify output of data from
main storage or external storage. The only difference
between the commands is the destination of the output
data. DISPLAY writes the data at the system progralnmer's terminal, while DUMP writes the data to an output device specified by the system programmer. Thedata
format is the same in both cases, although DU.J1P implies printing of certain control data such as machine
registers, status information, or other general data
areas.
It is frequently necessary for the system programmer
to suspend the parent system processing and cause it to
be resumed on command. The STOP and RUN commands provide these facilities. The STOP command
indicates that processing in the parent system is to be
halted. The RUN command causes processing to be resumed from the point it was suspended - or from some
other point. Note that a STOP command from a task
system programmer means "stop my task," while a
STOP command from a master system programmer
means "stop the system." The RUN command, of
course, means the inverse of STOP in each case.
In a debugging session, the system programmer frequently wants to gather system data dynamically. For
example, he may want to save the status of the last 100
input/ output interruptions. To do this, the system programmer uses the COLLECT command, specifying the
particular event that is to trigger collection of the data.
(For example, specified data could be collected each
time processor control was passed to the first instruc·
tion of an in put/output.interruption processing routine.)
Note that, while the COLLECT command is primarily
a debugging tool for a failing system, it can also be used
to save performance data or other surveillance data in a
non-failing environment.
No matter how much a system programmer knows
about a failing system, that knowledge is useless unless
the instructions and data of the time-sharing system can
be altered. We used to call this a "patch" function. In
the support system, the PATCH function has been extended to include external direct-access storage devices
as well as the conventional elements of main storage and

11

registers. Obviously, in a paging environment, the
system programmer will want to PATCH the "official"
resident copy of a program in addition to the copies
currently being used.
In a time-sharing system, terms such as "storage"
take on different meanings according to the current
state of the system. A particular segment of code may
be in one or another area of main storage, or it may be
on an external storage device, depending on the particular point in execution of the program. Because of this,
the system programmer must be allowed to qualify conlmands to specify the exact item or the exact location of
the item in which he is interested. The QUALIFY command provides this facility. It allows specification of
real or virtual storage, task identification, external
devices, program modules, etc. The system programmer can find out the location or status of a particu1ar item, and then use the QUALIFY command to pinpoint that item.
An IF clause is included in the support system command language to permit the system programmer to
specify the condition (or conditions) under which ac~ion
is to be taken. Through use of the IF clause, the system
programmer can cause a statement of logical, arithmetic, and relational expressions to be evaluated to determine whether the remainder of a command string is to
be executed.
The system programmer uses the DISCONNECT
command to end his use of the support system. He cannot use the support system again until he re-establishes
that communication link.
Two commands, DEFINE and SET, give the system
programmer a quasi-programming ability in the command language when combined with the IF clause. The
system progranuner can DEFINE certain private symbols, manipulate them with the SET command, and
make decisions based on their values.
If the system programmer were required to enter each
statement when he wanted it to be executed, his abiJity
to use the system would be severely restricted. Therefore, he is given the AT phrase to designate an event
upon which a given command string is to be executed.
The AT phrase empowers the system programmer to
perform al1 the funct.ions of the support system "on the
tiy." This facility endows the language with a power
only alluded to in prior systems but absolutely necessary
to capture relevant data in a tune-sharing system.
Just as the system progranuner can establish controls
using the' AT phrase and alter data using the PATCH
command, he is also allowed to negate those commands.
To accomplish this, he uses the RE:\10VE command.
This command erases the appropriate controls or restores
the original data that have been patched.
FinalJy, the system programmer can invoke a .predefined set of commands by using the CALL command.

12

Fall Joint Computer Conference, 1968

This conunand makes it possible to define a standard
debugging procedure, and then have that procedure executed in response to the CALL command.
From this general beginning, the system programmer
can proceed to specific debugging steps guided by his
experience and the support system output. The impact of
CALL is to extend the language to an "automatic" level
quite beyond the concepts of current debugging systems.
The commands described in the preceding paragraphs
are summarized in Table 1.
TABLE I-Summary of support system command functions
Command

Function

DISPLAY

To display specified values at the terminal
being used by the system programmer.

DUMP

To dump specified values on a printer or equivalent output device specified by system programmer.

SET

To change the value associated with a symbol.

COLLECT

To collect specified

PATCH

To change the value associated with a symbol,
to save the replaced value, and to record the
patching action.

STOP

To halt operation of the parent system or
operation of a specific task.

RUN

To resume the parent system operation at a
specified address.

QUALIFY

To specify qualifiers sub.:;equently to be applied to implicitly defined symbols.

DEFINE

To enable the system programmer to define
new symbols and, if necessary, to allocate
space for the symbols.

IF

To make execution of a statement dependent·
upon existence of one or more specified conditions.

AT

To specify events at which a statement is to
be executed.

CALL

To cause a prestored set of statements to be
executed.

REMOVE

To remove previously entered AT or P ATCR
statements originated by the system programmer.

DISCONNECT

To specify that a terminal is to be disconnected from the support system.

v~lues

into program area.

In creating the support system command language,
the need for flexibility was a prime consideration. Just
as the designers of a machine language cannot antici-

pate every use of the finished product, neither can the
designers of a support system language. The support
system command language is intended to provide a
general set of commands that impose no functional restrictions on the system programmer. The generality of
the language makes it a highly flexible debugging tool.
The commands can be used in many combinations to
achieve a large number of debugging functions.
Although design of the command language is an important aspect of creating a debugging support system,
the solution of internal implementation problems also
offers significant chal1enges. To integrate a support system into a time-sharing system requires the implementors to overcome several complex problems.
A key implementation problem is that of making the
support system transparent to the time-sharing system.
When the support system is invoked, machine and program status must be saved so that operations can be restored at the end of support system operations. The
integrity of the time-sharing system must be preserved
during the support system activities.
This requisite transparency is achieved by utiJizing
preallocated, private work space on external storage into which is written that data necessary to restore main
storage after the support systems use. In addition, the
interrupt-handling modules of the parent system remain
in main storage and are used to "stack" all interrupts
directed to the parent system. The support system requires that the parent system be able to recognize only
its activation signal, after which other surveillance tools
are activated and the hardware is actually controlled by
the support system.
Another example of the complexity of these problems is the implementation of a stand-alone Input/Output Supervisor (lOS). The lOS must be simple and
straightforward, while providing flexibility in the fluid
time-shared environment.
In retrospect, the system being implemented meets
all the requirements as previously stated except one.
The support system is not completely independent of
the parent system, though that independence has been
approximated in the most critical areas - the I/O
supervisor and the user interface. Complete independence may be neither possible nor desirable except
where it could justify a separate control processing unit,
memory, and I/O system.
Future prospects/or the support system

As mentioned previously, the flexibility of the support system prevents it from being "outgrown" by the
demands of its parent system. Even as the parent system is expanded, the support system will remain capable of solving the next program bug. Butevenmorein-:teresting than this are implications of more sophisti-

Debugging in a Time-Sharing Environment
cated applications of the system. Implied in its structure are the capabilities of forestalling the next program
bug, decreasing the probability that the bug will occur,
and perhaps ult¥nately eliminating bugs from the
parent system.
Among the future prospects for the system are the
following:
~

/'

• Provision of the ability to have predefined debugging steps automatically executed when a problem
occurs, thus enabling a system programmer to debug effectively even though he is not present at the
terminal at the moment the problem occurs.
• Provision of the ability to interrogate the system
at the micro-second level, thus easing the problem
of capturing data at the split second a problem is
encountered.
• Provision of the ability to monitor a system so
closely that the system can be rapidly adjusted to
achieve high-level performance.
• Provision of facilities to collect, compare, and evaluate data on program bugs, and ultimately
(through selection of alternative solutions) to have
a system restructure itself to avoid previously-recognized bugs.
These prospects are discussed in the following sections. It is important to realize that the basic knowledge
needed to implement these functions exists today.

Provision of predefined debugging steps
The support system described in this paper gives the
user an on-line real-time debugging capability. This
capability is overshadowed by another more powerful
capability inherent in the support system's on-site concept.
The systems programmer, in charge of solving userdetected systems problems, is impaired by the fact that
he was not present to perform certain actions at the time
the program bug appeared. It is indeed frustrating when
an answer must be returned to the user containing a set
of debugging instructions he must perform if and when
the problem reappears.
The support system can be extended to include provisions for predefining the debugging steps to be performed when a problem occurs and for making those
procedures a part of the total time-sharing system. An
example will illustrate the extent of this capability.
There are certain "should not occur" points within a
language compiler, i.e., there are points at which a compilation or assembly is aborted because of a programming or logic error. Instead of merely aborting the job,
a predefined set of support commands could be executed
to collect pertinent data (internal tables, transient records, etc.), to aid in debugging. The user, aware that hiR

13

compilation has been aborted, need not interfere in any
way with time-sharing operation. He merely allows the
system to perform the predefined debugging steps and
then forwards the diagnostic data to the systems programmer.
Under this procedure, the systems programmer is
sure that the data received from the user is what he
needs to solve this particular type of problem since he,
himself, defined the support system procedures to
be performed at the error points.
The inclusion of a new command, ON, would provide
this function. The following set of commands, comprising the debugging data set (DEBUG), could be used to
accomplish predefined debugging function.
ON FORTNOGOCALLDEBUGFORT
ON ASSEl\1NGO CALL DEBUGASSElVI
etc., for all language compilers/assemblers.
The phrase ON FORTNOGO or ON ASSEMNGO
would cause the support system to implant AT phrases at
all points within the Assembler or FORTRAN at which
abort action could be initiated. Note that the user
would not have to know the location of these
points. The exit points and the procedures to be performed (as defined by the data sets DEBUGFORT and
DEBUGASSEIVI) would be defined and supplied by
the system programmer. Control over collecting data at
these program error points would then be assumed by a
central source, the systems debugging group. The total
debugging efforts throughout the range of users could
then be organized to yield optimum results. To use the
predefined facilities, users would merely call the total
debugging data set (DEBUG) before initiating timesharing operations.

Gathering data at the micro-second level
The power of the support system could be greatly extended-by introducing the SCOPE command, a specialized debuggingtool. The multi-CPU environment innlany
time-sharing systems can be used to solve programming
problems in areas that require micro-second level interrogation and response. The SCOPE command would
specify that one CPU is to execute a series of operations
continuously while the other CPU's function nonnal1y.
With the use of the SCOPE command, one could
truJy debug at a micro-second level. An example of the
conlmand would be:
SCOPE IF LOCKBYTE - 255 DISPLAY MODID
The command would force one CPU to continuously
test the field LOCKBYTE for the value 255. When this

14

. Fall Joint Computer Conference, 1968

condition was satisfied, the module that changed the
value to 255 would be identified in output. In this
way, a systems progranuner may deter:mine which
routine altered a parameter, and when the parameter
was altered. More importantly, the entire system's
activity could be suspended while automatic debugging
routines were executed, and while an instantaneous
"snapshot" of the parent system was taken for complete
analysis.
Monitoring system performance

Since the support system is basically a meta-system
for surveillance and data collection in the parent system, it is obvious that the support syst,em may be used
to monitor a "healthy" parent system as well as aid in
debugging a "sick" one.
It is through the combined functions of system monitoring and the support system command language that
the first steps can be taken to improve perfor:mance for
a particular user. For example, a user could decide to
monitor the number of FORTRAN compilations requested per time interval. Then he could request that,
for his installation, FORTRAN modules be moved to a
slower or faster input device, depending upon the previously monitored infor:mation.
Potential for the parent system to correct itself

game program against another, the programs build up
statistics and knowledge of the best actions to be taken
under each of a mUltiplicity of conditions. With this
accumulated knowledge, the game program "learns" to
select the best alternative for a given condition.
The same type of system self-correction could be incorporated into an operating system or time-sharing
system by building a selective process based on the recorded results of previous actions.
If we define the term "complex system" to mean the
debugged system in its purest form, the following statement describes how to achieve the "bug-free" system:
"Selectivity through environmental feedback, and previous
experience as a source of selectivity (machine learning) leads to
the creation of the complex system through the creation of stable
intermediate forms upon which resulting more complex forms are
built."-The Architecture of Complexity, Herbert A. Simon in
General Systems, Vol. X, 1965.

Environmental feedback (i.e., knowledge of what has
happened previously) is provided by the monitoring
facility of the support system. Selectivity (i.e., the decision on the action to be taken) can be derived from the
monitored infor:mation and from the recorded results
of previous actions under the same or similar conditions.
Whereas selectivity was previously deter:mined by· the
debugging programmer's knowledge, skill, experience,
and learning power, it could now be part of the system
itself.
Since the basic mechanisms required to induce
machine learning (feedback through system monitoring
and selectivity through extended use of the support systenl) are available, the self-debugging system is a feasible concept.

The most far-reaching implication of the support system is that it creates the possibility of parent system
self-correction. More specifically, it paves the way for a
system that can learn to debug itself.
The support system provides extensive facilities for
gathering infor:mation on operations in a time-sharing
environment. Under current debugging procedures, this
ACKNOWLEDGMENT
.infor:mation is analyzed by the system programmer who
decides on a way to correct or circumvent the program , The basic capabilities (with the exception of the ON and
SCOPE functions) of the Tinle Sharing Support Sysbug. The system progranuner then evaluates the effect of
tem described in the paper have been implemented by
the change and makes further nlodifications if necessary.
Involved in this process is a series of selections and reIBM as a Type I program under TSS/360. The authors
wish to acknowledge the effort of the original designers
evaluations. Eventually, the systenl programnler learns
the best thing to do in each of a variety of situations.
of the Support System described herein.
It is feasible to incorporate this human debugging
process into the operating system or time-sharing sysMr. M. E. Sherck
temitself.
Dr. 1. Rezucha
Consider the learning process involved in the gradual
refinement of game-type programs (checkers, chess,
Mr. R. Heistand
etc,). These programs examine a current situation, select what appears to be the best action to take under
The authors also wish toa(:knowledge the efforts of
a particular condition, take and record the action, and
Mr. R. L. Bean in the editorial preparation of this
later evaluate it. Through extensive· interplay of one
document.

TSS /360: A time-shared operating system
by ALEXANDER S. LETT and WILLIAM L. KONIGSFORD
International Business M aehines Corporation
Yorktown Heights, New York

INTRODUCTION
Experience with TSS/360 design, development, and
application has been varied and interesting. For example, as we began putting the initial system together,
significant performance problems were observed that
had not been predicted by the earlier simulation efforts.
These problems had not been anticipated because ,the
paging characteristics assumed in the model development were significantly better than the actual system
characteristi cs.
Measurements and analysis soon indicated that one
significant problem was in the organization of the dynamic loader tables. This was overcome by splitting these
tables into functional sub-tables, which greatly reduced paging during the loading process.
However, the paging problem was widespread. In
most cases, the size of the actual code was two to three
times the size expected by the model. In addition to the
adverse effects on the available core space, this caused
the paging input/ output traffic to be significantly
larger than expected, the level of possible multiprogramming to be smaller than expected, and the number
of tasks wholly contained on the paging drum to be
fewer than expected.
During the mu1ti-terminal testing phase of TSS/360,
another significant paging problem was discovered.
Core-space control was based upon dynamically Jimiting the number of tasks active in core to the maximum
that their estimated core usage would allow. A greater
number of tasks would cause a high rate of unproductive paging within the system; a lesser number would
not fully utilize the system facilities. The core-space
control was not functioning properly due to bugs .. A
temporary solution was to restrict the number of active
tasks in core to a fixed number. This reduced the performance problem but, when the same test cases were
later run under the correctly operating dynamic. algorithm for core-space control, the dynamic algorithm
was found to be consistently more effective than the

static algorithm had been. This generally vaIld conclusion has been demonstrated'in all area of TSS/360.
Since the initial release of TSS/360 in October 1967,
performance has improved significantly with each subsequent release. The initial emphasis was on building a
stable system, followed by extensive measurement-andanalysis efforts to identify potential system modifications. Then, through comparatively small changes in
coding and resource management algorithms, the system performance was significantly improved.
From the material presented in this paper, we feel
that several conclusions-which are supported by our
operating experience-can be drawn:
• Paging is a sound concept. As expected, it is· a
direct solution to the dynamic-core-storage-allocation problem.
• Paging also allows for a hierarchy of auxi1iary
storage which, in the case of TSS/360, involves
high-speed drum and slower-speed but largercapacity disk files. A larger number of users
can be supported economically on a system by
subdividing each user's space requirements
between drum and disk storage. From experience,
sound algorithms can be developed for management of this storage, which is critical to the overall performance of the system.
• A data set access method based on page-size fixed
block images has the same simplicity of implementation and elegance of application as in the corestorage situation.
• In the improved command system, we have found
that a highly adaptive, open-ended system is not
only more valuable to terminal users, but simpler
to implement.
• The best strategies for resource allocation are
those that address the allocation of all system
resources in an integrated way, rather than optimizing specific sub-portions. In general, the
simple round-robin strategy is fai~ly good, but

15

16

Fall Joint Computer Conference, 1968
the need to emphasize certain characteristics
(such as response time to conversational requests)
requires the separation of resource requests by
priority.

It is the purpose of this paper to highlight the key
elements of TSS/360-control system organization,
user services, and task structure-in order to describe
and explain the design of a time-shared operating system.

Control system organization
There are many possible resolutions to the questions
concerning the division of functions within a control
program, the interfaces between portions of the control
program, and the decision as to which portions are to be
resident in main storage and which nonresident.
In the design of TSS/360,the historical exaWples of
the lVIIT Compatable Time Sharing Systeml an~ the
IBM Time Sharing Monitor system2 led towards the
concept of a small, fullS re~ident monitor whose primary
function would be to crefl.te a multiprocessing, multiprogramming enviornment.
In TSS/360, this monitor is called the Resident
Supervisor. The Resident Supervisor is interrupt driven, and is responsible for controlling the real resources
of the system and for performing services in response to
requests originating from tasks. A task represents the
environment in which a user's processing is performed.
There is one task for each conversational user of the system. A fundamental design decision was to provide
within each task the facilities of a full operating system.
Figure 1 depicts thi~ overall system structure.
Task processing is always performed in relocation
mode with the dynamic-address-translation feature
activated. Tasks are therefore said to operate in
virtual memory.
The Resident Supervisor, on the other hand, does not
use dynamic address translation-that js, instructions
within the Resident Supervisor have main storage addresses, not logical addresses, as operands. The decision
to make the Resident Supervisor operate in the nonrelocation mode was based upon the efficiency resulting
from eliminating dynamic-address-translation overhead
and upon the increased protection resulting from the
fact that no location within the Resident Supervisor can
be addressed by a program operating in virtual memory.
Resident Supervisor routines, however, are capable of
addressing all of main storage and of executing all of the
instructions in the System/360 instruction set.
Another basic TSS/360 design decision was to have
-tasks be interrupt driven like the Resident Supervisor.
It was felt that this structure provided the maximum of
flexibility in task development. Accordingly, task-con-

FIGURE I-TSSj360 program structure

trol structure is in many ways analogous to the control
structure of the Resident Supervisor.
In order to provide a wide variety of control program
services, while at the same time protecting user tasks
from each other, task virtual memory routines are divided into two classes:
• privileged routines, which operate in the privileged state;
• nonprivileged routines, which operate in the nonprivileged, or user, state.
As the term implies, routines operating in the priviliged state are authorized access to many supervisor
services denied to routines operating in the user state.
In this way, most par~meter validation and other protection checking can be eliminated from the Resident
Supervisor. In addition to decreasing the overall size
of the Resident Supervisor, this arrangement allows supervisor services to be more general and powerful.
The way in which the privileged state is implemented
is as follows:
• In a task's virtual memory, pages that are allocated to privileged routines (and their associated
tables and work areas) are assigned a storage protection key that differs from that assigned to user
programs. This will cause a storage-protect interruption if the privileged part of a task's virtual
memory is addressed by a user program. Priv-

TSS/360
ileged routines, on the other hand, can address
all of the task's virtual memory.
• The dynamic loader service routine will not
treat modules from a user's library as privileged
routines. Thus, an ordinary user cannot cause his
own version of a system routine to be loaded and
executed as a privileged routine, a facility available to the systems programmer.
• A user program normally requests system services
through instructions whose esecution cause
an interrupt to the Resident Supervisor. (In system/360 such interruptions are termed supervisor
calls.) In response to the supervisor call, the Resident Supervisor, by manipulating CPU status,
creates a task interruption to invoke a privileged
system services routine. The privileged rQutine
can then determine if the user's request is valid. If
it is, the privileged routine may then invoke other
TSS /360 supervisor calls while in the process of
performing services. If the request is not valid, it
will be rejected, thus preventing a nonprivileged
routine from causing incorrect system operation.
The reason for communicating between nonprivileged and privileged state via the Resident
Supervisor is that only the Resident Supervisor
can execute the instruction that alters a task's
protection key and, therefore, its state.
The privileged system service routines constitute the
bulk of the TSS/360 operating system. These routines
are either shared by all tasks or are located in independent service tasks. Printers, for example, are serially
shareable and thus are serviced through an independent
task. On the other hand, the dynamic loader provides
service to each task and is therefore shared in par~llel.

System control elements
The Resident Supervisor is primarily composed of an
interrupt stacker, a queue scanner, several processors, a
number of error handling and service subroutines, a
dispatcher, and the tables that form the system's data
base.
Entry into the Resident Supervisor i~ via an interruption. Some interruptions are processed immediately
either because of their urgency (e.g., interruptions denoting CPU malfunctions) or for efficiency (e.g., interruptions which require a change of task state).
For most interruptions, however, the interrupt
stacker builds a record called a generalized queue entry
(GQE), into which a description of the interruption is
placed. This GQE is then placed upon an appropriate
queue. A GQE is a standard control block used throughout the Resident Supervisor to contain a description of
the work to be done by a device or facility that is con-

17

trolled by the Resident Supervisor. Quite frequently,
one control block may belong to several queues and contain forward and backward pointers to each of them. In
processing these multi-threaded lists, the Resident
Supervisor becomes, in effect, a list processor.
Interruptions are disabled during processing in the
interrupt stacker. However, in contrast to many systems, the Resident Supervisor generally executes with
interruptions enabled to facilit~te processing of interruption queues, on a priority basis, without regard to
sequence of arrival. When the interrupt stacker completes processing, it generally exits to the queue scanner.
Every system needs some facility for sequencing the
work to be performed by the control program. In systems which operate with interruptions disabled, the
hardware priority-interruption system provides this
function for the interrupt-handling routines, and some
other control-program routine provides a similar function for the system's resource-allocation routines. Within TSS/360, these two functions have been combined
into one centralized queue scanner and a scan table.
Each system queue is anchored in the scan table.
Because the queue scanner is a central facility within
the Resident Supervisor, it must operate efficient1y if
the Resident Supervisor is to operate efficiently. To
achieve this efficiency, the queue entries in the scan
table are organized to minimize the number of entries
that must be inspected when the scanner is searching for
work. Moverover, the organization of scan-table entries
reflects an awareness of the possible interactions among
queues so that, for example, an exit is not made to a
processor only to find that a needed facility (such as an
I/O path) has been allocated to some other request.
When the queue scanner finds work that can be done,
it passes control to the appropriate processor; when it
determines that there is no currently available supervisor work, control is transferred to the scheduler and
dispatcher.
TSS /360 was designed for a generalized multiprocessing environment in which multiple CPUs may be
simultaneously executing the single copy of the Resident Supervisor. To facilitate multiprocessing, it was
necessary to define a number of programmed interlock
flags to prevent unwanted recursion and logical race
conditions. In general, TSS /360 used the approach of
defining a small number of interlocks, each covering a
wide scope. These interlocks generally guard entrance to
the queue processors and to the major system data
bases.
The purpose in minimizing the number of interlocks is
two fold:
• First, placing interlocks at the entrance to the
queue processors tends to prevent a CPU from

18 Fall Joint Computer Conference, 1968
entering a path of logic only to soon be forced to
await the resetting of an interlock., When the
queue scanner finds an interlocked queue processor, it simply bypasses inspecting that queue and
proceeds to the next entry in the scan tab1e.
• Second, in a multiprocessing situation, it is desirable to permit one CPU to perform error-recovery
procedures whenever another CPU encounters a
processor or storage unit error. Because all processors use the single copy of the Resident Supervisor, it may be necessary for the recovery CPU to
reset programmed interlocks initially set by the
malfunctioning CPU. This means that the recovery CPU must be aware of the reason why the
interlock was set. The fewer the system interlocks, the simpler the recovery procedures can be.
In general, a queue processor locks its associated
queue upon entry and unlocks the queue as soon as the
processor has dequeued a GQE for processing. In certain
cases a queue processor may lock a queue until some
specific future event or condition has occurred. Each
scan table entry has indicators reserved for such use.
TSS/360 has adopted a policy of concentrating the
physical locations of the interlock flags in an orderly
fashion within a very few key system tables. This has
proved to be a valuable aid to the development programmers, who can determine the status of the Resident
Supervisor by inspecting or displaying these system
tables.
The following is a brief description of the major processors within the Resident Supervisor:
• Task Core Allocation: Controls the overall core
storage space; it processes requests for space allocation and responds with the location assignments
• Auxiliary Storage Allocation: Controls auxiliarystorage space; it processes requests for drum and
disk page-space allocation.
• Page Drum Reguest: Processes input or output requests for the auxiliary paging drum. Because of
the unique mechanical characteristics of the drum
(several pages per track with instantaneous
switching), the requests are sorted by angular
position to maximize throughput.
• Page Drum Interrupt: Processes interruptions that
are the result of paging drum input/output operations. This processor will attempt to keep the
drum I/O channel busy by adding drum requests
to an active drum I/O channel program. It calls
the page-posting routine to process the results and
releases core space when appropriate.
• I/O Device Request: Processes requests for I/O
operations to devices other than the auxiliary storage drum; it first determines, by calling the path-

finding subroutine, if a free path to the requested
I/O device is available and, if possible, reserves a
path.
I/O device requests are either disk paging requests or other I/O requests. For disk paging requests, a subprocessor is called to convert the request into an I/O channel program. For other
I/O requests, a request control block chained from
the queue entry already contains the I/O channel
program. This I/O program is normally created
by the task requesting the I/O. The I/O operation is started by the request processor, which returns to the queue scanner.
• Channel Interrupt: Processes input/output interruptions that originate in other than the paging
drum. It determines if the interruption is synchronous or asynchronous by verifying if a request on the corresponding devi ce-request queue
had initiated the operation. If the interrupt is synchronous, various processing is performed. If the
interrupt is asynchronous, an interrupt entry is
queued for the task currently associated with the
device. If no task is currently associated with the
device, and it is a terminal, the channel interrupt
processor will call a routine to create a new task
that will then be dispatched. The newly created
task will begin execution of the appropriate taskinitialization routines in response to its initial
interrupt.
• Timer Interrupt: Processes timer interruptions; it
determines if a task has reached the end of its
time-slice or whether a task-specified time interval
has elapsed. At time-slice end, various processing
is performed. For task-specified intervals, a tasksimulated timer-interrupt entry is queued for the
task.
TSS/360 error recovery and retry procedures are designed to dynamically correct errors or to minimize the
effect of errors on the system as a whole. Although the
specific recovery procedures differ for each type of error,
the general approach to recovery is the same. Failing
operations are retried where possible, failing hardware
devices (e.g., a CPU or I/O device) are checked and
intermittent failures retried. vVhere an operation cannot be retried at all or is retried without success, n,
"hard" failure is recognized and fault localization, to
the component level, is invoked. The failing element or
device is removed from the system in an orderly manner, so that only the affected tasks are disrupted. An
environment record is genera ted for later a'lw,lysis by
service personnel and the system continues operation.
It is only as a last resort, when recO\"ery is not possible
and when removal of the failing component would

TS.s/360
render the system inoperative, that the system is shut
down.
In addition to the queue scanner's sean table, the
Resident Supervisor contains data bases to describe
task status and to describe I/O path status.
Each task has associated with it a control table that is
separated into portions. The first portion is needed fo~
scheduling and control purposes, so it is kept continuously resident in main storage. The second portion
contains the task's relocation tables that must be in
main storage during a task's time-slice, but not necessarily between a task's time-slices.
To allow a user's program to be highly device-independent and to allow the ResideI;it Supervisor to remain
relatively insensitive to dynami~ changes in system configuration, TSS/360 users nclrmally employ deviceclass codes that describe a devjce as a member of a class
of like devices. Furthermore;' the TSS/360 access methods employ symbolic addresses to designate devices.
The Resident Supervisor uses a group of tables, called
pathfinding tables, to translate a symbolic device address into a hardware address that specifies a path
through a channel control unit, channel, and device control unit to the device. The supervisor-maintained pathfinding tables are used to determine if a device is busy
instead of attempting to physically address the device.
In a typical environment, it is expected that there will
be multiple paths to most devices. In such a situation,
the efficiency of I/O processing will be increased by reducing the number of "busy" or "unavailable" conditions encountered during an attempt to initiate an I/O
operation. The use of common pathfinding tables also
assists in synchronizing I/O processing in a multiprocessing environment, because an I/O interruption may be
accepted by any available CPU, not just the CPU that
initiated that operation.
In retrospect, the design of the Resident Supervisor
has proved to be sound and remains, in outline, essentially as initially described in 1965. 3 Experience has
shown that it is nearly impossible to predefine an optimal overall system. A significant amount of tuning of
resource-control algorithms and processing procedures
must be expected. We have found that the best method
to do this tuning is by modification and measurement of
the running system.

Task control elements
TSS/360 includes a scheduling algorithm for determining the sequence of allocation of CPU time to competing tasks. As implemented initially, the scheduling
algorithm divided tasks into conversational and nonconversational groups.
The original algorithm followed a round-robin schedule for the active tasks (those not waiting for the com-

19

pletion of some event, such as terminal input). Conversational tasks were scheduled for dispatch in consecutive order to the end of the list. At this point, a test
was made to determine if an installation-specified realtime interval had elapsed. If not, the system devoted
the remainder of the interval to the round-robin execution of the nonconversational tasks. If the interval had
been exceeded, the system went back to redispatch the
first active conversational task.
As a result of system experience, this algorithm was
modified. All active conversational tasks are noW dispatched in round-robin fashion until no further active
conversational tasks are available. Then the system begins to dispatch active nonconversational tasks, but
With provision for pre-emption whenever a conversational task becomes active. Instead of round-robin
execution of the nonconversational tasks, the system
tends to run to completion as many nonconversational
tasks as can be effectively multiprogrammed within the
available core resource. This modification was incorporated because round-robin scheduling for the nonconversational tasks served no useful purpose and reduced system throughput by causing the system to do
additional paging in switching resources.
The scheduling algorithm outlined above is not considered to be the optimum for general time-sharing
operation in any specific customer's installation. Experience with scheduling algorithms and their effect
upon the system dictated the need to provide a flexible
facility for modifying the task-scheduling algorithm.
TSS/360 is adding this facility, called the table-driven
scheduler, in which table entries are made to define sequences of states and attributes that a task can assume.
When created, each task is assigned an initial table
entry in which specific parameters explicitly state:
• the relative priority of every task associated with
that table entry
• whether such tasks may be interrupted by a
higher priority task
• the time-slice quantum to be ttllocated to the task
• the maximuin core space to be allocated to the
task
• other parameters concerned with the action to be
taken when execution of a task is suspended.
Execution of a task can be suspended for reasons such
as time-slice end, terminal-wait condition, or excessive
paging. Associated with each of these conditions is a
value specifying the table entry to be assumed by the
task on the occurrence of that condition.
The collectIon of schedule table entries, which can be
prepared at each installation, specify the .Scheduling algorithm to be followed by the system. The table
entries can range from extremely simple ones that

20

Fall Joint Computer Conference, 1968

simulate a round-robin queue, through exponentially
related algorithms, to complex time-and-priority algorithms.
The allocation of the CPU resources to tasks, to best
carry out the sequence selected by the scheduling algorithm, is controlled by the dispatcher. The dispatcher
first determines if a new task can be placed into execution. This is determined by comparing an estimate of
the core pages a task is expected to require during its
next time-slice with the number of unreserved and
available core pages. The estimate of a task's page
requirements is based on its activity in the preceding
time-slice. If enough core pages are available, the count
of available core pages is reduced by the estimated
number and the task is prepared for execution. This
dynamic control of the number of tasks allowed to concurrently execute in core storage is vital to avoid overloading a paging system such as TSS/360.
A modification has been made to the dispatcher to
dynamically detect CPU-bound tasks. When more than
one task is ready for immediate execution, non-CPUbound tasks are dispatched before CPU-bound tasks.
Through this strategy, the system dynamically maximizes its probability of multiprogramming (overlapping
I/O with computing).
When a task is selected for immediate CPU execution, a task-interrupt-control routine in entered. The
need for a task-interruption mechanism arises because
the Resident Supervisor processes requests for system
services in a logically independent fashion, that is, the
Resident Supervisor may be concurrently performing
several services for a task. There is no way to forecast
the order or time of completion of processing of each of
these services.
Therefore, for a task to operate asynchronously with
respect to the completion of system services, a task-interruption mechanism has been created that is analogous to the hardware-interruption mechanism that
allows the Resident Supervisor to operate asynchronously with respect to the real computer system; Operation of task interruptions is similar to hardware interruptions. The major difference is that the hardware interruptions convey a change in the status of the entire
system to the Resident Supervisor, while the task intertuptions represent a change in status of only that portion of the system currently allocated to the task being
interrupted.
A task interruption is requested by a Resident Supervisor routine when it discovers an event, such as I/O
completion, whose further processing is a task's responsibility. However, a task is not always prepared to
receive an interruption; further, the task for which the
interruption is destined may not be the next ta.sk to be

dispatched. So there is a software queueing-and-masking
facility that is analogous to the hardware facility.
Before control is given to a task, the dispatcher transfers control to the task-interrupt-control routine, which
checks the task's interruption queues for unmasked
pending interruptions. If none is found, control is given
to the task at the location saved in its control table.
If pending interruption is found, the task-interruption-control routine changes the location pointer to
point to an appropriate interruption processor of the
Task Monitor. Now, control will go to the interruption
processor. This action of influencing the dispatcher's
transfer of control is called a task interruption.
The Task :\lonitor consists of a group of privileged service programs that receive and process task interruptions on a priority basis via queueing, scanning, and
dispatching mechanisms analogous to those of the Resident Supervisor. The Task ~Ionitor may thus be considered a task-interruption handler, whereas the Resident
Supervisor is a hardware-interruption handler.
The Task ~lonitor performs these major functions:
• Provides an interface with the Resident Supervisor for receiving and analyzing task-oriented
interruptions.
• Provides linkage to required service routines or
user routines, either by immediate dispatching
or by queueing the interruption for later dispatching in a priority sequence.
• :\laintains the integrity of the task and service
routines that are dispatched, primarily through
save-area management.
The Task ~\Ionitor is designed to provide for flexible
handling across a wide range of interruptions. Thus, it
provides an ability to dynamically specify task-interruption-handling routines and to dynamically arm, disarm, and change the relative priority of theRe routines.
As with the queue scanner of the Resident SuperviRor,
provision has been madp to URe thiR gPIlPralizpd proCPHR
in an efficient manner.

User .~ervice8
Because TSS/360 is a comprehensive operating system, it offers a wide variety of user services4 , such as:
Command system
Program control subsystem
System programmer support system
Catalog management
Page-oriented data management
:Ylagnetic-tape and unit-record data management
Dyn9mic program loading
Virtual memory allocation
External storage allocation

TSS/360
• Resource control and accounting
• Task-interruption control
• Language processors
From this list, we have chosen to describe in this section the command system, the page-oriented datamanagement services, and the dynamic-program-loading services. Not only does each of these represent a
key aspect of TSS/360, but each has relevance to problems of general interest.
Command system

The command system is the principal interface between a time-sharing system and its users. Therefore, it
has a position of special importance in TSS/360.
Initially, the TSS/360 project attempted to define a
set of commands that would be satisfactory for all users.
The result was a rigid set of commands that compJetely
satisfied no one. This experience led to the conclusion
that it is better to implement a command system than a
command language.
As a result, TSS/360 now contains a flexibile command system that is delivered with a set of simple commands that can either be employed as is or be completely replaced and expanded in a straightforward
fashion. This approach allows each installation and,
more important, each user at an installation to customize the system-user interface to his own needs.
In TSS/360, the syntax of the command system has
been separated from the semantic content of command
statements. This regularization of syntax and structure
has resulted in a simpler implementation utilizing a
single, centralized command analyzer and execution
facility.
The command-system syntax is simple and natural.
Each command consists of an operation name, which is
usually followed by one or more operands. As supplied
with the system, the delimiting character for the operation name is a blank or tab; the delimiter between
operands is a comma; the deliniiter between commands
is either a semicolon or the end of a line of input; and
the line-continuation flag is a hyphen entered as the last
nonblank character of a line.
When an individual enters his commands conversationally, he is told of the acti ons taken by the system in
response to each command and, when necessary, he is
prompted for additional non-defaultable inform~tion
needed to complete an action, is informed of errors (if his
command entry is either incomplete or incorrect), and is
told of the options he may exercise in response to an
error. Special care has been taken to make the types of
options consistent for all commands. Nothing, for example, could be more frustrating to a user than to be required to resubmit an operand with. delimiters in one
situation and without delimiters in another.

21

Each user can establish his own spellings, abbreviations, or operation· names for commands through a
SYNONYM facility. Use of this facility sets up one or
more equivalences for the original name but does not
destroy it.
Any command operand may be entered either by
position or by keyword. Keywords may appear in any
order and have the general form KEYWORD = value,
where KEYWORD is the name of the operand and
"value" is the actual value of the operand. For each
command operand, the user may select the form that is
most convenient for him. A keyword has a global meaning since it is associated with the value to be passed, not
with the particular command invoked. Therefore, the
SYNONYM facility, available for command operation
names, is also available for keywords. In contrast to
many other systems, almost every command operand
has a default value. Moreover, the user need not accept
rigid default values for operands, for he can easily override those supplied with the system. For example, a
standard default for the FORTRAN compiler might be
to produce an object code listing~ Any TSS/360 user can
individually change this default so that, in his case, the
language processor will not produce an object listing unless he specifically requests it.
TSS/360 maintains a special prototype data set that
is copied into the user's library when he is initially
joined to "the system. This data set, called a user profile, contains three tables: the first specifies the initial
default values for command operands; the second contains his character~translation list (to allow redefinition
of printing characters and control characters); and the
third contains command operation names and equivalences. The user can modify any of the entries in these
three dictionaries, which, in conjunction with the command system, define his command language.
The command system includes as a fundamental feature a command procedure facility, which permits the
user to create a stored procedure comprising commands and logical statements that control the flow of
command execution. Invocation of a command procedure is identical to invocation, ef a system-supplied
command. The command statement consists of the procedure name followed by a series of parameters, whose
values are inserted by the command system at the proper points in the procedure. The resultant statements
will be interpreted as though they had originated in the
input stream. For maximum power, command procedures can be nested and/or recursive. When defining a
procedure, a user can utilize the facilities of the
TSS/360 text editor. Once defined, a procedure may be
edited, shared, copied, etc., as with any other file.
Another interesting feature of the command system
is the use of "null conunands." For example, immedi-

22

Fall Joint Computer Conference, 1968

ately after a user has signed on the system but before
control is returned to the terminal, TSS/360 automatically invokes a command procedure called ZLOGON. As initially supplied with TSS/360, ZLOGON is
.a "null" command-it does nothing. However, the individual may redefine the ZLOGON command procedure to perform functions to augment the initialization
of his task. Thus, "null" ·commands are conceptually
similar to the "user exits" frequently associated with
general-purpose programs.
The command system also provides a facility for defining new command primitives. Efficiency can be enhanced through use of this "Built-in" facility as the
command system can directly bypass much of the interpretive processing required in the expansion of command procedures.
.
Still another feature of the command system available to the user is the ability to augment system-message handling:
• He can request explanation of system messages or
of key words in such a message; word explanations
may continue to a number of levels.
• He can dynamically specify the classification of
messages he is to receive; this filtering, or
masking, capability provides different messageseverity levels and message lengths.
• He can construct a personal message file that will
be issued in lieu of the corresponding system-supplied messages ..
The command system also provides a flexible system
for handling attention interruptions that is quite useful. For instance, suppose a user has forgotten to identify a library that contains a subroutine required by his
mainline program. When he receives a system diagnostic message, he can use the attention button to re-enter
the command mode, define the library, and then resume
processing at the point where the message was issued.
The program control subsystem of the command system is a powerful facility that permits a user to inspect
and modify programs during execution. These dynamic
control facilities eliminate the need for user-written debugging and control instructions that must be preplanned, coded into the user's programs, and then later
removed.
The output from the TSS/360 language' processors
may optionally include a dictionary containing the
values and other attributes associated with the symbols
or variables used in the source program. Through the
use of this dictionary, the program control subsystem
can properly interpret debugging statements utilizing
source program symbols and can properly format its in. put and output.
Even during the initial shakedown of TSS/360, there

were many users who insisted upon using the system
only because of the power associated with a dynamic
execution-control system. This has made clear that an
essential element of any interactive system must be a
dynamic symbolic debugging and control facility.

Page-oriented data mana,gement
The access methods that support page-oriented data
management in TSS/360 are called virtual access
methods. The name "virtual" was given to these access
methods to reflect the fact that they utilize only one
physical bl~ck size-that of a page. The virtual access methods were specifically designed for a time-sharing environment and present a clear division between
data set management and physical device management.
Each of the three virtual access methods provides access and processing capability for a specific type of data
set organization:
• Virtual sequential access method (VSAl\1)
• Virtual index sequential access method (VISAM)
• Virtual partitioned access method (VP AM)
In all three of these access methods, only data set
management is performed in virtual memory; the construction and execution of channel programs and error
recovery (Le., physical-device management is performed
by the Resident Supervisor. The direct-access volumes,
on which TSS /360 virtual organization data sets are
stored, are entirely formatted into fixed~length, pagesized data blocks. No key field is required. The recordoverflow feature is utilized to allow data blocks to span
tracks as required.
The page-sized block for data storage was selected for
a number of reasons. For example, rotational delay is a
significant factor in direct-access throughput, since it
cannot be overlapped as mechanical-seek time can. Any
block size significantly smaller than a page would be
extremely wasteful of total direct-access capacity unless
elaborate strategies were utilized to avoid rotational
delay.
The need for a large block size is also apparent when
the simultaneous. direct-access activities of multiple
users are considered~ Due to conflicts in demands for access arms, a mechanical seek may frequently be required before accessing a data block. A larger block size
makes better use of the total access cycle while, at the
same time, reducing the frequency of access requests by
each user.
The direct-access volume-packing efficiency is also
quite high for page-sized blocks. First, the data-recording space is utilized at better than 90% of the theoretical capacity that could be obtained by t.he use of cylinder-length blocks. Second, the smallest external-storage

TSS/360
allocation unit is a single page; hence, a large number of
small data sets can be kept on one volume. Furthermore, large data sets need not be allocated physically
contiguous external storage space. This contributes to
higher volume packing efficiency by reducing externalstorage space fragmentation.
The physical representation of a typical virtual sequential organization is shown in Figure 2. The specification of any virtual data set is contained within the
data set's external page map, which is stored on the
direct-access volume together with the data pages.
There is one entry in the external page map for each
page-sized block occupied by the data set. The content
of an entry specifies the location of a block in external
storage. The position of the entry within the external
page map signifies the relationship of the associated
block relative to the other blocks in the data set.
For the three-page data set shown in Figure 2, the external page map shows that the first data block is
between the other two pages of the data set. This example emphasizes that block relationships in the data
set are determined by the contents of the external page
map rather than by their physical position within the
volume. This concept allows the virtual access methods
true device mdependence across the range of direct-ac-

PaQ' Formatted Disk

Ext,rnal PaQG Map
PAGE I POINTER
PAGE 2 POINTER
PAGE 3 POINTER

FIGURE 2-Typical virtual sequential organization

23

cess devices. That is, it is perfectly feasible for a data
set to have physical records recorded on, say, the IB::\I
2311 Disk Storage Drive and the IB::\1 2314 Direct
Access Storage Facility in any mixture. Furthermore,
because information is referenced relative to the beginning of the data set and not by its location with respect
to an external-storage device, it is entirely practical to
move data sets (or portions of data sets) among a
hierarchy of devices.
In a typical virtual index sequential organization,
three classes of blocks can be specified within the external page map: directory pages, data pages, and overflow pages. One entry, corresponding to the lowest record key in each data page, is placed in the directory.
Records are maintained in collating sequence within the
the data set by key value. To find a given record, the
directory is searched and then the data page containing
the record is searched. Locator entries, corresponding to
each record within a data page are stored in the back of
the data page. Space in overflow pages will be assigned
when record insertions exceed the capacity of a data
page. The record locators in the primary data page will
point to secondary locators within the overflow page.
The placement of data and locators within the same
block is a significant convenience associated with choosing a fixed block size, and is in contrast to many contemporary systems.
In a typical virtual partitioned organization, two
classes of page blocks can be specified within the external page :directory pages and member pages. The
partitioned organization directory contains an entry
describing each member, which is specified as a contiguous group of entries within the member-data portions of the external page map. Members are subsidiary
data groups that may have sequential or index sequential organizations (or any combination of the two).
Members can be expanded or contracted by simply
adding or deleting entries within the external page map.
The partitioned organization allows a user to manipulate individual members or to conveniently treat a
group of data sets as a single entity for purposes such as
creating libraries or sharing data sets through the system
catalog.
Two types of interlocks are provided to coordinate
simulatenous access to shared data sets by more than
one user:
• Read interlock: prevents another user from writing into the interlocked data space; other users
may have read-only access at the same time.
• Write interlock: prevents another user from reading or writing the interlocked data space; can be
set only when no other interlock is set.
Interlocks are established at various data space

24

Fall Joint Computer Conference, 1968

intervals, depending on the data set organization. Virtual sequential organizations are interlocked at the
entire data set level. Virtual partitioned organizations
are interlocked at the individual-member level. Virtual
index sequential organizations, however, are interlocked
only at the individual data-page (block) level; this
allows a much finer level of sharing than is available in
most other systems. The control mechanism for sharing
has been simplified significantly by the choice of placing
interlocks at the level of the physical block, rather than
at the level of the individual record.
When a logical record is wanted (in a straightforward
case), the flow of control is as follows. The appropriate
external-storage address of the record's page is obtained
from the external page map. This address and the
virtual memory address of a buffer are passed to the
Resident Supervisor in a request list.
The Resident Supervisor places the symbolic device
address and relative block number in the relocationtable entry associated with the buffer's virtual addres8.
However, the page itself is not yet read into main storage. It is only when a user addresses a record in his virtual memory buffer that a paging-relocation-exception
interruption occurs, causing the Resident Supervisor
paging processors to bring the page into main storage.
The virtual access methods write onto external storage only those pages of the buffer that have been modified. When it is necessary to write a buffer page onto external storage, the appropriate virtual access method
routine obtains an external-storage address for the page
from the external page map and passes the virtual
memory address of the buffer, together with this external-storage address, to the Resident Supervisor. The
appropriate Resident Supervisor routines then write the
buffer page into the data set on external storage.
The external page table maps the external-storage
locations of a given portion of the data set into a virtual memory buffer. The size of the buffer controls the
extent of virtual memory allocated to the data set. This
second level of mapping allows the user to process a
page-oriented data set that can be as large as 65,000
pages, which is a great deal larger than the 4096 pages
available in a 24-bit-addressed virtual memory.
TSS/360 brings into the buffer only those pages of the
data set that are currently needed. The size of this buffer need not be limited to one page; it may be as large a~
a segment (256 pages), thereby allowing a user to address all or a portion of a data set in the same manner as
main storage.
The TSS/360 user thus has a choice that allows him
to treat a properly organized data set as a file or as onelevel storage. There are several advantages, however,
involved in the use of traditional data management
macro instructions, such as GET and PUT. For ex-

ample, while information \vithin auxiliary storage is
vulnerable to a systcm failure, information that is maintained through macro instructions is updated directly
on external stora,gc, and is thus preserved across system
failures. In addition, macro instructions directly slgnal
when buffer contents are no longer required and thus enhance efficient auxiliary space management.
As described, the virtual access methods perform a
programmed search of data set indexe8 in virtual storage. Conceptually, this amounts to combining the benefits of paging large indexes with the benefits of substituting high-Rpeed auxiliary drum storage for slower
speed disk storage.
This concept of programmed searches can be extended by user progrDms to secondary indexcs for data
sets. For example, the TSS/360 Assembler macro
library is maintained as a line data set for maintemtIlce
purposes. However, the library must frcqucntly be accessed alphabetically on the basis of macro instruction
name. A list of such names combined with the line numbers locating the macro instruction i8 maintained,
alphabetically sortcd, in a, separate sequential data set.
When it is desired to locate a pa,rticular macro instruction, the entire alphabetically arranged name list is
brought into virtual memory and a programmed search
is performed to locate the appropriate index (i.e., line
number) to the macro library.
We have found that implementation of the virtual access methods required significantly fewer lines of code
than were required for a corresponding set of TSS/360
access methods used to support physical-sequential devices, such as printers and magnetic-tape units. It is
apparent that the removal of device-dependent operations (with complex channel programs), the standardization of block size, and the elimination of exceptional
procedures (such as end-of-volume operations) simplified the actual coding for the virtual access methods.
Furthermore, the separation of data set management
from physical device management simplified debugging.

Program loading services
In TSS/360, program loading is dynamic; that is,
during execution one program may reference another
program that has not been previously processed by the
dynamic loader. Although not unique to TSS/360, this
is another of the means by which a user is given flexibility during his terminal sessions.
In most conventional systems, there are a number of
difficult design trade offs associated with dynamic loading. For example, the available memory space must
be apportioned in some way between the storage requirements of the link-loader and the option to leave
the program to be loaded in main storage. As another

TSS/360
example, the cost of performing basic linking and unlinking functions during program execution must be
traded off against the potential inefficiencies of passing
inter-module parameters by value.
In TSS/360, the loading process is performed in virtual memory. The large virtual memory environment of
TSS /360 permits a disassociation of claims on address
space from claims on main storage, and thus allows the
allocation of storage to be optimized on a system-wide
basis. Moreover, because of the large virtual store environment, it is seldom necessary to unlink program
modules. This makes it unnecessary to place system
restrictions upon the form of intermodule references.
A program .module generated by a language processor
resides in the system as a member of a partitioned data
set before being loaded and, in this state, consists of at
least two parts: text and module dictionary. A third
part, an internal symbol dictionary, used by the program control subsystem, is optional.
The text of the program module is divided into control sections. This division is determined by source
language statements for output generated by the Assembler, and automatically for output generated by the
FORTRAN compiler.
From a system standpoint, the purpose of control
sections is to allow a program to be divided into portions
whose virtual memory locations can be adjusted
(independently of other sections) by the dynamic
loader without altering or impairing the operating logic
of the program.
For the user, a control section is a segment of coding
or data that can usually be replaced or modified without reassembling an entire program. A control section
also represents a segment of coding or data to which
attributes can be assigned independently.
At the time the user creates a control section, he may
assign a variety of attrihutes to it, such as:
•
•
•
•
•

fixed length
variable length
read-only
privileged
shared

The module dictionary consists mainly of a group of
control-section dictionaries, one for each control section of the program module. A module dictionary describes the text: its length, attributes, external-symbol
references and definitions, and information to be used in
relocating address constants. Collecting all linkage data
into one module dictionary allows the TSS/360 dynamic loader to calculate linkage addresses without bringing the larger text portion of the module into main storage.
In TSS/360, the dynamic loader resides in virtual

25

memory. The basic functions of the loader are to load
programs into virtual memory-not into main storageand to relocate only those address constants that are in
pages of text actually referenced during execution of the
program.
The process of loading a program into virtual memory
does not involve the movement of any text and is performed in the allocation phase of the dynamic loader.
Loading a program into virtual memory consists, in
largt part, of establishing the addressabiIit.l of the program within the cirtual store.
When the dynamic loader's allocation phase is invoked, it utilizes the virtual access methods to locate
the program library containing the requested object
program module.
Utilizing information from the module dictionary, the
loader requests the allocation of a virtual memory for
the object module text. Virtual memory allocation involves the creation of relocation table entries for the text
and the assignment of protection keys according to the
attributes of each contr()l section. The loader next
places the external-storage addresses of the module's
text pages into the relocation table entries just created.
Locations within a program are addressed through base
registers, index registers, and displacements. Base registers generally contain values obtained from address
constants. For each text page that contains address constants, an "unprocessed by loader" flag will be set in the
appropriate relocation-table entry.
Among other functions during this phase, the dynamic loader examines all external references of the module, and obtains and processes the module dictionaries
for any additional object modules required to satisfy
these external references. This process results in the
dynamic loader recursively invoking itself as long as
additional dictionaries must be obtained.
When the allocation phase is complete, the dynamic
loader exits, supplying location values that correspond
to entry points in the loaded program.
The second phase of the dynamic loader is invoked
when a page containing address constants is referenced
and consequently brought into main storage during program execution. Address constants on the page are adjusted to reflect the values calculated during the allocation phase of the loader.
A secondary function of the dynamic loader is to enforce the TSS/360 protection rules concerning the loading and referencing of program modules.
During the allocation phase of the dynamic loader,
the content of each module dictionary is placed in a private task table. Called a task dictionary, this table contains the information needed to load (and unload) modules for particular task. A task dictionary consists of a
header containing three hash tables, and a body con-

26

Fall Joint Computer Conference, 1968
Initial virtual memory

taining one module dictionary for each module loaded
for the task.
To link programs dynamically, the dynamic loader
must be able to look up all external-symbol definitions
in an efficient manner; hash tables, consisting of headers
and a number of hash chains, are used for this purpose.
To reduce the number of pages referenced during the
loading process- and to prevent a nonprivileged user
from accidentally linking to a system routine or a system routine from erroneously linking to a nonprivileged
user routine, three symbol tables are defined: privilegedsystem, nonprivileged-system, and user.
The privileged-system table contains external symbols defined in control sections with the privileged
attribute.
The nonprivileged-system table contains nonprivileged external symbols defined in control ~ections
with the system attribute. A further conventIOn has
been adopted: the initial entry points of nonprivileged
system routines directly invoked by a no~pri:ileged
user (such as a language processor) may begIn wIth ~er­
tain reserved characters. This has the effect of makIng
these routines "execute-only" to the user.
With the two system symbol tables, instead of just
one the dynamic loader does not need to search a hash
chain containing a large number of privileged symbols
when looking up nonprivileged symbols. As will be
shown, the loader does not normally reference the priv.
ileged system symbol table during system operatIO~.
The third symbol table, constructed for the user, IS
primarily protective. It provides close cont:ol over the
interface between the user and system routInes by separating the user's symbols from system symbols.
Although the loading and protection facilities just described are quite powerful, it has already become apparent that future computer systems might requ~re extensions to these facilities. This is currently a subJect of
study within IBM and elsewhere. 5 •6

During the initial stages of development, it was realized that certain system service routines must reside
in each task's virtual store when the task is initiated
(e.g., the dynamic loader). This virtual-store image
would be created during system startup. As the system
developed, it became apparent that efficiency could be
enhanced by including a large number of other system
routines in this initial virtual memory.
The TSS/360 routines that currently make up initial
virtual memory include all privileged system service
routines and Inany nonprivileged system programs,
such as the FORTRAN compiler.
By tightly pre-loading most system. programs at system startup, the overhead usually associated with
library searches, binding, and unbinding is significantly
decreased. The trade off here is time versus the auxiliary-storage space needed to hold the fully bound copy
of those routines included in initial virtual memory.
Still another advantage is obtained by binding at
system startup. Efficiency in a paging system is closely
associated with the degree of locality of reference over a
time-slice. In a highly modular system, it frequently
occurs that there are groups of routines that follow a
pattern such that all members of the group tend to be
referenced within a short period of time whenever any
one of them is referenced. Page-reference patterns associated with system programs can be significantly improved by ordering routines with an affin~ty for e~c?
other so that they are packed, as a group, Into a mImmum number of pages.
In TSS/360, this ordering is based upon a control section name list that can be altered easily to optimize the
packing of system programs to minimize paging. This is
especjally significant in TSS/360 because many control
sections are much less than a page in length.

Task structure

Virtual memory sharing
three ways:

Within TSS/360, tasks function in the environment
of a large, segmented virtual store. Our knowledge of
the proper way to utilize this environment evolved as
the system was built and used.
Because of the large size of this address space, the
need for specifically declared overlays is eliminated.
This does not remove the need to plan program organization when efficient execution is desired; it merely
makes it possible to minimize planning. In a time-sharing environment, where there is ~ premium pla~e~. upo.n
solving a problem quickly, thJS added flexIbIhty IS
significant and frequently desirable.

Sharing
i~

TSS/360 is utilized in

• When users share programs, they share the pureprocedure sections of the program. Each user reC'eives a private copy of any modifiable data contained in the program.
• When users share data sets, they share a common
external page map control table.
• All tasks share certain common control tables
(such as the I/O device allocation table).
Program modules designed for simultaneous sharing
by more than one task are called re-entrant. Such modules are characterized by their division into a shareable

TSS/360
control section that does not change in any way during
execution and a private control section (PSECT) that
contains modifiable data and address constants.
While most system programs are re-enterable modules
with PSECTs, it is not necessary to use a PSECT when
composing a TSSj360 program. With greater effort for
special cases, it is possible to write re-enterable programs
where all parameters are held in CPU registers or where
working space is dynamically acquired.
When a re-enterable program is composed, all modifiable data, work areas, and address constants may be
placed within a PSECT. Allowing the composer of a
program to create the PSECT relieves the caller of that
program of the requirement to know precisely what address constants the called program req uires.
The use of PSECTs has effects upon the structure of
programs within TSSj360. Whenever a user loads a
shared re-enterable module, a private copy of its PSECT
is placed into the user's private virtual memory, while
shared access is established to a single copy of the progr-am's re-enterable control sections. Programs are
shared in such a way that the PSECTs and the re-enterable portions of the called routines are separately
mapped in to the task's virtual memory. 1\1 oreover, because each user's virtual memory is allocated dynamically and independently, the singh=- physical copy of a
re-entrant control section may be mapped into different
virtual memory locations for each concurrent user (see
Figure 3). Therefore, to perform linkage to are-entrant
routine, two virtual memory addresses must be supplied
The first address specifies the location at which execution of the program module will begin when control is
transferred. This is the conventional external reference
value.
The second address can be used to specify where the
PSECT of the linked module has been mapped within
the task's virtual memory. If this pointer were not supplied, the re-entrant module wOlild have no way of
knowing, for instance, where the appropriate private
modifiable data are located since the PSECT may be
placed in different virtual memory loc~tions in each concurrent task.
Putting all address constants and modifiable instruction sequences into one or more PSECTs does not
guarantee that the resulting routine will be re-enterable
under all conditions. While this provides for intertask
re-enterability (i.e., sharing by a number of tasks),
intratask re-enterability must be considered.
A single task can re-enter the same program when it
receives a task interruption, while executing a system
routine or when a routine is called recursively. In such
a situation, the PSECT' will not protect task integrity,
since within a single task there is only one copy of the
PSECT. This is why the Task Monitor provides either

27

ElIt.,nol Sto,o,.

AUlIliiory Sto,o,.

FIGURE 3-Sharing of programs in

TSS/:~~()

a push-down save-area or a means by which a routine
can protect itself from unwanted intratask re-entrancy.
A PSECT is generally used to hold the register savearea for a re-entrant routine. Placing a save-area within
a PSECT, rather than into a push-down stack, reduces
overhead and facilitates tracing linkages during debugging.
The sharing of programs in virtual memory is based
on many users aciively using pure-procedure sections 0,
the same program (such as the FORTRAN compiler)f
with resultant decreases in the paging overhead and
utilization of main storage. Because of the amount of
shared code in TSSj360, the probability that shared
pages will be simultaneously used is high only for a few
system routines. The primary value of shared code thus
lies in its read-only attribute, which allows only one
copy of a page of code to be on auxiliary storage. During the lifetime of the average task, there is a high probability that a number of users will lllvoke, say, the
FOR TRAN compiler. Thus, instead of many copies of

28

Fall Joint Computer Conferenee, 1968

the compiler eXIsting on auxiliary storage, ther€' is only
one copy of its pure-procedure sections.
When users share a data set, they share the external
storage map table. They do not share buffers because
there is a low probability of two or more users frequently accessing the same data at nearly the same time.
Further, each user can independently modify his copy in
the buffer without affecting other users.
When users share a program or a data set control
table, they share a common pag~ table (see Figure 3).
This leads to a great deal of fle~ibility. For example, a
common page-table entry can b~ pointed 1;6 by segmenttable entries for several differen.t tasks. However, sharing of each such page table c~ be restricted to specific
groups of users. The way -in which this sharing is accomplished is as follows:
Virtual memory service routines cannot directlyaddress shared page tables. Therefore, the Resident Supervisor must provide a method of.symbolically associating
the shared item with the page table that maps it.
A control table, located in shared virtual memory,
serves as the repository of sharing information. Whenever a user invokes a program from a shared library or
opens a shared data set, the system searches the shared
data table.
Because each system user can catalog a shared program or data set using any name he wishes, the search of
the shared data table is, by convention, based upon the
name established by the item's owner. If the entity has
not been previously referenced during the session, then
an entry for this name will be created in the table.
Next, shared virtual memory is obtained for the
entity. The Resident Supervisor creates the required'
number of shared-page-table entries and sends back the
symbolic identification number of the shared page table
and the location of the requested allocation within the
segment. This information is stored into the shared
data table. Thus, there is now an association between
the name of the entity to be shared and the page table
that maps the entity.

When another user invokes the shared module or
optns the shared data set, a search of the shared ,data
will yield a match on the name. The symbolic page table
number can then be used in a ~upervisor call to request
that a segment-table entry for this user be made to
point to the proper shared page table.
Virtual memory sharing requires the use of programmed interlocks to prevent destructive intertask
interference. The use of interlocks for sharing, however,
requires careful control. For instance, system operation
can be severely affected if one task sets an interlock in a
system table and then becomes inactive for a long time.
Furthermore, substantial system overhead is incurred if
tasks waiting for the interlock to be reset are continually being dispatched only to find that the interlock
is still set. This type of problem is representative of the
many subtle considerations involved in the control of
extensive sharing among tasks in a time-sharing environment. Weare still gaining experience and insight
into this aspect of the TSSj360 time-shared operating
system.
REFERENCES
1 The compatible time-sharing system: a programmers guide

P A Crisman ed MIT Computation Center Cambridge Mfl,sS
MIT Press 2nd ed 1965
2 HAKINSLOW
The time-sharing monitor system

Proc AFIPS 1964 FJCC Vol 26 Washington DC Spartan Books
1964 pp 443-454
3 WTCOMFORT
A computing system design jor user service

Proc AFIPS 1965 FJCC Vol 27 Part I 'Washington DC Spartan
Books 1965 pp 365-369
4 IBM system/360 time sharing system: concepts andfacililies

Form C28-2003 IBM 1968
5 RMGRAHAM
Protection in an information processing utility

Comm ACM Vol 11 No 5 May 1968 pp 365-369
6 EBVANHORN JBDENNIS
Programming semantics for multiprogrammed computations

Comm ACM Vol 9 No 3 March 1966 pp 143-155

Considerations for software protection and recovery
from hardware failures in a multiaccess,
multiprogramming, single processor system
by G. OPPENHEIMER
Radio Corporation of America
Riverton, Xew Jersey

and
K. P. CLANCY
Keystone Computer Associates, Inc.
Willow Grove, Pennsylvania

INTRODUCTION
Data processing systems are liable to both .hardware and system software failure. In first and second generation systems the impact of such failures was typically limited by the scope of the
system itself to the one or limited few programs
operating at the time. Resumption from the beginning of the program or preplanned checkpoint
typically constituted complete recovery.
Third generation systems have Increased in
complexity. They have assumed responsibility for
the management and retention of user files, and
they support and automatically schedule the concurrent operation of increasing numbers of batch
and interactive tasks. Information maintained
both on direct access devices and in memory is
critical to continuing system operation. Much of
-this information is dynamically updated in place
and as a consequence even partial loss may discontinue and delay system operation. Rapid and
smooth restoration of service subsequent to hardware and software failure has become a necessity.
Considerations for system protection and recovery
are, therefore, critical aspects of third generation
system design.
The types of failure that a system must contend with include processor or memory malfunction and the unreadability of data on a direct access volume. No complete solution 'to all the potential problems exists. Cures for each type of

sickness are apparent, though widely variant in
scope and cost. Tradeoffs exist in terms of dollars
invested and overheads incurred in hardware and
software procedures that might be employed. Increasing such costs can lessen the probability or
localize the impact of a failure.
A processor or memory malfunction may termiate the operation of the system abruptly. Salvaging the information in memory under such abortive circumstances tends to be extremely complicated and time consuming, if feasible at all. Processing cannot be resumed from the point of
failure. All tasks in process must generally be
prematurely terminated and restarted, and some
data in files that were being modified may not be
retrievable. The second section of this paper is
devoted to a discussion of this topic.
A major volume related failure, such as a head
scoring the recording surface, could destroy a significant amount of data. Without some means of
protection, a loss of this magnitude could effectively cause total loss of the system. This subject
is pursued in section 3.
A minor volume related failure such as the unreadability of a single track of data could cause
the loss of one or more files, or could prevent the
initiation of accepted tasks or prevent the completion of one or more initiated tasks. Preventative 'software techniques are helpful, but limited.
Online procedures to monitor and identify mar29

30

Fall Joint Computer Conference, 1968

ginal performance of the processor, memory and
I/O operations may warn of imminent failure or
permit avoiding the use of marginal elements. For
example, a routine which vigorously exercises the
tracks of a volume and inhibits the use of marginal
tracks will significantly reduce the probability 'Of
track unreadability.
Such techniques reduce the probability of failure. They do not prevent failure. Consequently,
provisions for recovery from failure are still essential. In sections 4 and 5 this area is considered
in terms of system files and user files~ respectively.
At the current state of the art it is not feasible
to consider system recovery procedures independently of the structure and organization of the
system to be protected. Consequently, the orientation herein is directed toward techniques considered for the protection of the time sharing
operating system on the Spectra 70/46. Particular
emphasis is placed upon the system and user information retained on online direct access volumes.
The relevant system characteristics which
bound the areas of discussion are:
• a single central processor, employing a single
memory bank.
• direct concurrent access to the system by
mUltiple interactive users.
• user program and data files, as well as system
information, maintained on mass storage. Allocating of file space as well as file access and
retrieval are fully managed by the system.
File size is essentially unrestricted.
• task (workload) control fully managed by the
system. Tasks submitted to the system are
maintained on online devices and scheduled
by the system for multiprogrammed operation concurrent with interactive processing.
Output is directed to printers and punches by
the system based upon resource availability.

System restart after a memory loss
In systems employing hierarchial control memories and micro programmed processor logics,
memory failure tends to produce less than an orderly system failure. Recovery of memory information under such circumstances may, in fact,
be impossible. Similarly, in systems without motor
generator sets, the abruptness of power failure
typically makes it impossible to recover the information in memory. Recovery under these circumstances tends to reduce to making the system
usable again. Automatic restart of the work in

progress at the time of failure is not feasible.
Terminal users must reconnect to the system and
background tasks must be resubmitted after update-in-place files that were being modified have
been reset to an original or checkpoint state.
One approach to system restart after a memory
loss is to periodically record the status of the
system (e.g., all the information on all the direct
access volumes) when no one is using the system.
'Vhile this permits re-establishing the system at
the chronological point at which the status was
recorded, it requires repetition of all file modification subsequent to the reset point and re-entry 'Of
all workload awaiting initiation at the time of
the failure. Such an approach places a major burden of recovery on the users of the system.
An alternative method is to re-establish the utility of the system by correcting system status information. This information reflects status for
tasks in process at the time of failure. It is invalid
at restart time in view of the necessity to initiate
all processing anew. The need for such a corrective procedure is dependent upon the probability
of memory loss. Its complexity is determined by
the extent of the dynamic control information
that is maintained in memory as contrasted with
that maintained on direct access volumes.
Information necessarily in memory includes the
precise status of tasks actually initiated, and file
content and file structure modifications actually
in process.
Information not subject to such dynamic updating and consequently, logically allocatable to
either the memory system or direct access volumes
includes:
• file accessibility information.
• direct access space allocation information.
• Rystem workload information.
Considerations for the protection and recovery
of the above three categories of information are
presented in the following discussions.
File accessibility information
The files in the system may be accessed by multiple users on a password restricted basis. Input
access may be granted to any number of concurrent users. Output and inplace update access is
restricted to one user at a time.
To control access to sharable files; the system
maintains the status of file usage for each opened
:file. Indications of granted output or update access
and of the number of input users are employed to

Considerations for Software Protection and Recovery from Hardware Failures
prevent interference among simultaneously incompatible accesses. If this information is maintained on a direct access volume, system restart
procedures must reset these indications. Otherwise files being accessed at the time of failure
would be incorrectly restricted. If this information is maintained in memory, the reset procedure
is unnecessary. Moreover, fewer updating accesses
to the volume would be required during normal
system operation.
In addition to the tradeoffs of processing efficiency and memory space usage, the restart consideration is involved in the placement of the indicator information. It appears highly desirable
that the system identify files that were being
created or modified at the time of failure. These
files may require special processing before a valid
program restart may be initiated. File content
may be imprecise. Records modified or created and
in the output process at the time of failure may
not be reflected completely or ·correctly on the volume. Moreover, the loss of memory contained file
structure information could prevent retrieval of
the entire file. Advising subsequent users of the
file would appear to be a minimum requirement
upon the system.
Hence, if usage indications are maintained on a
direct access volume, the system restart procedure
should search file directories, reset the indicators
and establish flags which will notify subsequent
users of the potential need for specialized file
correction procedures. If the usage indications are
maintained in memory, some auxiliary method of
identifying the files in the process of modification
at failure must be devised.
Direct access space allocation
Space allocation is typically maintained on direct access volumes to avoid memory loss and, in
some systems, to permit full ultilization of removable disc packs. Such information may not
accurately reflect tire allocation if failure occurs
while it is being modified. Moreover, the actual
file bounds within an allocated space may not accurately reflect the additions which were being
created at failure. To attempt to reconstruct such
files and re-establish the space allocation properly
is extremely complicated, and appreciable delay
in restarting the system may be anticipated. However, since it is reasonable, per the previous section, to identify all files possibly requiring special
processing, it also seems reasonable that the allocation information be assumed correct. Thus,

31

questionable file marking may be employed to
warn of potential allocation problems as well as
advising users of potential data loss within a file.
System workload information
Tasks queued on direct access volumes and
awaiting system initiation may be processed just
as though the system was being restarted after
a normal shutdown. Tasks which had been disrupted by the failure, however, cannot be reinitiated. Before such tasks may be restarted, update files must be returned to the status they
possessed at a previous checkpoint. Since it is not
possible to economically retain knowledge of
which tasks had actually performed such file
modifications, all tasks which had been initiated
must be purged from the system by the system
restart procedure. Appropriate notification must
also be given to the operator so that file resetting
and restart may be properly initiated.
If in controlling output print and punch operations, the system retains all data on direct access
volumes until the entire operation is completed,
these operations may readily be restarted subsequent to a failure. Restart of an operation from
an intermediate point may be desirable in certain
instances, such as printing. Such restart requires
special operator communication.
Summary of memory loss considerations
In guarding against memory loss, the appropriate use of direct access storage for control information and data provides an economical method for protection. It limits the impact of failure
to the actual .tasks and files in process. Execution of such file correction procedures, as described
subsequently, and restarting of the related tasks,
appears to provide an adequate level of protection.
A minimal protection scheme would therefore
involve purging of in process tasks, warning file
users of suspect file structures, restart of print
and punch output, and normal processing of
tasks awaiting initiation.
Major volume loss

The preceding section described procedures
which a system could employ to resume operation
subsequent to the loss of information in memory.
Such procedures are heavily dependent on the
availability in direct access store of pertinent control fields. Failures of the direct access store

32

Fall Joint Computer Conference, 1968

therefore are 'Of critical concern in the design 'Of
system recQvery prQcedures. This sectiQn addresses prQtectiQn and recovery frQm a maj 'Or direct access vQlume lQss.
Head sCQring 'Of the recQrding surface, extraneQus 'Output signals generated by device CQntrQl electrQnics, 'Or maj 'Or sQftware errQrs CQuld
destrQy a significant PQrtion 'Of the infQrmatiQn 'On
a vQlume. RecQvery frQm such a catastrQphe is
dependent largely 'On hQW direct access space is
allQcated. If critical system infQrmatiQn is restricted tQ a single vQlume, it is PQssible tQ recQnstruct the vQlume. This requires making a
CQPy 'Of the vQlume cQntents at the clQse of each
prQcessing periQd and maintaining ('On a different
vQlume) recQrds reflecting all significant changes
tQ the vQlume. Similarly, if each user file is alIQcated tQ a single vQlume and a vQlume catalQg
is maintained tQ identify all files 'On the vQlume,
it is PQssible tQ retrieve backup cQpies 'Of the files
tQ re-establish the destrQyed vQlume. Alternatively, in this instance, a full vQlume CQPy 'Of the infQrmation 'On the vQlume CQuld alsQ be used tQ
reCQver frQm a vQlume loss.
Many systems permit file infQrmatiQn tQ crQSS
vQlume bQundaries in 'Order tQ 'Obtain mQre flexible
system perfQrmance and better 'Overall utilizatiQn 'Of the available space. As a result, individual
vQlume cQpies and retrieval 'Of backup files beCQmes less practical. A full vQlume CQPy tends tQ
be useless as it will, if used, result in incQnsistencies within the files that reside 'On mQre than 'One
vQlume. MQreQver, the retrieval 'Of backup cQpies
fQr all the files allQcated 'On the vQlume may invQlve a large number 'Of files and require significant space allQcatiQn and deallQcatiQn 'On uneffected vQlumes.
FQrtunately, full vQlume lQSS tends tQ be a
rare 'Occurrence. TherefQre, a reasQnable apprQach,
fQr systems that permit files tQ crQSS vQlume
bQundaries, seems tQ be tQ use a CQPy 'Of the full
set 'Of direct access vQlumes as a system reset
PQint.

tracks. FQrming a tempQrary CQPy 'Of the vQlume
and relQading the CQPy data cQmpletiQn 'Of the
exerciser may significantly reduce the number 'Of
unreadable tracks encQuntered during system QPeratiQn.
Regardless 'Of the use 'Of such preventative functiQns, cQnsideratiQn must be given tQ the prQtectiQn and recQnstructiQn 'Of critical system files. In
this sectiQn prQtectiQn and reCQvery techniques
fQr the fQl~Qwing system files are discussed:
• user identificatiQn infQrmatiQn.
• reSQurce usage infQrmatiQn.
• file related infQrmatiQn.
• vQlume space allQcatiQn infQrmati'On.
• system wQrklQad infQrmati'On.
User identification information
TQ identify legitimate users 'Of the system the
administratQr enters pertinent infQrmatiQn intQ
a file. BefQre prQcessing any task submitted, the
system interrQgates this file tQ verify that the
user has been authQrized access. Typically, records 'Of this file include user identificatiQn, an
access passwQrd, permissable accQunt numbers,
the highest priQrity he may use, and the amQunt
'Of file space he is permitted t'O use and has used
tQ date.
With the 'One exceptiQn 'Of the permanent space
usage field, every change made tQ this file is
initiated by the administratQr. Each such change
is alsQ recQrded in hard CQPy fQrm at the administratQr's terminal. TherefQre, prQtectiQn 'Of
this file may be readily achieved byperiQdically
recQrding a backup CQPy. In the event 'Of file lQss,
the administratQr may retrieve the backup C'OPY
and reapply the few changes he has made since
the CQPy was made. The changes tQ the space
usage field, which are nQt directly available tQ
him in hard CQPy fQrm, may be retrieved frQm
the reSQurce usage file and applied t'O the recreated versiQn.
Resource usage information

System file considerations for minor volume
related failures
The unread ability 'Of infQrmatiQn stQred 'On direct access devices is significantly mQre prQbable
than entire vQlume lQss. TQ prQtect against such
lQss, the sQftware may perfQrm preventative marginal track tests .. TQ accQmplish this requires a
rQutine which vigQrQusly exercises the tracks 'Of
the vQlume and inhibits further use 'Of marginal

An accQunting file is nQrmally maintained t'O
serve as the basis fQr charging fQr the use 'Of system reSQurces. Dynamic PQsting 'Of usage tQ this
file is perfQrmed as tasks terminate pr'Ocessing.
The types 'Of infQrmatiQn included in this file
are the user identificatiQn number, the applicable
accQunt number, a task sequence number, time
stamps f'Or task entry int'O the system and f'Or
task initiati'On and terminati'On, pri'Ority level

CQnsideratiQns fQr SQftware PrQtectiQn and RecQvery frQm Hardware Failures
exercized, prQceSSQr time used, mem'Ory space
used, increment 'Of permanent file space used,
maximum tempQrary file space used, number 'Of
I/O 'Orders issued, and number 'Of types 'Of private
devices required.
Since this infQrmatiQn is bQth critical and lQW
in vQlume, it may be dually recQrded 'On separate
vQlumes and the tw'O cQpies may be retained 'Online. Alternatively, SQme reductiQn in system 'Overhead may be effected by maintaining a single base
C'Opy and recQrding a supplementary file. In systems where accQunting transactiQns are merely
appended tQ the base file, the supplementary file
will cQntain the identical recQrds PQsted tQ the
base CQPy. Where accQunting transactiQns are
used tQ update entries in the base CQPY, the
transactiQns are typically placed in the supplementary file. If the base file is cQpied periQdicalIy t'O create a backup, the supplementary CQPy
will 'Occupy less space and need be maintained
'Only between the periQds in which cQpies are
made. T'O achieve still greater prQtectiQn, each
supplementary file may be printed bef'Ore it is
destr'Oyed.
File related information
Systems emplQying remQvable direct access
vQlumes typically maintain file related infQrmatiQn in a file directQry 'Or catalQg, and als'O in
vQlume related labels. CatalQg entries include the
filename, creatiQn date, access passwQrds, access
restrictiQns, and PQssibly, current access (usage)
indicatQrs. AlsQ included are fields indicating the
number 'Of vQlumes and the actual vQlumes 'On
which the file resides, and QptiQnally, the lQcatiQn
'Of the backup CQPy. VQlume related lables describe
areas 'Of the vQlume allocated tQ the file and, fQr
index sequential type files, the related cQntrQl
indices.
A degree 'Of prQtectiQn fQr the catalQg may be
achieved by periQdically prQducing a backup CQPy.
HQwever, recQnstructiQn 'Of a catalQg frQm such a
CQPy may prQve tQ. be incQmplete and errQneQUs.
If a file is mQdified 'Or mQved subsequent t'O the
creation 'Of the backup, the vQlume infQrmatiQn
within the CQPy may be undetectably errQne'Ous.
Subsequent allQcatiQn and deallQcati'On CQuld present a different set 'Of vQlumes 'Or a different
'Ordering amQng the same vQlumes. VerificatiQn
checks might be emplQyed t'O minimize, but n'Ot
eliminate PQssible ambiguities. MoreQver, changes
tQ certain infQrmatiQn such as access limitatiQns
and file type CQuld nQt be reCQnstructed.

33

A mQre satisfactQry apprQach requires maintaining a lQg 'Of changes made tQ the catalQg. The
use 'Of such a lQg in cQnjunctiQn with a priQr CQPy
'Of the catalQg permits accurate and cQnlplete
recQnstructiQn. The system user is affected 'Only
if he shQuld attempt tQ access the file befQre recQnstructiQn is accQmplished. In general, this
means th at he may nQt be able to cQmplete SQme
prQcessing, but that he is able tQ resubmit and
resume his prQcessing at a later time with a
minimal PQtential IQss· and with nQ resPQnsibility
fQr catalQg recQnstructi'On.
PrQtectiQn 'Of the vQlume related labels presents
a sQmewhat different issue. LQSS 'Of a vQlume label
may make it impQssible tQdetermine the areas
'On the vQlume in which the file is lQcated. In
general, this means that it is impQssible tQ read
the file. InformatiQn relative tQ a backup CQPy
shQuld still be available and it may be retrieved
in lieu 'Of the CQPy 'On the direct access vQlume.
Alternatively, an analysis 'Of the vQlume labels 'Of
the 'Other files 'On the vQlume and 'Of the unalIQcated vQlume space infQrmation CQuld be used t'O
determine the space that was allocated to the file
in questiQn. This information CQuld the:.'1 be used
tQ read the appropriate areas of the volume and
tQ retrieve the file. The sequence of the data WQuld
then have to be verified and reorganized by the
owner. ·Both logging procedures and dual recording of the labels would provide for more CQmprehensive protection, but at a significant increase
in overhead.
Volume space allocation information
Unallocated volume space inf'Ormation is typically maintained on each volume. Loss of this information makes it impossible tQ safely allocate
additional file space on the volume, but d'Oes n'Ot
affect the retrieval of existent files. Protection 'Of
this inf'OrmatiQn does nQt seem tQ be warranted.
The file space allocated to each file 'On the v'Olume
may be determined, using the file labels on the
volume, and the unallocated space may be deduced. A more basic appr'Oach w'Ould copy all files
allocated to the volume and reinitialize the volume. However, in systems where tiles cross volume
boundaries significant space allocation and deallocation will be required 'On otherwise uneffected
volumes.
System workl'Oad information
The tasks representing the system wQrkl'Oad are
generally identified by entries in variQus queues.

34

Fan Joint Computer Conference, 1968

Normally, a single system routine maintains the
queues and the file space in which the necessary
information is stored. Proper maintenance of
these queues is so critical to continuing successful operation of the system that dual recording
is typically justified. If appropriately considered
in designing the system it is possible to accomplish the required level of redundancy without the
cost of total duality.
An approach to the appropriate level of
redundancy is achieved by dividing the relevant
file space into index and task areas. In the index
area, there is one entry for' each task, each entry
containing a task sequence number, an indicator
identifying current status, a priority indicator,
resource requirement information and a pointer
to a task header block. Similarly, in the task area,
there is a task header· block for each task containing the detailed information nece~sary to
initiate a task, interim resource and time stamp
information and a pointer to the file which contains the information required to process the task.
The loss of a track containing indices could result in the· loss of information necessary to initiate or account for a significant number of tasks.
The loss of a track containing task header blocks
could result in a similar loss for the tasks involved.
The inclusion in the task header block of a
backward pointer to an index entry makes it possible to identify the task header blocks associated
with an index. With this information an index
which is unreadable may be reconstructed. The
backward pointer identifies the task header blocks
associated with the lost index and the information in the header blocks and the file to which it
points is sufficient to reconstruct the index.
An additional pointer in the index, identifying
the file to which the h~ader block points would
similarly make it possible to reconstruct lost
header blocks. However, the addition of a pointer
to a file, which may be a rather lengthy filename,
significantly reduces the number of header blocks
that may be stored and consequently affects the
efficiency of the system.
The absence of the file pointer in the index
block implies that loss of a track of header blocks
requires these tasks to be resubmitted, if they
are to be run. The operator can be apprised of
the tasks involved to facilitate this action, since
the sequence numbers are available in the index.
The choice here, as so often, is one of efficiency
versus full protection by the system.

Summary of minor volume related failure
considerations for system files
System files contain information relating to
the entire user community. Loss of a singletrack
of data from one of these files could result in impaired service and significant inconvenience to
many users. A loss of user identification information could result in denial of service to all users
affected. Loss of resource information might be
reflected in lost revenues, loss of file related information could cause the loss of many files stored
within the system, while loss of sytsem workload
information might impose appreciable delays and
rework of tasks accepted by the system. Mechanisms to minimize the impact of these losses have
been discuss.ed above. The techniques cited range
from manual administrator adjustment to full
redundancy..
In the following section the subj ect of protection and recovery is developed from the point of
view of individual user files.

User file protection
Increased utilization of direct access devices
have enhanced the operation of third generation
systems in a number of ways. Direct access volumes and files may be concurrently shared by more
than one user providing the user community as a
whole with greater availability and utility of the
system. Files, and low activity files in particular,
may be updated on a record basis and the need
for recopying of entire files is reduced. Such updating in place is in many situations the only
feasible approach to updating large files with the
frequency required by some applications.
File shareability has introduced the need for
accessibility procedures alluded to in preceding
sections. Update-in-place has similarly increased
the need for more sophisticated protection procedures. File update procedures employing third
generation access methods affect both the data
content of the file and, in the case of non-serial
organizations, the very structure of the file.
Should a memory failure occur while a file is
being updated, consideration must be given to reconstruction of both file content and file structure.
Reinitiation of an aborted task or resumption of
it from a checkpoint established prior to the failure will otherwise prove unsatisfactory. Additionally, the loss of any system control information identifying the file or the inability to read
a track of data within the file may cause the loss
of the entire file.

Considerations for Software Protection and Recovery from Hardware Failures
In this section protection and recovery of user
files is developed in terms of consideration for:
• file content
• file structure
• protection by file copy
• file reconstruction procedures
Certain of these considerations fall within the
province of system responsibility, while others
may be achieved effectively only by the application programmer.
File content
Typical magnetic tape system recovery procedures entailed either reinitiation of a task with a
new set of output or "update" tapes or repositioning the tapes to the position they held at the time
of a prior checkpoint and resumption of execution
from that checkpoint. This is not sufficient in direct access update-in-place operations since processing performed subsequent to a checkpoint and
prior to a failure will have updated records. Resumption from a checkpoint will involve "doubleupdating" of these modified records if corrective
procedures are not employed. To illustrate, if the
file processing involved updating the accounts receivable, activity such as subtracting a payment
or adding the value of a new shipment must be
undone before the transaction may be reapplied.
Alternatively, procedures may be developed to
avoid redundant application of the transaction.
File structure
Direct access device file organizations have become more sophisticated. Typical magnetic tape
systems possessed only a serial organization
wherein the primary structural consideration was
the end of recorded information on tape. Since
typical procedures merely repositioned the tapes
to their location at a prior checkpoint, the difficulty of detecting the true end of data was avoided
by subsequently executed recovery procedures.
No greater difficulty is encountered in reconstituting a serially organized direct access file.
Linked file structures, and partially linked
structures such as index sequential, are often
consider to be immune to the effects of failure
since allocation information and file sequence are
embedded within the file itself., However, the
manner in which the next available record position is maintained, for example, is extremely
critical where insertion or deletion, or size modification of records is permitted. Typically, the

35

next available record position is maintained in
memory for efficiency purposes. Subsequent to a
memory failure, the only value available is that
from the volume. This value may be significantly
out-of-date. Utilization of an obsolete value may
cause the improper reuse of an allocated file section, destroying records and aborting link sequences. Similarly use of an obsolete value from
a checkpoint can cause the file to be impacted by
the pre-restart file correction procedure. The
seriousness of the situation is increased in environments where records completely unrelated
to the user's file transactions may be placed in
an overflow area to make space available for an
insertion or space modification. Use of an obsolete
value of the next available record position in this
case may result in the undetected loss of inactive
records.
Protection by file copy
A variety. of protection procedures are possible,
depending on file size, organization and frequency
of modification. In a number of instances, the file
to be processed may be small enough to fit into
the memory system. This is particularly the case
when the file is to manipulated by an interactive
language processor or file-editing processor. Indeed, some systems specifically constrain files to
such a size. In this environment, copying the file
into the memory system prior to processing provides file protection against memory loss or software failure during the update process. At worst,
the processing which immediately preceded the
failure must be repeated. In additio~, since the
updated file copy is returned to the device only
when a process is successfully terminated, the application programmer is afforded the lUXUry of
experimenting with a file without invalidating its
contents or structure.
In the general case, protection against file loss
still implies maintaining a second copy of the file,
regardless of its size. In the extreme, this could
he taken to mean that the file should be dually
recorded on line. The cost in space and processing
time does not normally warrant such a procedure,
and for the case of memory loss, it is reasonable
to expect that two copies could be lost as readily
as one. A safer and less costly procedure is to copy
the file after each processing session in which
the file is modified. This provides two current
copies of the file, one of which may be used as a
current backup in the event any loss should occur
in the other.

36

Fall Joint Computer Conference, 1968

The space required to maintain backup file
copies presents a different set of considerations.
The lower access time, higher transfer rate direct access devices are best used for frequently
accessed files. File copies generally do not fall
into this category and typically need not be online at all. If a system configuration includes
mass storage equipment of sufficient capacity to
contain such backup copies, the space problem is
essentially eliminated.
For such a configuration, systems should be
equipped to readily locate and maintain files in the
mass store for retrieval to the faster, normal
working store. System commands and procedures
for such file transfer operations provide essential
support to file recovery procedures.
In systems without mass on-line storage, the
capability to copy a file to tape becomes an
equivalently important system feature. A standard copy function, however, tends to underutilize
the capacity of magnetic tape reels and to burden the application programmer with the management of multiple, unrelated tape reels or single
tape reels containing sets of unrelated files. To
offset this, a system function may be provided
to manage backup tapes for all users. Commands
may also be provided to request creation or retrieval of a backup copy and the system should
manage the backup library while ensuring file
privacy by prohibiting direct user access to the
library.
File reconstruction procedures
To make a copy of a file each time it is modified
reduces the value of updating the file in place.
Certainly the reduction in I/O operations achieved
by only reading and writing records which are
to be modified is totally negated. However, a
gain may still be achieved in this regard since
it is not necessary to copy a file every time it is
modified. Rather, it is possible to copy it after
some time period or after some number of modifications have been made. Periodic copying of a
file is almost a necessity on larger, low-activity
files. In situations where such an approach is
taken;-consideration must be given to file reconstruction procedures, more specific to the file and
application than the general file copy procedures
previously discussed. Procedures specifically concerned with file content may typically be planned
best by the application programmer. File structure considerations are more specifically within
the province of the system.

Application program techniques
Subsequent to a failure resulting in the loss
of information in memory, typical recovery procedures entail a resumption of processing from a
checkpoint. Difficultie's arising from redundant
pre-failure and post-failure application of transactions may be avoided either by reconstituting relevant records to· their status at the time of checkpoint or by eliminating the redundant application
of the appropriate trans·actions. The feasibility of
the particular approach is heavily dependent upon
the actual application. Accordingly, although the
system may provide the application programmer
with tools which will facilitate his development of
appropriate procedures, it is generally not feasible
for the system to undertake the full procedure.
To re-establish a file so that it contains precisely
the same data as when a checkpoint was taken, it
is necessary to maintain an auxiliary file which is
synchronized with the checkpoint. Prior to updating a record, the unmodified input image of
the record is recorded in the auxiliary file. A file
of such "pre-images" is thus constituted. When
a new checkpoint is established, the auxiliary file
may be erased and a new series of pre-images
supplementing the current checkpoint may be
initiated. Subsequent to a failure, the pre-image
file may be read in reverse order and used to return every record to its status as of the related
checkpoint.
Alternatively, procedures to avoid redundant
application of transactions, would either mark
effected transactions or store effected transactions
in an auxiliary file analagous to that above. Unfortunately, such procedures are not perfect. If
transactions are marked before the primary record is updated, a failure before update will cause
the transaction to be eliminated; while if the
primary record is updated prior to marking the
transaction, an intervening failure will cause the
transaction to be applied a second time.
Subsequent to the loss of data in a file or the
inability of the system to retrieve the file because
of the loss of some vital control-information, the
user must generally rely on a backup copy to
recreate his file. If a new backup copy is not made
each time the primary file is modified, it is necessary to augment the backup copy with an
auxiliary file. This auxiliary file could contain
either the transactions which were used to modify
the primary file or the after image of the records
that were modified subsequent to recording the
backup copy. With an auxiliary transaction file,

Considerations for Software Protection and Recovery from Hardware Failures
the reconstruction must essentially repeat the
update processing for each transaction to produce
a current file. With an auxiliary file of after images, the processing required entails only the application of the after images to the records of
the retrieved backup copy.
System reconstruction considerati'Ons
File content recovery c'Onsiderations are peculiar to the application and, accordingly, they are
left to the application pr'Ogrammer for solution.
File structure considerati'Ons require the retention of inf'Ormation typically unavailable to him.
As a result, procedures, if any, f'Or this latter purP'Ose require system functions. T'O illustrate, a
system function could be empl'Oyed t'O reconstitute
the structure of the linked file discussed previ'OuslYe With full knowledge of how the space is allocated to the file, a special procedure could be
employed to retrieve rec'Ords from the suspect
structure and create a new linked file. Such a pr'Ocedure would utilize the link addresses t'O retrieve
all data. Since the s~spect file would be employed
for input, concern f'Or unavailable file structure
inf'Ormation is irrelevant.
Procedures such as the above are highly dependent on actual file organization and typically
require reprocessing 'Of the entire file. Therefore,
it appears that file C'OPy techniques are b'Oth m'Ore
feasible and more basic.
Summary of user file protection considerations
The need to safeguard both the data within files
as well as the information relating t'O the 'Organization of the files has added to the c'Omplexities of file protecti'On in third generation systems.
File update-in-place has transformed the creation
'Of backup-files from an automatic by-product 'Of

37'

the update process t'O a planned design requirement. These additional resP'Onsibilities must be
shared by both the system and the applicati'On
programmer.
SUMMARY
Modern data processing systems require software protection and recovery. Nevertheless, the
virtually limitless possibilities of malfunction cannot be completely managed by a software system
simultaneously required to pr'Ovide efficient performance. Necessarily, the uncertain probability
of the occurrence of malfunctions and their impact on continuing system operati'On are m'Ost
significant parameters in the decision that must
be made to include or exclude each specific pr'Otection mechanism.
In addressing itself to the protection 'Of inf'Ormation on direct access volumes, this paper has
considered the impact of mem'Ory loss, v'Olume
loss and track loss and described factors weighed
in the design of a given system. Preventative tools
such as track and memory exerciser routines have
been mentioned. Dual recording, backup file procedures, transaction logs, dual recording of updated
records prior to and after update, and redundant
recording 'Of selective information have all been
The impact of recovery and reconstruction procedures on the system has been reviewed and the
'Often ignored necessity of sharing the burden
'Of recovery with the system administrator, the
system operator and the system user indicated.
There is no single solution to the myriad problems that exist. Nor will the problems vanish
until the Utopia of hardware and software perfection is reached. In the meanwhile, pr'Ogress
can only result from a solid facing of the problems
and a judicious weighing of the practical S'Olutions.

Error recovery through programnling
by ALAN N. HIGGINS
International Business Machines Corporation '
Kingston, New York

INTRODUCTION

System incidents

The requirement for error recovery procedures has
existed as long as computers themselves. Since the
earliest computers, one of the goals of design has been to
increase the reliability and availability of the computer
to the user. While great strides have been made in this
direction, the need of error recovery is still as present
today as ever and at this time, the need is actually
amplified and more pressing than ever before.
With the many advanced techniques in programming
such as multiprogramming and multiprocessing, the
cost of an error has increased dramatically so that no
longer are the consequences of an error limited "merely"
to the loss of a job and the imposition of the need for a
subsequent rerun.
Error today can:

An examination of system incidents reveals that such
incidents are due to a number of sources. Among these
are Hard Core errors (including errors in the CPU,
memory and channels), errors from Input/Output
devices and control units, procedural and operational
errors. Each of these is made up of a number of different
errors but from a gross point of view, it seems reasonable to state that there are three general types of system
interruptions:
• Hardware malfunctions.
• Design errors (both hardware and software).
• Operator or user injected errors.
Systems planning must therefore be influenced by the
facts that machines will malfunction, neither hardware
nor software is perfect and that operators are still likely
to make as many mistakes a.s they have in the past.

• Cause the termination of concurrently executing
tasks.
• Cause an environmental control system to go down.
• Cause the loss of teleprocessing messages.
• Cause the generation of a report to be delayed

Recovery management
The primary objective in any error recovery procedure or Recovery :\ianagement Support should be to
alleviate the burden of system interruptions to the user.
In order to accomplish this we must:

No longer can rerunning the job be accepted as a
prime means of "error recovery. The situation existing
when running under an Operating System, and executing a number of jobs in the computer at the same time,
makes improved error recovery procedures mandatory.
. It is recognized that the Engineering Community is
diligently striving to improve the hardware itself and
thus for a complete solution it is necessary to look at
the other half of the question of error recovery-what
can be done to improve reliability~ to improve availability, to improve error recovery through programming?
In order to do this, we have to first consider in a
general way error recovery procedures or Recovery
Management Support. The next step is to look specifically at some of the work which has been done in
Operating System/60 with the Recovery Management
Support for the Model 65.

1. Reduce the number of interruptions to which the

user is exposed and,
2. :\iinimize the impact of these interruptions when
they do occur.
Recovery :\-ianagement therefore Hhould provide the
user with a higher degree of system. availability (more
time for more jobs) by minimizing the impact of
system malfunctions upon his operations.
With this objective as the target, error recovery takes
on a broader meaning and scope than has been applied
to the concept in the past. In an environment of multiprogramming, the system becomes all important and it
is most necessary that no matter what happens, the sys. tem must continue to function. It often becomes a situ-

39

40

Fall Joint Computer Conference, 1968

ation of sacrificing a part so that the "whole" may survive. In order to accomplish this, Recovery Management facilities may follow a pattern similar to one where
the support attempts to reduce the number of system
interruptions by retrying the operation which was interrupted by the malfunction or it may terminate the
task affected and continue system operation. If this is
not possible, then the second step toward accomplishjng
the primary objective of error recovery becomes of paramount importance-to minimize the impact of the interruption. This is done by preparing the system for a
simple restart or it may indicate that repair by maintenance personnel is required.

Instruction retry.
This pattern, which has just been outlined, suggests a
nUlllber of functions which can be performed to achieve
the objectives of Recovery Management. The first of
these functions is instruction retry. The concept of
instruction retry is not really new. It is something which
IBM has been doing for years, particularly in the I/O
area. Instruction retry has been standard procedure
whenever an error was en'countered in reading or writing a tape. But it is possible to extend this retry capability and to employ it when a CPU or memory malfunction occurs.
A relatively large number of malfunctions are intermittent in nature rather than solid failures and therefore, there is a high probability of success of execut.ion
and recovery if an instruction retry can be attempted.
The first thing which must be determined then is
whether instruction retry is feasible and then if feasible,
to execute the retry.
The determination of instruction retry feasibility is
usually quite dependent upon the characteristics of the
particular machine. Ordinarily for feasibility to exist,
the "environment" of the computer must be valid or
free from error. Dependent upon the specific machine,
this may include the data contained in general purpose
registers, floating point registers, machine log-out areas,
permanent storage areas, etc. Arbitrarily, the criteria of
validity can be keyed on parity. If the parity of the
data is good, the environment is assUllled valid and
therefore retry is feasible. If parity is bad, then no further retry action can be taken.
Having ascertained that instruction retry is feasible,
it is necessary to continue the analysis and determine if
a specific instruction is retryable. To do this, it is first
necessary to locate the failing instruction. The ·procedure involved here is again dependent upon the particular machine and what type of fetch or pre-fetch logic is
employed and whether or not the instruction counter is
accurate. In one case, a comparison of the internal registers in the machine log-out can provide the clue as to

whether the instruction counter is accurate; in another
it may be a function of when the machine check occurred and what updating cycles the instruction counter
was executing at the time.
It is obvious, therefore, that it is not always easy or
possible to locate the failing instruction but if the instruction counter is accurate and it is possible to locate
the failing instruction, an analysis can be performed to
ascertain whether the retry threshold of the interrupted
instruction has been exceeded. (The retry threshold is
that point in the instruction cycle after which retry cannot be attempted and is usua]]y indicated by a bit set
by the hardware.) The retry threshold has been exceeded when during the normal instruction cycle one or
more of the original operands has been changed. If the
threshold has not been exceeded, it is possible to cause
another attempt at executing the failing instructions.
If, however, the threshold is exceeded, it may be possible to extend the threshold by examining the instruction type to determine whether a copy of the original
operand might still be intact in some internal register
and if it is, by restoring it. This is accomplished by re,building (in a special execution area) the instruction
from the contents of the log-out or the internal registers
or main storage.
Therefore, from an analysis, it is possible to determine
that an instruction is either:
I-Retry able , that is the retry threshold has not been
exceeded or if it has been exceeded, the damaged
operand can be restored and therefore instruction
retry can be attempted or
2-Non-retryable, that is instruction retry is not possible because either the threshold has been exceeded or the damaged operand cannot be restored,
an invalid environment exists because of incorrect
parity or the value of the instru~tion counter is indeterminate. If the second condition is the case,
then it is necessary to look for another way to
handle the error recovery.

Refresh main [)torage
The occurrence of a parity error in main storage obviates instruction retry therefore, one function which
could be of value would be the ability to "Refresh" main
storage. By this is meant to repair the damage which
either caused or was caused by a malfunction by loading
a new copy of the affected module into main storage. (A
module is a program unit that is di'screte and identifiable
with respect to compiling, combining with other units
and loading.) The use of refreshable code requires a good
deal of foresight in coding since in order to be refreshable, a module must not modify itself or be Inodified by
another module; for example, it must not set switches,

Error Recovery Through Programming

contain dynamic storage areas, or store registers or address pointers within the body of its code. The foresight
is well rewarded, however, when it is possible to load this
refreshable code and then continue execution without
changing either the sequence or the results of the processing.
The attribute "refreshable" is similar to "reentrant".
Most reentrant modules meet the requirements specified
above and in addition, a reentrant module is one that
may be utilized by more than one task at a time (some
modules classified as reentrant deviate from these requirements by operating in a psuedo disabled manner,
thus actually allowing modifications during a short
period of time). The difference between the two is that
"reentrant" is based on the operational characteristics
of the module within the system while "refreshable" is
based only on the fact that the code is not modified in
any manner.
Selective termination

The functions of instruction retry and refreshable
code are most desirable since they render the error recovery procedure transparent to the user and require no
intervention on his part. Unfortunately, it is not always
possible to attain this level of recovery. When this is the
case, it is necessary to accept some degradation in order
to keep the system operational. One way to accomplish
this is to implement a function of Selective Termination. Such a function would enable the system to examine the failing environment, determine what problem
prograln was executing and then proceed to terminate
this program while continuing all other jobs which were
executing at the time of the malfunction. This is really
a type of job-abort which frees the resources of the system allocated to the job and makes theln ava,ilable for
future use. If a problem program was utilizing system
code when the malfunction occurred, selective termination could be effective if the system code was transient
rather than resident in nature. This process results in
the loss of a specific job but it does enable the system to
continue without interruption.
Another function which would aid in the error recovery process when a memory malfunction occurs is
the ability to logically carve out or remove that portion
of the memory in which the malfunction occurred. Since
this type of error recovery would result in job termination and might not return resources (Storage, I/O devices, etc.) to the system, such a procedure would obviously introduce undesirable side effects, such as loss
of availability of I/O devices, loss of part of core and,
loss of the terminated job, but it would preserve the system and operation would continu~ until an orderly correction could be made.
.

41

I/O Recovery

The functions which have been discussed so far have
been directed mainly to errors which occur in the CPU
or memory. From an examination of system inciden~s,
it is evident that a significant portion of errors occur In
the I/O area. Is there anything which can be done to
improve error recovery procedures for I/??
.
In the first place, there is I/O retry whlCh IS avaIlable
through the ERPs (Error Recovery Proce~ure~) for
the different I/O devices. As indicated earlIer, It has
been standard procedure to retry I/O instructions when
errors occur. A number of errors (unit check, unit exception wrong-length indication, protection check· and
som~ chaining checks) can be corrected by this means.
An I/O Supervisor performs an analysis and selects,
according to device, the proper ERP to attempt recovery. After retry is attempted, the ERP regains control to determine whether or not the retry has been successful. If it was successful, the I/O retry is transparent
to the user.
There is another group of I/O errors-channel
checks (channel control check, channel data check
and interface control check)-which need not be
disastrous but which after analysis of the conditions
causing the error, it may be possible to recover .. Such an
analysis would determine the type of operatIOn t~at
failed the type of device affected, the sequences whlCh
occur~ed across the I/O interface following the error and
whether a retry can be attempted.
The I/O device or medium can malfunction and if a
retry is not successful,. there may be other ways to
continue the execution of the job. One such way would
be to have the ability to switch data sets (devices), that
is to change a tape or disk pack from one drive to another and then to retry the operation with the new
drive. Another possibility (if the malfunction was really
related to the Channel or Control Unit) would be to try
another route to the same device. In this circumstance
it would be an attempt to use the device by accessing it
through a different route, that is by addressing it
through a different channel or control unit.
Other system incidents

Another group of system incidents is due to procedural and operator errors. Several things can be done to
decrease this and as such, it certainly deserves concentrated attention. The first is, of course, better trained
personnel but from a programming ~oint of view, .several possibilities exist. It is most deSIrable to reqUlre a
minimum of user intervention and interaction in order
to accomplish execution. Control information should
be minimal. When interaction is required, messages
should be clear and concise - to the point of outlining

Fall Joint Computer Conference, 1968

42

possible choices. A conversation mode could be optional
which would permit correction or confirmation of operator action. All these points are generally grouped under
a concept of Operator Awareness and have a very definite place in the planning of any error recovery support.
All of these functions are aimed at continuing the
operation of the system but unfortunately this is not
always possible to accomplish. Therefore, the next best
thing is to minimize the effect of the malfunction. This
can be done by attempting to preserve information concerning the malfunction and to make it available to
assist knowledgeable personnel to determine what
caused the error and what can be done to correct it.
This will have the most desirable effect of shortening
the Duration of the Unexpected Interrupt and get the
system back in operation as quickly as possible

RMS/65
The Recovery Management for the System/360
Model 65 (RMS/65) has provjded a number of these
functions in the operating system. These functions are
contained in two programs which make up RMS/65.
These are the Machine Check Handler (MCR) which
is directed at CPU and memory malfunction and Channel Check Handler (CCR) which is oriented to I/O
problems. The RMS/65 has provided a hierarchy of
recovery which involves four levels:
I.
II.
III.
IV.

to continue processing all unaffected jobs. This is done
by means of a Program Damage Assessment and Repair
feature which attempts to analyze the malfunction environment, to isolate and repair the program damage if
possible and to report permanent failures to the program and operator. This feature also incorporates the
mechanism to provide the capability of selective termination of a task.
The function of System-Supported Restart is called
on when both Functional and System Recovery have
fail~d but a stop for repair is not required. The operator
is informed that such a condition exists and that it is
necessary to restart the system.
The fourth level of recovery support provided by
RMS/65 is System Repair. In a way, this is perhaps
one of its most important functions since the detailed
error analysis information which is provided can be of
great assistance in the determination of the cause of
failure and in suggesting the proper correction for the
problem. Once the repair is completed, initialization is
required to restart the system.
Figure 1 shows the relationship of these levels of recovery to one another and to the main objective ofRecovery l\1anagement Support which is to keep the system in operation.
Each level of recovery performs the important func-

Functional Recovery
System Recovery
System-Supported Restart
System Repair

Functional Recov:ery is the successful retry of an
interrupted instruction. MCR handles the operation
for the CPU and main storage through its Machine
Analysis and Instruction Retry (MAIR) facilities. The
MAIR facilities perform an analysis of the machine
environment at the time of the machine check interruption to determine the feasibility of retrying the interrupted instruction. MAIR then retries the interrupted
instruction when retry is feasible. The CCH performs
the analysis function for the channel checks discussed
earlier. This is accomplished by intercepting I/O interruptions before the I/O Supervisor receives them and
performing an analysis of the existing conditions. If
feasible, the status bits are manipulated to make the
channel check look like a failure for which ERP exists
and then control is transferred to the appropriate ERP
for action. Functional recovery is of course the desired
goal because in this case the malfunction is transparent
to the user.
System Recovery is the second level of recovery and
is required when functional recovery is either not feasible or fails. The objective is to preserve the system and

FIGURE 1

Error Recovery Through Programming
tion of recording information concerning what happened, the status of the computer at the time of the
incident, what action was taken and the results of such
an action. This information which is recorded on a special data set S YSI.LOGREC, is then available through
execution of the Environment Record Editing and
Printing utility (EREP) which runs under the control
of the Operating System/360. This program edits and
prints the records generated by MCH and CCH (as well
as by several other recording functions) and provides
the information for interpretation by the experienced
Customer Engineer. A Standard Operating Procedure in
a Computer Center using MCH and/or CCH should be
to execute EREP on a regular basis and then the information should be available to the CE as an aid or indicator to anticipate serious trouble. For example, if a
particular pattern appears indicating possible degrada-

43

tion, preventative maintenance can be performed before
the occurrence of a serious incident.
CONCLUSION
RMS/65 is a step in the direction which error recovery
must take if the requirements of computer technology
are to be met in this area. l\/fore and more the question
of error recovery canr:tot be relegated to hardware or
programming alone but rather these two must form an
effective partnership and attack the problem together
in order to provide. a satisfactory solution. Every sign
indicates that this is being accomplished and it appears
that some meaningful steps such as Rl\/fS/65 are being
taken toward the goal of reducing the number of interruptions to which a user is exposed and to minimizing
the impact of these interruptions when they do occur.

OPTS-600-0n-line Peripheral Test System *
by G. W. NELSON
Graphic Corporation
Phoenix, Arizona

•
INTRODUCTION
Computer Test & Diagnostic (T&D) Programming Development and usage in the past ten years
have undergone very few changes. As a result of
this, the philosophy and attitude towards T&D's
are passe. From basically simple systems, to the
very complex, the T&D's for the early systems
were completely off-line-either the customer
work was run, or T&D, but nQt both.
Being a dynamic industry, hardware and custQmer software systems grew in complexity, SQphisticatiQn, and custQmer dependence. The third
generation systems brought with them multi-prQgramming, compute and input/output 'Overlap,
multi-processQrs, and the heavy custQmer 'On-line
work lQads.
The failure 'Of a peripheral device such as a
magnetic tape handler, card reader, etc., dQes nQt
always necessitate the lQSS of the tQtal system, due
tQ the ability of reallQcatiQn of a replacement
device to the jQb. HQwever, the system thrQughput is decreased by an amount proportiQnal to the
work capacity 'Of the lost device. Should the failure be 'Of such a nature, the customer is faced
with two choices: (1) give the entire system tQ
the maintenance persQnnel so that off-line T&D's
can be run to determine the specific malfunctiQn,
'Or (2) keep on running at a reduced capacity. In
'Only the most extreme circumstances will the
customer chQose the first alternative.
If the customer cQntinues to run, then the failed
device cannQt be examined 'Or repaired until the
normal maintenance period. This turns out tQ be

a double edged sword which hurts the customer,
due to reduced capacity and the maintenance staff,
as they must wait in order to start taking CQrrective actiQn.
The General Electric Company recognized that
in many cases this awkward situation CQuld be
greatly reduced or possibly eliminated if on-line
T&D's were available. Active development of online T&D's for the GE 625/635 computer systems
started approximately fQur years ago. This has
evolved from the early peripheral exercisers to the
present comprehensive On-line Peripheral Test
System-OPTS-600.
The OPTS-600 System is an integral part 'Of the
total General Electric Comprehensive Operating
Supervisory (GECOS) System (see Figure 1).
The test executive, OPTS-600, operates within the
frame work 'Of GECOS-III, but provides fQr all
test dispatching, peripheral device allQcation, lan-

::

:
t-~,~,-= ~{~~O» :~
j ::::,~:--- '-~r-1--::--1

~
_

u~~
I

II

J~

--~~-l
USER

It,J ::,
i.

L:J

_:

I
:
I

- I ~-l

- - - - - - -,

""

USER

PAGE

I

~he work performed herein was accomplished at the General Electric Co., Phoenix, Arizona.

FIGURE 1

45

r=

r--'~~-

SIIARE

USER

**Formerly with General Electric Co., Phoenix, Arizona

L~

i

:

I
L
__

f"~:~

:. -!

USER

46

Fall Joint Computer Conference, 1968

guage processing, issuing of test input/output, . memory access mode (slave mode) . and would
require only occasional excursions into Master
data transfers, memory space management and
Mode. Systems programs such as OPTS-600 are
error output. The test executive will control from
allowed this privilege of going into master mode
one to eight individual peripheral tests in a multiwhen necessary. !tis under this Privileged Slave
program environment, concur-rent with normal
Mode (going into master mode when the need
customer operation.
arises) that the OPTS-600 system operates. By
The use of an on-line test system is relatively
operating in the Privilegea Slave Mode instead
low when compared to the utilization of GECOS
subroutines, libraries, compliers, and assemblies.
of directly in master mode, GECOS-III System's
For this reason the OPTS System is not mainprograms are afforded greater fail soft protection
tained permanently in memory, but called in from
against malfunctions camdng systems disasters.
system file storage on demand by customer or
Should a malfunction occur in a systems program,
maintenance engineer.
only that program will be eliminated. This is parConsole request verbs describe the exact type of
ticularly useful to the OPTS-600 System because
test to be executed on the desired peripheral. Reof the probability of testing malfunctioned equipquesting a test on a specific device results in a test
ment. OPTS-600 is called into memory from syspage being .called in for execution. Test pages
tem file storage via console demand.
represent tests explicitly designed for a particular
The OPTS-600 Executive requires 5000 words
peripheral device. The OPTS-600 system conof memory and can control up to eight different
tains a complete library of comprehensive test
test pages at once in a multi-test program environpages which are available for selection by the
ment. The OPTS-600 Executive consists of four
maintenance engineer. The test pages are written
main modules. (See Figure 2).
in a test and diagnostic English type language,
1. Master Mode Service
which is also available to the maintenance engi2. Language Processor/Dispatcher
neer via conversational console entries. In this
3. Error Output
manner the maintenance engineer can write and
4. Test Page
execute tests of his own design concurrent with
The Master Mode Service module is the only
customer operation.
portion of the OPTS System that operates in the
unrestricted memory access mode. Five main
OPTS-600-0n-line peripheral test syst'em
service functions are provided by this module:
The purpose of the On-Line Peripheral Test
1. Peripheral allocation and request buffering.
System (OPTS-600) is to provide the on-line ca2. Test Page loading, initialization, 2nd memory
pability, under GECOS-III, of comprehensive testspace management. Memory is allocated dying and on-line trouble-shooting of malfunctioned
namically as required, so as to keep requireequipment. This is accomplished without unduly
ments
at a minimum.
interfering with the overall system capability to
3.
System
Termination.
continue the processing of customer jobs.
4.
Fault
protection
and processing.
A secondary function is that during slack periods of customer operation, or idle peripheral
availability, equipment testing can be accomplished. This allows the normal schedule preventative maintenance time to be utilized more effectively in the actual corrective maintenance of
equipment rather than the running of tests.
The OPTS-600 System is an integral part of
GECOS-III, similar to the Time-Sharing System
which is also a part of GECOS-III.
It is not necesary for all segments of the
GECOS-III System to operate in the unrestricted
memory access mode (master mode) at all times.
Most functions can be executed in the restricted
FIGURE 2

OPTS-GOO
5. Issuing of Input/Output data transfers.
The Language Pr'Ocess'Or/Dispatcher is the main
'Operating m'Odule within the OPTS system. The
maj'Or P'Orti'On 'Of this m'Odule c'Ontains the Test
and Diagn'Ostic language pr'Ocessing functi'On.
Pr'Ocessing 'Of the T&D Language entails the f'OlI'Owing functi'Ons:
1. Interpret s'Ource language c'Ode.

2. Set up Input/Output (I/O) test sequences as
directed by the s'Ource language.
3. Perf'Orm err'Or checking 'On behalf 'Of previ'Ous
test I/O.
4. Execute 'Operat'Or selected operating 'Opti'Ons.
The dispatcher c'Ontr'Ols fr'Om 'One t'O eight test
pages. Input/Output is maximized in the dispatcher by dispatching c'Ontrol t'O the Test Page
that has had its I/O c'Ompleted f'Or the l'Ongest peri'Od 'Of time.
The err'Or 'Output m'Odule f'Ormats and transmits err'Ormessages f'Or the test page t'O the c'Ons'Ole that 'Originally initiated the request, the systems acc'Ounting file f'Or hist'Orical err'Or development, 'Or b'Oth depending UP'On the selected 'Operating 'Opti'Ons.
The OPTS System is capable 'Of directing err'Or
output and c'Ontr'OI input requests f'Or a test page
t'O any 'One 'Of f'Our I'Ocal c'Ons'Oles. This pr'Ovides
the maintenance engineer the ability t'O initiate a
test request 'On a sub'Ordinate c'Ons'Ole, thus reducing the 'Output and interference 'On the main system c'Ons'Ole which receives the bulk 'Of the system
message traffic (e.g., a maintenance c'Ons'Ole).
F'Or the systems that have Real-time capability,
OPTS-600 pr'Ovides the ability t'O use a rem'Ote
teletype (TTY) as if it were a I'Ocal c'Ons'Ole. A
small percentage 'Of device malfuncti'Ons will require that the I'Ocal maintenance engineer 'Obtain
99

VERB

Ilo

CONTROLLER #

2

47

the assistance of centrally located device specialist,
in 'Order t'O c'Orrect the pr'Oblem. By using the
TTY, the specialist can dial int'O the c'Omputer
system and be aut'Omatically c'Onnected t'O the
OPTS system. He n'Ow has available t'O him the
full range 'Of 'Operating features 'Of OPTS-600
Test Pages and pr'Ograms 'Of his 'Own design. The
TTY n'Ow bec'Omes in reality, a l'Ocal c'Ons'Ole 'On a
I'Ong extensi'On c'Ord. All err'Or messages f'Or the
device under test will be directed t'O the l'Ocal c'Ons'Ole, the rem'Ote TTY, with the additi'Onal ability
t'O transmit c'Opies 'Of the ·err'Or message t'O still
'Other TTY's f'Or m'Onit'Oring. In getting first hand
kn'Owledge ab'Out the malfuncti'On via OPTS-600,
the specialist may be able t'O instruct the I'Ocal engineer as t'O the type 'Of c'Orrective acti'On t'O take.
By res'Olving the pr'Oblem in this manner, d'Own
time will be c'Onsiderably reduced due t'O the device being 'Out 'Of service f'Or a sh'Orter peri'Od 'Of
time.
The OPTS system pr'Ovides the maintenance engineer the capability 'Of accumulating all 'Of the
OPTS-600 err'Or messages 'On a Systems Acc'Ounting File which is dedicated file f'Or all 600 Systems. In the case 'Of r'Outine device testing, the accumulate m'Ode 'Of err'Or c'Ollecti'On will bypass
c'Ons'Ole err'Or message type'Outs. Then, at a m'Ore
c'Onvenient time the maintenance engineer can
dump all accumulated err'Or messages t'O the printer. These messages are identical t'O what W'Ould
have been typed 'Out 'On the c'Ons'Ole, plus the engineer n'Ow has a permanent and detailed hist'Orical
err'Or rep'Ort.
Test pr'Ograms may be called in three ways. The
operat'Or may initiate a test pr'Ogram by typing the
verb "TEST." The request verb is f'OII'Owed by
the descript'Ors which exactly define which peripheral, the type 'Of test desired, and the desired
'Operating 'Opti'Ons. See Figure 3.
03

COMPREHENSIVE

CHANNEL 4F

TEST PAGE

FIGURE 3

LOOP

HALT

ON

AFTER
ERROR

48

Fall Joint Computer Conference, 1968

This would request. a comprehensive test page
(C), to be executed on Input/Output controller
00 (IOC), Channel 02 of the IOC, and Peripheral
Device 03 'On that channel. The operating 'Options
specify that execution is t'O start at test 32 (T32),
loop on that test (L), and halt after each err'Or
(H).

It is recngnized that a specific peripheral device
may n'Ot be available fnr test at the time the maintenance engineer enters a request. Sn, to prevent
him frnm having to stand guard at the console, and
attempt tn use the "TEST" request bef'Ore the
GECOS system allncates the device to annther
job, he may enter the "TSTQ" request. This request is identical to the "TEST" request except
that it says the device is obviously nnt available
right nnw, sn queue the test request and perindically check the availability of the device. Once the
device is found to be available, start a test as
specified by the request parameters.
During errnr recovery by the GE 625/635 supervisory system 'On behalf 'Of a custnmer job, the machine nperatnr may be interrogated as tn the desired recovery actinn to be taken. The nperatnr
has a varied combination 'Of responses that he may
evnke. The "T" nptinn can be used at this point
in conjunction with 'Other respnnses. For example: he cnuld reply "RT," this would cause the
error recovery tn be retried and the specific device
marked for testing befnre it is allncated t'O another
user. The "T" response is the machine 'Operator's
counterpart t'O the "TSTQ" request.
To minimize the number 'Of 'Operatnr messages
and reSP'Onses required, operating 'Options can be
used tn cnntr'Ol the testing 'Of a device. Any cnmbination of up t'O five 'Option characters may be entered with the "TEST" 'Or "TESTQ" requests.
After a Test Page has gone int'O executinn, any
cnmbinatinn 'Of twelve nptinn characters may be
used. Figure 4 is a list 'Of the 'Operating 'Options
that may be applied tn a specific Test Page.
Peripheral Test Pages are written in a macrn
Test and Diagnostic Language (TDL). Each Test
Page requires 2000 words of memnry, and is diYided into a series of tests. The tests are escalating
in complexity, starting with very basic cnmmunications, and advancing tn the more c'Omplex events
'Of sequencing and data sensitivity. Each test perfnrms a particular testing function and is capable
of being Inoped 'On indefinitely, or 'Of being executed without requiring the previnus execution of
any other test. When errnrs 'Occur, part 'Of the

A • ACCU1lUlate on Accounting file for Historical Error Development
B • Bypass console error messages
C -

No transient error recoveries

H • Halt on error for n_ operating options
L • Loop on current test
N '" Negate next option character

o•

Go to enter options for more operating options

R - Recycle entire Test Page
S .. Skip .to next subtest
Txx • Start execution of test xx

(eg:

ABL - !cCU1lUlate errors on accounting file. !>'Pass console
error messages. 1.Oop on error.)

FIGURE 4

errnr message cnntains a direct reference to the
test that failed, the line of code that was in execution, and the exact peripheral instruction being attempted. This errnr reference is also the paragraph number in the documentation that contains
a. prose descriptinn 'Of the purpose and methnd fnr
the test and operatinn invnlved.
When the OPTS System is called intn memnry
via an auxilliary consnle, the master cnnsnle is
nntified 'Of the request by a Ing-nn message, giving
the System Identification, Revision Level, Date
and Time. See Figure 5.
Once the requested peripheral device is allncated
and the test page called in, a start message is issued t'O the 'Originating c'Onsole. See Figure 5.
Within the parentheses is the -identificatinn 'Of
input/'Output cnntrnller, channel, device number,
and the type 'Of test page that will be executing.
This infnrmatinn prefixes all messages related to
a device under test. The message further states
that it is a start 'Of Test & Diagn'Ostics f'Or Device
Type 10, C'Omprehensive Testing Program, Revisinn Level A. The device type is further explained
as being Standard Magnetic Tape, Seven Channel, C'Omprehensive Test Page. Unless the 'Operat'Or has requested specific c'Ontr'Ol 'Over the test
page, 'Or the device becnmes in'Operable due t'O an
Dttentinn cnnditinn, n'O further nperatnr interventi'On is required. Up'On cnmpleti'On 'Of the test page,
a terminati'On message is typed.
In additinn t'O the m'Ore detailed err'Or messages
which accnmpany each device error as they 'Occur,
a summary is typed with the terminatinn message.
This terminati'On message will summarize all errnrs encnuntered during executinn, plus the
amount 'Of channel time in millisec'Onds that the

OPTS-GOO

49

LOG-oN MESSAGE:
ON

T

System

r

AT

i

Date

Revision
Level

r
Time

START MESSAGE:

7\~

Input/Output
Controller IF

7

Channel #

Tn

Device #

Revision
Level

Generic
Comprehensive
Description
Test Page
of Peripheral

TERMINATION MES.SAGE:

os

01

In~t/M~t\~

Controller #

ERRORS

C)Norm Term,

Channel #

Device #

C.T.' \

Comprehensive
Test Page

Number of
Status Errors

Number of
Data Errors

Channel Time
in Milliseconds

FIGURE 5

test ran. See Figure 5.
Upon the completion of all test pages, the OPTS
System will type a log-off message to the master
console. This message will be the same as the log:on format, with the exceptioI1- that the amount of
processor time that the entire OPTS-600 System
was in execution is given in milliseconds. All memory will then be released back to the main level
operating system (GECOS).
The OPTS-600 System also provides the unique
ability to the maintenance engineer to manually
write and execute special tests on-line, concurrent
with customer operation. This is provided by the
"Manual Test Pages" which are available for all
peripherals. The "Manual Test Page" contains no
coding: the maintenance engineer provides the
coding from the console, or remote teletype. By
specifying a manual test page he may then enter
the Test and Diagnostic Language coding of his
own design. This provides the needed flexibility
for custom designed T&D to cover as needed situations, or more convenient on-line trouble-shooting.
The maintenance engineer has the same instruction repertoire available as the diagnostic pro-

grammer. The OPTS Executive will monitor the
instructions and inform him of any illegal instructions or sequences that could cause system problems.
All test pages are written in TDL (Test & Diagnostic Language) which is a Macro Language
that causes a complete sequence of events to be
executed for each Macro encountered.
The "TDL" Instruction Set consists of Macros
for all normal test and diagnostic functions with
provisions for adding Marcos to perform specialized functions when necessary.
There is basic information that must be used
when issuing I/O commands to a peripheral subsystem. This is true regardless of what language
the test is written in. The information normally
required· is given in Figure '6.
Obviously, if all this information has to be defined for each command issued, any test program,
even a fairly simple one, would be somewhat complex to write and understand. "TDL" combines
these items into two groups.
The first six items are combined into each peripheral operation instruction.

50

Fall J'Oint C'Omputer C'Onference, 1968

1.

Peripheral Op-Code-..operation code directed to a peripheral such
as read magnetic tape, punch card binary, etc.

AD010101010101

2.

IOC COIIIIIand---------The cOllllland directed to the Input/Output
controller, such as transfer data, skip over
data. This is used in conjunction with the
op-code.

DRAN

3.

Record Count--------The number of blocks of data to transfer.

4.

Major Status Expected-The major classification of the state of
peripheral. This is reflected back to the
computer at the completion of each peripheral operation.

5.

Substatus Expected----A further break down in the classification
of a peripherals condition.

6.

Interrupts Expected---A signal sent by the peripheral at the
completion of an operation.

7.

IOC Number------------There can be up to four Input/Output controllers on one system.

8.

Channel Number--------The specific channel on an IOC, as there
can be sixteen.

9.

Device Number---------The specific device connected to a channel,
this also may be one of sixteen.

10.

Record Length---------The number of

11.

DeW

12.

Type of Data---------"Octal, decimal, random.

weE"

ds to transfer

List------------~Data

Control Word. This word specifies
where in memory the data will be transferred
to or from.

FIGUHE 6

D·LNXX
DREAD

Instructi'Ons f'Or defining any 'Or all inf'Ormati'On
necessary fer 1/0 executi'On are pr'Ovided as well
as utility instructi'Ons f'Or I'O'Oping, branching, 'Outputting special messages, e.g.:
LP05.49

L'O'OP t'O line 05 a t'Otal 'Of 50
times bef'Ore g'Oing t'O next instructi'On.
LP85.SVI L'O'OP t'O Line 85 and save return
address in return register 'One.
RET1 + 1 Return via save return register
'One plus 'One field.

SUMMARY

F'Or example:
"WTB"-Sets up Peripheral Op-C'Ode 15 (Write
Tape Binary), IOC C'Ommand 00
(Data Transfer), Rec'Ord C'Ount 'Of 1
('One bl'Ock t'O be transferred), Maj'Or
and Substatus Expected 00 (Ready),
Wand Terminati'On Interrupt Expected.
"BKF"-Sets up Peripheral Op-C'Ode 47 (Backspace File) IOC C'Ommand 01 (N'OnData Transfer), Recerd C'Ount 'Of 1,
('One bl'Ock t'O be shipped) , Maj 'Or
status 04 (End 'Of file), Substatus 'Of
17, and expects a terminati'On interrupt.
Because they can apply t'O many peripheral 'OPerati'Ons within a. pr'Ogram, the last six items in
the list may be st'Ored in "Standards" and applied
te each subsequent peripheral 'Operati'On. Standards may be 'Overridden by defining any 'Of these
items immediately f'Oll'Owing the peripheral 'Opera.tion mnem'Onic.
"T.D·L" has instructi'Ons f'Or defining different
types 'Of test data, e. g.:
D707070707070

DROT

Add t'O existing data pattern in standards
Generate rand'Om data
pattern
R'Otate data 'One character
P'Ositi'On left
Use data· fr'Om "TDL"
Line XX
Write data fr'Om. read
area

.Data in 'Octal

Realizing that c'Omputer equipment d'Oes fail,
and 'Of all failures peripheral devices, such as card
readers, card punches, and magnetic tape handlers, represent the largest pr'OP'Orti'Onal share 'Of
these failures, On-line C'Ompresensive Test and
Diagn'Ostic Systems can be very beneficial in impr'Oving t'Otal system availability, and cust'Omer
satisfacti'On.
T'O this end, the OPTS-600 System is currently
being used by the maintenance engineers en the
GE 625/635 c'Omputer systems. Thr'Ough the
utilizati'On 'Of the 'On-line test and diagn'Ostic system, the engineers preventative maintenance
(P.M.) time is used t'O actually d'O P.M. 'Or c'Orrective maintenance (C.M.), rather than running
tests in 'Order t'O determine if additi'Onal maintenance is warranted.
An additi'Onal advantage is achieved by the
T&D System, in that tests are executed in the
same envir'Onment that the cust'Omer experiences.
By being 'On-line and an integral part 'Of the t'Otal
'Operating system, the cust'Omer is able t'O establish a higher equipment c'Onfidence level due t'O
the OPTS-600 System being subjected t'O the same
I'Oading and interference situati'Ons.

Fail-safe power and environmental facilities
for a large computer installation
by R. C. CHEEr\:
Westinghouse Electric Corporation
Pittsburgh, Pennsylvania

INTRODUCTION

The continuity of service required of environmental
conditioning equipment is only slightly less critical than
that required of electrical power. A failure or outage of
a few seconds to a few minutes can usually be tolerated
before performance of the computer system begins to be
affected. This means that suitable temperature and
humidity detectors can be used to sense trouble conditions and sound alarms in time to permit stand-by
equipment to be manually switched into service and
avert a computer shutdown. However, it is obviously
better to plan the system in such a way that manual
intervention is not necessary in case of failure of a particular component.
The provision of fail-safe electric power and reliable
environmental conditioning for the computing facilities
of the vVestinghouse Tele-Computer Center was a matter of serious concern from the outset of the planning
for the Center in 1961. The measures eventually taken
to achieve these goals considerably exceed those initially
thought to be adequate; so it is obvious that a few lessons were learned along the way. The purpose of this
paper is to describe the evolution of these facilities; to
recount some of the problems encountered and their
solutions; and generally to share with others the benefits
of some experience in this relatively neglected area of
planning for computer systems which must provide a
high degree of operating reliability.
.
.
It should not be inferred that the solutIOns deSCrIbed
in this paper are the only suitable ones. Recent developments have placed a variety of approaches to ~~ese
problems at the disposal of the planner of a new faCIlIty.
In the evolution of the systems at the Center, the designs were based on the best available balance between
economy and the degree of reliability desired, using the
approaches available at the time.

For a modern large-scale computer installation, the
reliability of the power supply and environmental conditioning systems is as important a consideration as the
reliability of the computing equipment itself. This is
especially true of installations which involve on-line
real-time and time-sharing operations, in which no convenient re-start point is available for re-;;umption of operations after an outage. It is becoming more and more
important in batch operations, many of which have
grown in scale to the point where the expense of lost
time due to re-starts can be a major economic factor.
Reliability of power supply, as the term will be used
in this paper, refers not only to the continuity of power
but also to its quality in terms of constancy of voltage
and frequency and its freedom from momentary
transients and surges. From the ~tandpoint of general
continuity, the typical electric utility power supply is
excellent. However, this continuity is achieved by the
provision on the power system of redundant line.; and
circuits equipped with fault-detecting relays, so that a
line on which a fault occurs can be automatically and
quickly removed from the system. Inevitably, the fault
itself creates a transient voltage surge which is propagated generally over the system, and the switchin.g
operations required to isolate the faulty line create addItional transients. These transient voltages often find
their way into users circuits. They go relatively unnoticed by the average user, but they may induce a delicate flip-flop circuit in a computer to flip when it should
flop and play havoc -with a program in the process of
being executed. As will-- be pointed out later in this
paper, such transients may be transferred -by induction
between circuits which upon casual study appear to be
completely isolated electrically as far as metallic connections are concerned. For example, they may appear
in the output of a motor-generator set by induction due
to the proximity of the generator output wiring to the
motor input wiring.

Power supply facilities at the Westinghouse
Tele-Comp'llter Center

The vVestinghouse Tele-Computer Center is the cor-

51

52

Fall Joint Computer Conference, 1968

porate-Ievel computing and data communications facility of the Westinghouse Electric Corporation. Operations began late in 1962 with a single UNIVAC 490
Real-Time System, initially performing teletype message switching on the Corporation's private teletype
network, along with a variety of straightforward batch
processing applications. The Center is located at a site
in suburban Pittsburgh, where the only available utility
power supply was a conventional 4160-volt radial distribution circuit, serving many small commercial establishments and residences in the vicinity. It was obvious at
the outset that this circuit was inadequate to serve the
needs of the Center, not only from the standpoint of
reliability but even its ability to provide enough power
under normal conditions to supply the projected load.
It was therefore necessary to have power at 23-kv
brought to the site by the utility from a 23-kv subtransmission circuit approximately a mile away which
interconnected two of the utility's 23-kv substations.
This would have provided adequate capacity, but considerations of reliability led to the decision to have a
second 23-kv feeder brought into the site from a geographically separate 23-kv interconnection approximately three miles away. The two 23-kv feeders were
built on separate pole-lines on each side of the road
along which they run together for several hundred yards
before entering the property, and they share common
poles only after entering the site. It was also decided
to install a private substation on the site, in order to
incorporate in it special relaying and switching equipment for transfer of the load from one line to another in
case of failure.
The substation (Figure 1) incorporated two identical
1500 kva transformers, 23 kv to 4160 v01ts regulated,
either of which alone could supply adequate power for
the whole building to the 4160-volt bus in the outdoor
substation. The 7.50-kva power center inside the building, supplied from this bus, stepped the 4160 volt power
down to 120/208 volts for distribution within the building. The power distribution unit for the UKIVAC 490
computer system was supplied by one feeder from this
power center. I t supplied power directly to blowers,
motors, and other "non-critical" units in the computer
system, as well as to a motor-generator set which in turn
provided regulated voltage, presumably free of surges
and transients due to external system disturbances, to
the central processor, communications control units,
and other units which were deemed to be critical in sensitivity to power fluctuations.
Both the "raw" power and the "regulated" power
were distributed throughout the computer room in enclosed common wireways, separate from signal cabling
which was laid in open cable trays.
The original scheme of operation was to supply the

23 KV.

RANKIN
LINE

1500 KVA

"

WILMERDING
LINE

1500 KVA

REGULATED

REGULATED

)

0

,

4160 V. BUS

1

1)

±

UNDERVOLTAGE DETECTION AND
AUTOMATIC TRANSFER CONTROL

750 KVA

t)

1)

1201208 V.

J

T)

t)

I)

J

J

l

AIR HANDLING COMPRESSORS
LIGHTS
UNITS
AND MISC.

,..----

UNIVAC
P.D.U.

I

-------,

I

l-f-fi~i~--i)J
"RAW" POWER
TO BLOWERS.
MOTORS, ETC.

M
M·G SET
G

~)

f

120/208 v.

?

~)

"REGULATED" POWER TO CPU AND CONTROL UNITS

Figure l-Original configuration of power-supply system

total power requirement of the site from one of the
23-kv lines with its associated transformer. The other
transformer was kept energized by its 23-kv circuit, but
its 4160-volt breaker to the bus was kept open. An
undervoltage relay on the 4160-volt bus detected loss of
voltage on the bus due to failure of voltage on the 23-kv
circuit normally in use and transferred the load to the
other transformer and line by sequentially opening the
breaker from the faulty source and closing the breaker
to the other. Relaying and circuit breaker operating
times were adjustable to considerably less than a second, and it was felt that the inertia of the m-g set supplying the critical computer units would be sufficient to
maintain adequate speed to keep these units supplied
with power during this period. Also, it was felt that any
fluctuations in frequency at tb.e output of the generator
would be gradual and therefore not disturb the operation of the system it supplied.
These assumptions were probably correct, and the
theory of operation described was probably very good,
as far as it went. However, during repeated tests of the
transfer scheme during the remainder of the winter of
early 1963, and upon the one or two occasions when
power actually did fail and initiate a transfer, the transfer was never accomplished without resulting damage to
the programs running in the UNIVAC 490 and an
abrupt shutdown of the entire computer system. During this period more and more units of the computer
system were moved to the isolated supply, on the theory
that perhaps some of them which previously were
deemed noncritical were actually injecting false inter-

Fail-Safe Power and Environmental Facilities
rupts or other spurious signals into the central processor
and affect,ing its operation. The transfer time 'vas
shortened to the minimum possible, less than half a second. However, these efforts were to no avail, and although the possibilities of this line of approach were exhausted, the transfer scheme was still unsuccessful.
But the worst was yet to come. With the advent of
spring came the thunderstorm season, and it was
quickly learned that when the skies began to darken
with thunderclouds it was good tactics to get the recovery-program tapes out of the racks and ready to
mount, because an outage was probably imminent. It
was also found that even an instantaneous transfer
scheme would not have solved the problems, because
surges due to lightning strokes and resulting switching
operations on remote parts of the utility's power system
of duration sufficient only to cause a momentary light
flicker at the site, were enough to shut down the comp u ter system.
It was then concluded that it was these transients in
the "raw" power source, induced into the wiring of the
presumably isolated power source due to their proximity in the common wireways, which were causing the
trouble. Furthermore, it was apparent that no scheme
for transferring to an alternate source of power would
work under these conditions, because the switching
transients set up by the transfer itself would defeat its
major purpose.
A solution might have been to rewire the entire computer system, isolating the wiring for critical units in
separate wireways and keeping it separate throughout
allpartsofthesystem. However, thiswouldnotonly have
been quite expensive but would have required extensive
shutdowns of the system, which was not feasible at the
time. It was decided to take a "brute-force" approach
and supply the entire computer system with isolated
power from a single large motor-generator set, with the
output power leads from the generator well separated
from the raw power source to the motor.
The motor-generator system selected is called the
"constant-frequency" or "CF" system, in which a conventional m-g set is mechanically coupled to a higherspeed flywheel through a controllable eddy current
coupling or electrical clutch (Figure 2). Under normal
conditions the motor receives power from the input
line and drives the generator in the conventional way.
The flywheel, disconnected from the system by the
electrical clutch, is driven by a separate motor at a
higher speed. Upon failure of normal power, which is
sensed by voltage and frequency sensors on the input
line, the clutch is energized under control of a frequency
regulator at the output of the generator. The coupling
of the flywheel to the m-g set is controlled in such a way
that the flywheel gives up its energy to the system at a

53

INPUT
120/208 V·60 -

~~=-ss----.j) 1) 1)
BREAKER

OUTPUT
1201208 V·59.8 -

Figure 2-"Constant-frequency" motor-generator system

rate which maintains the speed and therefore the frequem'y and voltage of the generator until the flywheel
slows down to the speed of the m-g set.
Such a system, rated at 80 kilowatts, with a flywheel
sufficient to supply full output for a minimum of 12
seconds after loss of input power, was ordered for installation before the lightning season of 1964. Upon
installation of this system, it was immediately possible
to realize the planned benefits of the alternate power
transfer scheme. Several failures of the normal power
line subsequently occurred. Except for a momentary
outage of the computer room lights (which were on a
separate circuit from the comp':lter system), computer
operating personnel would have been unaware of the
fact that transfer to an alternate power source had
taken place, because the computer system was unaffected. Furthermore, during the lightning season of
1964 alone, this system averted many outages and the
loss of information and time that would have resulted
from the many power-line disturbances that were noted.
Although several failures of the normally-used
power line have occurred each year, they have been of
very short duration. And in every case but one, the
alternate source was available, and the transfer was
made automatically and successfully without interruption to the real-time operations. Fortunately the
one case referred to, in which the alternate source
failed simultaneously with the normal source, occurred
during a weekend when real-time operations were already suspended.

54

Fall Joint Computer Conference, 1968

The computing facilities of the Center have ~xpanded
tremendously from the single UNIVAC 490 system
with which operations were begun. These facilities
(Figure 3) now include dual UNIVAC 494 central processors in addition to the original 490, which is still in
service; a dual CDC 6600 system with a 6416 scheduler
and control processor; and an IBM 360/50-75 system
in an ASP configuration. This concentration of processing power correctly suggests that the volume and
variety of the applications handled by the Center have
expanded greatly also, and it is no exaggeration to say
that a prolonged loss of power could have very serious
consequences to the operation of the entire Westinghouse Electric Corporation.
The construction of a second building at the Center
during 1966 and 1967, larger than the first, required replanning of the power supply facilities. The lessons of
the widely publicized Northeast power blackout led to a
reappraisal of the initial policy of complete dependence
upon the public utility supply for power. The decision
was made to install a quick-starting diesel-enginedriven generator as an alternate supply. With each of
the three major systems supplied by its own constantfrequency m-g set, capable of providing full power for
12 seconds after failure of the prime source, it is possible
to sense the failure, start the engine and bring it up to
full speed in 10 seconds, adequate time to pick up the
load of all three systems without interruption. The enginedriven generator is rated at 800 kilowatts, sufficient to
supply all the computer systems as wen as the critical
auxiliary items needed to maintain computer operations. These critical auxiliaries are listed in Table I.
The control system is arranged to drop automatically
from the power centers all loads except these critical
items whenever the engine-generator must be brought
into gervice.

Figure 3-Computer configurations at the Westinghouse TeleComputer Center

TABLE I-Westinghouse Tele-Computer Center
Critical computer and auxiliary load
KVA

Computer Systems
UNIVAC 494 Systems (CF Set)
IBM ASP System (CF Set)
CDC 6600 System (CF Set)
Air Conditioning Compressors

125
260
260

IBM and CDC Chiller Compressor
UNIV AC Air Conditioning Compressors
Fans and Pumps

160
40

IBM Room Fans
CDC Room Fan and Pump
UNIV AC 494 Room Fans
Cooling Tower Auxiliaries

30
30
15

Pump
Diesel Heat Exchanger Pump
Chiller System

15
10

Electric Heater for Humidity Control
Lighting-All Critical Areas

30
20
Total

995

An important factor to consider in planning a system
using an engine-generator is the ability of the generator
to supply the starting KVA requirement of any large
motors which may be dropped during the outage. In the
case of the CF units, because the motor-generator combination is kept at rated speed by the flywheel until the
engine-generator is ready to providepower, there is a
momentary transient lasting only a few cycles, while the
motor adjusts itself to the supply frequency. The control system allows a short time delay for this to occur
before re-connecting the chillers, air-handling units, and
pumps to the 208-volt bus. The KVA capacity of the
generator is adequate to start the chiller units, which are
by far the largest motors on the system and the only
ones which might present any problem.
In this system (Figure 4), the bus-tie breaker is normallyopen. Undervoltage relays detect loss of power on
the portion of the 4160-volt bus normally used to supply
the computer systems. If the other portion of the bus is
still energized, the transformer breaker is opened, the
bus-tie breaker is closed, and the other 23-kv source
supplies power to the entire bus. Meanwhile, the same
signal is used to energize the cranking system for the
engine-generator. If poweris not available from the
other 23-kv source, the tie breaker remains open and
the generator is connected to the 4160-volt QUs as soon
as it achieves rated speed and voltage, provided normal
power has not returned in the interim. Once the enginegenerator is connected to the bus, the system does not
reverse itself automatically even though the normal supply is re-energized. The transfer back to normal power

Fail-Safe Power and Environmental Facilities

• RANKIN
LINE

"--.....;23...K...:,.V.:....-._ _"- WI LM ERDI NG
LINE
1500/1750 KVA
1500/1750 KVA
REGULATED
REGULATED

~ rDrmrl ISTARTERl
.~
I. 1 . I

)

I)
•

BUS TIE

--;--.....:--

+t

v.

r

800KW

4160 V. BUS

+750 +1000
)

)

1350
KVA

)

120/208

ENGINE

)

KVA

KVA

I)
I.
1120/208 V.

;) .:) :) UJ)
1') !) ') 1') f)
i'
208

TIE

LIGHTS

)
1 120/208 V.

:) f) !) !) ') 'I) !)

208 V. TIE CHILLERS

I COMPRESSOR AIR
I
UNITS
HANDLING
I
UNITS
OFFICE ICOMPUTER 80 KW
BLDG. I BLDG.
CF UNIT

UNIVAC
EQPT.

CDC
EQPT.

PUMPS
AIR
HANDLING
UNITS

IBM
EQPT.

Figure 4-Present configuration of power-eupply system

supply is performed manually, In this case again, the
OF units provide a l2-second period during which the
generator may be removed from the bus and the transformer breaker. energized to restore normal s!1Pply
from the main power transformer.

Static inverter power supplies
An alternative to the use of motor-generator sets for
reliable power supply has been developed since the system described for the Center was designed. Rapidly increasing power capability and decreasing costs of power
semiconductors have now made static inverter systems
feasible as power supplies for large computer installations.
The basic elements of a typical inverter system are
shown in Figure 5. The system consists essentially of a
battery charger (static rectifier), a battery, and a static
inverter. The rectifier converts input a-c power to d-c,

NORMAL
A-C SUPPLY

RECTIFIER

-.

D-C
-..
INVERTER
~

loCTO

~ LOAD

BATTERY

Figure 5-EsElential elements of rectifier/battery/inverter powersupply system

55

maintaining the charge on the battery as it supplies d-c
to the inverter, which converts the d-c back toa-ctosupply the load. In case of failure of the input power, the
battery supplies d-c to the inverter, maintaining the
power to the load without interruption for a period depending upon the battery rating (several minutes in a
typical installation).
In addition to providing a temporary source of power
until alternative supply sources can be brought into
service, the battery performs another important function.
It acts at all times as a filter of almost infinite capacity
to prevent power-line transients and surges from being
transmitted through the system to the load.
Being completely static, the rectifier/battery /inverter system requires little maintenance and is clean and
free of noise.
Such systems are now available with ratings from 1
kva to 400 kva, and several systems can be paralleled if
necessary to achieve still higher total power capability.
Although the initial cost of a typical complete system
is generally somewhat higher than that of a motor-generator set, the lower installation and maintenance
costs and the operating advantages make the system an
extremely attractive alternatve.

A ir-conditioning systems
In the planning of the air-conditioning system for the
original 490 computer installation, it was concluded
that a total of 20 tons of compressor capacity would be
adequate to supply the units of the system which used
room air for cooling. Certain critical units, including
the central processor, were cooled by a separate ducted
system, for which 20 tons of cooling also was sufficient.
Each system had adequate cooling capacity for future
expansion. Here again a stand-by system was designed,
and the system finally selected used two 10-ton reciprocating units each for the room and the closed supp]y.
For each system, an additionallO-ton unit was provided
as a stand-by for each20-ton combination. Air-to-air
systems were used, partially to avoid the dependence
upon continuous water supply that would have been inherent in a condensing-water system.
The controls were designed so that on each system,
one 10-ton unit supplied the base cooling requirement,
the additional compressor being cycled on and off under
thermostatic control to supply the incremental cooling
requirement. The system provided for manually-controlled substitution of the stand-by compressor for
either of the normally-used compressors. Each of three
compressors supplied its own separate set of cooling
coils in the air ducts to the room system and the closed
system respectively.
The initial control design provided for damping or
modulation of the air flow by means of thermostatically

· -5e

Fall Joint Computer Conference, 1968

controlled vanes in the air ducts, so that control of temperature could be maintained within one degree despite
the "on-off" cycling of the second compressor in each
system. Since there was more than adequate cooling
capacity provided when both compressors were on, the
vanes cut down on air flow under this condition to maintain steady supply-air temperatures in the room and in
the equipment.
The most important lesson learned from experience
with this scheme was that a simple, reliable control system with a minimum of complication is far preferable to
a complex, sophisticated one which theoretically provides more precise regulation. One of the requirements
of a reciprocating compressor is that once itis started it
should be run for some minimum period of time in order
to insure proper lubrication (in this case a minimum
time of four minutes). The contr~l system was arranged
so that once aeompressor was started it automatically
ran for this minimum time, even though there was no
longer a cooling requirement for it. The result was that
the air-flow modulation system occasionally closed the
vanes in the ducts so far that ice formed on the cooling
coils due to the restricted air flow. Once this began, the
effect was cumulative, and it was not long before the
cooling coils completely restricted air flow in the system.
The result was a complete loss of air flow until all compressors had been shut down long enough to permit the
ice to melt away.
.
The high-precision temperature control system was
quickly abandoned, and the vanes in the air ducts were
permanently propped wide open. The temperature was
allowed to decrease as it would during the minimum
cycle time of the cycling compressor on each system
Although this sometimes meant 9 variation of temperature in the ducts of as much as three or four degrees
below the control temperature, this cured the icing
problem and provided much more reliable operation.
Another restriction involved in the use of an air-to-air
system is that it is harmful to the compressor units to
operate such a system when outside air temperature
drops below a certain minimum figure, in this case 1.5
degrees Fahrenheit. The control system was arranged
to shut down the compressors and use outside air directly for cooling when this outside temperature was
reached. This involved another complicated system of
controls and vanes to mix outside air with recirculated
air to maintain proper temperatures, one with which
adequately reliable results were never obtained.
In general, experience with the air-to-air system and
reciprocating compressors was not good, and in the
planning for expansion a chilled-water system was designed, using centrifugal compressors (chillers), which
are theoretically much more reli~ble. This has proven
to be the case. Before adopting this system, however,
arrangements were made for water supply from
alternate directions to the water input line to the site,

with isolating valves on each side of the tap, so that
a water-main break in either direction could be quickly
isolated.
The system as it is now operating uses two 120-ton
centrifugal chillers, providing. chilled water to the
water-to-air heat exchangers in the CDC-6600 and IBM
computer rooms. The chillers in turn are supplied with
condensing water circulated through outdoor cooling
towers. Although the chillers are physically essentially
in parallel, the control system operates the chillers in
sequence. Qne chiller is sufficient to supply the entire
cooling requirement of both computer rooms. The other
is normally de-energized, and its condensing-water and
chilled-water pumps are stopped. Thus, the first chiller
takes the entire load. If, however, it should fail, or if any
of its auxiliaries should fail, the resulting rise in
chilled-water output temperature will cau.se the second
chiller and its auxiliaries to be energized automatically,
restoring normal cooling capacity without manual intervention.
Experience with this system has been very satisfactory. The centrifugal chillers are very quiet, reliable,
and vibration-free. The water-to-water system presents
no seasonal problems as does the air-to-air system. Because chilled-water supply temperature to the air-handling units in the computer rooms is a minimum·of 45 degrees, there are no cooling-coil icing problems. Also, as
described, the system provides its own back-up protection without manual switching.
SUMMARY AND CONCLUSIONS
1. For important computer installations, it is desirable to provide a back-up source of power which can be
brought into service without interruption of continuous
power to the computer system.
2. Unavoidable transients and surges on a utility
power system can cause malfunction of a computer, and
the power supply system should be designed so that
these transients do not appear in the supply lines to the
computer system.
3. lVlotor-generator sets with controlled-energy flywheels and rectifier/battery/inverter systems constitute
two alternative means of isolating a computer system
from transient voltages and maintaining continuous
power while an alternative source is brought into service.
4. Simple environmental control systems with less
precise regulation are preferable from the standpoint of
reliability to more complicated systems with greater
precision.
5. Operating experience at the Westinghouse TeleComputer Center has proved chilled-water cooling systems with centrifugal compressors to be more reliable
than air-to-:-air systems with reciprocating compressors,
despite the requirement for essentially continuous water
supply.

A generalized methodology for computer simulation of
numerically controlled production systems
by GASTONE CHINGARI
Sperry Rand Corporation
Philadelphia, Pennsylvania

INTRODUCTION
Numerical control (N/C) is generally acclaimed as the
largest single advance made in the techniques of industrial production in the last decade. It represents a key
technical innovation that has significant effects on productivity, engineering design, product marketing, factory organization, employment and industrial relations.
The basis of these new types of production systems is
the numerically controlled machine tool. In most types
of metal-working operations the cutting or formjng tool
is told exactly what to do by 'means of a pre-recorded
program. The direction in which the tool moves, its
speeds and feeds, type of machining operation, together
with auxiliary machine tool commands, are directed by
digital instructions read from a punched tape or a magnetic storage. The N/C concept, as it applies to machine
tools, emphasizes the significance of this new form of
automation: the merging of information handling systems with production facilities.
Numerically controlled machine tools can be looked
at primarily as information utilization devices which
operate at the periphery of a digital computer. Their
function is the utilization of information to give output
in the form of finished physical parts. Computing power
is necessary to prepare and organize the machining instructions which, when fed to the machine tool, repre:'
sent a "fixed logic" program describing product dimensions, machine member direction, speeds, feeds and
other process control data.
At present, a variety of numerically controlled machines are encountered in various industries, all of them
requiring data processing services of various complexity
and frequency. In the metal-working machine tool area,
N /C machines such as turrent drills, jig borers, lathes,
multi-axis milling machines, engine lathes and multipurpose machining centers are most common in large
manufacturing companies but are also found in medium
and small machine. shops. Other numerically controlled
devices that are being used extensively are drafting

machines 'flame cutting machines, riveters, tube
benders ~elding machines, and inspection machines.
Figure shows a general-purpose N/? machi~e to?l
considered in the simulation model dIscussed In thIS
paper.
The concept of computer-based numerical control is
not relegated to the machine tool itself but can embrace
the full spectrum of N /C production in an engineering
and manufacturing company, Indeed, the entire process
may go from functional specifications of the piece-part
through production control, individual part manufacture assembly testing and follow-on statistical perfor~ance evaluation. In addition, there is a definite
trend for computer support in N/C manufacturing for part selection, machine center load~ng and
scheduling in order to improve N/C/machme ~ool
utilization. Information processing for numerIcal
control is carried out, in all three of the major
phases required in the production of a part. Phase 1, .information generation, constitutes the process of defimng

i

Figure 1-Numerically controlled machining center

57

58

Fall Joint Computer Conference, 1968

a part. This process aims at arriving at some specific and
detailed specification of the configuration of the part to
be produced and at its method of machining. Phase 2,
machine tool program generation, has the objective of
providing the computations required for the production
and verification of the complete set of machine tool instructions. Phase 3, information utilization, covers the
final phase where the instructions in the machining program are used at the machine tool site for actual production of the desired part as visualized in the part design. The main objective in programming an N/C
machine tool is the solution of the overall machining
problem, i.e., the optimum application of an automated
machine tool to a given piece of work according to predefined geometry and the attainment of the highest
speed in the machine operation compatible with machine dynamics and efficient metal-working techniques.
Computer-based programming systems for numerical control remove the part programmer from direct
contact with detailed machine tool coding and allow
him to define the machining problem in broader and
more meaningful terms. He can describe his problem
and procedures with a symbolic or graphical language
which is problem oriented and has little relationship to
the computer itself. The data coming out of the computer are in the language that the machine tool director can understand. A symbolic-type manufacturing
language (APT) with English-like terms can be used by
production people to "talk" to the computer. In this
language, which should be easy to master, the part programmer may describe the profile, surfaces or hole
patterns which define the part to be machined, and specify the sequence of required tool motions to generate
the desired geometry jn metal forgings or castings.
As shown in Figure 2, the present state of the art in
the use of general- purpose computers in machine too I
programming reflects the recent advances reached in
computer technology in general. Experimental graphi-

cal part-programming systems are in existence today
that permit, through the use of a cathode-ray tube display equipped with a light-pen device, the definition of
the part, and subsequently, of the machining problem. The part programmer can immediately see the
results of the process as the solution of the problem progresses.
These programs can also produce true perspective pictures of any curvilinear segment of series of lines including coordinate axes, and provide the part programmer
with an added degree of flexibility in controlling what he
sees on the scope. By manipulation of console switches,
the operator may rotate the three-dimensional view of
the part being shown about many axes and thus observe
it from various aspects as an aid in deciding if it has
correctly defined the part configuration. The graphic
communication capability is expected to increase part
programmer efficiency and decrease the preparation
time of verified N I C tapes.

Formulation of the generalized model
The formulation of a generalized model for N/C production stipulates parameters that provide the prime
operating modes of the production system, and describes
means for evaluating alternative design solutions.
A simulation methodology in numerical control requires the definition of a framework achieving integration of physical processes and information handling processes. Figure 3 shows a simplified representation of
such process integration. There are essentially four
component systems or subsystems considered in the
modelling philosophy presented here. There are the
N IC Data Processing System, the Physical Processing
System, the Emergency Repair Support System and the
Production Information System.
The Numerical Control Data Processing System has
the function of generating machine tool control informa-

rrr=::~~:~:::-~:::::~::~
I I I
I I I
I

I

I
I

I

I

I

I

I I
I I
I I

I

:

I
I

,
I

: ::

~:*~~~IIC

Figure 2--Information flow in a computer-controlled machine tool

I

I

: ::
I

I :

i
.-1-'_ - - L _

Figure 3-General model for N /0 production systems-Basic
schematic diagram

Generalized Methodology for Computer Simulation
tion from engineering drawings and process planning
data.
The Physical Processing System covers the production processes carried out by the N /C machine tools and
the Emergency Repair Support System provides the
services needed for repair of machine tool breakdowns.
The Production Information System encompasses all
the activities of the three principal systems metioned
above. Sensing elements report to this information system events that take place in the subsystem. The end
result of the information arriving at the Production
Information System is a series of images that describe
the activities within the subsystems.
The generalized model treats the numerical control·
plant as a man-machine system of discrete-type production and it makes use of feedback links within each
subsystem and between the subsystems themselves.
The production system may be composed of procedures,
equipment, information, methods to compile and evaluate the information, as well as the people who operate
and use the information. The basic schematic model of
the generalized N / C production system is shown in
Figure 4. The model is a detailed representation of the

operations and flows illustrated in elemental form in
Figure 3.
The flows as indicated in the diagram are of four
distinct types. The solid-black line network shows the'
materials flow from raw material storage to finished
part storage, going through the numerical control machining operation. The double-line network provides
the carrier for all information issued from the arrival
point of the engineering drawings to the issuance of
numerical control tapes for the production process,
going through various points for processing of the
numerical control programs. The broken lines identify
information flow for machine repairs. The thin-line network links all the other three networks and their work
stations to an information center designed for the
measurement of system performance during the simulation.
Shop orders are treated as purely exogenous inputs,
accompanied by engineering drawing releases and process planning data. These orders represent the transactions which g6 through the system in a stochastic
flow. Based upon decisions on the extent to which plant
capacity is used, the model allows incoming orders to

r---

::::~;OOlHl ---~------

: r--

FUflCTION

~
. E.el.EERI.e

~mms AIO

PROCESS DATA

~

,IIJMERICAl}

~~~~:~~I~TS

FUNCTIO.

~

~~~

II+1FF+9F+#:=l=iF======*=x====t- )

works in the current IBM 360 implementation of the
APT Standard routines.

«IDENTIFIER> = POINT /  )

Data deck example
The APT Standard data deck is divided into decks for
the basic words of the language, the semantics, and the
syntax. Each deck is identified by a deck number
punched in a column reserved for this purpose. The
syntax deck contains a rule and subrule number for the
rule being defined, and a series of positive integers,
where integers less than a certain size represent syntax
rule referents, and larger integers refer to basic words of
the APT language.
For example, let us examine the syntax rule for a
"point specification" as used in
GOTO / (point)
L = LINE / (point), (point)
where the first statement causes the cutter to move to
the point specified, and the second statement defines a
line "L" which passes through the two points specified.
The syntax rule which defines a point specification
("(poin~)", above) is given in the syntax data deck as
Rule Subrule
No.
No.
Syntax
1
2

3

42
2040 2334 2047
2040
42 2061

452 2041
2334 2047

The data giving the subset and module numbers
for each rule and subrule in the syntax deck are maintained as a separate card deck. Columns are reserved
in this deck for the subset or modular feature number
for each rule, as well as columns for the recommended
subset, if the rule falls into the modular feature category. For example,
Rule No. Subrule Subset Modular Feature Recommended Subset
12345
12345
16
18
50
142

or

52

Subset and module numbers

452

2041

1
1
1
1

1

01000

01111
1

01000

00111

where each number shown is punched in a specfic
card column. These selected rules shown above give a
representative sampling of the subset and module deck.
We see that rule 16(1) is part of a modular feature
which has subset 2(01000). as a minimum recommended
subset. The modular feature number is given by the
column in which the "I" appears. Rule 18(1) is a
member of Subset 2. The nested subset characteric is
evident from the fact that any member of a subset also
has a "I" in every higher subset card column (e.g.,
01111 for rule 18(1».
CONCLUSION

By substituting the entry in the semantics deck for
rule 52, replacing the large (2000 series) numbers by the
actual basic words, and printing in a "prettier" form,
the rule becomes
.
52 POINT SPECIFICATION
IS(I)42
OR(2)

(POINT / 452)

OR(3)

(42 = POINT / 452)

This is known as the "short form" produced by one
of the available computer print routines.
By substituting the names of the rule referents 42
and 452 and using the accepted Backus-Normal form,
the print becomes

 ·

::~

In conclusion, it should be noted that the information
contained in this paper represents a particular level of
the work of USASI X3.4.7. By the time the reader sees
this paper, it is likely that changes will have occurred,
and the latest information may be obtained by contacting the committee.
. It should also be made clear that all of the work on
the APT Standard has been performed by representatives of the Numerical Control community, including
the Aerospace Industry, computer manufacturers,
machine tool manufacturers, and universities. This
background has made for an APT Standard which is
generally agreed upon by a representative group of
users, and should therefore be readily acceptable.
REFERENCES
1 Automatic programming of numerically controlled machine tools

A series of eleven Interim Progress Reports on the M.LT. APT
PlOject June 11956 through November 301959 totalling 695 pp

Subsets and Modular Features of Standard APT
2 SHORI
/luture of numerical control in industry

IEEE Transactions on Industrial Electronics May 1963 pp
15-21
3 SA BROWN CEDRAYTON BMITTMAN
A descritpion of the APT language
Communications of the ACM Vol 6 No 11 November 1963 pp
649-658
4 CEDRAYTON
APT for continuous path N /C programming
Technical Paper No 576 American Society of ~ool and Manufacturing Engineers 1964
5 P ARANDA S HORI R N LITTLE
APT-Present and future

73

Paper Society of Automotive Engineers Midyear meeting
Detroit Michigan June 6-10 1966 Paper No 660354
6 RCHANDLER
Design for numerical control machinery
Machine Design Magazine February 151968
7 Procedures for the standardization process
USASI X3.4 Subcommittee Common Programming Languages
Document No X3.4f68-1 June 251968

8 T C HARRIS JALBERT

C G FELDMANN et al

Report of the subsets and modular features subgroup
USASI X3.4.7 Working Paper No 102 June 17 1967

9 C W WILSON III
Computer routines for editing numerical control meta-language

June 121968 USASI X3.4.7. Working Paper No CWW /11

A remote processing system for the APT language
by MALCOLM E. WHITE
Radio Corporation of America

Princeton, New Jersey

INTRODUCTION
With the advent of time shared computers and
the development of remote terminals capable of
providing fast access to these computers it be.
'
came eVIdent that processors could be developed to
greatly increase the efficiency of an N/C part programmer. In general, a majority of the errors
which occur in the processing of N/C programs
are errors of syntax, and these errors cause nearly
as much loss of time in processing as the more
complex arithmetic errors. Therefore, any system which could provide a. partial or complete
interactive APT processing capability would be
a valuable aid in' reducing processing time. A
system has been devised whereby a part programmer can sit at a remote console (teletype,
etc.), and directly communicate with the computer. This system can produce output for immediate display or for punching onto a tape. Such
a system requires a highly specialized processor
which can accept APT language statements, check
each statement for detailed errors in syntax, and
then perform the necessary computations needed
to produce an N/C output tape.

SY8tem description
The APT language is very large and complex
and generally follows quite unique, and rather
rigid guidelines. Studying the APT language, one
sees that, with very few exceptions, each statement consists of well-defined, syntactical elements.
Thus, for the most part, it is possible to describe
the language in "Backus' Naur Form" (BNF).1
Some work has been previously reported and dem..
onstrates methods of describing APT in BNF.2
A language which can be described in BNF can
be readily analyzed by a compiler type program
for correctness of syntax. The RCA Basic Time

Sharing System, available on the SPECTRA 70/45
computer,a contains a compiler, the syntax of
which allows one to alter compiler functions and
perform ones which are nonstandard Fortran.4
This computer feature allows the user to specify
the general format (syntax) and the output (semantics) of his own special purpose statements,
which can later be used as he desires. Thus, the
user may take control of the compiler process to
any extent he desires, from the addition of specialpurpose extensions to the compiler, to designing
a wholly new, on-line, interactive compiler.
The RCA Fortran PI compiler (a subset of
USASI Fortran IV) has special non-Fortran language elements in it which are especially useful
in describing the syntax of a language. The special symbol ": =" (colon equals) is interpreted to
mean "is" (or "is defined as") and the symbol
"I" is interpreted as a logical "or." Parentheses
may be used to enclose syntactic elements or
strings of elements, and thus can serve as delimiters. The symbol "$" is used to mean the
"arbitrary sequence of" a given character, string,
or syntactic element. Other features which are
part of the compiler language are seman tic operators which allow backup in case of error, operators to do label table lookup, operators to scan
real or integer expressions,' etc. There is also a
feature which enables the user to generate arbitrary machine language instructions for immediate execution or for placement in the output area
for execution at run time. With the availability
of these features it is easy to completely describe
the syntactic elements, as well as the semantics of
a language such as APT.

Program operation
An APT programmer may sit at his teletype
,console and type statements, a record at a time.
75

76

Fall Joint Computer Conference, 1968

Upon completion of each record (signified by a
carriage return), the computer syntax analysis
takes place. After each correct statement the
computer returns a line feed, carriage return, and
a sequence .number awaiting further input. The
execution of the interactive APT processor is the
same as that of most compiler programs. After
the interpretation and compilation has taken
place, the' program can be executed. There is a
feature available on the RCA time-shared system
which allows the execution of statements a 'line
at a time, after they are compiled. This feature
facilitates the use of on-line plotting of statements, one at a time.
The user may make corrections or modifications
to his APT program by using the text editor available as part of the RCA Basic Time Shared Sys.tem. T}le editor allows insertion of recOrds anywhere in' the program or corrections to existing
records.
Syntax checking (compilation)

Using the time-shared Fortran PI compiler, an
interactive APT processor has been written. The
program operates in much the same manner as a
typical time-shared, interactive computer program. Each input record (APT statement) is
scanned to determine its validity according to the
syntactic rules set forth in BNF. This scanning
process (compilation) produces' machine language
instructions which then can be executed in order
to produce APT output.
As each APT statement is scanned, it is classified according to type (cutter motion statement,
surface definition statement, APT post-pr()cessor
word, etc.). If the statement is determined to be
an allowable APT postprocessor word, the program branches to that section (subroutine) which
then checks the entire record (calling other subroutines as needed) for the proper occurrence and
usage of syntactic elements. The presence of the
word "GO" as the first two characters of a record
may signify a cutter motion statement and causes
a transfer to a subroutine which checks the remainder of the record for correctness of syntax.
If the record does not fit one of these two categories, it is tested to determine if it is a surface
definition statement. Such a statement, in a record by itself, will always be headed by a symbolic
name. Thus, the statement is first tested to ascertain if the symbol is a valid one. If the symbol

is acceptable, it is placed in a ,label table (the same
label table used by the Fortran PI Compiler).
Upon determination of the type of surface definition specified, the label table is again entered, and
the label is e1assifiedaccording to the type of surface defined. This is especially important because
nested definitions and backward references to symbolically defined surfaces are allowed. After classifying the label, the surface definition is checked
for completeness and accuracy. The number and
type of APT surface definition statements is large,
and therefore the interactive syntax checker must
carefully check each possibility, and back up in
case of error to check other logical branches,
where applicable. The APT Compiler completely
checks all symbols, flagging multiply defined ones,
and checking all referenced symbols to determine
if they are properly used.
An APT Surface is often defined ill terms of
other symbolically defined surfaces, and it is possible that these referenced surfaces can be nested.
This means that the APT compiler must be able
to analyze any arbitrary surface definition while
it is scanning definition or motion statements. It
is a simple matter to define a surface in terms of
a similar surface type (i.e., to define a line which
is parallel to another line). Such a statement is
analyzed by the compiler by use of recursive subroutine calls, another special feature of the RCA
Fortran PI Compiler.
During the compilation process the compiler, as
it scans a record, generates executable machine
language code. In the case of a surface definition,
the code which is generated is that which will
place the named variables into Fortran Common
for subsequent execution. For cutter motion statements, the code for moving the canonical forms
of all referenced, surfaces (drive, part and check
surfaces) into the next available common location
is generated. Finally, at the conclusion of the
analysis of each record, a link is generated to the
appropriate Fortran subroutine where further
analysis will occur at run time.
The program scans each record, a character at
a time, halting when an error is detected. Thus if
there is more than one error in anyone statement,
only the first will be detected and flagged. When
an error is found, the computer responds with a
print of the characters immediately preceding the
incorrect ones and will insert a question mark
after the character (or string of characters) in
error.

Remote Processing System for APT Language
Because the APT compiler is actually embedded
in, and is in fact an adjunct to the Fortran PI
Compiler, it is possible to intermix APT statenlents and Fortran statements in any desired
rnanner. It is feasible to use all the computati'On
features of the full Fortran PI compiler to help
describe the mathematical shape of some surface.
In addition, the standard Fortran looping capabilities are available (arithmetic and logical IF
statements, DO loops, computed GO TO statements,
etc.). It is als'O possible to use all the read and
write features available in the Fortran PI language, and therefore, the user has available a
much broader language capability than is normally provided· by the APT language.
The number and type of APT statements which
can be interpreted by the interactive syntax analyeis program is limited 'Only by the size of the program which can be operated in the RCA Basic
Time Shared System. The interactive APT processor contains not only syntax analysis programs,
but also a number of Fortran subroutines used for
producing APT output. Due to the present limited
size of the programs which can be run efficiently
on the time-shared system, the number of allowable APT statements has been restricted to those
which are vital to a two-dimensional APT part
program. A list of these statements appears in
rrable 1. A syntax analysis program which doeR
not generate any semantics has been written and
encompasses a large part of the allowable APT
statements, including all point, line, circle and
plane definitions, all cutter motion statements, and
a considerable number of miscellaneous APT vocabulary definitions. This program could easily
be expanded to handle the syntax analysis of the
entire APT vocabulary.

Progra1Jl- execution
Upon c'Ompletion of the syntax analysis of any
input record, the generated code can be executed.
The executi'On of an APT surface definition statement begins by branching to a Fortran Subroutine
where the canonical form 'Of that surface is generated. The program has the capability of generating canonical forms f'Or a number of different
definition formats of points, lines, circles, and
planes. Each surface is handled by a unique subr'Outine. The output of each surface generation
subr'Outine is left in the lowest available common
l'Ocations, and upon return to the calling program,

77

TABLE I -Allowable APT statements
I. Surface Definition Statements

A. Point Definitions
1. SYM = POINT /X,Y,Z
2. SYM=POINT/X,Y
3. SYM=POINT/(*), INTOF, (SYM. LINE), (SYM.
CIRCLE)
4. SYM=POINT/(*), INTOF, (SYM. CIRCLE),
(SYM. CIRCLE)
5. SYM =POINT/INTOF, (SYM. LINE), (SYM
LINE)
B. Line Definitions
1. SYM =LINE/X,Y,Z,Xl,Yl,Zl
2. SYM =LINE/X,Y,Xl,Yl
3. SYM =LINE/(SYM. POINT), (SYM. POINT)
4. SYM =LINE/(**), TANTO, (SYM. CIRCLE),
(**), TANTO, (SYM. CIRCLE)
5. SYM =LINE/(SYM. POINT), (**), TANTO,
(SYM. CIRCLE)
C. Circle Definitions
1. SYM = CIRCLE/X, Y,Z,R
2. SYM=CIRCLE/X,Y,R
3. SYM = CIRCLE/CENTER, X,Y,Z, RADIUS, R
4. SYM=CIRCLE/CENTER,
(SYM. POINT),
RADIUS,R
5. SYM = CIRCLE/(*) , (SYM. LINE), (*), (SYM.
LINE), RADIUS, R
D. Plane Definitions
1. SYM =PI,ANE/I,J,K,D
II. Cutter Motion Statements
A. Point-to-Point
1. GOTOjX,Y,Z

2. GOTO/(SYM. POINT)
3. GODLTA/X,Y,Z
4. FROMjX,Y,Z

5. FROM/(SYM. POINT)
B. Continuous Path Motion Statements
1. GO/(***), (SYM. SURFACE)

2. GO/(***), (SYM. SURFACE), (***), (SYM.
PLANE)
3. GO/(***), (SYM. SURFACE), (***), (SYM.
PLANE), (***), (SYM. SURFACE)
4. (****)/(SYM. SURFACE), (***), (SYM. SURFACE)
(*) = XLARGE, XSMALL, YLARGE,
YSMALL
(**) = RIG HT, LEFT
(***) = TO, ON, PAST, OR NOTHING
(****) = GOLFT, GORGT, GOFWD, GOBACK
III. Other Statements
A. TOLER/(VALUE)
B. OUTTOL/(VALUE)
C. INTOL/(VALUE)
D. CLPRNT
E. CUTTER/(VALUE)
F. MACHINj(VARIABLE LIST)
G. ORIGIN /X,Y,Z
H. FINI
I. SCALE/(VALUE)

78

Fall J'Oint Computer Conference, 1968

this canonical form is stored in the reentrant stQrage area, by the calling prQgram. A reference tQ
that· area in reentrant storage had been previQusly
generated during the CQmpilatiQn prQcess, and
thus backward references tQ these surfaces are
permitted.
The algQrithms used to· generate the surface
canQnical:rorms resemble, as much as possible,
thQse cQntained in the standard APT system. The
fQrmat 'Of the canonical fQrms is alsQ the same as
in the APT system, with the exceptiQn that a circle
is defined 'Only as its center coordinates and radius,
but dQes nQt include the cQmpQnents 'Of the unit
nQrmal vectQr thrQugh its center. Each canQnical
fQrm is described by five wQrds in· CQre, the first
'Of which is a cQde describing the type 'Of surface,
and the remaining four being the canQnical fQrm.
FQr a PQint, the canQnical fQrm cQnsists 'Of the x,
y, z cQQrdinates; the fQurth wQrd is always zerQ.
FQr a line, the can'Onical f'Orm c'Onsists 'Of the
c'OmpQnents 'Of a unit n'Ormal vect'Or t'O the line,
and the absQlute value of the distance fr'Om the
'Origin tQ the line. The can'Onical f'Orm· 'Of a plane
is the same as that f'Or a line because in APT
usage a line is cQnsidered to be a plane· which is
n'Ormal t'O'the X-Y plane.
During the c'Ompilati'On 'Of a cutter m'OtiQn statenlent, code is generated f'Or moving the canonical
fQrm 'Of the named surfaces into the lowest available CQmmQn IQcatiQn. If the named drive 'Or check
surface is nested, the rQutine which generates the
canQnical f'Orm leaves this data in the IQwest available CQmmQn IQcati'On. TherefQre, the rQutine
which cQmputes the cutter center path can always
find the required surface data in, a specific CQmmQn locatiQn.
The determinati'On 'Of the prQper drive and
check surface intersection is handled by devel'Oping tWQ new surfaces (line 'Or circle) which are
parallel ('Or c'Oncentric) to the 'Original surfaces,
but displaced frQm them an amQunt equal tQ Qnehalf ,the cutter diameter (fQr cutter 'Offset c'OnditiQn). When the tWQ new surfaces have been determined, the pr'Oper intersectiQn 'Of these surfaces is fQund, and this exact intersectiQn PQint
is used as the cutter stopping PQint fQr that particular symbQlic instructiQn.
Since the present interactive APT system is
limited tQ only fQur surface types, there are 'Only
fQur intersectiQn prQblems which must be sQlvednamely,. the s'OlutiQn 'Of line drive surface tQ line
check surface, line drive surface tQ circle check

surface, circle drive surface tQ line check surface,
and circle drive surface tQ circle check surface.
Since the line and plane have the same can'Onical
fQrm, they are treated as 'One. The intersectiQn
solutions are fQund fQr any value 'Of cutter 'Offset,
and in the case 'Of a circle drive surface, the circular interpQlatiQn data is aut'Omatically cQmputed
to facilitate p'Ost processing. In the case 'Of the
circle drive surface tQ circle check surface, both
intersecti'Ons are cQmputed, a line is cQnstructed
through these points, and the prQblem is then reduced to that 'Of the circle drive surface t'O line
check surface.
The problem of cutter path generation is greatly
simplified 'Over the traditi'Onal APT cutter path
solutiQn(which is an iterative prQcedure) because
'Of the fact that the interactive APT prQceSSQr is
limited to tWQ dimensi'Ons. Since 'Only the intersection 'Of circles and lines need be solved, it is
p'Ossible to find an exact, cl'Osed form solution to
the cutter center path. The limitati'Ons of a program t'O 'Only tWQ-dimensi'Onal parts is nQt as severe as might be thQught because a great majQrity
of N/C parts are limited t'O 'Only tWQ dimensiQns.
Circular interpQlatiQn is perfQrmed whenever
the cutter is mQving al'Ong a circle drive surface.
The starting and ending PQints are used tQ determine the angle thrQugh which the cutter must
mQve, and the number 'Of steps needed tQ maintain the specified tQlerance is cQmputed. The intermediate p'Oints are calculate'd with a straight·
fQrward trigQnQmetric cQmputatiQn. TQlerance is
specified in the usual APT manner with a tQlerance statement. A default tQlerance 'Of .002 inch
is used if n'O t'Olerance is specified.
During executi'On, the APT, cutter center path
output is passed t'O a F'Ortran subrQutine which
generates 'Output in a f'Ormat acceptable f'Or pl'Otting 'On a stQrage 'Oscill'Osc'Ope 'Or a digital incremental pl'Otter. This f'Ormulated 'Output data. is
transmitted fr'Om the c'Omputer back t'O .the teletype c'Ons'Ole, then thr'Ough a hardware interface
tQ 'One 'Of the plQtting devices. 5 With the added capability 'Of 'On-line instantaneQUS plQts 'Of 2-dimensiQnal APT part prQgrams, errQrs of part de··
scriptiQn and cutter m'OtiQn can be quickly de·
termined by visual inspectiQn. That is, it iSPQs·
sible tQ type, analyze, and plot APT statements
a line at a time. Thus one can very quickly determine the validity 'Of 'One's part program and
drastically reduce turn ar'Ound time.
At the time of writing, no post processors have

Remote Processing System for APT Language
been developed for the interactive APT compiler,
but it would not be a difficult task to generate
them as needed. It is not likely that a post processor would fit in the same file as the interactive
APT proceSSQr due tQ the present program size
limitations of the RCA Basic Time Shared System.
TherefQre, it is expected that any post proceSSQrs
whi&l are develQped WQuld have tQ operate as a
separate autQnQmous prQgram. This "is not considered to be a limitation, hQwever, because one
can be reasQnably certain that his prQgram is
valid by using the interactive cQmpiler and instantaneous plotting capabilities.

Remote batch processing of APT
If one finds that the capabilities of the inter··
active APT processor do not fulfill his needs, it is
PQssible to use the remote terminal to cQmmunicate with the APT batch processing system. The
part programmer can create his symbolic source
file (in the time-shared envirQnment) in exactly
the same manner as described earlier. The interactive syntax analysis program is used tQ determine the validity of each statement, as it is
typed.
After analysis of each record, its symbolic
source code as well as the generated 'Object code
can .be deleted. The original APT program can
be saved 'On an auxiliary file for prQcessing by the
APT batch prQcessing system. Such a file would
cQnsist 'Of a series of card image records (72 characters maximum) which would then serve as input to the batch prQcessing APT system. The
prQcessed APT input file is headed by a pair 'Of
records which indicate that it is a file t'O be transferred frQm the time shared environment (via a
switching mQdule) tQ the Tape-Disc Operating
System (TDOS) mQnitor batch input tape for
subsequent prQcessing. Thus, it is necessary that
all contrQI recQrds be an integral part of the file.
As a part of system hQusekeeping, the ti~e­
shared files are checked periodically to determine
whether there is any data for transferral tQ the
TDOS monitQr batch input tape, and if SQ, the
data is cQpied withQut remQving it physically'frQm
the user's file iJ? the time-shared system. In 'Order
t'O aVQid redundant pr'Ocessing 'Of this data, a new
header recQrd is written by the executive rQutine,
indicating the date and time 'Of transferral.
At the cQnclusiQn 'Of APT batch prQcessing, the
user has several options available to him. He may

79

prQceed to the cQmputer center tQ examine his
'Output. If it appears satisfactory, he can then
ask tQ have the 'Output punched. If there was a
pr'Ogram errQr, he then must make corrections tQ
his SQurce file. He may, by using the time-shared
system's text editQr, make corrections t'O his s'Ource
file, and the job can then be submitted for another
run. Such a process dQes nQt save much turn
ar'Ound time, but dQes allQw one to cQmmunicate
with the batch prQcessing system thr'Ough phone
lines frQm a distant station, and does guarantee
a source prQgram which is free of syntax errors.
It is possible, if the 'Output file is nQt tQO large,
that the user may request his 'Output be switched
tQ his time-shared users file f'Or subsequent processing. In this mode 'Of Qperati'On the user may
examine the APT 'Output data (CLFILE), and
print all err'Or diagnQstics at his teletype. He may
also selectively scan the CLFILE in 'Order tQ determine if the prQper tQQI path has been generated.
Naturally, if an errQr was made, he may elect to
edit his data file, withQut reprQcessing the APT
jQb. It will then be suitable fQr PQst pr'Ocessing.
Once all APT prQceSSQr errQrs are eliminated
and postprQcessing is complete, the user has
several QptiQns available tQ him. He may request
that his tape be punched at the cQmputer center
and mailed tQ him, 'Or, if the jQb is 'Of a relatively
shQrt nature, he can ask that the 'Output be transmitted tQ him fQr punching at his teletype.
CONCLUSIONS
The system described in this paper has been develQped with' the idea 'Of prQviding an N/C part
prQgrammer with the capability 'Of pr'Oducing his
N/C tapes as quickly as PQssible. The interactive
APT system with its 'On-line graphic 'Output prQvides an N/C prQgrammer an extremely efficient
meth'Od 'Of generating and debugging his part pr'Ogram. It is nQW PQssible tQ prQduc.e a plQt 'Of an
APT prQgram as quickly as· 'One can type APT
statements at a teletype cQnsQle. PQst prQcessing
fQr a specific machine tool can be acc'Omplished
very rapidly after final debugging of the part program. Thus, the pr'Ogrammer has the ability t'O
sit at his cQnsQle (which can be lQcated in his
'Office), and produced an N/C machine tQQI cQntr'OI
tape within a matter 'Of minutes, rather than hQurs
'Or days .('Or longer), as is generally the case with
batch processing computer systems.

80

Fall Joint Computer Conference, 1968

REFERENCES
1 PNAUR
Revised report on the algorithmic language AWOL 60
Communications of the ACM January 1963
2 SABROWN CEDRAYTON BMITTMAN
A description of the APT language
Communications of the ACM November 1963
3 BTSS-JJ users manual

RCA Systems Programming Information Systems Divisio n
Radio Corporation of America June 1968
4 JTO'NEIL
Meta PI compiler/compiler
Private Communications
5 J C MILLER C M WINE
A simple display for characters & graphics
IEEE Transactions on Computers Vol C-17 ~ 0 5 May 1968

Software compatibility: What was promised, what
we have, what we need
by JOHN A. GOSDEN
The MITRE Corporation
Bailey's Crossroads, Virginia

Varieties of compatibility

INTRODUCTION

In default of formal definitions, it is useful to
attempt to describe a few of the properties of compatability.

S'Oftware compatibility is an extremely complex
and pervasive topic. Unfortunately it is not well
defined nor well documented. To say anything
useful within the space and time constraints we
must confine ourselves to generalities and readily
admit in advance that there are many exceptions.

Kinds of compatibility
There are three usefully distinct kinds of compatibility:

What Is software compatibility?

(a) Identicat-i.e., one thing is exactly the
same as another, or two things can interface directly;
(b) Convertible-i.e., a Rimple set of algorithms exist for two-way translation. If
we translate "X" to "Y" and back to
"X" then the resulting "X" is identical
to the original "X";
(c) Tram lata ble-i.e., some complex process
is needed for translating the output of
one thing to the input of another.

Many people confuse compatibility (which is a
state to be achieved) with standardizati'On or commonality (which are techniques by which compatability may be achieved). In default of being
a.ble to define the terminology formally, we define
software compatibility by examples.
If we assume that "software" implies "not
hardware," then we can implicitly define software
compatibility as:
(a) common man/system interfaces-e. g.,
the abiltiy to move a user, programmer,
or operator from one type of computer
to another without further training;
(b) program exchange-e. g., the ability t'O
move a program from one type of computer to another without any changes;
(c) data exchange-e. g., the ability to send
data from one program to an'Other with
only automated changes;
(d) program pooling-e. g., the ability to assemble, combine together, various subprograms from diverse s'Ources into. one
program;
(e) data pooling-e. g., the ability to combine diverse source files into an integrated data base.

Degree of (how much) compatibility
There are only two pragmatically useful degrees
of compatibility:
(a) complete, or algorithmic-can be fully
automated
(b) close, 'Or nearly algorithmic-can be automated except for a few exceptions.
A complete shnulator and a COBOL-to-machinecode compiler are examples of (a).
EXODUSl and LIBERATOR2 are examples of
(b) ; they translate most of a program from 'One
computer to another and flag some exceptions that
must be hand-coded.
81

82

Fall Joint Computer Conference, 1968

Extent of compatibility
The extent of compatibility can be characterized
in two ways:
(a) Entire-i.e., everything in "X" is compatible with "Y";
(b) Limited-Le., a set of limiting but acceptable conventions exists such that
anything in "X" conforming to the conventions is compatible with "Y."
A simple example is that for a program at installation "X" to be transferable to "Y" it must usually
satisfy two criteria:
(1) conform to a POL standard-both "X"
and "Y" accept an identical programming language;
(2) conform to a set of conventions, such as
limits on storage space and peripherals
needed.
We call this limited compatibility from "X" to
"Y."
Directions of compatibility
Direction of compatibility can be characterized
in three ways (assume "Y" represents a greater
capability than "X") :
(a) Upward--i.e, there is "entire" compatibility from "X" to "Y", but "Y" to "X"
is unspecified.
(b) Downward-i.e., there is "entire" compatibility from "X" to "Y" and "limited"
compatibility from "Y" to "X";
(c) Complete-i.e., there is "entire" compatibility from "X" to "'Y" and "Y" to "X."
Compatible zones
All the previous characteristics were pair-wise
considerations of compatibility. A more useful
concept is a compatibility "zone." A compatibility
zone is a collection of ED·P centers all of whom
are downward compatible with some notional
"zone model." The zone model is a set of conventions such that anything-be it a program, a file,
or a language-that conforms to the zone conventions is as a result, automatically entirely compatible with all other members of the zone.
Now we can readily see that any EDP center
is a potential member of many zones, e.g.,

(a) one computer at the center
(b) two different makes of computers at the
center
(c) three of the same make of computer at
different centers
(d) all computers in one corporation
(e) all computers in SHARE
(f) all computers in Air Force Logistics
Command.
In general, the more extensive the,zone the more
restrictive the conventions, and for each thing developed, a tradeoff decision must be made between
the extent of compatibility desired and the consequent restrictive conventions to be followed.

lVhat were we promised?
In this paper we are restricting ourselves to
promises made by those who thereby commit
themselves to deliver-we are excluding prophets
who only make predictions. Searches of the literature showed that few of these promises are recorded in print, and the best evidence for them
lies in the lack of explicit disclaimers. Overall we
were not promised a great deal and the promises
were largely implicit rather than explicit. Let us
number the promises Pi.
Common man/system interfaces
With reference to common man/system interfaces, we were promised that, using POL's, we
would:
P1-not have to learn a new language when
we moved to a new computer;
P2-be able to use the same language on
many computers with no relearning;
P3-have upward compatible subsets of each
language that would be available on different sized computers.
Now these promises were not all-embracing, and
not all were meant to cover each POL on all computers; the general concept was clear, but the
scope was vague. P1 and P2 were made in the
late 50's and P3 during formal standardization
during the early 60's after COBOL "electives"
caused many problems.
Note that we were not promised interfaces for:
(a) operating systems (control input or error messages)(b) diagnostics (variety available or format)

Software Compatibility
(c) utilities (facilities available or control
input)
(d) on-line dialogs (semantics 'Or syntax).

Program exchange
With regard to program exchange, a general
search of the literature shows three. interesting
things. First, except for a recent study by the
author that also discusses commonality,S nearly all
the literature cites standardization and conventions as the basic ways to 'Obtain compatibility.
Second, most authors, notable A. Holt' in 1960,
SHARE5 in 1961, and more recently Morenoff and
McLean 6 in 1966 have explicitly concentrated on
program exchange as being the essence of software c'Ompatibility-although Morenoff and McLean also mention data exchange as well. These
people have looked to computer independent languages as a solution. Third, the developers and
proponents of common programming languages,
notably Bromberg7 and Heising, 8 have noted that
the prime objective is to simplify programming
and that they only offer a first step to compatibility.. Sammet9 also notes that the goal is program compatibility, not automatic transfer, and
certainly not data tapes.
Overall we were apparently promised a great
deal:
P4-that a progr~m written in a POL on one
type of. machine could easily be run on
a different type by using a comnion
source language program and the appropriate compHer on each computer
type.
We are excluding the promise of running the
same object program on several computers of the
same family because that is hardware compatibility.
There' is no doubt that many people thought
such a promise existed and their disappointments
are recorded many times. As an example, see
G'Ordon.10 However, the promises one can find in
print are a little vague: a statement by Rosenl]. in
1964 of a requirement that the first Philco 2000's
have a compiler that would accept 704 FORTRAN
substantially without change; a loose statement
by Luebbert and Colloml2 in 1959 that compilers
will be available to automatically translate a program "for any computer desired"; a mention by
ShawlS in 1961 that suggests the only cost of mov-

83

ing programs coded in JOVIAL from one computerto another are those of writing a new compiler; an expectation by Schwalbl' in 1963. that
GECOM programs could, with no change, be compiled on future GE computers. On the other hand,
RCA 15. in 1960 clearly stated that COBOL only P\lt
them into a better position to cooperate in achieving compatibility.
One major problem about program exchanges
was that although the caveats and conditional
clauses were explicitly stated 7,8,l6 as early as 1960
and again in 1964, they were not remembered. The
concept of conventions for zones of compatibility
was not developed and emphasized. In 1961,
SHARE did make one attempt/ but Gremsl7 and
Sanborn18 immediately criticized it as grossly inadequate, and the false notion of a kind of "universal" zone became a myth of our time.

Data exchange
With reference to data exchange, we were
promised that we could:
P5-send a file from one program to another
program of the same kind (typically
COBOL)- and use a common data description for both within the same environment.
We were not promised any equivalent ability for
data between programs in the same language on
different computers let alone for data between
programs produced in different languages, although it was stated to be feasible and desirable
by Mahoney1.9 'Of GAO in 1964.
Program pooling

With reference to program pooling, we were
promised that we could:
P6-combine various subprograms written in
a comm'On POL 'Or in assembly language.
We were not promised that we could mix routines
written in different POL's.

Data pooling
With reference to data pooling, we wer.e promised that we could:
P7-merge, amalgamate, and subset files
within one POL family.

84

Fall Joint Computer Conference, 1968
program pooling, being restricted usually to one software family, with the major exception being an "escape" to assembly language. We have some partial
solutions in combining tasks into·a job,
but these are severely limited by the
lack of compatibility in data exchange.

We were not promised that we could do this with
arbitrary files.
Summary of promises
The interesting thread through all the promises
is that they tended to promise only "intra-software-family" compatibility, where a software
family is, for example; "all programs written in,
and the files described in, COBOL."
What do we have?

Common man/system interfaces
It does seem that the basic promises concerning
c.ommon man/system interfaces have been largely
fulfilled.

P1...,.-We do have widespread c'Ompilers for
COBOL and FORTRAN, and others
coming along slowly, but at least improving every day.
P2-We do have sul?stantial compatibility;
various COBOL's generally do look alike.
P3-Weare getting reasonable subsets.
Program exchange
P 4-Weare only just beginning to be able to
exchange programs-there is a long way
to go. Even today papers such as those
by Morenoff and McLean6 are still suggesting conventions for zones of compatibility. Only a few groups such as
Westinghotlse 2o ,2 1 have established such
zones by careful planning and management.

Data pooling
P7-We are able to merge, amalgamate, and
subset files within a software family. To
construct a data base from diverse· files
it is necessary to construct individual
file converters, but· most data base systems are limited in the structures that
they can accept.
TVkat do we need?

To put it simply, we need all the five items listed
earlier:
(a)
(b)
(c)
(d)
( e)

common man/system interfaces
program exchange
data exchange
program pooling
data pooling

Most of the important ones are missing because
we did not anticipate the need. What we were
.
promised was largely
"intra-software-family compatibility·'
and we are moving towards it with reasonable
speed. What we were not promised, but now see
that we need, is
"!nter-software-family compatibility."

Data exchange
P5-In some cases, we can exchange files
within a software family on similar systems; unfortunately, physical files are
not operating-system-independent, and
this is a major problem. Even so, in
cases such as Westinghouse21 the exchange is based upon prior agreement
of formats. In other cases, at present it
is necessary to build a converter for each
file, and no general purpose converter
exists for any pair of s'Oftware families.
Program pooling
P6-We only have a very limited amount of

This divides into four problem areas:
(a) language compatibility-the general
ability to mix statements or procedures
written in different programming languages (e.g., COBOL statements in a
data management system query) ;
(b) data exchange-the sending of files from
a program of one family to one of an'Other family (e.g., a FORTRAN program using a COBOL file) ;
(c) operating system compatibility-similar
and compatible services expected by and
provided to each software family and to
each human family-operators, programmers, and users;

Software Compatibility
(d) data pooling-the ability to build an integrated data base from diverse sources.
Language compatibility
If we want to be able to mix routines written in
different languages we have two possible solutions.
We need either:
(a) one comprehensive language which covers all needs so that mixtures are not
necessary, or
(b) a harmonious (compatible) family of
languages.
Alternative (a) is unattractive. Some steps have
been taken in that direction. PL/I is an amalgam
of the scope of COBOL and FORTRAN, but we
agree with Barton22 that languages will proliferate. Proliferation will .occur in two dimensions at
least:
(1) languages for special groups of users;
(2) languages for different levels of sophisti-

cation of users.
To try to blend all these is likely to lead to a
"kludge." All these points were recognized by
SHARE23 in 1958 when they published the UN COL concept, which they noted had "been around"
since 1954. This provides a mechanism upon which
to build an unlimited number of compatible languages.
Data exchange*
There is a growing need for data exchange, particularly the passing of files of data between programs that were produced independently. This
will be needed in the development of computer networks and data bases; for example, a head office
installation collecting files from various divisions
of a corporation to build a data base. Both the development of formal and informal computer networks as well as the economic feasibility of large
data bases are favoring the development of arrangements for a considerable volume of data exchange, whether directly over communication
systems or by the dispatch of reels of tape and
boxes of cards. These are very significant areas
of growth that are just beginning to emerge in
commercial EDP and are already creating problems within the Federal government.
·Th~ text of this section is largely drawn form referenee 24.

85

The development of data interchange is
straightforward when the correspondents have
agreed on the format, but where there has been
no prior agreement, conversion usually involves
considerable manual intervention. Some typical
problems are that:
(a) The sender's format may not be specified
rigorously and an informal description
may have to be debugged.
(b) The sender's format may not be expressible in the receiver's system.
(c) The sender's format descriptions may be
embedded in the program.
(d) The format in the sender's system may
vary from rec'Ord to record and be embedded in the data.
Any of these problems may arise when either
an existing application is converted to a new system, or a new member of a cooperating network
has a system different from that of any existing
member.
There are two basic problems:
(a) Few existing systems have any ability
to deal with a new format automatically,
and those that do are limited to data described in the same system.
(b) The number of different, and often incompatible, ways of describing data is
increasing; e.g., Format statements in
FORTRAN, Data Description in COBOL, COMPOOL in JOVIAL, FFT's in
FFS.
Any solution to this pr'Oblem should not restrict
participants in the use, within their own local
system, of any internal data structure they like
or any programming or query language they like.
Therefore we ·need a standard data description
language for data exchange. It is expected that
systems should interface with a single way of describing data for interchange and provide conversion processes in their interfaces. If a suitable interface is to be developed, we will not want to
standardize formats, which would be absurd, but
we would want to standardize ways to describe
formats. We also will want to attach the data descriptions to the data, so that the transmission 'Of
both data and its description can be performed
without manual intervention.
A data description language for data interchange does not principally have to be read and

86

Fall J 'Oint Computer Conference, 1968

understood by humans. It can be thought of as a
complicated coding to be generated and interpreted by the interface modules of systems in a·
network. In a well-designed system a user would
describe data .in the form provided for local use,
and the system would translate to data interchange conventions. Therefore, the data description language should be generally compatible with
data descriptions in current programming languages. Later, developments in programming
languages may be influenced by a desire to remain
compatible with data interchange conventions.
Operating system compatibility

Operating systems differ because they interface
closely with those parts of hardware that vary a
great deal, and because there is still a great variety among operating system design philosophies.
As a result, compatibility among operating systems provided by different suppliers is minimal.
There are some rare exceptions: at North American Aviation, the UNIVAC 1107 operating system
was modified to provide control card compatibility
with the IBM 7090; and currently, Lockheed is attempting to develop a sUb-executive to provide a
common input-output interface between COBOL
.programs and future operating systems.
The solution is to develop a standard operating
system specification. We need to concentrate on
the external standards that have a primary effect
upon the compatibility goals; they include:
(a) System Control Cards
(b) Message Formats
( c ) Calling Sequences
( d) . Security Procedures
(e) Label Conventions.
However, the future for operating system standardization does not look optimistic and USASI
standards are not likely to be agreed upon and
implemented before the next generation of computer systems. It was only as recently as 1967
that Halst~ad25 noted the need for operating-system-independent programs. The only current activity is that M. Perstein of s.ntC has recently begun to try to determine if there is sufficient interest in operating system standards to form a
USASI working group. On the other hand, there
has been some progress in a few of the basic interfaces (e.g., the adopted, but not yet widely ac-

eepted, ASCII code ;26 and the drafted, but not yet
approved, USASI standard for labels. 27
The ideal long-range (fourth generation?) solution is to have a standard machine-level interface provided to the outside world by an "extended
computer.·" An "extended computer" is the hardware plus the operating system and any microprograms or read-only storage, and is one level of
the extensible machine concept of Goodroe and
Leonard. 28 This could be the long awaited "UNCOL, "23 or the standard machine language advocated by Barton. 22
Data pooling
We are right in the middle of a series of developments that are addressed to the concept of data
pools. These are the data management systems.
Unfortunately they have given little attention as
yet to the problem of amalgamating varieties of
existing data files except by special converters
built for each specific file.
There are two possible solutions to this problem:
(a) build a set of converters for each data
management system-each data management system needs two for every other
system with which it wants to interface;
(b) use a common data description language
for data exchange.
We favor the second alternative. The next need
is to ensure that each data management system
can handle all possible data structures. A recent
CODASYL report29 addressed this topic in a
straightforward manner, and Mealy30 points out
the need for .later binding and more explicit representation of data description in programs. A
data description language would provide a means
to send a self-describing file to another installation, the file might include code tables, format descriptions and pointers. It is the "internal" specification discussed by Moores. 31 His external format is for man/machine use but we believe more
than one standard will be needed for data description by men, just as many programming languages will be needed.
Summary of needs

What we need is a radical change in software
architecture to handle all these problems. One

Software Compatibility
obvious solution is separate explicit specifications
of procedures and data:
(a) a standard "extended computer" interface (UNCOL);
(b) a standard data description language for
data exchange.

REFERENCES AND BIBLIOGRAPHY
1 MECONWAY
Proposaljoran UNCOL
CACM 110 p 5 October 1958
2 F J CORBATO et al
The compatible time-sharing system
MIT Press Cmabridge Mass 1963
3 j A GOSDEN et al
Achieving inter-ADP center compatibility
The MITRE Corporation MTP-312 May 1968
4 A HOLT
Overall computational control and labelling
CACM 311 p 614 November 1966
5 G F RYCKMAN
Operational compatibility of system.s-Conventions
CACM 46 p 266 June 1963
6 E MORENOFF J B McLEAN
An approach to standardizing computer systems
Proc ACM 22nd Nat Conf p 5271967
7 HBROMBERG
What COBOL isn't
Datamation 7 9 p 27, September 1961
8 WPHEISING
FORTRAN: Compatibility and standardieation
Datamation 10 8 p 24 August 1964
9 JESAMMETT
More comments on COBOL
Datamation 7 3 p 33 March 1961
10 RMGORDON
COBOL and compatibility
Datamation 10 '7 p 47 July 1963
11 SROSEN
Programming systems and languages-A n historical survey
AFIPS Conf Proc 25 SJCC 1964 pI Spartan Books
12 WFLUEBBERT PWCOLLOMJR
Signal Corp research and development on automatic programming
of digital computers
CACM 2 2 p 22 February 1959
13 C J SHAW
JOVAL
Datamation 7 6 p 28 June 1961
14 JSCHWALB
'
Compiling in English
Datamation 9 7 p 28 July 1963
15 RCA Letter to Editor
Datamation 6 4 p 35 July/August 1961
16 CAPHILLIPS
Letter to Editor

87

Datamation 6 3 p 24,MayjJune 1960
17 MGREMS
Letter-Standards conventions
CACM 49 P 365 September 1961
18 T G SANBORN
Letter-Standards conventions
CACM 4 9 p 366 September 1961
19 E J MAHONEY
Federo,l E DP
Datamation 10 1 P 26 January 1964
20 Westinghouse Electric Corp
COBOL Programming TIPS
Management Systems Department Apri11967
21 WBFRITZ
Computer change at Westinghouse Defense and Space Center
AFIPS Conf Proc 31 FJCC 1967 p 581 Thompson Books
22 RSBARTON
A critical review of the state of the programming art
AFIPS Conf Proc 23 SJCC 1963 P 169 Spartan Books
23 J STRONG et al
The problem of programming communication with changing
machines
CACM 1 8 p 12 August 1958
24 JGOSDEN
Suggested standards for data description for use in data
interchange
PrepareJ for D8ASI, X3.4 and reproduced in Appendix D of
reference 3 June 1967
25 M H HALSTEAD
Machine independence and third generation computers
AFIPS Conf Proc 31 FJCC 1967 P 587 Thompson Books
26 USASI
Standard code for information interchange
USAST X3.41967
27 USASI Proposed USA Standard
Magnetic tape labels for informo,tion exchange
CACM 10 11 p 737 November 1967
28 J R GOODROE GF LEONARD
An environment jor an operating system
Proc ACM 17th Nat Conf 1964
29 Report to the CODASYL COBOL Committee
COBOL extensions to handle data bases
January 1968 Reprinted in SIGPLAN Notices 3 4 April 1968
30 GHMEALY
Another look at data
AFIPS Conf Proc 31 FJCC 1967 P 525 Thompson Books
31 J L LITTLE C N MOORES
Standards for user procedures and data formats in automated
information systems and networks
AFIPS Conf Proc 32 SJCC 1968 P 89 Thompson Books
32 H BROMBERG
COBOL and compatibility
Datamation 7 2 p 30 February 1961
33 JBROOKS
Letter to Bureau of the Budget Director, Schultz
CACM 111 p 55 Janua.ry 1968
34 A LIPPITT
COBOL and compatibility
CACM 55 p 254 May 1962

Interactive systems-·-Promises,
present and future
by JULES I. SCHWARTZ
SY8tem Development Corporation

Santa Monica, California

INTRo.DUCTION
In recent years, "interactive" systems have become. synonymous with "time-shared" systems for
n10st people. Time-sharing has been emphasized
by those interested in providing interactive (online) access to a computer. On the other hand,
there are a number of other kinds of systems that
provide interactive service. First, there are systems like SAGElo and the airline reservation systems (Ref. 26 , for example). These are single-purpose systems providing the capability for users to
communicate directly with a computer to accomplish a well-defined task. Then there are the numerous third-generation operating systems, generally considered to be multiprogrammed systems.
There is an increasing tendency for these systems
to provide an interactive capability t9 some set of
users.
These multiprogrammed systems provide a
number of interesting examples of interactive application programs. But generally~ they limit the
truly interactive use to one user or one application
at a time; that application receives response satisfactory for interactive activity, but little opportunity exists for others to do the same. These systems also tend t'O limit the core storage available
tC' a given user, so that operation on small configurations is impractical. Also, the number of
simultaneous programs is limited by core memory
on most multiprogrammed systeIlls. Time-sharing
systems, on the other hand, attempt to provide a
certain "aura" of user orientation which usually
doesn't exist on typical multiprogrammed systems.
'rime-sharing systems are designed to serve the
on-line user (although off-line service is also provided by most time-shared systems today). Con-

<

89

sequently, there is an attempt to orient the services and communications to the person at the console, making them concise, forgiving, and easy-tolearn, while muItip·rogrammed systems tend to
base their interactive access on the 'Off-line methods normally asociated with batch-processing systems.
There are, of course, exceptions to the generalizations mentioned above. The Michigan TimeSharing System (MTS) ,36 which was derived
from a standard multi programmed system, now
services 30 or m'Ore simultane'Ous users in what
appears to be a normal interactive fashi'On. Other
systems (e.g., Allen-Babc'Ockl) , have adapted
OS/360 in such a way that the interactive useralthough limited in capability-apparently has
the interactive characteristics provided in m'Ore
complete time-sharing systems, while the basic
OS/360 system services non-interactive pr'Ograms.
Essentially, the major difference between timesharing and 'Other multipr'Ogrammed systems lies
in the meth'Od of scheduling. The c'Oncept of the
"time-slice" is' characteristic of most time-sharing
systems, whereas the 'Other operating systems rely
on pri'Orities to provide rapid service t'O a subset
of users. Als'O, most time-sharing systems rely on
"swapping" t'O pr'Ovide access to' many programs
'Of up to full physical core size. (IncidentaIiy, the
systems mentioned in the preceding paragraph
are n'Ot swapping systems.)
In summary, time-sharing systems concentrate
on the interactive user, and have been in the f'Orefront in providing this service. Consequently, this
discussion will c'Oncentrate mostly 'On the devel'OPment 'Of time-sharing systems per se, while n'Ot
overlooking the fact that interesting work 'On in-

90

Fall Joint Computer Conference, 1968

t(lractive activities has gone on in non-time-shared
systems. In fact, future interactive computing
services may be provided by either.

Promises
The early ideas and hopes

It is always difficult to recount the history of an
idea. In this case, some of the first ideas are recorded. In 1959, Strachey hypothesized a timesharing computer and operating system. 34 In
1962, McCarthy fQresaw: "We can envisage computing service companies whQse subscribers are
connected to them by telephQne lines. Each subscriber needs to pay only fQr the capacity that he
actually uses, but he has access tQ all programming languages characteristic 'Of a very large system."21
In 'One of the first papers 'On an operatiQnal timesharing system, CQrbato et al. 5 stated that a timesharing system of the kind described in their paper would "improve the ability to prQgram by one
'Or two 'Orders 'Of magnitude" and "several new
forms of computer usage" WQuld be 'Opened up.
This paper alsQ discussed SQme 'Of the prQblems
aSSQciated with building such a system, including
file handling, debugging techniques, mingling 'Of
foreground and backgrQund, and scheduling. AIthQugh the paper was generally 'Optimistic (based
'On some limited experience), it ended-interestingly enQugh-with a warning: "it is essential
fQr future system design and implementation that
all· aspects 'Of time-sharing system prQblems be
explQred and understQQd in protQtype fQrm 'On
present computers so that majQr advances in CQmputer organization and usage can be made."
WithQut dQubt, 'One 'Of the first and mQst influential papers 'On the subject was presented by
Licklider in 1960. 18 His basic theme was that in
solving prQblems, men do SQme things well, such
as developing hypotheses, while cQmputers are
much better at the lengthy computational tasks.
By fQrming a partnershill-a symbiotic relationship-they can help each other and thus speed the
solution 'Of problems. He stated, "It seems reasonable to envision, for a time 10 or 15 years hence,
a 'thinking center' that will incQrporate the functions of present day libraries together with anticipated advances in information stQrage and retrieval and the ,symbiotic functions suggested
earlier in this paper. The picture readily enlarges
itself into a network of such centers, connected to

one another by wide-band cQmmunication lines
and to individual users by leased-wire services. In
such a system, the speed of the computers would
be balanced, and the CQst of the gigantic memories
and the sophisticated programs WQuld be divided
by the number of users." In sum, he discussed the
equipment and programming concepts which hs
thought would assist the human in his contact
with the computer.
In addition to these papers, numerous other
statements have been made 'On the future of timesharing. To mentiQn but a few: "All computing
will be on-line by 1975," "Ninety percent of all
computing will be done on-line by 1970," and
"checkQut will be 100 'Or more times faster 'Online"-all made possible by time-sharing.
The first systems

In 1963, the ideas of some of the early papers
began to be demQnstrated. At MIT~6 SDC30,31
and BBN, 3 time-sharing systems that were more
than demQnstration vehicles came into existence,
and communities 'Of users began to form. The
number of simultaneous users permitted on systems such as these (using second-generation hardware) ranged from 5 tQ about 30, although some
predicted that a time-sharing system could serve
100 users on the IBM 7090. 3
The next steps
It seemed easy to extrapolate to hundreds of
users once the hardware had been built specifi<;ally
for time-sharing. Consequently, preparation for
third-generati'On time-sharing machines began in
earnest in 1964. Dennis 8 described a scheme
whereby names-representing "pages" rather
than arbitrary bl'Ocks-would be associated with
locations thr'Ough associative hardware. Pages
would be part of a larger memory hierarchy called
"segments," sufficiently large so that expanding
dynamic requirements for data space would not
require c'Ontinual reallocation of space. Implementati'On 'Of these hardware c'Oncepts was begun on
several major computers (GE 645 and IBM 360/
67). In theory, they WQuld ease the problems of
storage management for large-scale time-sharing
systems by prQviding automatic access only to
those portions 'Of data space that were required,
and by providing considerably more flexibility in
the mapping 'Of larger random-access storage 'Onto
core storage~

Interactive Systems-Promises, Present and Future
By 1965, these hardware systems .were part of
rather ambitious plans to provide the next major
steps in large-scale general-purpose time-sharing
at MIT and IBM. MIT embarked on the development of the MULTICS System. 7 This system
promised-by 1966 or 1967-to be the first version of a true "computer utility," whjch would
serve several hundred to a thousand simultaneous
users solving major problems on the GE 645
(Ref. 9 ) . IBM followed soon ~fter with plans for
a similarly ambitious effort ./on the ~BM 360/67
(TSS). In addition to the /addressi:dg hardware
described earlier, both of th~se machines were the
first time-sharing computefs that would contain
dual processors-this is, essentially balanced systems where more than on~ control and computing
element would have equal access to the total machine. This dual capability.was to provide more
power to time-sharing systems, which until then
were severely limited in computing power.

91

ably several hundred experimental or research
systems. 37 This is particularly surprising since
most computer manufacturers-who traditionally
lead the field in operating system developmenthave tended either to ignore, -or treat as subordinate, the development of time-sharing. Several
attributes of these systems can be isolated, but the
general picture is rather incoherent. Relatively
few standards apply, and an examination of these
systems shows that the definition of time..;sharing
is by no means simple. (See Ref. 32 for further discussion.)
Commercial· time-sharing

Most commercial services now are effectively
one-language systems: GE's BASIC, Allen-Babcock's version of PL/I, BBN's TELCOMP
(JOSS), and IBM's QUIKTRAN· (FORTRAN)
are examples of such systems. Other systems
stress one kind of application-for example, KEYDATA for business applications, and the IBM
Special-purpose systems
Text Data Service.
It also appears that few large-scale generalOne other important area in time-sharing hispurpose systems have made the grade yet on a
tory should be discussed at this point. While the
commercial basis. One system that has at least
initial efforts at the development and· use of largesome general-purpose attributes is the SDS 940
scale general-purpose time-sharing systems were
under way at places like MIT and SDC, efforts in
Time-Sharing System, which began as an experithe development of special-purpose systems taimental vehicle at the University of California at
Berkeley, but is now in commercial use at a numlored to a problem-oriented user environment were
being pursued (frequently on relatively small
ber of installations. Other than the fact that the
computers). One of the first was JOSS,33 which . computer is rather small and file capacity is
limited on this system, the 940 Time-Sharing Syswas a system devoted exclusively to the solution
tem shows promise that a multi-purpose system
of computational problems by people unsophistican be commercially successful. The G E BASIC
cated in computer usage. Another was BASIC,15
System,15 which started as a university and onean extremely s!mple but reasonably efficient syslanguage system, is now also beginning to offer
tem for handling small computational problems.
These systems promised to be an effective tool
multi-language facilities commercially.
within a prescribed problem area for a number
Laboratory systems
of simultaneous users.

The present
Dr. Licklider, who has been a great stimulus in
the field of time-sharing, recently stated informally that he was surprised and pleased by the number of current time-,sharing systems, but was disappointed at the lack of coherence in them. It is
interesting to note that in the past few years the
number of systems labeled "time-sharing" has
increased from around five experimental systems
to about 30 different commercial systems operating
in 70 installations (as of early 1968), and prob-

There are still a large number of systems in
the laboratory. Systems like MULTICS and
IBM's TSS, which were presumed by many to
represent the next major step in large-scale interactive computing, still haven't fulfilled their promise. At this writing, MULTICS is just beginning
to work in a minimal way, and the IBM system
is being used in scattered installations with considerably fewer simultaneous users and services
than one might have envisioned for this time. The
reasons for the relatively slow progress of these
systems are many. For one, they require large

92

Fall Joint Computer Conference, 1968

programming system efforts on relatively new
hardware. These kinds of efforts are always much
slower in production than smaller efforts. Also,
they are attempts at order-of-magnitude improve.ment in quantity and quality of service. Whether
these hardware and software designs will result
in dramatically improved performance is, of
course, a subject of ~ebate at this time. Theoretically it seems possible, but perhaps the previously noted admonition by Corbato et al. 5 should
be re-examined in assessing these systems. An
attempt at assessing the effects of hardware and
software decisions on efforts such as these was
made by Nielson.:l 3 One result of his study was
the (not unexpected) finding that there are a considerable number of parameters affecting the performance in complex systems like these, and
thorough simulations of them ar~ in themselves
quite difficult, but should be a requirement.
Other reasonably general systems are -n'Ow operating on third-generation computers at the University of Michigan, Lincoln Laboratory, Livermore Laboratory, 8.DC, and the California Institute of Technology. These systems can handle
about 30 'Or more simultaneous users on singleprocessor configurations.
In suni, then, we have not yet achieved orders
of magnitude improvements in service over that
offered in the early days of time-sharing. The
original systems at SDC and MIT are- still running, and still approximate the current limit on
capability of large-scale general-purpose timesharing systems. Many of the special-purpose
c.ommercial systems, however, now serve between
40 and 100 simultaneous users on reasonably small
computers. Thus, it seems quite possible that populations 'of many hundreds could share a large computer where· the application was limited.

Applications of interactive systems
So far we have discussed the progress of timesharing in terms of raw power (i.e., amount of
service provided). It now remains to discuss the
ways in which interactive systems have been used
in recent years. Even though the amount of service provided is imp'Ortant (particularly commercially) , a more interestin~ aspect of these systems
concerns the kind of service provided. Under timesharing, certain kinds of processing can be accomplished which would not be economically possible on systems that do not take advantage of the

lag in human response time to service other users'
computation requirements. In the last few years,
a wide-ranging set of interesting applications
have been exercised on general-purpose timeshared systems. These include game-playing, online simulations, computer-assisted· instruction, retrieval of information from data banks, and numerous others which take advantage of keyboard
devices. Experimentation with devices other than
keyboards on some general-purpose systems has
resulted in a number of interesting applications,
including examination of three-dimensional figures through rotation on a display, graphical data
analysis and plotting, real-time recognition of
handwritten characters and mathematical expressions, and hypothesis-testing utilizing a display to present the alternatives and relative
w-eights of factors.
Some operatink systems have been devoted to
specialized interactive applications. For example,
in the APEX System 20 at Lincoln Laboratory, the
structure, language, and data forms of the system
are oriented toward the construction of a variety
of graphical applicati'Ons. Applications on this
system include aids to drafting, electronic component design, analysis of three-dimensional figures and the hidden line problem, and the analysis
of electronic circuits and program flo,v diagrams.
For another example, Jacks 1.4 has reported on an
interesting applicati'On of an interactive system to
automated design. Several simultaneous users
were able to utilize displays in the design and
study of automobile components.
Earlier in this paper we quoted Licklider's view
that by 1975 n~tworks of interactive computers
would be available to service users. How far have
we progressed in this area? Marril and Roberts1.9
have written a rep'Ort on the current state of
networking. By actual count, there have been few
real applications of the networking concept in conjunction with interactive computing. Experimental two node networks have been formed between various installations. Three examples include SDC's Q-32 TSS and SRI's CDC 160A; the
Q-32 and Lincoln Laboratory's TX-2; and the
TX-2 and a PDP-9 in Washington. The concept
generally demonstrated was the use of a small, remote, on-line device-driver utilizing a distant large
computer forc'Omputing ,power-a concept also
used in other installations, but not under the "network" label. The TX-2 to Q-32 link did go fur-

Interactive Systems-Promises, Present and Future
ther, however. In this case,. programs running on
one computer were able to invoke and run programs on the other, thus permitting quite incompatible computers to share capabilities (for example, a LISP compiler on the Q-32 was used by
a display program running on the TX-2).
Thus far, slow progress has been made in sharing information among a network of interactive
computers, which would provide a massive library
at a user's fingertips .. Many reasons exist for this
slow progress in the information-network field.
The handling of information itself (even on one
computer) is a subject of considerable technological complexity. Also, experiments in networking
are expensive, requiring several or more computersand high communication costs. Few agencies are willing to investigate an expensive concept until it is, in fact, proven economical.

Evaluations
Like most new concepts, interactively-oriented
systems have generated their share of controversy.
One area of debate lies in the pure "economics"
of running such systems. In order to sustain a
large number of simultaneous user' programs with
rapid response times, one must be willing to pay
some overhead in swap-time and program management (and perhaps in equipment) when operating under time-sharing; such overhead is not
required in more sequentially· oriented systems.
rrhe amount of overhead is a subject of some question and, of course, varies widely on different
systems. Some early quantitative studies of this
subject were made by Scherr29 and Fine and
McIsaac. 11,22
For several reasons, it is hard to draw firm conclusions from studies such as these. For one thing,
there is little basis on which to compare the "efficiency" of a particular time-sharing system with
~l. non-interactive system. There are few quantitative studies of time-sharing, but there are probably fewer (relatively) for other kinds of systems. Comparing raw percentages of the time in
object program state on a time-sharing system
(such as the 60-70 percent demonstrated for the
Q-32 TSS) versus the efficiency of a particular
batch-processing system (such as OS/360)
doesn't really give much insight into the problem.
Furthermore, it is argued by some that the gain
in productivity using a computer interactively is
so great that a considerable loss in "computer

93

efficiency" can be tolerated. This theory has been
generally accepted, but since the early days of
time-sharing the feeling that interaction with a
computer greatly increased productivity has been
primarily intuitive. There have been some attempts at testin~ this hypothesis over the last
few years. For· the most part, these attempts
have consisted of experiments comparing program
production and problem-solving under time-shared
and non-interactive systems.
A discussion of five such studies was presented
by Sackman. 28 Attempting to summarize here
what is in effect a summary of a controversial set
of experiments is obviously precarious, but a few
of the conclusions given by Sackman might be
mentioned. Using interactive systems, fewer
man-hours but more computer time is utilized in
solution of problems. (The differences demonstrated in these experiments are much smaller
than the orders of magnitude predicted in the
early days.) User preference for interactive over
conventional off-line operation was evident. Also,
in many cases individual subject differences in the
experiments overshadowed any differences in the
modes of computer operation. Sackman also came
to other conclusions, and .made a plea for improvements in methodology in several areas which
would make future experiments more meaningful.
It should be mentioned that there are some who
disagree with this kind of experiment, or at least
the experiments that have been performed so far.
This criticism has included-among others-accusations that inadequate or obtuse sets of statistical methods were used; that the experimental design was poor; that unrepresentative systems were
used in the experiments (what is a representative
time-sharing system ?); and that since time-sharing is relatively new, most systems used had to be
experimental. A particularly vitriolic critique of
an experiment was made by Lampson. 17 Patrick27 was slightly-very slightly-more reserved
in his critique of some of this work. (Interestinglyenough, Patrick and Lampson differ strongly over the value of time-sharing.)
O'Sullivan 24 has made a number of interesting
observations on existing time-sharing systems. In
its work (primarily computational), his installation used a fairly large set of different commercial
systems. Among other things, he pointed out that
none was perfect, some had unique advantages,
and the variety of pricing schemes as well as
range of capabilitjes warranted the use of a com-

94

Fall Joint Computer Conference, 1968

puter to automate access to the various systems.
Thu~ an assessment of the current state of timesharing and interactive systems is difficult to summarize. Such systems ~ppear to be proliferating.
A large number of enthusiastic users exist, as well
as a wide variety of systems. Access to a commercial system for on-line computing requires only a
decision as to which one to use. Many interesting
applications are now being supported. Home early
predictions and hopes fQr the future have not yet
been attained. Some people are trying to produce
experimental evidence of the gains (or losses) due
to this technology. Others are seemingly satisfied
with the intuitive evidence (whichever it happens
to be for them).
The future

On what basis can one predict the future of interactive systems? In some sense, one should be
able simply to extrapolate from current systems
and make assumptions on improvements in computer power that will provide a parallel improvement in capability. But of course such predictions
are risky. For example, some new third-generation· developments (which were based on prototype large-scale time-sharing systems on secondgeneration computers) have not yet reached the
power of the second-generation efforts, let alone
surpassed it. This is partly due to the fact that
designers are generally not satisfied just to improve the capability of an old system. They always want to add considerably more, even revolutionary, capabilities to the system. In computing,
these ambitions can delay, if not do away with,
visible progress. Consequently, simple extrapolations from old systems don't work.
. On the other hand, a total lack ot' confidence
isn't in order, either. One can comfortably predict
that within the next five years, at least some special-purpose time-sharing systems will be capable
of handling a thousand simultaneous users.
Whether or not one computer's handling of many
hundreds of users makes commercial sense depends to a large extent on the communications industry. Current rate structures make communications the most expensive· part of conversational
computing for all but close centers. There are
efforts to change this situation, but the obstacles
are great.
Perhaps as large-scale general-purpose systems
on third-generation machines get shaken down

over the next several years, we shall see their
capacities rise to the one or two hundred" user
class. But until the advent of fourth-generation
computers, or the economical and efficient utilization of three or more multi-processors, generalpurpose systems will not have the user capacity
of special-purpose systems.
Multi- or parallel-pr<;>cessing will certainly tend
to facilitate increased capability in time-shared
systems. Systems now exist on some computers,
such as the Burroughs B5500 and CDC 6600,
which take advantage of multiple processors. These
are not now strictly interactive systems, but obviously demonstrate the usefulness of truly simultaneous processing capability. The two major efforts at using multi-processor computers (IBM
360/67 and GE-645) for large-scale time-sharing
have not yet progressed to the point where this
value for interactive computing is demonstrable.
Access devices
Most interactive system terminals today use
typewriter-like devices. Their prime advantages
are their relatively low price and the use of a hardcopy medium, which provides automatically a record of all input and output. Cathode-ray tu:be devices avoid some of the problems of typewriters.
They can operate rapidly, and are considerably
more flexible in format and editing control. CRT's
are gradually becoming more widely used as terminal devices, and over the next few years should
be used as much as typewriter devices. Obstacles
to their acceptance into the field have included
high cost per terminal and communication limitations, which make the rapid data-rate necessary
to update and maintain distant displays prohibitively expensive or impossible. Prices are coming
down, slowly, and the recent influx of reasonably
inexpensive keyboard-CRT alphanumeric displays
has accelerated the trend away from paper output devices. Thus systems of the future should
be largely CRT terminal oriented. This should
tend to further stimulate interest in interactive
systems, since the use of CRT's consistently attracts more attention than applications oriented
to other devices.
Other techniques are being investigated which
will facilitate new methods of dialogue with computers in the future. These include direct use of
touch-tone telephones; hand-written· input via devices such as the RAND Tablet or Grafacon;

Interactive Systems-Promises, Present and Future
voice input and output through a set of software
and hardware constructions. Both of the latter
are far from becoming generally useful. Interesting demonstrations of on-line hand-written input
have been given,2,13 but the mass use of this technique currently would be prohibitively expensive
as well as somewhat limited in capability. With
a few minor exceptions, use of voice-recognition
or output equipment with computers is strictly a
laboratory exercise at this time.
Networks
It is unlikely that sufficiently powerful computers will be developed within the next decade
to handle the large volume and variety of information and applications required by populations of
interactive users. It is also questionable whether
use of a single, monolithic computer is the best
technical approach. A network of computers, each
with an independent set of information files and
applications, may represent the ultimate potential
for the interactive user.
Experience in this area is limited. Experimentation is expensive, and again, remote communication is relatively costly and is limited by present
facilities. The programming problems are also
significant. Procedures f'Or minimizing communication paths and optimizing loads on computers
must be developed. The ,1ecision to maintain centralized or decentralized directories of data and
programs is one not yet solved in the general case.
Standards f'Or data formats and query languages
must evolve. These and other problems will have
to be solved before networks of cOlnputers can become a reality.
Considering the difficulties and expense involved
in evaluating networks as a viable technique for
providing the ultimate capability for p'Opulations
of users, it is clear that a major sponsor or set of
sponsors who can fund and coordinate these activities is necessary. One such effort is now beginning. The Informati'On Processing Technique
Office of ARPA, which was largely responsible
for the development of time-sharing over the 1ast
five years, has begun the first large-scale network
effort in this country. In 1969, they expect to have
a nation-wide network of about 20 interconnected
c'Omputers operating in a preliminary fashion
(most of these will have interactive operating
systems running on dissimilar hardware). At
each installation, a satellite computer will serve

95

as the buffer and language translator between the
home computer and adjacent nodes of the network. Efforts such as these are necessary to develop the technology needed to put multi-computer power at people's fingertips.
Improving communication and understanamg
The major emphasis of most interactive systems
to date has been in the area of individual problemsolving. It may be, however, that the ultimate
value of these systems will lie in their ability to
bring together and assist in assimilating diverse
ideas from large c'Ollections of users. Licklider
and Taylor have discussed these ideas at some
length. 35 They have described a meeting at Stanford Research Institute, at which speakers and
attendees had direct access to a shared computer.
'Vith this mechanism, speakers and listeners were
able to refer quickly to significant background
and demonstration material, so that the discussions could proceed at a reasonable pace while
permitting all participants to stay involved. Extrapolating from this point, they envisioned the
eventual formation of "user communities" comll1unicating and mutually developing ideas over a
widespread network of computers.
Interactively oriented systems as operating
systems
An examination of the characteristics 'Of largescale general-purpose time-sharing systems raises
an interesting question: Could they be used as
the basic operating system in a variety of installations, instead of the more common form of batchprocessing or multiprogrammed systems?
Time-sharing systems have a range of response
characteristics; they are always "up"; they have
been shown to be evolutionary, and at least in
truly general-purpose systems, they don't exclude
any kind of application. Several ma~ufacturers
. have recognized the basic capabilities 'Of timesharing and have promoted it as their operating
systems. Digital Equipment Corporation provides
an example of this with their PDP-6 system. Scientific Data Systems also emphasizes time-sharing
on some of their line. At SDC, a system called
ADEPT,16 is designed for this purpose on thirdgeneration hardware.
If time-shared systems really provide the capa~
bilities described here, one might legitimately ask
why they have not yet come to predominate third-

96

Fall Joint Computer Conference, 1968

generation computers. The major third-generation
operating systems, although generally multiprogrammed and with some capability for on-line interaction, are primarily 'Oriented to the off-line, 'Or
nonterminal user. One reason, mentioned before,
is reluctance on the part of most nlanufacturers to
make time-sharing the major 'Operating system.
To s'Ome extent, this is due to the necessity for
manufacturers to cater t'O the tradition existing
in most c'Omputing installati'Ons. Computer customers have been used to operating in a non-interactive envir'Onment. The manufacturers believe
their customers would n'Ot accept willingly a rapid
change in this c'Ondition.
Another reason that general-purpose interactive
systems have been slow in coming to the fore is
the fairly slow emergence of the better known
time-sharing eff'Orts. It is quite P'Ossible that, had
the MULTICS and IBM TSS efforts strongly
demonstrated in 1967 the value 'Of large-scale general-purp'Ose time-sharing, the momentum would
have increased in favor of time-sharing. Of c'Ourse,
from the days of the early systems, there have
been controversies 'Over the relative values 'Of interactive systems and more traditi'Onal systems.
The volume 'Of demand f'Or "hard facts" regarding
interactive operati'On is probably unprecedented
in computing history. Whether this requirement
for statistics is necessary or not, it certainly serves
to make a now reasonably conservative industry
hesitate to take seemingly r8.dical steps.
There is little question that on-line interaction
f'Or certain kinds 'Of applications is desirable. On
the other hand, there will always be problems for
which human interacti'On is undesirable. However, we must avoid thinking in terms of closed
systems. Some think that time-sharing systems
permit only interactive use, and batch-processing
systems do not allow on-line access. As stated bef'Ore, this is not true. Both types 'Of systems are
providing the two kinds of service. Third-generation time-sharing systems emphasize the availability of batch-pr'Ocessing services in the background, and in a similar fashion third-generation
batch-processing systems provide interactive capability. In fact, some of the standard operating
systems are even beginning to use the word "timesharing" to describe part 'Of the services provided
(see Ref. 3 ) • Thus, one can predict with
some degree of confidence that all systems will
eventually provide some interactive capability to
more than one application or user class. Time-

slicing may well be part of the scheduling scheme,
although it may be c'Oupled with priority. assignments. Swapping may be used in configurations
where large, fast, rand 'Om-access devices exist but
'Operating storage is small, although in a few
years, operating mem'Ories may be large and cheap
en'Ough so that swapping won't be necessary. The
command language for interactive users will be
simple enough so that on-line access will not require preparation equivalent to that needed for
preparation of 'Off-line inputs. Whether these systems will evolve from current time-sharing or
batch-pr'Ocesing systems is n'Ot very clear, and
probably not too important. What is important is
that in order to be successful, the batch-processing
'Operations will have to be efficient, and the inter. active access will have to satisfy the principles
learned in today's time-sharing installations.
CONCLUDING REMARKS
Today we take for granted the airline clerk's
interactive use of a remote computer to make inq uiries and reservations for our flights. S'Oon he
will be able to plan meals, schedule flights on other
airlines, and make hotel reservations at the same
terminal. Ultimately, he will pr'Obably make use
of other 'services to check the credit status of the
cust'Omer making the plans, as well as call up displays pointing out the variety of routes and costs
'On planned itineraries. Using interactive systems
for school management, engineering computations,
business data processing, program composition,
various military activities, and other purposes is
bec'Oming common. The use of these systems to
assist engineers, architects, draftsmen, and others
using elaborate' display techniques is now in its
infancy. Communication facilities, computers,
terminal devices, and operating systems are being
adapted to accommodate c'Ommunities of interactive users. Techniques for integrating software
and hardware complexes are being investigated
in order to provide truly large amounts of information to many users. There is no question
that the future generation will find their access
t'O computers immediate and an essential part of
their daily life, whether at home, school, business,
or in the library. (Parkhill's book 25 c'Onsiders the
future possibilities and problems of the computer
"utility" in much greater detail.)
Recently, an informal conversation was held
discussing the possibility of starting an experi-

Interactive Systems-Promises, Present and Future
ment with a "computerized town." All industry,
school, utility, financial, and domestic facilities
would have direct access to a network of computers. This would ultimately eliminate money
transactions, lengthy individual income tax calculations, uncoordinated record keeping, many
problems in transportation, and an unlimited variety of other conditions. The social and psycho-.
logical problems involved in installing such a system were apparent in this discussion (but not
attacked). It was significant to note, however,
that the technical problems mentioned-although
not deemed trivial-were within our grasp. In no
small measure, this is due to the experience gained
during this decBN~ in interactive computing.
BIBLIOGRAPHY
1 RUSH terminal user's manual

Allen-Babcock Computing Inc November 1966
2 M I BERNSTEIN T G WILLIAMS
A two-dimensional programming system
Proceedings IFIP Congress 1968 in press
3 S BOlLEN et 801
A time-sharing debugging system jor a small computer
Proceedings of the Spring Joint Computer Conference 1963
pp51-58
4 D CAMPBELLW COOK W HEFFNER
General comprehensive operaJ,ing supervisor--GECOS III
Software Age Vol 2 No 1 January 1968 pp 8-14 38--39
5 FJCORBATO MMDAGGETT RCDALEY
• An experimental time-sharing system
Proceedings of the Spring Joint Computer Conference 1962
pp335-344
6 FJCORBATOetal
The compatible time-sharing system: A programmer's guide
Cambridge Massachusetts The MIT Press 1963
7 F J CORBATO V A VYSSOTSKY
. Introduction and overview of the MULTICS system
Proceedings of the Fall Joint Computer Conference 1965 pp
185-196
.8 JBDENNIS
Segmentation and the design of multi-programmed computer
systems
IEEE International Convention Record Part 3 1965 pp
214-225
9 General Electric GE 6J,.5 time-sharing system
Digital Computer Newsletter Office of Naval Research April
1966
10 R R EVERETT C A ZRAKET H D BENINGTON
SAGE-A data processing system for air defense
Proceedings of· the Eastern, Joint Computer Conference
December 1957 pp 148-155
11 G H FINE P V McISAAC
, Simulation oj a time-sharing 8ystem
Management Science Vol 12 No 6 February 1966 pp B-180B-194
12 G H FINE C W JACKSON P V McISAAC
Dynamic program behavior under paging_
Proceedings of the 21st National ACM Conference 1966 pp

97

223-228
13 GFGRONER
Real time recognition of handprinted text: Program documentation
RAND Corporation document'RM-5550-ARPA May 1968
14 ELJACKS
A laboratory for the study of graphical man-machine communication
Proceedings of the Fall Joint Computer Conference 1964 pp
343~350

15 JGKEMENY TEJURTZ
BASIC programming
N ew York John Wiley & Sons Inc 1967
16 P R KENNEDY
The ADEPT-50 system: a general description of the time-sharing
executive and the programmer's package
SDC document TM-3899/100/0l June 71968
17 B W LAMPSON
A critique of an exploratory investigation of programmer performance under on-line and off-line conditions
IEEE Transactions on Human Factors in Electronics Vol
HFE-8 No 1 March 1967 pp 48-51
18 J C R LICKLIDER
Man-computer symbiosis,
IRE Transactions on Human Factors in Electronics Vol
HFE-1 No 1 March 1960 pp 4-11
19 TMARRIL LGROBERTS
Toward a cooperative network of time-shared computers
Proceedings of the Fall Joint Computer Conference 1966 pp
425-431
20 Graphics Semiannual technical summary report 1 J une-30
November 1967
Massachusetts Institute of Technology Lincoln Laboratory
ESD-TR~7-570 January 1968
21 J McCARTHY
Time-sharing computer systems
In Greenberger M ed Management and the Computer of the
Future Cambridge Massachusetts The MIT Press 1962 pp
221-236
22 P V McISAAC
Job descriptions and scheduling in the SDC Q-32 time-sharing
sharing system
SDC document TM-2996/000/00 June 1966
23 N R NIELSEN
7'he analysis fof general-purpose computer time-sharing systems
Stanford University document No 40-10-1 December 1966
24 T C O'SULLIVAN
Exploiting the time-sharing environment
Proceedings ofthe 22nd,ACM Conference 1967 pp 169-175
25 D F PARKHILL
The challenge of the computer utility
Massachusetts Addison-Wesley 1966
26 R WPARKER
The SABRE system
Datamation VollI No 9 September 1965 pp 49-52
27 RLPATRICK
Time-sharing tally sheet
Datamation Vol 13 No 11 November 1967 pp 42-47
28 HSACKMAN
Time-sharing versus batch processing The experimental evidence
Proceedings of the Spring Joint Computer Conference 1968
pp 1.;...10
29 ALSCHERR
An analysis of time-shared computer systems
Massachusetts Institute of Technology document MAG-TR-

98

Fall Joint Computer Conference, 1968

18 June 1965
30 J I SCHWARTZ C WEISSMAN
The SDC time-sharing system revisited
Proceedings of the 22nd National ACM Conference 1967
pp 263-271
31 J I SCHWARTZ C WEISSMAN E G COFFMAN
A general-purpose time-sharing system
Proceedings of the Spring Joint Computer Conference 1964
pp397-411
32 JI~CHWARTZ
Observations on time-shared systems
Proceedings of the 20th National ACM Conference 1965 pp
525-542
33 JCSHAW
JOSS: A designer's view of an experimentaL on-line computing

34

35

36

37

system
Proceedings of the Fall Joint Computer Conference 1964 pp
455-464
C STRACHEY
Time-sharing in large fast computers
Proceedings of the International Conference on Information
Processing UNESCO June 1959 Paper B 219
R WTAYLOR JCRLICKLIDER
The computer as a communication device
Science and Technology No 76 April 1968 pp 21-31
University of Michigan terminal system (MTS)
University of Michigan 2 Vols December 1967
DC WHITNEY C H WHITE JR
Time-sharing services
Modern Data Systems Vol 1 No 1 February 1968 pp 40-50

Multiprogramming-Promise, performance
and prospect
by THOMAS B. STEEL, JR.
System Development Corporation
Santa Monica, California

INTRODUCTION
"Multiprogramming'! is the label given to the concept
of a dynamic sharing of the resources of a given computer system among two or more programs. An operating mUltiprogramming system presents to external
observers the appearance of effecting the concurrent
execution of several object programs. There mayor
may not be truly simultaneous operation of more than
one program, but it will be the case that a second pro··
gram begins execution before the first program has
rUn to completion. Simple sharing of storage among
several programs in a systematic way to facilitate
serial execution is insufficient to qualify an operating
system as incorporating multiprogramming. There
must be an oscillation of control among the several programs for multiprogramming t~ come into play.
In order to make a rational analysis of the relation'
between the claims for multiprogramming and the
actual performance of multiprogramming systems
it is essential to have a clear understanding of th~
motivation for attempts to develop such systems. It is
unexceptionable that the primary justification for
multiprogramming systems is the economic advantage
that accrues from their use. Many areas on the frontier
of information processing science, such as artificial
intelligence and mechanical translation, draw their
research and development energies from the desire to
augment the functional capabilities. of computing
systems; others, such as programming language development, are pursued in the hope of improving the
ability of humans to cope with the computer. Multiprogramming is intended to improve the performance
of a machine qua machine. A mUltiprogramming system
provides no capability that could not be obtained in
its absence at a price. It must be kept in mind, however,
that there are certain everyday activities that, while
they could be accomplished in the absence of multiprogramming, could not be afforded with contemporary

hardware. A case in point is giving every gr..aduate
student his own computer.
To explicate the essentially economic nature of mulHprogramming it is necessary to examine the usual justifications for its use.! Three arguments are advanced:
(1) improved throughput by maximizing utilization
of machine components, (2) time-sharing, with all it
implies, and (3) real time response.
Improved throughput is currently the most prevalent
reason for employing multiprogramming and is likely
to remain so for the foreseeable future, time-sharing
advocates notwithstanding. In this context, multiprogramming requires some multiprocessing capability
in the hardware. If it is not possible for two or more
explicitly programmable functions to occur in parallel,
nothing can be gained from multiprogramming in the
way of improved throughput and the attendant overhead is merely expensive waste motion. For this reason,
multiprogramming did not arrive on the computing
scene until the advent of elementary multiprocessing. 2
If coupled systems and satellite computers are disregarded as irrelevant in the present context, * the
only pertinent parallelism in generally used computers
has been, and continues to be, overlap of computing
and input-output. Typically, the computing time required to service an input or output device is far less
than the time required for that device to perform its
function. Thus, unless another part of the program
initiating the input-output operation, or another program altogether, can employ the computing circuits of
the machine while the input or output request is being
processed, time is lost and throughput is diminished.
Most multiprogramming systems are designed explicitly to overcome this loss. Improved throughput means
*The satellites and the drivers of coupled systems should be
regarded as external, asynchronous signal sources and their
relationship to multiprogramming is, therefore, to be found in the
real time context.

99

100

Fall Joint Computer Conference, 1968

more computing per unit time which means more computing per dollar. Here the motivation for multiprogramming is palpably economic.
The relationship between multiprogramming and the
technology of on line, multi-access systems, unfortunately almost universally mislabelled "time-sharing,"
must be carefully delineated in order to absolve multiprogramming from unmerited responsibility for the
many difficulties that have plagued on-line systems.
An on-line system involves multiprogramming in a
special way only in the event that it is also a multiaccess system. The purpose of this multiprogramming
by rapid cycling through many users is to provide an
economic impedance match between slow men and a
fast computer. If, as may some day happen, machines
were inexpensive enough it would be reasonable
to provide every user with'· his own computer, a
tour de force eliminating the need for "time-sharing."
Admittedly, this observation ignores certain significant
elements of multi-access systems such as mutually'
interacting users and shared files, but it does illustrate
the primacy of the economic motivation for multiprogramming in this context.
Real time systems pose something of a problem for
this discussion as it is not clearly appropriate to view,
say, an airline reservation system in the performance
of its principal duty as a multi programmed s~ stem.
Terminal servicing of this sort under control of a master program is really more akin to the treatment of
conventional programs in machines with arithmetic
overflow and zero divide interrupts. There is a hint of
multiprogramming in the situation but it is extremely
primitive. The full employment of mUltiprogramming
in real time systems occurs when it is found desirable
to occupy machine resources that would otherwise be
idle while waiting for an external signal. Here the background task filling the idle time could be performed on
another computer at additional cost. Again, the motivation is primarily economic, although dynamic access
to a changing data base by the background program
may be a factor.
Having evoked maximization of the cost effectiveness
of computer resources as the dominant excuse for
mUltjprogramming systems, it follows that instances
of these systems must be judged primarily in economic
terms. Care must be taken, however, to examine all
aspects of the cost equation, for capturing idle machine
time at the expense of programmer and operator frustration may well be a poor trade. It will be seen below
that this is a nonempty caveat.
Promise

The first explicit mention of multiprogramming in
the general literature was, as noted above, in the con-

text of overlapping computing with input-output. 2
Here, as elsewhere initially, there was no hint of a
multiprogramming system, merely the suggestion of
employing the technique in a single program. These
early claims were modest and generally remained so in
the responsible literature. As might be expected, performance claims got a little out of hand in the sales
brochures of equipment manufacturers, a recurrent
theme that will generally be disregarded in this account.
In the case of certain early military applications of
computer systems for comma~d and control, such as
SAGE,3 it is at least arguable, in hindsight, that the
rudiments of what would now be called a multiprogrammIng system were in evidence. Since for reasons of
military security the details of such systems were not
generally available, their development exerted little
direct influence on the future course of multiprogramming. The indirect impact of these military activities
was considerable, however, as a technical expertise unavailable to the less affluent civilian sector was acquired
by the personnel engaged in the development of these
big, complex and advanced systems. With the passage
of time this expertise percolated to all corners of the
industry. It is not within the scope of this paper to
discuss the hopes and realities of these military systems.
Probably the first, and certainly the most ambitious, early attempt to create a. mUltiprogramming
capability in an operating system context where the
object programs were expected to be totally independent was the SHARE 709 System (SOS).4 SOS was designed for the IBM 709, a machine with a multiple
channel, asynchronous input-output capability'. Among
the design objectives was the ability to perform,
in parallel, input for job N + 1, compute for job N, and
output for job N - 1. The conceptualization and design of this capability to the level of detailed flow
diagrams was complete by the Fall of 1957 and the
prospect of snch facilities was widely accepted soon
thereafter.
The next major step in the advocacy of multiprogr~ng systems was the explicit recognition by
Strac~ey of the hierarchical natur~ of .imm~diacy ~n
computer time demands. 5 The key Idea In thIS work IS
not, as is usually claimed, the invention of the multiaccess concept; it is the introduction of the "director,"
a program element now usually referred to as a "scheduler." In the example detailed by Strachey there was
only a single on-line user envisioned, but given the
concept of an on-line user with priority overall offline users, and the director, only a modicum of imagination is required to arrive at the rest of the multiaccess, on-line system concept. Subtract the on-line

Multiprogramming-Promise, Peformance and Prospect
user, however, and what remains is a reasonable prescription for a modern batch mUltiprogramming system. The real advance in this approach over the ideas
inherent in the SOS structure was freeing the system
from the constraint that object programs must pass
through the system in a lock step order that is dictated
by the initial invut stream sequence.
By the end of 1961 a number, far more. than cited
here, of intuitive claims and theoretical analyses of
mUltiprogramming behavior had appeared. 6- 8 The
consensus of these studies was that effective multiprogramming was feasible, valuable and imminent. The
meaning of "effective" varied, of course, from ~uthor
to author. Two measures of multiprogramming effectiveness have generally been given: (1) the amount of
time devoted to the overhead activity of keeping the
system operating, and (2) the improvement of throughput over that encountered in a strict batch system.
Both are normally quoted as percentages, and neither
is really satisfactory as a measure of multiprogramming
effectivity.
The first measure indicates the minimum distance
from perfection-'-the unrealizable state where all of the
machine is busy on useful work all of the time-that
the system could attl;Lin with an ideal job mix. It gives
. an absolute measure of the best case. The second measure indicates the relative improvement in performance
but provides no indication of how this relates to the
ideal. Even' taken together the two measures do not
close the gap. Something else is needed, perhaps a set of
stantlard job mixes, but this paper must stand on the
available data.
These early claims varied but generally suggested
overhead figures of between one and fifteen percent and
throughput improvements of up to several hundred
percent. The low figures for overhead were quoted by
manufacturers, such as Honeywell for its Model 800,
who planned to employ hardware for much of the overhead activity. The extra hardware costs money, however, and this cost is normally not factored into the
equation.
By 1962, and continuing to date, the scientific literature began to carry reports of actual experience with
mUltiprogramming systems. 9- 14 l\1ost of these reports
were made by representatives of hardware 'manufacturers and,therefore, exhibited a natural tendency to
minimize difficulties. Since this time, the performance
claims for multiprogramming systems have remained
more or less static in the responsible literature. Two
revealing changes have occurred: (1) the word "multiprogramming" no longer contains a hyphen, providing at least linguistic legitimacy to the concept, and
(2) the availability dates for most multiprogramming

101

systems have slipped, often considerably, but happily
at somewhat less than real time.
At the present time most large, commercially available computing systems are designed with the expectation that they will be multiprogrammed in many
environments. Generally they are accompanied by a
manufacturer supplied, batch multiprogramming system. Some are vehicles for on-line, multi-access systems that are now in being. Since these things exist and
can be evaluated by the customer, current claims tend
to be rather realistic and representative of the actual
situation, at least with respect to performance. Ease of
use is another matter altogether.
Performance

Having reviewed in deliberately general terms the
promises for multiprogramming, it is nOw necessary to
review in equally general terms what has actually been
accomplished in providing multiprogramming capability. As noted above, the early claims were modest
and made in the context of multiprogramming within
the confines of a single object program. Even here the
claims went a bit beyond reality. While substantial
gains in program performance were obtained through
overlapping computing with input-output operations,
the results were less gratifying than it seemed they
ought to be. Two reasons for this can be isolated.
In the first place, insufficient information was provided by the hardware for programmers to make completely effective use of the actual capabilities of the
machine. The extent of the requisite interaction between hardware and program for efficient handling of
asynchronous interrupts was long unrecognized, despite some careful studies on the subject. 5 Indeed,
this subject is not perfectly understood today, but at
least there seems no doubt that, at long last, machine
designers are aware of the problem. Attention to its
resolution cannot fail to improve the performance of
future systems.
The second difficulty with early mUltiprogramming
efforts was more subtle and went unappreciated until
attempts were made to instrument computing systems
to determine, among other things, just how much overlap of computing and input-output actually went on.
The depressing nature of the results could be traced to
the fact that the average programmer simply was not
good enough to make full use of the multi-channel
hardware capability, even where the problem cried out
for its use. It was the recognition of this situation that
paved the way for the design of the first multiprogramming systems.
SOS was a failure if measured by its impact on the
community. It is the author'.s contention-exhibiting

102

Fall Joint Computer Conference, 1968

a bias justified in one of the designers-that the failure
was in implementation, not in design. To put the matter
bluntly, IBM blew it! The system that finally came out,
to be distributed and maintained by the vendor, was a
pale ghost of the original conception (in many aspects,
not just in the multiprogramming features) that eventuallyevolved into IBSYS, a tolerably good batch processing system, but hardly a multiprogramming system.
The fact that reasonable approximations of the original
were used by the RAND Corporation, the Applied
Physics Laboratory and others indicts the IBM effort.
The multiprogramming aspect of this situation must be
carefully weighed. It was possible to get approximately
the same amount of overlap between computing and
input-output in both IBSYS and SOS, but it required
much more programmer effort in IBSYS. This difference is significant in view of the difficulty programmers
have with this problem.
The multiprogramming aspects of large, real time
systems and on-line, multi-access systems are somewhat more severe than those found in batch multiprogramming systems, due to the added pressure of
vital time requirements on the scheduler not usually
found in batch situations. Nevertheless, the literature
'reveals that the serious problems in these more complex
systems really lie el~ewhere in such areas as command
language, paging, multi-access files and lack of reentrancy in generated code. 16-17 It is a slight oversimplification, but not amiss in principle, to a~ert that the
current performance of mult~programming' in real time
and multi-access systems has about the same relationship to the earlier promises as can be shown to -apply in
batch systems.
The literature now abounds in reports on the performance of various multiprocessing systems,18-23 but
with some notable inadequacies; e.g., for OS/360. The
trouble with these reports is that they don't say very
much concrete. The lack of carefully defined measures
hurts the analyst and the lack of hard data hurts him
even more. In view of this situation the author has forborne from constructing a table of performances of the
specific existing systems. It would be invidious to attempt an explicit comparison from the available data,
and no individual has had sufficient experience with
several systems to permit the gathering of even intuitive judgments. What evidence there is suggests that
all of the major systems share roughly the same
strengths and weaknesses. Thus, it makes sense to
compare a kind of generic, current multiprogramming
system against the industry's broad claims for what it,
collectively, expected to,produce.
Viewed in these terms, the situation is rather better
than one might expect. While it is only in special situations that throughput improvement has attained the

several hundred' percent initially claimed, the average
figures of between thirty and seventy percent are but
a binary order of magnitude below the claims. More or
less the same factor of two appears in the overhead'
figures; ten to thirty percent in the real situation as
against half that in the projections. The serious problem
has been in delivery dates, a not uncommon element
of software development. As has been observed, much
of this is due to inadequacies in the hardware. Good
multiprogramming systems simply were not-in the cards
until the current class of machines were available.
The glaring failure of current multiprogramming
technology is the complications it has introduced for
the programmer and operator. The current Job Control Languages (JCL) required to specify what the
system is to do are, by and large, disasters. It takes far
too much of a programmer's time to construct the
appropriate JCL statements, and an even larger amount
of time to debug them, not to mention the effect on
morale of aborted runs deriving from trivial JCL errors.
The implications of JCL in the machine room are even
worse. The operators must be a good deal smarter
(and, therefore, necessarily, paid more) than has been
standard in the past. Computer center managers are
faced with the realization that poor operations will
destroy and overwhelm any gain in throughput ,with
no trouble at all.
Prospect

In considering where multiprogramming may be
expected to go from here, it is worth noting the reason
why this technology fares considerably better than
most when measured against the early claims of its
proponents. In muitiprogramming there is a well defined, finite upper limit for improvement in capability.
The most one could ever claim was to use all of the
machine all of the time. This is hardly true in other
cases; witness artificial intelligence where the more
flamboyant claims defy the imagination. As multiprogramming technology approaches its natural limit,
it clearly ceases to make sense to expend much effort
trying for the last fraction. Satisfaction is obtained by
near optimum performance at acceptable cost.
Some performance improvement can be obtained
through judicious use of the various empirical24 and
theoretical25-27 studies of multiprogramming, and
through attention to the problem of hardware-software interaction. It is likely that use of a firmware
approach to multiprogramming supervisors by placing
them in read-fast, write-slow storage units will provide the last big reduction in overhead cost. Improvements beyond a factor of two or three will probably
cost more than they are worth. Of course, the introduc-

Multiprogramming-Promise, Peformance and Prospect
tion of multiple, interacting arithmetic, logic and control units may start a whole new ball game.
The real improvements in multiprogramming systems
must come in the area of making them easier to program and to operate. As indicated above, much is left
to be done in this area, and it shows little sign of happening so far. Programmers sweat, operators err and
managers complain, but JCL marches on.

REFERENCES
1 EFCODD
Multiprogramming
Advances in Computers 3 Academic Press New York 1962 p 77
2 N ROCHESTER
The computer and its peripheral equipment
Proc EJCC p 641955
3 R R EVERETT C A ZRAKET H D BENNINGTON
SAGE-A data processing system for air defense
Proc EJCC p 1481957
4 0 MOCK C J SWIFT
The SHARE 709 System: Programmed input-output buffering
JACM 6 2 P 1451959
5 CSTRACHEY
Time sharing in large fast computers
Proc ICIP p 336 1959
6 EFCODD
MultiproiJram scheduling
CACM 3 6 p 347 1960
7 BLRYLE
Multiple program data processing
CACM 4 2 P 99 1961
8 T KILBURN D J HOWARTH R B PAYNE
F H SUMNER
The Manchester University Atlas operating system Part I:
Internal Organization .
Computer J 4 P 222 1961
9 RDSMITH
Multiprogramming the RCA 601 .
Preprints of 16th ACM National Meeting p 12C-11961
10 GFELTON
Multiprogramming on the Ferranti Orion computer 8y8tem
Proc IFIP p 570 1962
11 R CLIPPINGER
Multi-programming on the Honeywell 800/1800
Proc IFIP p 5711962
12 J L FRANCOIS

103

Programmation simultanee dansle Cas d'll. Gamma 60 Bull
Proc IFIP p 5731962
13 EFCODD
Multi-programming stretch: A report on trial8
Proc IFIP p 5741962
14 AJCRITCHLOW
Generalized multiprocessing and multiprogramming sy8tems
Proc FJCC p 1071963
15 F P BROOKS JR
A program-controlled program interruption system
Proc EJCC p 1281957
16 JSCHWARTZ
A general purpo8e time-sharing system
Proc SJCC p 3971964
17 FJCORBAT6 V A VYSSOTSKY
Introduction. and overview of the multics system
Proc FJCC p 1851965
18 BBCLAYTON EKDORFF REFAGEN
An operating system and programming system for the 6600
Proc SJCC v 2 P 411964
19 H SBRIGHT
A Philco multiprocessing system
Proc SJCC v 2 p 971964
20 DMDAHM
Using the B5500 disk file master control program
Proc IFIP v 2 p 362 1965
21 JWLEWIS
Multiprogramming on Leo II I
Proc IFIP v 2 p 363 1965
22 JBOUVARD
Experience with multiprogramming on the Honeywell 800/1800
Proc IFIP v 2 P 364 1965
23 R EFAGEN
Time-sharing the Control Data 6600
Proc IFIP v 2 p 368 1965
24 H N CANTRELL A L ELLISON
Multiprogramming sY8tem performance measurement and
analysis
Proc SJCC p 213 1968
25 W CHANG D J WONG
Analysis of real time multiprogramming
JACM 124 P 5811965
26 BPETERS
Security considerations in a multi-programmed computer system
Proc SJCC p 283 1967
27 DPGAVERJR
Probability models for multiprogramming computer systems
JACM 143 P 4231967

An algorithm for finding a solution of simultaneous
nonlinear equations
by R. H. HARDAWAY
Collins Radio Company
Dallas, Texas

INTRODUCTION
In many practical problems the need for a solution of a
set of simultaneous nonlinear algebraic equations arises.
The problems will vary greatly from one disciplin,e to
another, but the ba'sic mathematical formulation remains the same. A general digital computer solution
for all sets of simultaneous nonlinear equations does not
seem to exist at the present time; however, sever~l
recent techniques make the solution of certain systems
more feasible than in the past.
The algorithm described here is a slight variation of
one of the methods described by C. G. Broyden1 in
"A Class of Methods for Solving Nonlinear Simultaneous Equations." This modified version of Newton's
method converges quadratically for a convex space. It
includes Broyden's technique of approximating the
initial Jacobian and the~ updating its inverse at each
step rather than recomputing and reinverting the Jacobian at each ite:r;ation. A procedure is given which
helped to circumvent the difficulty of an initially
singular Jacobian in several test cases.
The examples given include applications in several
engineering fields. A simple hydraulic network and the
equivalent nonlinear resistive network are given to
show the identical mathematical formulation. Applications to the stress analysis of a cable, to the analysis of
a hydraulic network, to optimal control problems, to the
determination of nonlinear stability domains and to
statistical modeling are mentioned as examples of usage.
Statement of the problem
Let a system of n nonlinear equations in n unknowns
be given as
fl(XI, X2, "', x n ) = 0
f 2(xI, X2, "', x n ) = 0
(1)

This may be represented more concisely in vector
notation as
f(x) = 0

(2)

where x is a column vector of independent variables and
fis a colll;mn vector of functions.
A solution of the system of n equations is a vector x
which satisfies each fj in the system simultaneously.
Newton's method
In Newton's method for a one dimensional case, the
iterative procedure is given by
(3)

The need for a good ini~ial estimate, the computation
of the derivative, and failure to find multiple roots are
usually cited as major dis~dvantages of the method.
However, from a "good" initial estimate, convergence'
of the method has been frequently proven and has been
shown to be quadratic.
For an n dimensional system we will expand this
notation. The initial limitations and the advanta,ge of
quadratic convergence are maintained. For proofs on
the convergence, see Henrici's Elements of Numerical
Analysis. 2
Rather than a single independent variable, we have
an n dimension;:tl vector of Independent variables x.
An n dimensional vector of functions f replaces the
single function equation and the Jacobian replaces the
derivative of the function. The Jacobian is defined as
an (n X n) matrix composed of the partial derivatives
of the functions with respect to the various components
of the x vector. A general term of the Jacobian J may
be denoted as aij = afj/axi where fj and Xi are components of the fand x vectors, respectively: Since in
equation (3) the derivative appears in the denominator
we must consider the inverse of the Jacobian and
evaluate it as Xi. This will be denoted as J rl.
105

106

Fall Joint Computer Conference, 1968

Therefore, for an n dimensional case, Newton's
method may be rewritten as

In order to define the modification method for the
inverse Jacobian, we let

(4)

(6)

The obvious difficulties of the method lie in choosing an
initial vector Xo and in computing and evaluating the
inverse Jacobian. Despite the oversimplification, it will
be assumed that enough knowledge of the system exists
to enable one to make a "good" initial guess for Xo.
The Jacobian is considerably more difficult. With the
method that was presented by Broyden not only can
an initial approximation to the Jacobian be used, but
also at each iteration the inverse Jacobian may be
updated rather than recomputed.

Then the vector of functions of f(x') may be considered
a function of a single variable t. The first derivative of
f with respect to t will exist since the Jacobian has
previously been assumed to exist.
It follows that

Broyden's variatwn of Newton's method

Notation
Xi

i'th approximation to the solution

fi = f(Xi)

set of

J i or J rl

Jacobian or its inverse evaluated at

func~ions

= afax'

(7)

ax' ati

When we determine df/ dt, we have established a
necessary condition on the Jacobian.
To approximate df/dt, Broyden suggests a differencing method where each component of f may be
expanded as a Taylor series about s as follows:
fi

evaluated at Xi

= f(t i

-

s)

= fi+! -

df
dt

S-

-

•••

(8)

Xi

Ai or A i- l i'th approximation to Jacobian or its
inverse evaluated at Xi
t

df
dt

Disregarding the higher terms, an approximate expression for df/ dt is
df
dt

scalar chosen to prevent divergence

fHl - fi

Yi

s

s

-~---

the difference in f i+l and f i
Yi = fi+l - fi

~

(9)

The choice of s is such that the approximation to the
derivative is as accurate as possible, but care must be
taken that the rounding error introduced in the division
is not significant. Since we have chosen Broyden's
method of full step reduction, ti is set equal to sand (9)
becomes

the negative product of Ari and fi
Pi :::; -Ai-1fi
the transpose of Pi

Method
It is assumed that an initial approximation of the
Jacobian Ao exists. The iterative procedure seeks to
find a better approximation as it also seeks to find the
solution of the system. In this process the function
vector f will tend to zero and indicate the convergence
of the system.
If we let Pi = - Arlfi as given above, then equation
(4) becomes
(5)

where t i is a scalar chosen to prevent the divergence of
the iterative procedure. The value of ti is chosen so
that the Euclidean norm of fi+l is less than or equal
to the Euclidean norm of f~; hence, convergence is not
ensured but divergence is prevented. A complete discussion of the backward differencing method used is
given in a followinig paragraph.

(10)
If we now combine equations (7) and (10) we have
another necessary condition which the Jacobian will
satisfy,
(11)

Since Ai, an approximation to the initial Jacobian,
exists, we are seeking a better approximation and J is
replaced in equation (11) with Ai +1 ,
(12)

This equation gives the relationship between the change
in function vector f and the change in the X vector
in the direction Pi. Since we have no knowledge of chang-

Algorithm for Finding Solution of Nonlinear Equations
es in any direction other than pi, we will ,assume that
there is no change in the function vector f in any direction orthogonal to Pi. Using this assumption and equation (12), A i +1 can be determined uniquely and is
expressed as follows:

107

given in the next paragraphs. The general flow chart
in Figure 1 summarizes the procedure.

The initial vector
The initial vector Xo may be selected arbitrarily or
from knowledge of the system, With a nonlinear resistive network, for example, the elemental values cou~d

Since we actually need the inverse of A i+l, Broyden
uses a modification given by Huseholder 3 which
enables us to obtain a modification formula for the
inverse from the information we already have. Householder's formula is

INITIALIZE X

(14)
EVALUATE SET OF
FUNCTIONS

where A and (A + xyT) are nonsingular matrices and
x and yare vectors all of order n. Therefore,
A

-1 HI
-

A

-1

i

+ r.t .p'
t

'I

- A .-ly .J P .TA .-1
'I

TA

Pi

'I

-1

i

Yi

'I

'I

EVALUATE
JACOBIAN

(13)

is the modification we have Deen seeking.
This method of updating the inverse of an initial
approximate Jacobian was shown by Broyden to give a
better approximation as i increases if the terms omitted
in the Taylor series expansion are small. Since s = t i
is always chosen to be less than or equal to I} this
condition is satisfied.
With this improved approximation of the inverse a
new Pi is computed and the iteration is repeated.
As Xi approaches the solution, the convergence becomes quadratic as Henrici3 has shown. The function
vector tends to zero and the Jacobian tends to the
actual Jacobian evaluated at the solution vector. AAY
one of several methods citnbe used to determine the
accuracy of a solution.
Since the computation of partial derivatives has been
simplified by the approximation procedure, this method
presents advantages over those which require explicit
evaluation of partial derivatives.
The step size at each iteration is such that the norm
is reduced rather than minimized. The time spent in
evaluating the set of functions repeatedly and the
storage required to save various vectors to determine
the minimum, negate the advantage of norm minimization. This method combines the use of initial approximations with an iteration procedure that is computationally simple, to produce an efficient algorithm.

INVERT
JACOBIAN

EXIT

CHOOSE TTO
REDUCE NORM
( THE ·VECTOR X
AND THE .sET OF
FUNCTIONS AR.E
RECALCULATED IN
THIS PROCEDURE.)

UPDATE
JACOBIAN INVERSE

NO

YES

Computational procedure

Details on the implementation of this algorithm are

FIGURE I-Flow chart

108

Fall Joint Computer Conference, 1968

be used. If no knowledge at all exists, a unity vector is
generated as Xo.

The Jacobian
Since the initial Jacobian may be approximated'
several methods are available to compute this matrix·
The simplest is to let the inverse equal a given value and
not attempt to compute or invert the Jacobian. So
much valuable information is lost that, despite the
simplicity, this method is not chosen.
At the opposite extreme is the possibility of computing all the necessary partial derivatives, evaluating
the Jacobian at Xo, and then inverting the matrix. The
evaluation of the partial derivatives is gener~lly very
laborious so this method was not considered. Further,
the assumption thatAo may be approximated makes
this degree of precision unnecessary.
The third alternative is to approximate the partia\
derivatives. This will provide better information than
the first case and give less computational difficulty than
the second case.
Since any term of A may be denoted as aij = afj / aXi,
we have
ai,

.

=

hm

fj(xi

+ h)

h

- f,(xi)

(16)

i_O

where fi and Xi are components of f and x. For purpose
of evaluating Ao 1 a relatively small value of h is selected
and equation (16) used to generate each element.
For the test program, a value for h was computed as
.001 of Xi.
The inverse Jacobian
When the Jacobian has been evaluated, the next
step is to invert it. If the Jacobian is nonsingular, the
inversion is performed and the iteration proceeds. A
standard Gaussian inversion routine is used.
If, however, the Jacobian is singular, the inverse doe~
not exist. The first solution given in the previous section
is one method of sidestepping this problem.
During the testing of the algorithm an attempt was
made to determine an optimum arbitrary matrix. One
choice was to use the results that had been stored in the
inverse matrix by the Gaussian elimination procedure
at the time the singularity was detected. This will give
a reasonably good approximation for some entries in
the inverse. At the next step, the modification procedure will improve the initial approximate inverse.
This is the matrix that was used if the Jacobian was
singular.

Seletion of the Scalar ti
The Euclidean norm of the vector fi should approach
zero as a solution is reached. When t i is selected so th'Bt
the norm of fi is a nonincreasing function of i, the
divergence is prevented.
The first guess for t i is always + 1. If this satisfies the
condition that the Euclidean norm of fi+l(Xi + tiPi)
is nonincreas~ng with respect to the norm of fi, then
ti = 1 is used. If not, then a quadratic minimization
procedure similar to one given by Broyden1 is used.
Ten attempts are made to find a good value of t i . At
that point the final value of ti is used and the corresponding modifications are made on the inverse Jacobian
and the f and x vectors. Obviously, the Euclidean norm
may not be decreased but at the next step the directional change in the correction vector will result in norm
reduction with relative ease.
In the process of selecting t i ,ji+1, Xi+l and the norm of
fi+l are all computed. These values are all saved for
future use in the ~omputational procedure.

Convergence
. The necessary degree of accuracy should be determined by the application and specified for each case.
The norm of the function vector can be used as a convergence criterion; the absolute value of each element in
f can be checked to see how closely it approaches zero;
ora comparison between the norm of Pi and the norm
of Xi may be used. This last method implies that if the
norm of the vector Pi which is used to cor~ct the solution Xi is less than some epsilon times the norm of the
solution, then convergence is already attained. Since
Pi = -Arlfi,animplicittestismadeonfi.
This last criterion presents an advantage because the
prediction vector as well as the function vector is considered, so this was the criterion selected.
If the iterative procedure is not converging, provision
must be made to terminate the problem. A value equal
to 2n2, where n is the order of the system, is computed.
The maximum of this value or 50 is used as an upper
limit on the number of iterations allowed. Terminati.on
is enforced when this number of iterations has been
attained whether or not a solution has been found.

Modifieation of inverse Jacobian
If the convergence criterion is not satisfied, then the
inverse Jacobian is modified accoraing to equation (15).
The new values of Xi and f i that are stored as Xi+! and
fi+! are placed in the appropriate vectors.

Algorithm for Finding Solution of NonIinear Equations
Continuing the iterative process
The value of i is set equal to i + 1. If the max mum
number of iterations will not be exceeded, the iteration
is repeated from the evaluation of Pi.
The subprogram

The procedure described was programmed in generalized subroutine form using variable dimensioning and
making use of the option of an external subroutine to
evaluate the set of functions. The external subroutine
can be varied from one application to the next without
affecting the main subroutine that performs all the
other invariate calculations.
As a second option, the subroutine that evaluates the
initial approximation to the Jacobian is declared external.The usual approximation is given as follows,
(17)
(.001) (Xi). This approximation has been
where h
programmed into a subroutine.
However, in any specific case if a better method of
approximation exists, a subroutine which evaluates this
approximation may be declared external and replace
the first approximation subroutine. Results using the
first approximation were so satisfactory that this second
option was not utilized in the cases discussed here.

The defining equations, the initial vector, and the
solution obtained in each test case are given as follows.
1. fl = X 12

f2 = Xl
fa = Xl

+ X 22 + Xa2 -

+ X2
+ Xa

5

1
- 3

-

Xo

.[
V5
[ ++-VsJ
V5
1

=

X =

3

01 ]

(18)

2

F. H. Deist and L. Sefor'.
2. same as 1.

x·=[U

X =

1.66667 ]
-.66666
[
1.33333

3. f1 = X 12 + X 22 - 1.0
f2 = 0.75 X la - X 2 + 0.9
-.4 ]

Xo = [ -.1

X = [ -.98170. ]

(19)

.19042

V. A. l\latveev6 •

4. same as 3.

Xo = [

Timing and accuracy
The method was programmed in Fortran V on. the
Univac 1108 for single precision input and output.
TABLE I, which follows, reflects the order of the system, the accuracy of the result, the number of iterations
and the time required on the Univac 1108 for ten sample
problems. Following the table the defining equations
are given for each system.

109

5. fl
f2

=
=

1.3] X = [ .35697 ]
-.3
.93412

10(X2 - X12)
1 - Xl

x. = [: ]

X

= [: ]

(20)

H. H. Rosenbrock6 •

1.
2.
3.
4.
5.
6.
7.
8.
9.
10.

Order N

Accuracy

3
3
2
2
2
4
5
10
20
30

10--6
10-6
10-5
10-&
10-7
10--6
10-7
10-7
10-7
10-7

Iterations
19
11
15
11
21
7
10
13
17
18

Time in sec.
.02
.01
.01
.01
.23
.02
.02
.09
.40
.90

TABLE I-Timing and accuracy of the subprogram

6. fl = 20Xl - COS2X2 + Xs - sin Xs - 37
f2 = cos 2X l + 20X 2 + log (I + X42) + 5
fa = sin (Xl + X 2) - X 2 + 19X a + arctan Xa - 12
f4 = 2 tanh X 2 + exp( -2Xa2 + ..5) +. 21 X 4

r
-l

X _

O. G. Mancino?

1.896513l
-.210251
.542087
.023885

J
(21)

110

Fall Joint Computer Conference, 1968

7., 8., 9., 10. Are all defined by the. same general
equations
2X 2 - 1
fl = - (3 - .5Xl) Xl
f, = X'-l - (3 - .5Xi) Xi
2X'+1 - 1
i = 2, "', n - 1
f" = X,,-l - (3 - .5X n ) X" - 1

+

+

Asa second example, consider the hydraulic network
in Figure 3.
Let the pressure drop across each member be expressed as Pi = (aL i /D i 4.86) Ql·85 = B i Qi· 85 , where a
is a constant, Li is the length, Di is the diameter, and
Qi is the flow. The flow through each member may be
determined from the following equations which describe
the system.

(22)
C. G. Broyden. 1
ApplicationDf the subprogram

Equivalent systems
To demonstrate the equivalent mathematical formulation of a set of .defining equations for different
systems, a very simple example of a dual application
will be given.
Consider the nonlinear resistive network given in
Figure 2.
Let the voltage drop across each resistor be Vi =
RiI/'. Then from Kirchoff's laws the system may be
completely described by the following three equations
and II, 1 2, and Is may be determined uniquely.

PUMP

1--E

FIGURE 3-A nonlinear hydraulic network

----+
II

FIGURE 2-A nonlinear resistive network

Algorithm for Finding Solution of Nonlinear Equations

Equations (23) and (24) are identical in form although they originated from different sources. The,
solution to either example may be determined by solving the same set of nonlinear equations.
From th}s second example an additional feature of the
subprogram may be pointed out. The subroutine that
evaluates the set of functions may be dependent on
other calculations for the elements in the expressions.
When the determination of a single element becomes
involved, a subroutine may be used for this calculation.
Finally, depending on the states of the system, control
may be transferred to various segments of the subprogram and the appropriate operation performed. The
versatility of a particular subprogram may be greatly
increased in this manner.

Cable tension program
An application to which this'method of 'Solution was
applied was the stress analysis of a suspended cable.
Analysis for a uniformiy loaded cable does not give an
acourate picture of what actually happens under environmental conditions such as wind and ice or for concentrated loads.
The cable in Figure 3 is suspended between two points,
A and B. The stress conditions may be considered
forces acting on the cable at certain positions and are
represented by the k weights.
By writing the static equilibrium equations for each
elemental segment, a set of equations for expressing the

1--

7~'O"'~

1c

r

/11

/1--------W _
N 1

w,

FIGURE 4-Suspended cable under stress

111

change in each direction as a result of each load is
obtained. From these equations for eaoh segment, the
total stress on the cable in each direction may be determined.
The position of B calculated by this method will not
coincide with the actual position of B. A set of nonHl1ear
equations expresses the change in the position 0 .. B.
As this change is minimized, the calculated tension L 1.
the cable approaches the actual tension.
The loads on the cable may represent any environmental conditions either singly or multiply. Analysis of
the stress performed in this way gives a much more
accurate solution that the assumption of a uniformly
loaded cable which was previously used.
This problem is a good example of the extended
capabilities that are available with the external subroutine to compute the function evaluations for the
nonlinear solution subprogram. The external subroutine
which we will call CNTRL acts as a monitor to determine what operations· will be performed in a second
subroutine, CABLE. The CABLE subroutine reads the
data, computes the function evaluations and calculates
the final state tension. CABLE, in turn, calls a second
subroutine ELEM to evaluate the components of the
equations which are evaluated in CABLE. The complexity of the equations and of the individual elements
is such that this approach greatly simplifies the programming.

Applications to functional optimization
Finding a minimum of a functional of several variables is a frequently encountered problem. Many optimal
control problems fall within this category; so with an
appropriate set of equations for the problem this subprogram may be used to find a solution.
Both a minimization problem and an optimal control
problem will probably have constraints on the solution.
In a control problem both initial and terminal constraints on the state and costate variables and inequality constraints on the state and control variables may
be expressed as a penalty function in the formulation of
the problem. Lasdon8 and others have derived a method
of approach involving the conjugate gradient technique
which may be adopted to the given subprogram.
The determination of stability domains for nonlinear
dynamical systems also involves functional optimization. As in the optimal control problem; provision must
be made for the constraints that operate on the given
system.
The second method of Liapunov may be used as a
theoretical basis for stability determination.
A nonlinear dynamical model may be expressed as
the following n~dimensional system of autonomous
state differential equations,

112

Fall Joint Computer Conference, 1968

--.-------------------------------------------------------------------------------------x=

Ax

+ f(x)

= g(x), g(O) = 0 . .

(25)

where f(x) contains all the nonlinear terms.
The method is based on choosing a quadratic Liapunov function V which yields the largest estimate of
the domain of attraction for the system given in equation (25).
. Figure 5 shows the projection in two dimensions of
the quadratic Liapunov function.
To find the optimal or largest stability domain, one
needs to maxiI:niz'e the area of the ellipse represented by
Vex) = C subject to the conditions Vex) ~ 0 and x ~ O.
A complete discussion of this problem is given by
G. R. Geiss.'

Hydraulics network
The analysis of a hydraulic cooling system is a specific
example of how the subprogram may be used in network analysis.
The temperature drop across any heat exchanger may
be calculated if we know the corresponding pressure
drop. If we assume that the positions of the valves are
held stationary, then from the conservation equations
that describe the system, one can determine the pressure
drop across each heat exchanger. With the known
environmental conditions, the external temperature in
the vicinity of each heat exchanger may ultimately be
determined.
On the other hand, if a specific external temperature
is desired, the position of each valve may be calculated

Ii(x)0

OOMAINOF
ASYMPTOTIC
STABILITY
~

__ ...::::.v..:::.
.(

ONE OF A SET OF
NESTED ELLIPSES

Ii(x) >0

V(X)=.C

to give the proper flow through each member to cause
an appropriate preSsure drop. A very general program
may be written to analyze a very general network. The
elements and their connections may be read into the
computer along with the various parameters that are
necessary. The complete process of analyzing and
solving the network is supervised by a program which
will eventually use the subprogram for solution of
simultaneous nonlinear equations.
As networks become more complex, this approach
will greatly reduce the time spent in tedious calculations.

Application to statistical modeling
Many statisticians are involved in constructing
models on the basis of experimental data. The model
may then be used to draw conclusions and predict
future outcomes. Frequently these models are nonlinear and will result in nonlinear equations. After' a
model has been developed, its accuracy must be constantly verified.
Using the equations of the model and the equations
that describe the data the validity of the model may
be determined. Since the model is assumed to be
nonlinear, the resulting analysis will involve simultaneous nonlinear equations.
Other statistical applications that may require the
solution of a set of simultaneous nonlinear equations
are nonlinear regression analysis, testing likelihood
estimator functions and survival time analysis. The
many fields that use decision theory would then have
the same applications.
As a simple illustration of the preceding application,
suppose that it has been observed that in a sample of
two hundred persons, twenty-two possess a certain
genetic characteristic. Suppose, further, that the characteristic is inherited according to a hypothesis which
predicts that one-eighth of those sampled can be expected to possess the characteristic. The model would be
a frequency function that would enable the observer
to infer' future outcomes and detect disagreements with
his theory. The solution of an appropriate set of nonlinear equations will express the relationship between
the model and outcome. By this type of analysis the
hypothesis may be accepted or rejected or reformulated.
CONCLUSIONS

v(x). .~:

'1 cf-----+¥---4I___-......:...------+ . . - - - - - - ~----+"o8F.1I

FIGURE 13-Flow chart of the new processing method for the
case of 8 real inputs

eigh.t real input points is shown in Figures 12 and 13,
respectively.
In Figure 13 we changed the output numbers which
are larger than four to output numbers smaller than
four by use of the following formula:
(59).

This formula results from the foldover of the data
when only real inputs are used. This can be seen from
Figure 12, when only real data are used, since SF2, SF!
and SF1h will be equal to SFe, 8F7 and SFs respectively
due to the Q's being equal to the P's.
To compute the required number of operations, start
with the addition and subtraction operations. From
Figures 12 and 13 we see that after every -j multiplication there is a saving of two additional operations. The
number of -j multiplications is easily seen, by inspection

Real additionlland lIubtractionll =

i

N(II-l)+Z-N+Z =

~

(311-5)+4

(61)"

The number of multiplication operations for the
real input case is the same as for the complex case. The
number of multiplication operations for the complex
case is given by equation (10). Therefore, the total
numLel' 0: real rr.."!Jlti:;::,lications for the real input case is
equal to:

Real multiplications

=~

(1I-3)+Z.
(62)

Presently, the described method for computing the
Discrete Fourier Transform is limited to numbers of
data points which are powers of two. It is the belief of
the authpr that the method can be extended for any
number of data points. This belief is based on similar
types of calculations for the special cases N = 6 and
N = 12. The author also believes that the described
method requires, in general, the minimum number of
additions and multiplications for both the complex and
the real case. This is aJso based on analyzing the cases
for small values of N.
Since there are many variations of the Cooley-Tukey
Algorithm, the author hopes that other, more streamlined, variations will be developed· for this algorithm.
Such streamlining should reduce the problems in the
control logic when this algorithm will be programmed
for computation. by a digital. computer. In any case,
this algorithm should result in considerable saving in
time when extended calculations with a large number of
data points are required.
The method for the real case was developed together
with Mr.13ertram Goldstone, a friend of the author who
works at Raytheon Company, Bedford, Massachusetts.

Non-linear interactive stepwise regression analsis
in a time-sharing environment
by LETA ROBERTS EDWIN·
SY8troniC8, Incorporated
Ann Arbor, Michigan

and
ALLAN I. EDWIN
Univer8ityoj Michigan,
Ann Arbor, Michigan

INTRODUCTION
Time-sharing techniques have created an environment
that is ,capable of supporting a sophisticated generation
of mathe~atical programs. This paper discusses one
s~c~ pro~ram fo~ non-li,near stepwise regression .analySlS In an InteractIve mode. The principal improvements
of this implementation over standard regression programs are the inclusion of the programmer in the controll(JOp (thereby allowing on-line modification of the
stepwise regression analysis and non-linear term selection procedures) and the ability of the program to modify itself, i.e., learn, from the results of previous passes
of the analysis over the data.
Regression analysis is a powerful technique for summarizing (modeling) collections of data. The great
speed of digital computers now makes it a practical
tool as well. Basically, this form of modeling formulates
a regression equation which optimally fits data sets
that have typically been gathered via experimentation. Since the resulting equation concisely summarizes
the characteristics or patterns of the data it can be
used to predict future (causal) relationship~ or to de~cribe an entire past process (random), based upon the
information sampled.
In order to fully appreciate the flexibility and increased utility of the interactive program described in
this paper, one must be aware of the historical development of mathematical programs designed fQr general
use. In order to fill the ever increasing demand for spe-

cial purpose programs not supplied by the manufacturer or developed "in house" by or for the user, it
has usually been necessary to utilize existing batch
processing programs whose limited flexibility often
diminished their usefulness in particular applications.
For example, batch processing implementations of
regression analysis have been complex numerical programs that allow minimal interaction (if any) between
the man and the machine. Moreover, even the best of
these regression analysis programs were hampered by
the profusion of control cards needed to communicate
with the program, the likelihood and frequency of errors on data cards, and the lengthy turnaround time
between runs. Then, once the regression equation had
been formulated, a superfluity of printed output had to
be scanned in order to evaluate the data and the resulting equation.
Time-sharing, i.e., the ability to allow many users to
"simultaneously" share the same computer facilities,
has given birth to the "computer utilities." These companies usually provide their subscribers access not only
to the computer hardware and programming languages,
but also to a library of application programs.
For one such computer utility the author has created
a flexible general purpose program for non-linear stepwise regression analysis in the form of an independent subsystem. The design of the program (called
COMSTAT) reflects advantages in the following areas:
1. Tailoring the program to the user
2. Implementing the statistical method
3. Integrating the subsystem into the time-sharing
environment.

*Fermerly with Com-Share, Incorporated, Ann Arbor, Michigan

127

128

Fall Joint Computer Conference, 1968

Tailoring the program to the user
COMSTAT allows the user to become an active
participant in the program's activity. At critical points
in its execution, the program allows the user, via the
teletypewriter, to exert control over the program's flow
and output. COMSTAT provides for personalized data
storage allotment so that on a small data run the user
will not be penalized for the large data capabilities also
possible in COMSTAT.
As will be seen, the user can insert or delete terms
from the equatio,n as the equation is developing. Thus,
a scientist may use COMSTAT as an effective tool for
model development. He can examine different models
on several runs and gain insight into the inter-relationship of the variaples of interest. These powerful abilities
are available to the scientist who is not a sophisticated
programmer, since the program design stresses a simple
execution for the user.

sent a brief-formulation of the classical stepwise regression method.

Statistics
Multiple regression analysis is a modeling technique
principally concerned with finding a mathematical
relationship of the form:
Y = b o + a 1f1 (xl,X2, ... x,,)

+ ... + a"f,,(xl, X2, ... x,,)

a) fl(XI, X2, ... x.)

=

Xl2X7Xai -a non-linear term with
highest power two

b) f2(xl, X2, .. x,,)

=

XaX7

c) fa(Xl, X2, ... x,,)

=

Ln(x2) -a non-linear term

'-f

Integrating the subsystem into the time-sharing
environment
By writing COMSTAT as a subsystem, it was possible to have the program simultaneously accessible to
many users of the system. Implied in this decision is
that COMSTAT, like all other subsystems, would
contain a "command dispatcher" which recognizes the
user's command and executes the appropriate block of
machine instructions.
The capabilities of the Com-Share System substantially influenced the objectives and design of this program. These capabilities include: the size of core storage,
data and program storage and accessibility, the extensive on-line editing capabilities available, the virtual
elimination of turnaround tim~, and the memory relocation capabilities.

Mathematical development
Before discussing the implementation of user interaction and learning procedures, it will be useful to pre-

(1)

where b o is a constant term to be included, if necessary.
f,(xl, X2, ... x,,) represents a general term that can be
either linear or non-linear, as the examples below show: .

Implementing the statistical method
. COMSTAT's designers recognized that the large
size of the program an4 the need to store large quantities of data for an analysis would require a sizeable
amount of core storage; additional storage was necessary for a square correlation coefficient matrix needed
in the stepwise method. Finally, learning techniques
required storage to save the significant results of preceding passes for use in future passes. The program,
therefore, has utilized the dynamic memory relocation
capability of the Com-Share operating system to handle
these memory requirements in a most efficient manner.

+ a 2f2(xl,X2, ...x,,)

-a non-linear term with
highest power one

- a linear term
The method arrives at an equation of the form of
Eq. (1) which gives a "best" fit of the data according
to the least squares criterion described herein.
The statistics presented here will be developed for the
linear case without loss of generality since a substitution can be made to transform a non-linear term into a
linear term.

Example:
Y = alx12xa + Ln (J4) + aax7
would be transformed according to:

b)

Z2

c) Za

= Ln ("')

=

X7

into the linear regression equation:
Y = alZI

+ a2Z2 + aaza

which is a linear equation in
the new parameters, Zl, Z2~
and Za.

The regression equation aims to minimize the sum
of the squared residuals, (the deviations between the
observed points and 'the predicted points). If Y 1, Y 2,
... Y m are observed points for m sets of observations

Non-Linear Interactive Stepwise Regression Analysis
and Y1', Y 2', . . . Y fT.' are the estimated or predicted
values for use in some predicting equation, then what
is to be minimized in order to obtain the regression
equation is:
m

L:

(Yj - Yi)"

i-I

where: m is the number of observed points.
This minimization is called a least squares criterion
since the quantity to be minimized is the sum of the
squared deviation; where (Y i - Y /)2 is called the
squared deviation of the observed value of the dependent variable, Y, from the estimated value of the dependent variable, Y', for the ith-observation.
This type of analysis is used in causal relationships
between several independent variables and one dependent variable, i.e., a causal relationship is developed to
predict a future -effect based upon gathered past observations.
Random processes can also be described by a regression equation, but there is no guarantee for extending
the resulting equation to other data sets of random
variables. In this case, the regression equation describes a past relationship based upon a sample of
the past and nothing can be said about the future in a
random process unless more is known about the nature
of the process.
Normality and a common variance are assumed for
the data so that th~ F Test for significance can be applied with reliability in term selection. A 2-tailed F Test
is used with the level of significance set by the user.
In order to measure the quality of the regression
equation developed, certain statistics are computed at
each step in the analysis. The Standard Error of Y,
also known as the Standard Error Estimate, is computed to estimate that part of the variance in Y left
unexplained by the present regression equation. The
CoefficIent of Determination is the fraction of the
total variance in Y which is accounted for by the present regression equation. The Multiple Correlation Coefficient is the positive square root of the Coefficient of
Determination, and ranges between 0 and 1. This statistic is preferred over the Coefficient of Determination
in estimating the amount of variance in Y explained by
the regression equation.
The stepwise process for· constructing the multiple
regression equation proceeds by inserting the most
significant term not included (if its significance exceeds
the criterion set by the user). Then it checks all terms
in the equation to insure that they still contribute significantly. If one is found that doe~ not meet the in. elusion criterion, it is del~ted from the equation. This
stepwise proce~s continues until there are no longer any

129

terms significant enough to include, nor do there remain
any included terms that should be deleted.
Note that during the stepwise process terms are often
included which are not found in the final equation. This
is because a combination of terms may be present at a
later step that may account for most of that portion of
the variance of the dependent variable attributed to
an earlier term. The earlier term's remaining contribution to the variance is then insignificant and so the term
is removed from the equation. Figure 1 illustrates an example of this sequence.
Useful statistical definitions in conjunction with a
How diagram are included as an appendix. The appendix, together with the references cited should provide
the interested reader with sufficient background for
further work in this area.

Interaction with the stepwise process
Because COMSTAT operates in a time-sharing environment it becomes practical to allow on-line interaction since the computer is not forced to wait for a user
response, but rather can process other tasks during the
delay. Thus at each step in the equation development
COMSTAT allows the user, if he desires, to insert or
delete terms, i.e., the user can modify the equation at
any step.
Since the user has had the benefit of inspecting the
intermediate statistical results, he may want to try
Variance of Y

Varian"ceof Y

2. & 3.

1.

Variance of V

4.

PROCEDURE
1. Xl makes the greatest significant contribution, therefore it
is included first.

2. X2 is included next because it accounts for the greatest remaining amount of the variance of Y
3. X3 is included since it still accounts for a significant portion
of the variance.

4. W,-" Xl is tested, it is found no longer to be significant,
since most of its Contribution is subsumed by either X2 or X3'
It is therefore excluded.

FIGURE I-Term inclusion-exclusion procedure

130

Fall" ,Joint Computer Conference, 1968

some combination of terms not chosen by cOMSTAT.
Also, since the form of the equation may depend on the
I order of term selection (particularly in the non-linear
, case), the ability to steer the course of equation development may allow the user, to develop alternate models
for his data. It should be noted, however, that if the
user adds a term that is not significant on .the basis of
the existing equation, cOMSTAT will reject it. Also, if
the user rejects a term that has been chosen, either by
COMSTAT or himself, and that term remains significant on the basis of this and subsequent equation modifications, it will be automatically reinserted.
Thus, while the user may m6difY the ,development of
the equation, he is preventeg from including insignificant terms or leaving out tenus that must be included.
The alternate models developed can be compared and
may suggest new and fruitful lines of inquiry.

of possible exponents, then one may write a closed expression for the number of possible non-linear terms.:

t (J! (MM!-

,

Learning
In order to accommodate reasonably complex nonlinear terms, cOMSTAT must have the capacity to
select the significant terms from a number of possible
non-linear terms that could be too large for analysis in
a single run, and perhaps so large as to make complete
analysis prohibitively expensive. A method has been
incorporated into cOMSTAT which will run a series of
passes over the data, and analyze sets of non-linear
terms chosen from the set of all possible non-linear
terms in such a way as to converge on a regression equation. Since this method stores information about the
nature and makeup of terms found significant in previous passes for use in the selection of terms for subse- .
quent passes, the method is called learning.
During each pass of regression analysis a new set of
non-linear terms, which include the non-linear terms
found to be significant in the previous pass, is tried.
This "insures that the resulting regression ,equation will
be at least as significant as that of the pass before.. The
additional terms in the set are selected in. a manner
that takes advantage of knowledge about term characteristics gained from previous passes; terms may also
be inserted int~e set by the user through interaction.
To explain the learning mechanism more fully, it is
necessary to examine the nature of term selection. The
relevant characteristics of a non-linear term are:
1) the number of interactions of pure variables to be
allowed in a general term;
2) the actual pure variables which are to interact;
3) the functions (powers) of each pure variable selected.

If M were the possible number of pure variables, K
the possible number of interactions, and N the number

=

J=l

) (NJ )
J)I

In the following example, there are six pure variables.
If a maximum of four of these variables, each with an
exponent of 1 or -1, can interact in a term, the number
of possible terms would be:

T

= ~21 +~22+~28 +~24
1J 51

= 6 X 2

2141

31 31

41 21

+ 15 X 4 + 20 X 8 +

15 X 16

="472
Since the relevant characteristics listed above form
3 populations each containing an independent finite
number of elements, the learning mechanism justifiably
utilizes techniques for random sampling from finite
populations in generating the non-linear terms used in
each pass.
The process for generating a term to be tested in a
pass of the regression analysis begins with the selection
of the number of interactions that will be included in
that term. This selection is from a population that has
as members the numerical values of all allowable levels
of interaction. Associated with. this population is another .population which contains as elements the selection probabilities for each corresponding element in
the first population.
Example:

Assume the maximum level of interactions is ten.
These levels form a set containing 10 elements as
shown:
element number:
levels of intera8tWn:

1 2 3 4 5 6 7 8 9

10

1 2 3 4 5 6

10

7 8 9

SetA

For this example let us assume the user has no prior
knowledge (as would usually be the case in a first pass'
over the data). In this case equal probabilities would be
assigned to every interaction level, i.e., each element
would be assigned a probability of Xo as shown:

Non-Linear Interactive Stepwise Regression' Analysis
element number:

1 2 3 4 5 6 7 8 9 10

probability for
corresponding
level of interaction:

111 1 1 1 1 1 1 1
10 10 10 10 10 10 10 10 10 10
SetB

'Next, a random number between zero and one is
generated. Then the term-generating mechanism proceeds to add together the probabilities of elements
(starting with the element that corresponds to' the
lowest level of interaction) until the random number is
exceeded. The level of interaction chosen for the terin is
the level whose probability was the last one added with-:out exceeding the random number.
In the above example, a random number 0.76 was
generated. Thus, the probabilities of levels are added
until 0.76 is exceeded. The last level added is 7 and so
this term will contain seven interactions.
The mechanism then selects the 'pure variables to be
included in the term. This is done in a manner similar
to that for selecting the level of interaction. Each variable is assigned a probability of being chosen; with no
prior knowledge, the probability for each variable =
1
. hI ) . The program generates as many
(No. 0 f Vana
es
random numbers as there are interactions, and then
utilizes the same sununing scheme as outlined above.
However, if a variable has already been chosen for inclusion in a term, and it is selected again, the mechanism rejects it and generates a new random number.
Finally, the mechanism must select an exponent for
each variable in the term. This procedure is similar to
that for the pure variable selection except that here
duplication is allowed.
In each pass of the analysis a specified number of
temis are selected in this manner. Upon completion of
the pass, the results are used to bias the learning arrays,
which contain t4e probabilities associated with the
elements of each of the three populations, thereby
biasing all future passes.
Example:

In a pass XIX3-t was found to be significant and
X1XaXe was found to be insignificant. The following probability modifications would be made:
1) probability of 2 interactions is increased;
2) probability of pure variables Xl and Xa are in-

creased;
3) probability of exponents 1 and -% are increased for the respective variables;
and
4) probability of 3 interactions is decreased;

131

5) probability of pure variables Xl and Xa and Xe
are decreased;
6) probability of exponent 1 is decreased for the
respective variables.
The form of these learning arrays and the biasing
procedure will be discussed in some detail later in the
paper.
COMS'TAT'8 implementation

In programming a subsystem, the programmer must
utilize the computer system's inherent capabilities. This
section examines the actual implementation of the design. The first part discusses the time-sharing system's
contribution to COMSTAT, and the second discusses
the software features incorporated into COMSTAT,
with examples. Figure 2 summarizes these relationships.

System's capabilities utilized by COMSTAT
The regression analysis subsystem can handle input
and_ output on-line via the teletype or paper tape. However, initially placing the correct input on a disc file can
save time for a user during program execution in many
input/ output tasks. These files may be used for program
or data storage and may be in binary or symbolic form.
The storage and retrieval of files created by a user are
automatically handled anywhere within the Com-Share
System by the EXECUTIVE system. This feature allows a user the flexibility of accessing the same file in
any subsystem. Thus, a user is able to create a data
file within the text-editor subsystem, QED, and then
use it within the regression analysis subsystem.
Ample file protection is provided by the system $0
that one user may not access another's files unless the
file owner has defined the file for public use. This gives
a user the flexibility to access files created or used in
separate accounts. Practically, this can aid the user by
allowing him to be in one account and executing COMSTAT while someone else, in another account, could be
simultaneously creating or editing data files to be used
in another analysis.
Core memory in the Com-Share System is divided
into discrete segments called pages. Each of the 32 pages
in memory has a capacity of 2048 10 words (cells). Each
user is ~llowed a maximum of eight pages at a time, of
which some may belong only to him (private pages) and
some may be shared simultaneously by .any number, of
users (shared pages). Although these pages may no~-be
contiguous in core, they appear to be so, to the user" as
a result of the virtual memory mapping technique. The
pages (private and shared) allocated to the user are'

132

Fall Joint Computer Conference, 1968

referred to in his map. Referencing for this core memory
is provided by pseudo-page numbers.
The dynamic memory relocation capability enables
COMSTAT to maneuver the pseudo pages within core or
in and out of core; the physical process of maneuvering
these pseudo pages is referred to hereafter as relabeling.
To make relabeling both practical and economically
feasible, pages relabeled out of core are placed on a rapid access device (RAD). This is done because "swap"
time between the RAD and core is much faster than
when the disc units are accessed.
Since stepwise regression analysis can be functionally
broken down into section& with no loss in continuity
between sections, the technique lends itself well to implementation on a time-sharing system with dynamic
memory relocation capabilities. This statistical analysis requires such capabilities since the quantity of program code alone required to handle this application is
sizeable, not to mention the vast quantities of data
storage a user may need in a single run.
Also, it is this relabeling technique that makes it
~ossible for the text-editing subsystem, QED, to be
mcorporated into COMSTAT.
The ability to rerun COMSTAT on the same data
with the same or different subsets of variables , without
restarting the entire subsystem is provided by COM-

Conversational
and Interactive
Stepwise Regression
Analysis

Efficient
Flexible Input

Data
Allotment

STAT since it provides for the relabeling of a master
data table in and out of core for each run. This allows
a user to experiment with the modeling process by
specifying differen,t subsets of variables for each run.
In the non-linear case where many passes are required
to produce a significant non-linear model, relabeling is
essential in handling the added tasks placed on COMSTAT in th~ term selection process and in saving the
learning arrays from pass to pass.
The use of QED, the on-line editing subsystem, within COMSTAT is noteworthy since both are independent
subsystems which are usually accessed through the
_ EXECUTIVE system. COMSTAT sets up linking information in a specific area for QED, and then transfers
control to an area of code in COMSTATwhich relabels
COMSTAT's code out of core and onto the RAD, while
it relabels QED's program code into core from the
RAD. Now, with QED in core, the program location
counter continues specifying instructions from the same
area as it did before the relabeling had occurred, except
that now QED's code will be executed. QED saves the
linking information so that it can relabel and restore
COMSTAT, without interruption, when QED has completed its job. In addition, QED passes to COMSTAT
the edited pages of text or· data for direct transfer into
COMSTAT's allocated storage area. The effect upon

Learning

Selective Output

Conversational
Command
Dispatcher

System Capabilities Utilized Above:

oo
CD

o

Conversational Abilities
Relabeling
QED Editing
Disc File Management

FIGURE 2-Functional representation of COM STAT with related capabilities

Conversational
Error Detection
and Correction

Non-Linear Interactive Stepwise Regression Analysis
the user at the teletypewriter is only the change of subsystem readiness symbols and commands; response time
is continually steady as in normal use.
However, by utilizing QED within COMSTAT, the
user is afforded the same range of capabilities as available in the QED sybsystem, thereby simplifying and enhancing the input procedure as well as error corrections.
Inherent in a time-sharing environment is the online man-machine interaction, "conversational" ability.
This permits a wide range of valuable activites as has
been discussed.

Software features
In COMSTAT, three pages of shared code are allotted for the program. The program is divided into a control page, an input and learning page, and a statistical
analysis and output page.
Depending upon the user's data requirements, COMSTAT will also use 4 to 11 private pages of core storage.
The number of data storage pages required can be
approximated by:
pages

~ 2 + f(n + 1)21 + fen)
1024

X (m)l
1024

where f 1 represents the smallest integer not
exceeded by the contents.
n

= total number of variables

m

= maximum data set number

and

Control page
Whenever COMSTAT is used, the control page remains resident in core and commands other pages to be
relabeled or swapped into and out of core from the RAD
as needed, thus controlling the entire subsystem internally.
This internal control is triggered by the user via a
teletype through the use of "commands" to COMSTAT. These commands are translated, in the control
page, into internally understood commands by a section
of program code referred to as the command dispatcher.
Presently, there are ten such commands. Those commands that are unique to COMSTAT (not standardized
system commands), are English words whose meanings
are evident.
In very real sense, this section-by-section coinmand
of the program execution in a time-sharing environment
gives COMSTAT a "conversational" quality. Furthermore, in the course of executing a command, vital information may be needed from the user. COMSTAT

a

133

obtains such information, as needed, through a conversational exchange with the user.
Input and learning page
This page handles all the input activities and learning
procedures incorporated into COMSTAT. The full textediting capabilities of QED are provided ih most of the
input commands.
Presently, the subsystem is capable of performing
analyses on a maximum of 614410 data entries, or 6
pages of data. The total number of variables in an
analysis pI'edeterminesthe number of data sets allowed.
Thus, if an analysis were to be done for 30 variables
(29 independent variables plus 1 dependent variable),
153 data sets could be analyzed, for a total of 612010 data
entries.
There are, however, limits to this flexibility in dimensioning. The upper limit presently on the number of
variables is 44 (43 independent, 1 dependent). The
upper limit on the number of data sets is 1000.
The data requirements for regression analysis vary
so widely between users that the large data capacity
just described necessitates different use of storage for
each user. Conversatioll\al dimensioning has 'been implemented to allow each user to define his specific requirements for data allotment and structure. Likewise,
the program sets aside only enough storage to' handle
the user's data. Thus, the fewer the variables and/or
data sets in an analysis, the less storage will be used.
This means that fewer page swaps will occur, and connected line time to the computer via the teletypewriter,
and central processing unit (CPU) time used will be
reduced appropriately. Thus, the user with a small
amount of input will not be penalized because the program is also designed to accommodate large data input.
In the input sequence, all errors detected by COMSTAT are communicated to the user, via a printed
teletypewriter message. The user is provided with an
opportunity at the time of detection to correct the
input errors; therel?y eliminating the need to correct
and resubmit the input, or to completely restart COMSTAT, as would be the case in a batch processing environment.
Also, on this page of code is COMSTAT's learning
mechanism which is oriented around 3 learning arrays
("order of interaction" array, "variables entering interaction" array, and the "exponents of the variables"
array). It is from these 3 arrays, that COMSTAT develops a specified number of non-linear terms for each
pass over the dataaccording.to the method outlined.
There are limits set on each learning array. Presenty,
a limit of 4 is set on the number of variables allowed to
interact in anyone term. T.his restricts the "order of

134

Fall Joint Computer Conference, 1968

interaction" array to contain 4 entries, (1, 2, 3 and 4
interactions). The maximum number of entries in the
"pure variables entering interaction" array is preset by
the maximum number of independent variables allowed
in any analysis, (43). In the "exponents of the var.iabIes" array, the permissible exponents are;

f(l)

+1

f(2)

1

1
3

-

f(8) =

in the present regress~on equation, and "punishing" the
characteristics of insignificant terms.
This "rewarding" is done by multiplying the elements
(probabilities) in each learning array which correspond
to the respective term characteristics of the significant
terms, by the respective learning constants. Likewise,
"punishing" term characteristics is done in the same
manner as "rewarding," except that each respective
array element (probability) is multiplied by the inverse
of the learning constants.

f(9) = 3
Learning Array

1
f(3) 2

f(4)

-1
2

f(5) =2

f(IO)

-3
order of interaction

f(Il) -

f(12)

1
4
-1
4

f(6)

-2

f(I3) = 4

f(7) -

1
3

f(I4) = -4

This last array is a doubly dimensioned array of maximum size 602 locations (14 by 43).
In each pass of non-linear regression analysis, a specified number of non-linear terms are chosen by COlV1STAT to be tried in that pass. Some of these terms are
developed by utilizing the learning arrays and optionally some are specified by the user; the remainder
are the terms from the last pass which were found to be
significant enough to include in the evolving regression
equation.
Terms inserted by the user during the term generation process alter the selection process and will therefore affect the form of the learning arrays for the next
pass.
If it is possible to try 10% or more of the possible
terms in a single pass, C01VrSTAT gives the user the
option of deciding whether the term generation process
is to be done by the learning mechanism or in an ordered
manner. This means that whenever the total number of
terms could be tried in a "reasonable" number of passes,
the learning selection process is often more costly and
time consuming than generating all of the terms in an
ordered manner and trying a specified number in each
pass until all of them have been tested.
The biasing of term characteristics for each term
tried in a pass is done by "rewarding" the characteristics of terms found to be significant enough to include

variables entering
interaction
exponents of variables

Rewarding

Punishing

(~
)'"
.. 5

(.5)

Gr

(.5)

C5)~

113

113

1

(.5)1.5

After all the passes have been made for a non-linear
analysis, COl\1STAT provides the user with a way to
save the learning arrays on a disc fIe for future use and/
or onto the RAD for immediate reuse in a new analys:,s
over the same data.
Statistical analysis and output page
The statistics computed on this page are those outlined in a previous section. In addition, in COl\I{STAT's
stepwise term selection process, the user is provided
with the ability to actively interact at each step byspecifying a term to include or delete from the present regression equation. This interaction does not harm the
stepwise process at all, as explained in the previous
part.
Selective statistical output is produced by this page.
The user conversationally specifies what output he
desires by answering the pertinent questions posed by
COMSTAT.
One further point to be noted, which is applicable to
all 3 pages of program code, concerns error detection.
As part of the natural logic flow of COl\1STAT, error
traps have been placed strategically throughout the
code to assist a user in any difficulties he may encounter
while executing. Wherever relevant, detected errors
critical to proper program execution are pointed out to
the user for correction before processing continues. For
example issuing a command out of sequence which
will later result in an ambiguous program state is de-

N on-Linear Interactive Stepwise Regression Analysis
tected whenever possible and noted to the user, failing
to supply critical information as input will be flagged as
an error, or incorrectly answering any of the conversational COMSTAT questions will be noted followed by
the opportunity to reanswer the question.

Execution examples
The ten commands which can be issued to COMSTAT are:
Command

Function

Inp~t via QED a title to be used as a
heading on output.
MAINInput via QED the names of all the
variables in the analysis.
SUBSET~ Input via QED the names of a specific
subset of variables in a run.
NUlVIBER-Specify the number of variables in the
run without naming them. This command does not allow for subsets to be
run.
DATAInput via QED the data sets for all the
possible variables.
FILEInputs a title, the-main variable
names, the data, and any number .of
subsets, from a disc file.
RUNBegins a run of regression analysis.
HELPGives a summary of how to execute
COMSTAT and what general conventions are used throughout.
QEDGives the user complete QED textediting capabilities.
Used to exit from COIVISTAT back to
EXECUTIVE system.

1. TITLE2.
3.
4.

5.
6.

7.
8.

9.

Any of these commands may be abbreviated by typing 1 or more letters.
In the following examples note that the user-generated
type is underlined, while the computer-generated is not.
A right parenthesis, D], in the first position of a line is
COMSTAT'S readiness symbol, whereas a star (*) is
QED'S readiness symbol. These readiness symbols
indicate the respective subsystem's readiness to accept
a legal subsystem command from the user. Letters
with a superscript c, (for example, Ge) are non-printing
and represent a set of characters interpreted by the subsystem to accomplish certain activities.· For example,
in QED a Dc is interpreted as an indication that the
present input or line is complete up to, but not including
the Dc.
Figure 3, outlines the simplest complete execution of
the subsystem-specifying the three COMSTAT commands NUMBER, DATA and RUN. One can see the

135

typical COMSTAT-user conversational exchange within the first 2 commands. Two QED commands are (APPEND and EDIT) used internally in the DAtA command to input the data and to edit the first line of the
input, respectively. The SCO command is a special
QED command which is interpreted by QED as the end
of all QED tasks and an indication to return to the
original subsystem.
The less than sign, «), on the end of the input is
placed there to be interpreted by COMSTAT a.s an
indication that the input sequence is terminated.
The control character, Ze, within the QED EDIT
command is just an indication to QED that the user
wishes to copy the line to be edited up to the characters
typed immediately following the Ze, in this instance,
up to the first four, (4).
Within the RUN command, many alternative executions can be effected by answering the conversational
questions differently. One such execution is outlined in
Figure 4. When the int~rmediate steps are to be printed,
the user is given, at each step, the statistics computed.

)!lliM
NUMBER OF UNNAMED V ARIABLES=
)~

IS THE DATA TO BE WEIGHTED?

N

MAXIMUM DATA SET NUMBER=

-±

INPUT DATA:
*APPEND

2,1.3,1, .998, 3, 1.007, 1.15, 1.4; 7,
.979,1.2,1.005( DC

*1.!ill.!!
2,1.3, 1, .998,3, 1.007, 1.15, 1.4,7,

UC

2, 1.3, 1, .998, 3, 1.007, 1.15, 1.4z.1..

)B!lli.

FIGURE 3-Basic COMSTAT input

.l.

136

Fall Joint domputer Conference, ~968
FIGURE 4--Sample interactive execution and output

)!!lli
IS THIS ANALYSIS LINEAR?

.x.'

IS THERE A CONSTANT TERM IN THE REGRESSION EQUATION?

..L

USE STANDARD PROBABILITY LEVELS FOR ENTERING AND DELETING TERMS?
PRINT INTERMEDIATE STEPS?

USER INTERACTION IN TERM SELECTION?
STANDARD ERROR OF Y=
VARIANCE= 1.496666667

.L

..L.
L

1.223383287

STEP NO. 1 :
COMSTATS NEXT CHOICE: INCLUDE A
VARIANCE CONTRIBUTION FOR THIS VARIABLE=
I? N

0.996318557

IN STEP 1 VARIABLE NUMBER 1 (A) ENTERED.

F LEVEL=

811.8977962

STANDARD ERROR OF Y= 0.090911i66
MULTIPLE CORRELATION COEFFICIENT: 0.998157581
COEFFICIENT OF DETERMINATION= 0.996318557
CONSTANT TERM~ 0.196499239
VARIABLE

COEFFICIENT

A

0.95281583

PRINT CORRELATION MATRIX?

STANDARD ERROR OF COEFFICIENT

0.040954715

.1L

COMSTAT SEES NO FURTHER SIGNIFICANT CHOICES.
I?

Y

STEP NO.2:
DELETE TERM? N
INCLUDE TERM? 'Y
NAME OF TERM TO ENTER:

.Jl

IN STEP 2 VARIABLE NUMBER 2 (B) ENTERED,
F LEVEL= 10.7681248
STANDARD ERROR OF Y= .089976531
MULTIPLE CORRELATION COEFFICIENT= .998917872
COEFFICIENT OF DETERMINATION= .997214587
CONSTANT TERM= .069542187
VARIABLE

COEFFICIENT

A
B

~32154726

STANDARD ERROR OR COEFFICIENT

.072342179
.029432178

.147321789

PRINT CORRELATION MATRIX?

N

STEP NO. 3 :
COMSTATS NEXT CHOICE: DELETE B.
VARIANCE CONTRIBl]TION FOR THIS VARIABLE=
I? Ji

.5670453!S

IN STEP NO. 3 VARIABLE NUMBER 2 (B) DELETED,
F LEVEL;: 10.7681248
. STANDARD ERROR OF Y= .089976531
MULTIPLE CORRELATION COEFFICIENT: .998917872
COEFFICIENT OF DETERMINATION= .~97214589
CONSTANT TERM= .196499239
VARIABLE
A

COEFFICIENT

STANDARD ERROR OF COEFFICIENT

.95281583

PRINT CORRELATION MATRIX?

.040954715
N

COM STAT SEES NO FURTHER SIGNIFICANT CHOICES.
I?

N

COMPLETED NO. OF STEPS FOR THIS ANALYSIS= 3
PRINT PREDICTED VS. ACTUAL VALUES?

1:L

RUN ANALYSIS ON THESE DATA SETS WITH NEW SUBSET?
RUN ANALYSIS ON NEW DATA SETS?

N

N

N on-Linear Interactive Stepwise Regression Analysis
FIGURE 5-Flow diagram for statistical and learning processes

Trans(orm matrix elements, ai,j

Note 1:

The sign of VNS is a bookkeeping notation whlch
I
indicates whether the variable is presently in the
regression equation; th
VNS1 ) 0, I
variable not in regression
equation.
vNS (0, Ith
variable in regression
1
equation.

• Remove variable from regression equation

t Include variable in regression equation

J;ES

137

138

Fall Joint Computer Conference, 1968

In addition, if the user requested interaction in term
selection, he is given an opportunity to interact at each
step, as noted in Figure 4 by "I?".

elements of the correlation coefficient matrix. i and j = 1 to n.
(7)

the standard deviation of the it"
variable. i = i to n.

(TZt

CONCLUSION
Although regression analysis is a powerful and useful
tool for constructing mathematical models, many scientists have not utilized the technique. This is perhaps due
in part to inadequate statistical knowledge and in part
to the complex programming techniques required to
employ the batch-processing programs currently a vailable. COMSTAT's statistical capabilities in combination with its conversational execution should interest
many experimenters who have not previously used
regression analysis techniques.
The availability of intermediate results and the user
interaction incorporated into COMSTAT have added
a dimension of utility that the experienced user will also
find very beneficial in the formation of models. Neither
the new user nor the experienced statistician need have
much experience before he becomes proficient in the use
of COMSTAT.
In summary, we s,ee that the subsystem approach to
mathematical programming in a time-sharing environment has great potential. It is hoped that the developmental details presented in this paper will be helpful to
programmers in developing future mathematical programs for general use.

(8)

Xi
Xn

= (Xi +

= (xn

n)

+ n)

the mean value of thei th variable
over all the data sets. i = 1 to n.
the regression coefficients for the L
variables included in the equation.

The weighting factor, Wk, is assigned to each data
set. This allows an experimenter to convey to the program the relative amount of importance (credence), to
be given to that data set. Thus data gathered under
ideal conditions can be weighted more heavily than
data gathered under more trying conditions.

Standard statistical definitions
1. Standard Deviation for i th variable,

m(m - 1)

2. Mean of

ph

variable,

APPENDIX

Xi:

(1)

Xi:

m

2:

In the interest of completeness, this appendix details
the statistical and learning procedures of COMSTAT
in the form of a flow chart, Figure 5, with the standard
definitions listed separately.
The conventions used throughout the diagram and
definitions are:
.

(Xi';

X

Wi)

i-I

(2)

3. Correlation Coefficient for the i th and j th vari(1) n

1 to the number of variables in the
analysis. The first (n -1) variables, (Xl,X2,XS, • • • Xn-l), refer to
the independent variables (terms),
and the nth variable, x n , refers to
the dependent variable, y.

ables:

(3)
(Txi

(2) m

refers to the number of data sets.

(3) mn

refers to the number of non-linear
terms to be tried in a pass of
regression analysis.

(4)

X •• k

refer to the raw values
for the kth data set and the i th
variable. k = 1 to m, i = 1 to n.

Xl.k,X2,k•••• X(n-l)

weighting factor for the k th data
set. k = 1 to m.

X

(Tzi

4. Standard Error Estimate for the k variables
(terms) in the regression equa.tion presently:

S,,1l23 ... k

=

V<

m -

1k

-

1)f: (y, - y',)'
i==1
(4)

where: y i represents the. observed points for m sets
of observations, and y,/ represents the predicted points
from the regression equatIOn.

Non-Linear Interactive

=

Regression Analysis

139

10. Linear transformation on the existing correlation

5. Coefficient of Determination:
r2

Stepwi~e

2
1 _ [em - k - 1) X Su h23 ...
(m - 1) X S.,2

kJ

(5)

coefficient matrix' elements for
or deleted:
a"k X

where:

ak,j

t~rm

for: i

to be entered

k, j

¢

k

for: i = k, j

¢

k

¢

ak,k

m

m

mL y2, - (L: y2,)
i=1

(11)

i=1

(6)

m(m - 1)
6. Multiple Correlation Coefficient:

=Vf2

(7)

7. Variance contribution to the regression equation
for the i th independent variable:
VNS, = a',N X
a"i

aN,i

(8)

1

'for: i

¢

k, j = k

for: i

=

k, j = k

where k is the index of the variable to be included or
deleted from the regression equation.
ACKNOWLEDGMENTS
The authors wish to thank Mrs. Pat Choley ahd the
staff of the Technical Division of Com-Share for their
assistance in the preparation and editing of this paper.

where:
N=n
i = 1 to (n - 1)
and ai,j is an element of the correlation coefficient
matrix
8. Regression Cdefficient :

BIBLIOGRAPHY
1 E L CROW F A DAVIS M W MAXFIELD
Statistics manual

Dover Publications Inc New York 1960 Chapter 6 pp147-t94
2 J E DALLEMOND

b L = a"n X

(9)

UZn.

where:
L = 1 to the number of variables presently included in the regression equation,
i = the index of the variable included,
and n = the dependent variable ind,ex.
9. The Standard Error of the Regression Coefficient:
- S.,/123 . . . . .

SbL -

U:Jt

Stepwise regression program in the IBM 704-

General Motors Research Staff GMR 1991958
3 M A'EFROYMSON

U:Jt

k

X - r:-

vas.,

(10)

Multiple regression analysis

Math.ematical Methods for Digital Computers John Wiley and
Sons Inc New York 1962pp 191-203
4 AHALD
Statistical theory with engineering applications

John Wiley and Sons N ew York 1952
5 F B HILDEBRAND
Introductiof!, to numerical analysis

McGraw-Hill Book Company1llc New York 1956
6 F H WESTERVELT
Stepwise regression with simple learning on the IBM 704-

The University otMichigan Research Institute 1959

Recursive fast Fourier transforms
by G. EPSTEIN
ITT Gilfillan Inc
Los Angeles, California

The development of the Fast Fourier Transform in
notation has obscured the savings that can be
made through the use of recursive properties of trigometric functions. A. disadvantage of the Fast Fourier
Transform is that all samples of the function must be
stored in memory before processing can start. The com.,.
putation in the Fast Fourier Transform occurs after the
receipt of the last sample of the function; there is no
processing of the incoming data prior to this point. Thus·
if there are N samples of each function, and G different
functions (in G "gates" or "channels"), then a total
of GN words must be stored in memory.
The recursive approach provides methods whereby
these memory requirements maybe reduced. These reductions in memory are accompanied by increases in
total computation time; the computation time required
after the reciept of the last sample, however, decreases.
This is accomplished by performing recursive computations on the incoming data as they are being received.
Since savings in memory size must be balanced
against increases in total computation time, it is necessary for any given problem to select that recursive
method which satisfies the given time and memory requirements. For some problems, it is also important to
distribute the computation time in a particular way;
e.g., to minimize computation time after receipt of
the last sample with bounds on computation time during receipt of samples, as might be the case in a real time
spectral analyzer. These considerations are discussed
completely for the example case when N is a power of 2.
In January 1958, Gerald Goertzel, in the paper
"An Algorithm for the Evaluation of Finite Trigonometric Series" in the American Mathematical Monthly,
described an algorithm for reducing the computation
time of finite Fourier series. The method which follows
makes two essential alterations in this algorithm.
First, Goertzel's equations require all samples of the
function to be received before the algorithm can be
applied. Second, his algorithm does not make use of the
co~plex

arbitrary factor technique used in the Fast Fourier
Transform.
These alterations lead to the following equations. Let
the input function be denoted by f(x), so that the spectral components to be obtained are given by
(1)

N-I

2

~-O

N

N-l

2

~-O

N

AK

=

I: f(x) cos..!!:. Kx

BK

=

I: f(x) sin..!!:. Kx,

K = 0,1, ... , N - 1.
Let N have a factor Pl. The method now to. be described
is called Recursive Method 1. Recursive Method 1
computes recursively on PI recursion quantities. Thus
this method requires PI words of memory. These PI
recursion quantities are denoted by R i , i = 0, 1, ... ,
(PI - 1), and each Ri recurses on the N/pi samples
f(PIX

+

i),

X

= 0, 1, "', ( : - 1). The recursive

equations for each Ri are given by

x

= 2, 3,

R i (l)

=

f(i)

Ri(X)

=

21rPlk)
(
)
( 2cos~ Ri x-I

"', (:, -1 ); k

= 0, 1,

"', ( :, - 1 ).

Thus in Recursive Method 1 no computation is per141

142

Fall Joint Computer Conference, 1968

formed during receipt of the first PI samples, and
after that one multiplication and two additions
are performed for each recursive quantity R i , i = 0,
1, "', (PI - 1). This occurs for each value of k = o.

1, "', ( :, - 1 ).
The values AK and BK are computed at the end, after
receipt of the last sample, by

The components AK and BK for each value of K may
be obtained through equations (3) and (4) by 6Pl multiplications and 6Pl additions. These operations occur
after receipt of the last sample of the function, f(N-I).
For each value of K equation (2) requires N -2Pl
multiplications and 2(N-2pl) additions. Thus, the total
computations using Recursive Method 1 for each
value of K are N +4Pl multiplications and 2(N + PI)
additions. If there are G functions to be sampled, the
total number of recursion quantities in memory is Gpl'
This same technique may be applied

(3)

- R.(:' - 2) + f(N -

PI

+ i)

and, setting K = k + wN , by
PI
(4)

w = 0, 1, "', (P, - 1); k = 0, 1, "', (:. - 1) .

These results follow from the arbitrary factor techniqueused in the derivation of the Fast Fourier Transform, and from the following recursive property of
trinonometric functions:
(5) If

S(O) = 0

S(I) = 1
S(y) =

(2 cos 2;'k) S(y -

1) - S(y -

2)

k

1li

RECURSIVE
METHOD

•

MAX, NO. OF MULT.
DURING RECEIPT
OF SAMPLES

MAX. NO. OF MULT.
AFTER RECEIPT
OF LAST SAMPLE

k)

P1 Y
P1
. (27r
then Sln
- - - ) = S()'
y SIn (27r
--

and cos (

21T;,kY)

N

=

S(y) cos (

2;;k )
-(Sy-l)

a

factor P2' This case is called Recursive Method 2, for
which there are PIP2 recursion quantities stored in
memory, and each recursion quantity recurses on
N
- - samples of the function. The extension of the
PIP2
above equations for this case is obvious. The total number of recursion quantities in memory for Recursive
Method 2 increases to GpIP2, and the total computation
time decreases from that required by Rescursive
Method 1, although the computation time required
after receipt of the last sample goes up.
Continuation of this process for factors PI, P2, .. generates Recursive Methods 1, 2, ... The selection of the
appropriate recursive method depends on the total
number of words required for the recursion quantities
(given by G7rPi), the total computation time allowable,
and the time margin allowed for computation after receipt of the last sample of the function. These considerations will be illustrated completely for the case when
N is power of 2, N = 2
When N=2 n , Pm = 2 for m = 1, 2, ... , n. Thus,
Recursive Method'm for a single function (G = 1) requires 2m recursion quantities to be stored in memory.
The computation times for AK and B K , K = 0, 1, ... ,
(N-I) may be indicated by the number of multiplications that must be performed to obtain these values.
These are given in Figure 1, starting with Recursive
Method 0, the case where there is no factorization of
N; periodic symmetries are used to obtain the number
of multiplications given in this figure.

y = 2,3, ... ,

N

ii(:') has

(Zm+l)N

FIGURE 1

MAX. NO. OF
TOTAL
MULTIPLICATIONS

RecurSIve Fast Fourier Transforms

It should be clear that the actual computation times
are less than depicted, due to the existence of trivial
multiplications and factorizations. In addition, there
are further factorizations in the recursive methods.
For example, using the notation

NUMBER OF RECURSIVE
WORDS IN MEMORY

16

(6)

kR(x) = 2kR(x - 1) cos kO - kR(x - 2)

+ f(x
Recursive Method 3

- 1)

= kAz -

N-l

8R(n) =

L ai(s,n) f(i) +
i-o

FIGURE 2

I. . . . . . . . . . . . . ..

RECURSIVE METHOD I,

--

N-I

+ f(x

MAY6,1968

N

RECURSIVE METHOD 2,

[N~- N-l

L L:
i-l

Recursive Method 0
~----------~------------~----NO.OF
MULTIPLICA TIONS

2345678910

kR(x - 2)

- 1),

expansion and simplification yields
(7)

RECURSIVE METHOD 0,

143

for each s in the range

~j cij(s,n)

i ...l

~ ~ s < ~' where ai(s,n) and

Cij(s,n) are integers or zero.
Since (7) does not require any full-length. multiplications, it f()1.lows that the number of multiplications
required during receipt of the input samples may be
halved at the cost of increased additions and shifts
after receipt of the last sample. That is, Ri(N -1)
and Ri(N - 2) in (3) may be obtained directly
N
through (7) for each s>-.

-4

RECURSIVE METHOD 3,

ACKNOWLEDGMENT
FIGURE 3

It is seen that as m increases, the number of multiplications required after· receipt of the last sample increases to the number of multiplications required for the
Fast Fourier Transform, while the total number of multiplications, that those required during receipt of the
samples, decreases. These results are illustrated graphically in Figure 2.
The distribution of the computation time in these
different methods is shown in Figure 3 by the shaded
area following the bars, the latter representing the times
of sampling.

In addition to the references listed below, this work
was founded on discussions with John S. Bailey. The
contribution of other personnel at ITT Gilfillan and
ITT Electro-Physics Laboratories is acknowledged,and
also the fine assistance of Linda S. Saiki in transcribing.
BIBLIOGRAPHY
1 G GOERTZEL
A n algorithm for the evaluation of finite trigonometric series

American Math Monthly January 1958 p 34
2 J W COOLEY J W TUKEY
A n algorithm for the machine calculation oj complex Fourier series
Math of Comput Volume 19 April 1965 p 297-301

A file management system for a large corporate
information system data bank
by HONIEN LIU
Pacific Gas and Electric Company
San Francisco, California

mit the proper management level to take
prompt corrective action.
• Strategic planning information assembled to aid top management in its
policy decision making will be available
on special request.
• Computer service will be extended to the
entire company by telecommunication
network thus improving the efficiency
and accuracy of the information flow in
the organization.

INTRODUCTION
A corporate information system has several characteristics that distinguish it from a conventional
"batch-oriented" data processing system.
1. It has a well-planned integrated data base
which is logically organized to facilitate the
natural information flow in a corporation.
By contrast, a conventional batch system is
quite often fragmented into "information
islands" with rigid .boundaries, each designed for a single function.
2. It is a real life computerized model of a
corporation. This model will reflect the
corporation's performance on a continuous
basis. If management wishes to evaluate
any segment of the organization, they may
'Obtain an up-to-date picture of that segment
upon request.
A conventional batch system usually is a
discontinuous . record-keeping mechanism,
designed for a predetermined cut-off date,
with the tabulated results reporting past
performance of those organizational segments which had been previously defined.
3. It is a flexible system designed to serve a
c'Orporation at all levels of information processing. For instance:

• High-volume, detailed business transactions related to every day business operations will be processed as scheduled.
Summary reports of management control
information (required to speed up control action) will be available on demand.
Operating standards may be computer
monitored with notice of nonstandard
performance being swift enough to per-

The key factors in the implementation of a
corporate information system are the establishInent of a corporate data bank and the design of
a file management system that will provide for
efficient and effective use of this data bank. The
remainder of this paper describes the requireInents, strategy, design, and implementation of
such a file management system.

System requirement8
The following requirements are essential for an
effective file management system of a corporate
information system.
Centralized control of data definitions
Because the elements of the data bank of a
corporate information system interact upon each
other, a logical intertie must be built to ensure:
• Consistency of .Data Definitions:
That is, agreement on name, meanings,
usage, timing, and scope of each data element definition.
• A piece of Information Should Be Recorded
Only Once:
This not only allows for efficiency of opera145

146

Fall Joint Computer Conference, 1968
tion and reduction of storage requirements,
but also is necessary for maintenance simplicity. It will guarantee that once a piece
of data is updated, all the users will be provided with identical and current information.

Independence of data from individual programs
The contents of the data bank change as the
needs of an organization change. The same data
bank will be used by hundreds or probably thousands of programs; the reprogramming cost will
be prohibitive if the data and programs are dependent upon each other.
File protection and security
Security of a File at the Field or Element
Level:
Since the data bank is shared among many
users, certain sensitive data should be available only to authorized personnel.
• Exclusive Control Over Concurrent Updating:
During concurrent updating of the data
bank in the multiprogramming mode, it is
possible to destroy previously updated information, thus some preventive procedures
must be designed.
• Checkpoint and· Restart Facilities:
A large data base usually h~s long file maintenance runs and it is quite possible that the
system will encounter certain fatal inputoutput errors causing the system to abort
the job. An adequate checkpoint and restart
facility must be provided to enable the job
to skip the error record and achieve normal
completion.
For the on-line real-time situation, the system should have a facility to degrade gracefully and still give partial service in the
event part of the data bank· has· been damaged.
Effective use of file space
The data bank of a large corporation may very
well require ten .to forty billion characters of
storage. If we attempt to store all these data on
a direct access device with reasonable access speed
and reliability, the price could be prohibitive (see
Table 1).
If we cannot resolve the mass storage space

management problem, economically and technically, we cannot build the kind of data bank we
IBM-2311 IBM-2314 IaM-2321
DISK
DISK
DATA
DRIVE ARRAY
CELL
Number of units required for
a ten billion character data.
2,000
60
34
base*
$1,200,0~O $360,000 $120,000
Monthly rental in dollars
Sequential loading time in
340
30
125
hours
Approximate direct access device requirement for a ten billion
character data base using conventional programming technique.
*Assumed net usable capacity after considering overhead of
aadressing, indexing, etc,

TABLE 1

need. One of our solutions has been to design
several data compaction routines which allow us
to substantially reduce the amount of storage
space required for these data. In Table 2 an example is given of the amount of savings that can
be obtained with data compaction for P. G. and
E.'s customer information master file using 8drive disk units. The storage of the unpacked
data would require the equivalent of 90 IBM2314's. Besides the impracticality 'Of housing these
many disk units, their annual rental would approximate $6,500,000. With well designed data
compaction software, we can cut costs to an annual rental of a little over $500,000; about $6,000,000 savings in annual rental. However, the
question may be raised whether there wouldn't
be an offsetting cost in the system time that would
be used to compact the data. An examination of
Table 2 shows that it takes 45 hours to sequentially
load a file of unpacked data and only four hours
to load a file of compacted data; a difference of 41
hours. Our compaction routines will use considerably less time .than this, and hence we will receive an overall time advantage as well as reduce
storage costs.
A facility to capture management planning and
control information
Certain data elements in the corporate data
bank have the characteristics of controlling the
operation of business activity. Others provide
vital information for strategic planning; for instance, information on customer orders and customer usage are us~d in forecasting demands, in

File Management System

Average
Record
Size
(Bytes)

Storage
Requirements
(Billions
of Bytes)
(1)

Number
of 2314
Units
(2)

4500

15.8

90

700

2.5

15

400

1.4

8

Record Type
Fixed, No Compaction
Variable Increments, No'
Compaction
Variable Increments,
Compaction

Sequential
Loading
Time
(Hours)
(3)

147

Approximate
Monthly
Rental
(4)

45

$540,000

7.5

90,000

4

48,000

Nows:
1. Storage requirements based on 3.5 million customers
2. Storage based on 75% of capacity or 175 milllion b~s per 2314.
3. Assume 30 minutes for eight drives.
4. Cost per 2314 approximately $6,000 per month.

TABLE 2

designing facilities, and in constructing plants.
Since planning and control information requirements change from time to time, the system must
identify such information and establish adequate
relationships among them so that proper summary
reports can be prepared without tedious programming efforts.
Provide usage statistics on each data element

Multitasking:
In Figure 1 the program contains I/O buffers and therefore cannot be re-entrant.
Once a task is initialized for this program,
variable data contained in the program belong to this task. If a second task begins
before the first task is completed, it will destroy the data required by the first task.
However, in Figure 2 there are no variable

This information will detect dead fields or low
usage fields versus high activity fields and thus
allow for improving the usefulness of the data
bank.

PROGRAM t

PROGRAM 2

PROGRAM 3

PROCESSING
ROUTINE

PROC£SSING
ROUTINE

PROC£SSING
ROUTINE

Efficient and easy appliea,tions programming

DATA
DEfINITION
F'lLE
DEFINITION
l,tl BUFFER

DATA
DEfINITION
.FILE
DEFINITION
I/o BurFER

DATA
DEFINITION
FILE
DEFINITION
I/O BurrER

I/O ROUTINE

VO ROUTIN.E

I/O ROUTINE'

The advantage gained by coding in high level
languages such as COBOL or PL/l should be considered for application programming.

Strategy of the 8ystem
. Separate the input/output (I/O) functions from
the application programs
This will reduce the effort required by the application programmer in programming, debugging, and testing the input/output routines as
well as providing several other advantages.
Figure 1 shows a conventional program structure in a multiprogramming environment where
each application program has its own data and
file definitions,. I/O buffers, and I/O routines.
If we change our concept in structuring the
program to that shown in Figure 2 and cent:ralize
all four I/O components in one location, we will
achieve the following advantages:

• NON-REENTRY CODE

• REPETITION IN:
DATA DEFINITION - F'lLE DEFINITION

IA> BUrrER

- I/O ROUTINE

FIGURE I-Conventional program structure in
multi-programming environment.

data within the program, and the coding in
the program does. not alter any portion of
the program (i.e., the program is a readonly copy). These programs now may become reentrant modules. Any number of
tasks can be initialized in the module without waiting for completion of the previous
tasks.
Reduction in Core Memory Requirements:

148

Fall Joint Computer Conference, 1968

PROGRAM f

will have very limited impact on most
of the application programs.

PROGRAM 2

There are, however, some disadvantages in
separating I/O from the application programs:

'RE-ENTRY CODE. MUlTI·TASKING • SHARED:
DATA DEF'lNITION

- FILE DEFINITION

I/O BUFFER POOL -

I/o

ROUTINE

FIGURE 2-Program structure with centralized I/O function
in multiprogramming environment

I/O routines can be identical if all
the programs share the same data
bank.
I/O buffers can be shared by different files.
In general, these four components
will represent a high percentage of
the core requirements for the application program.
Speed-Up Program Loading:
In the on-line real-time environment,
the program loading activity consumes a good percentage of the time
available. It is obviously not economical to load a message processing
program of 8.0,000 bytes merely to
process a short message of 20 bytes.
Since the sizes of the applications
programs are greatly reduced, more
programs can be allowed to reside in
the core, thus reducing roll-out roll-in
time.
The size of the program library will
also be reduced thus allowing it to
be concentrated in very few cylinders
on the disk, resulting in reduced disk
arm movement and less I/O time.
Central Control:
It is necessary to have centralized
I/O in order to achieve consistency
of data definition, protection/security, usage statistics, mass storage
space management, and concurrent
updating.
Flexibility :
Reconstruction and redesign of a file

Adequate Software is N ot Available:
System programs to handle centralized I/O
functions are not supplied as standard packag,es by the computer manufacturer at the
present time. Some uncommitted trial packages exist; however, and in general, the performance of these packages is not satisfactory for ultra-high volume systems.
Nonconventional Usage of High Level Language:
The normal use of high level languages such
as COBOL requires that the I/O, file, and
data handling routines be within the program. Some programmers accustomed to
this method of programming may feel
strange if they must change their ways. Documentation, programmer orientation, and
training in the new programming concepts
are necessary to achieve optimum results.
• Increased CPU Overhead:
The data description compiled within the
application program has one definite advantage in that the code is already generated
within the program. No further interpretation process is required for the I/O function.
Additional CPU time may be required for
the centralized I/O routine to interpret the
record for the application program. However, the amount of time saved in program
loading should more than compensate for
this additional CPU interpretation time.
Separate tables and search routines from the
a,ppIieation program
To demonstrate the concept of centralized tables
and table search routines, compare the following
figures:

• Figure 3 shows the fixed table concept with
the tables and search routines coded within
the applications programs. Its major disadvantages are:

File Management System

149

--------------------------------------------------------------------------------TABLES
ROUTINE
F"

TABLE
SEARCH
ROUTINE

TABLE
SEARCH
ROUTINE

TABLE

SEARCH

IA I

TABLES

TABLES

I

PROCESSING
ROUTINE

TABLES
WITH VALUE
COMPILED IN
APPLICATION PROGRAM
TABLE SEARCH ROUTINE
USING
'IF' & 'GO TO'
STATEMENTS

I

I A I F" I

I

F"

t(

TABLE
SPACE

SPACE

CALL STABLE

CALL STABLE

CALL BrABLE

TABLE

SEARCH

.. .

TABLE

SEARCH

C!:IIJ

[IIEJ

I

ROUTINE
BUILD TABLE:
ON-LINE

PROCESSING
R.OUTINE
BUILD TABLE
ON-LINE

'BTABLe'

'BTABLE'

PROCE.SSII-IG

PROCESSING
ROUTINE

PROCESSING
ROUTINE

...

TAB~.E

SEARCH
pkt,J§sIJG
R.OUTINE

BUILD TABLE
ON-LINE

'srABLE'

.-

TABLE SPACE

a,

(
(

f2

a
a

f~

3

~.

f,

a

2

4

COMPILED HJ:
APPLICATION PROGRAM
:

f4

\

CALL

....

::::
CODE
LIST
FILE

I

STABLE ROUTINE

D

F

-

TABLE SEARCH ROUTINE
'IF' & 'GOTO ' STATEMENTS

IARGUMENT I· AlNGTlON I
PROCESSING PROGRAM

IARGUMENT I FUNCTION I
PROCESSING
PROGRAM

A

TABLE

TABLE
SPACE

an

fn

DYNAMIC TABLE BUILDING

ROUTINE (SUB ROUTINE)

TABLE SEARCH
FIGURE 4-Dynamic table building

FIGURE 3-Fixed table

Duplication 'Of tables and search r'Outines in the c'Ore.
Inefficient table search r'Outines.
Inflexibility 'Of tables; that is, when
a table is changed, the pr'Ogram must
be rec'Oded and rec'Ompiled.
F~gure 4- illustrates the dynamic table build-

ing concept. Here table space is reserved
within the applicati'On pr'Ogram; a BuildTable-R'Outine (BTABLE) is called by the
applicati'On pr'Ogram and linkage edited with
the pr'Ogram. .During pr'Ogram executi'On
time, the BTABLE r'Outine will read the
table fr'Om the 'On-line c'Ode list file. The impr'Ovement 'Of this appr'Oach 'Over the fixed
table coricept is that the table is relatively
independent 'Of the pr'Ogram. When the·
table must be m'Odified, if the reserved space

is n'Ot violated, the pr'Ogram is n'Ot affected.
• Figure 5 sh'Ows the centralized table c'Oncept. Here the tables as well as the table
search pr'Ograms are separated fr'Om applicati'On pr'Ograms and c'Ollected int'O 'One centrally contr'Olled area, 'Offering the foll'Owing
advantages:
Savings 'Of C'Ore Storage:
C'Ore st'Orage utilizati'On is 'Optimized
by I'Oading 'Only 'One c'Opy 'Of the search
m'Odule 'Or any given table in a multiprogramming envir'Onment.
Optimum Resource All'Ocati'On:
Res'Ource all'Ocati'On is 'Optimized by
dividing the tables into tw'O groupsa high activity gr'Oup, which resides
in the main st'Orage (eliminates frequent I'Oading 'Of these tables fr'Om
the mass st'Orage device) ; and a l'Ow
activity gr'Oup, which is l'Oaded into

150

Fall Joint Computer Conference, 1968

F'
A
PROCESSING
ROUTINE

AIF'
PROCESSING
ROUTINE

F'
A
PROCESSING
ROUTINE

I
oeM

RECORD
COMPo

SWARED

TABLE LOOK

LI:

UPMooULES

RESIDENT

. TAaLES·
TRANSIENT
TABLE
AREA

~

eli

CORE

3.

fl

IMAGE
TA8LE

-

LIBRARY

COBOL, are not able to use the base
and displacement facility of the ,third
generation computer. However, if
we can load the beginning address of
a table in the base register and then
load the displacement of the argument entry into the index register,
we can immediately pick up the function and argument from the entry
without a search. For large tables,
this means a large saving in CPU
time.
Ease of Maintenance:
It is obvious that one must store the
displacement instead of the argument
in the data bank to obtain the above
efficiency. This adds another advantage to this approach; if the tables
are updated, the data base can remain unchanged.

System design

DIRECT TABLE LOOK-UP
(BASE DISPLACEMENT)
FIGURE 5-PG and E centralized table system

a transient area of the main storage
only when requested.
Prevent the Creation of Redundant
Coding Schemes:
The centralized control of code tables
prevents each application project
from designing its own coding scheme
for the same subject; e.g., an accounting program might use a different
construction job code than an engineering program although they both
refer to the same physical job. It also
guarantees the consistency of code
definition since there is only one
copy of each table in the system.
When this copy is updated, all the
users get the latest version of that
table.
Efficiency in Searching:
Most high-level languages, such as

To design a software package satisfying all the
requirements stated previously is quite challenging. The name of the game, however, is not just
to meet these requirements but rather to satisfy
them ina simple and efficient way. The package
we have designed is logically subdivided into four
parts: .
Data control manager (DCM)
A real-time file management control program:
• It is the central clearing house of all the
input/output requests from all the tasks in
a multiprogramming environment.

It performs the centralized input/output
buffer pool management.
It is. the intercept point for file protection,

security· clearance, and exclusive. control for
concurrent updating.
• It opens and closes all the on-line files, keeps
the file and table directories, and captures
usage statistics on each data· element as well
as all the entries on certain resident code
tables.
It interfaces with the Mass Storage Space

Manager and the Dynamic Table Manager
through the Record Structure Descriptor
Table.

File Management System

Mass storage space manager
A group of data compaction routines driven by
the Record Structure Descriptor Table (RSDT)
to serve the following functions:

• Centralized Data Definition:
Interpret the contents of the data base to
the application programs thus eliminating
data descriptions and making the data independent of applicati'On programs.
• Provide Various Internal Data Structures
to the Data Base:
That is, variable length records each constructed by a combination of the following
types CYj.. increments.
Fixed length increment with increment bit map:
If increments are not used in certain
records, they are not stored in the
file. The presence or absence of an
increment is signified by a bit switch
in the increment "bit map" for that
particular record. For instance, if
there are four increments in a maximum rec'Ord, and only the first, second, and fourth are present for a particular record, its bit map would be
1101. The three "l's" indicate increments that are present and the "0"
indicates an absent increment (Figure 6).

Variable length increment with field
bit map:
Similar technique applied to field
level.
Variable length increment with field
counter:
A group of fields of the same length
with a counter to tell how many of

-l1--.J5 )

BA_ S_E _1L...-"_·_· · . . I-1_,1L--2- - - L . _
3_...L1_4

L..--

"

BASE

1"0, ..... 1 f

I

BASE

1'011 .....

I

BASE

1

1011 ' ..... 1

1

2

I

2

4

3

these fields are actually present in
this increment.
Utilizing nesting logic, 'One can construct a
great number of different internal record
structures; one special example would be
the tree structure (Figure 11).
• Data Compression:
Information units should be precisely
defined to the bit level; thus, a binary
variable (switch) should only occupy
one bit instead 'Of one byte ( eight
bi:ts> .
Absent data elements should not occupy storage space with blanks.
The variable length record concept
can be extended to the field level; e.g.,
a name field in the persennel file is
usually defined as a fixed length of 30
characters so that it can handle the
longest name in the file; thus, a shert
name will occupy a 30 character space
padded with unnecessary blanks.
A more efficient coding structure can
be utilized to increase the informatien
density ; e.g., if a long data field of
alphanumeric information is stered
in the eight bit EBCDIC code, by
simply changing it te a six bit BCD
coding scheme 25 percent sterage
space can be saved.
Tailored routines can be designed te
compact frequently occurring data
elements fer greater saving; e.g., a
six-digit "date" can be stored in a
two-byte field witheut loss 'Of inf'Ormation.
Store numerical information in binary form; e.g., a f'Our byte binary
field can accommodate nine digits 'Of
decimal data.
Dynamic table manager
R'Outines are provided that will I'Oad, delete,
search, and maintain a centralized table facility
for all of the applicati'On programs. These rou. tines serve the following functi'Ons:

4

3

In.

151

1

I4

FIGURE 6-Incremental structure

• Reduce the number of tables required since
all pr'Ograms desiring similar infermation
will use the saine table.
• Facilitate code table maintenance. If a c'Ode

152

Fall Joint Computer Conference, 1968
The relative location of the data element
when the record is residing in file storage
(Ds, Ls) in the compacted form (Figure 8).
After Expansion:
The relative location of the data element
after the record has been expanded and
moved into~ the user area (Du, Lu).
• Units of Information:

is changed, added, or deleted, only one
change need be made to the code table rather
than having to change several tables in
several applications programs.
• Relieve· the applications programmer of
writing table search routines, some of which
are quite tedious.
Centralize control of code tables to insure
that different applications don't design different coding schemes for the same subject
matter.

The "bit switch" and the "hex" attributes
define' the units of information at the bit
level.
• Variable Length Element Switch:
When data elements are stored in the variable length form, this switch will be turned
on.

File maintenance interface
Since batch processing and on-line message
processing programs share the same data bank,
certain facilities such as the Mass Storage Space
Manager and the Dynamic Table Manager must
be available for use by a file maintenance run.
The heart of the file management system presented in this paper· is the Record Structure Descriptor Table (Figure 7) • This table is divided
into two major sections, one containing the data
coordinates anp the other containing control information:

The Data Coordinate Section Shows the Following Attributes:

1.

2.

The Control Information Section Contains:
• Usage Statistics for Each On-Line Data
Element:
Periodically, a system service program will
dump these accumulated statistics on a storage device, such as magnetic tape, for future
analysis.
• A Security Code Attached to Each Data
Element:

• Before Expansion:

Each on-line request for access to the ele·
ment will have its security code checked

FIGURE 7-Record structure descriptor table

CONTROL INFORMATION

BITS

DATA COORDINAT£S

r-----+---~---r~--+-----~--~----4_--~----~--+_--_+_44444~

BYTES r-----+---~~-r~--+-----~~~~--4_--~----~~+_~_4_44444~

.Bit Rest'rttl n,r
*** -Bif
le"f'h Fielt!

IiIfv~ lise
011 illlliufes fI~,,;'''le

INCREMENT
ORGANIZATION

T'IIOBITS

** *-I"fo""lllo"
,sll',lclt
0" -

00 - Fix,' Itt'fll, J"tfMI,,,f

PI~""i"9 1"/ofm~/io,,
Ofl -·c.,,,ftol 1"Io_JlitJ"

oI . ~fi~bl, l"'fll, Met"",,,!

tUUUf-Col1fnrl Swifclt

"i'f, Iii" Bi! N;p
10 - V'rt"J/''' 1""If, btertIIRIIl
,,;II, !!tid (qq,,;'" Byk
1
....·~---4

0" -/rf311lgemtl1l Co,,1101
Off -Ope,t1I;ol1~1 Co"IN/

4

File Managernent System

~

I

FILE I0

I

({

I

c-

1

4

lOT
HDR IADDR-

I,

INCREMENT
HEADER

de·

ELEMENT

FIGURE 8-Record compaction/expansion

This attribute serves as a pointer to the correct routine to interpret the data element
(Figure 9).

do
d,

HEADER #2

I-

TABLE

I-

TABLE
-3

I---

d2
d3

~

an

'----

It,

~

I---

INCREMENT

against that of the data element before access is allowed.
Compaction, Expansion, or Table Search
Routine Displacement:

~
15~ ~
ROUTINE
TABLE

~

ELEMENT

ROUTINE
DIRECTOR'i

TABLE
DIRECTORY

RECORD
ADDRESS

~

d,

d3

I ...,..., STROCI

r

Information Switch:
If a data element is identified as management planning information, this bit switch
will be turned on.
Control Switch:
If a data element is identified as management control information, this bit switch
will be turned on.
• The increment number, the increment organization, and the increment· chain displacement attributes will provide the ability
to access information in the following forms
from the data base:
A record:
If the user desires, he may have the
entire record expanded and presented
to him.

#1

I-

·2

~

ROUTINE

'2
ROUTINE
#3

[J. b
I-

1ST

TABLE

ROUTINE

#4

1ST

ROUTINE

INCREMENT
HEADER #3

2ND

TABLE

INCREMENT

U

HEADER -4

3RD

ROUTINE

1

Code Table Address Displacement:
If the data element is a code that requires
interpretation, this attribute will locate the
correct code table for the table search routine. If the table is not in the main storage,
the control program will load the table into
the core. If it is a low activity table, the
system> will delete the table after the search
function is completed thus freeing the core
for other usage.

153

U

3RD

TABLE

4TH ROUTINE

FIGURE 9-File directory ent.ry

An increment:
A logical group of elements within
the record. The increment· chain displacement attribute indicates the location of the next element in the
increment and thus provides the
ability to supply a complete logical
increment to the user.
Increment by circular ring:
Since the increment chain displacement is constructed in a circular ring
fashion (see Figure 10), a user can
obtain a logical increment by identifying the class of information desired
in the lead column of his report. For
example, a user requests a listing 'Of
an employment directory from the
data base; he may choose to have his
employees listed first by name or by
telephone number, 'Or by social security number, or by addres, or by de-

154

Fall Joint Computer Conference, 1968

2

4

3

3

4

onmateria..l item (XYZ), store (i),
vendor (1), volume (p).
An element:

5

5

2

A unique element control number assigned to each field when the RSDT
is created allows the application program to request individual elements
and thus free the program from being cluttered with elements that it
does not use.

1

0
~

2
~

5

~

4

FIGURE 100Increment chain and circular ring

partment number, etc. without additional programming.

Implementation of the system
The system program package has been written
in IBM-360 Operating System Assembly Lan..
guage (ALC).
1. It is fully interfaced with the IBM-360 op-

Branch of a tree structure:
By combining different increment
organizations in one record, a limited
tree structure can be formed with a
record (Figure 11); e.g., an inventory record using the material code
as the major ~ey has a base increment describing the characteristics
of the item followed by a certain
number of increments which describe
those stores that carry this item, and
each store increment in turn will be
followed by a certain number of increments which will describe all the
local vendor information concerning
this item. Furthermore, each vendor
increment can have a number of volume and price increments. If we
consider this as an internal information tree, a branch of the tree may
appear as: list the price information

2.

3.

4.

5.
6.

erating system, under either MVT (multiprogramming with variable number of
tasks) or MFT (multiprogrammirig with
fixed number of tasks). The package is not
tied to any particular release of 0/8; hence,
if a new version is released, there should be
little or no effect on this package.
The data bank management package takes
full advantage 'Of the existing operating system facilities.
It is intended to interface with all the operating system supported languages (COBOL
interface will be implemented first).
The entire packag'e has been designed to be
dynamic in nature; that is, all programs are
load modules. They are not linkage edited
into the application program; thus, the
package may be redesigned and improved
without any appreciable effect on the application programs.
The entire package has been programmed in
re-entrant code.
The system has been coded in a modular
fashion. Each routine was individually
coded, tested in detail, subgroup ed, and
finally all routines were combined together.
• To increase the efficiency of the package,
the following measures were taken:

FIGURE 11-Tree structure

Unnecessary saving of registers
and store register operations were
avoided by branching between
modules rather than using subroutine calls.
All modules \vere carefully ex-

File Management System
amined to the bit level to insure
tight coding. The total coding 'Of
the package may use less than one
percent of the total main core
memory.
7. The hardware anticipated over the next
several years includes two large central
processors with a million bytes of main
memory, supported by smaller satellite com·
puters and a score of multi-drive disk storage units. The system is being designed to
support several hundred terminals most of
.
'
whIch are expected to be high speed CRT
display units.

APPENDIX 1

Record 8tructure de8criptor table
Control information
1. Reserved area-A two byte reserved area
for control function; e.g., use it as 16 bit
switches each associated with a management
report.
2. Usage Statistics
A. A two byte binary counter is used to
maintain a count of the number of accesses made· to each partiCUlar element.
B. When maximum value (65,535) is exceeded, an overfl'Ow routine stores the
element control number in an overflow
area in the record structure header, adds
one to the two byte binary overflow
area, and clears the original counter.
3. Increment Number/Organization
A. Indicates which increment within a record c'Ontains the element described in
the table entry.
B. Increment number occupies six high
order bits (maximum value - 63).
C. Increment organization: Two low order
bits.
1.) 00 - Indicates fixed length increment.
2.) 01 Variable length increment
with field bit map. The presence
or absence of certain fields in an
increment depends on the on or off
of the related bit switch in the bit
map.
3.) 10 - Variable length increment
with a field counter byte f'Ollowed

155

by a group of fields of same length.
4. Security Code
A. Consists of a security or protection code
for the element described in this entry.
B. Designed to prevent certain information
in the files from being 'Obtained by unauthorized individuals.
C. Occupies one byte (maximum value255).
5. Increment Chain Displacement
A. Provides a pointer to the next logical
element description for the record (or
increment) .
B. Provides record structure independence
from data changes in description and/or
additions or deletions of elements by
allowing a nonsequential physical record
structure table organization.
C. The chains are constructed in a circular
ring fashion; i.e., the last element
pointed to the .beginning element of an
increment, or in the case of single level
structure, the last field pointed to the
beginning field of a record.
D. Occupies two bytes.
6. Compaction/Expansion or Table Look-Up
Routine Displacement
A. Used by the DCM modules to determine
the correct compaction/a~pansion or
table look-up module to be invoked.
B. Occupies six bits, maximum 64 routines.
7. Code Table Address .Displacement
A. Points to an entry in a table directory
which identifies the table required to
convert the code in the record to the
value obtained from the table.
B. Occupies ten bits.
Data coordinates
1. Element Length
A. Length User - Indicates the length of
the elen:tent when expanded to user format. Occupies one byte.
B. Length Storage - Indicates the length
of the element in its compacted format
as stored upon the DASD. Occupies one
byte.
2. Element Displacement
A. User Displacement - Indicates the relative location 'Of the element in relation to
the beginning of the record ('Or increment) as expanded to user format. Oc-

156

3.

4.

5.

6.

7.

8.

Fall Joint Computer Conference, 1968
cupies twelve bits.
·B. Storage Displacement ~ Indicates the
relative location of the element in relation to the beginning of the record (or
increment) as compacted to storage format. Occupies twelve bits.
Bit Displacement
A. Occupies three' bits which indicate the
relative displacement within the byte of
the particular bit switch.
Hex Switch Indicator
A. Indicates if data normally contained in
1h byte has been combined at compaction time with similar data.
B. Occupies one bit.
Variable Length Field Indicator
A. If on identifies the element as a variable
length field or if off as a fixed length
field.
B. Occupies one bit.
Information Switch - Occupies one bit.
A. If on identifies the data in this element
as planning information.
B. If off identifies the data in this element
as control information.
Control Switch - Occupies one bit.
A. If on - management control.
B. If off - operational control.
The last bit is not used at this time, but is
held in reserve.

ACKNOWLEDGMENT
The author wishes to thank Mr.J. R. Kleespies

for his encouragement and sup,port; Messrs. J. O.
Mohn, R. J. Wolfenden, C. E. Jones, and R. St.
Germain for their dedicated efforts in design and
programming; Mr. W. S. Peck for his careful
editing; Mmes. L. Andrews and L. Fiore for their
typing; Mr. R. P. Kovach for many stimulating
discussions; and Messrs. J. W. Nixon and F. J.
Thomason of Haskins & Sells for their invaluable
assistance and advice.
REFERENCES
1 RVHEAD
Management information systems: A critical appraisal

Datamation May 1967
2 A METAXIDES
Data base management

ACM SICBDP December 28 1967
3 P J DIXON J SABLE
DM-J-A generalized data management systerfl

Spring Joint Computer Conference 1967
4 COBOL extension to handle data base

CODASYL Data Base Task Group January 1968
5 The corporate data file

EDP Analyzer November 1966
6 Corporate data file design

EDP Analyzer December 1966
7 GSCHECTER
Information retrieval

Thompson Book Company and Academic Press 196 .
8 JMARTIN
Programming real-time computer systems

Prentice Hall 1965
9 J R KLEESPIES
A progress report on developing a comprehensive information
system

Presented at the Annual Meeting of the Association of Edison
Illuminating Companies at White Sulphur Springs West
Virginia October 41967

Omnibus:
A large data base management system
byROYP.ALLEN
IndU8trial Indemnity Company

.San Francisco, California

INTRODUCTION
In designing a third-generation data base and a'system
for interrogating and maintaining it, Industrial Indemnity Company set the following general objectives:
1. The management and retrieval system should be
oriented to providing its services in a simple and
8traightforward way to application programs written in
a high-level langUage, such. as PLII or COBOL.
2. The data base should be compact. Its secondgeneration predecessor was a pair of files occupying together some 35 reels of magnetic tape; but the new data
base, which would need to meet significantly expanded
data requirements, was to fit onto a single IBM 2321
data cell drive (capacity about 390 million bytes).
3. It should be possible to design, program, and implement the system with a configuration of machines
and personnel commensurate with the anticipated benefits.
4. Provision should be made for storage, retrieval,
and -maintenanoe of data elements with widely varying
8pace requirements. Well over half of our policies have no
olaims at all, but a few policies for very large companies
acquire claims in the thousands.
5. Both sequential and direct accessing, in a variety of
oombinations, should be feasible, in order to accommodate file-scanning applications, efficient updating, and
an open-ended variety of inquiry and reporting applications.
6. Retrieval8hould be BWift enough to maintain rapid
response to inquiries coming from several dozen remote
inquiry terminals.
7. A very high level of data integrity must be maintained, with protection inplemented in at least three
ways: detection of improper attempts to alter the contents of the data base; prevention of incorrect updating;
and recovery from data, program, or machine failures in
a minimum of elapsed time and with a high level of

justified confidence in the restored version of the data
base.
8. Both the data base structures and its management system should be flexible enough to permit new
and unforeseen data requirements to be accommodated in
the future with a minimum of disturbance to either
operational application programs or the data base
management system itself.
I would like to describe to you "Omnibus," the system developed to meet these objectives. The description
will be presented in five topics: the logical structure of
the data; data interfacing and retrieval; protecting data
integrity; accommodating changing data requirements;
and patterns of retrieval.
Data structure

At the most general level, data managed by Omnibus
are clustered by one primary and one secondary identifier. Since Industrial Indemnity is an insurance carrier,
our primary identifier is the insurance policy number;
each data item is related to a single, specific policy.
Data that apply to a policy as such, rather than to its
individual claims, have no secondary identifier; data relating to specific claims, however, are grouped by claim
number, the secondary identifier. Each claim is subsid·
iary to the specific policy on which the claim is made.
The terms "policy" and "claim" apply specifically
in the insurance industry, but the philosophy and techniques of Omnibus are applicable for any large data
base that can be similarly structured according to one
primary identifier and a very small number of subsidiary identifiers. For the sake of concreteness, the application-oriented terms "policy and "claim are used
throughout this discussion.
The basic unit of data organization in Omnibus is the
field string; a field string is defined as a group of one or

157

158

Fall Joint Computer Conference, 1968

more fields structured according to a corresponding
Format, and a Format is defined as a fixed pattern of related fields. Since Omnibus can accommodate a variety
of data requirements, few or many Formats may be defined to the system at a given point in time. Formats are
identified by Format numbers in the range 1-2/; Formats numbered 1-63 apply to field strings such that
each relates to its respective policy, but not to any
specific claim; whereas Formats numbered 64-127
apply to field strings such that each relates to a specific
claim on a specific policy. Each field string carries with
it the Format number of its corresponding Format.
Field strings are logically and physically grouped in
sections; a section is defined as a group of one or more
related field strings such that Omnibus is required to
treat the group as indivisible in mass storage. Specifically, a policy section is defined as the group of field
strings rel~ting to a particular insurance policy but not
specifically to individual claims, and a claim section is
defined as the group of field strings relating to a particular claim on a policy. Each policy section consists of
one field of Format 1 (the policy summary Format),
followed by zero or more field strings (for the same polEach rectangle represents a field string of .the Format indicated.

POLICY 678-9015

I Format

I

.l - policy summary Format

r- Format 3/12 (repeatable)
r- Format 3/17 (repeatable)
r- Format 6/01 (repeatable)

I
I

icy) numbered 2 - 62*; each claim section consists of
one field string of Format 64 (the claim summary
Format), followed by zero or more field strings (for the
same claim) numbered 65-127.
The complete data recorded in the data base for any
given insurance policy, then, consist of one policy section followed by zero or more claim sections.
Data are transferred between application programs
and Omnibus in either standard form or long form, where
the form is defined as the sequence of field strings that is
assumed in such a transfer. Standard form consists of
one, two, or three field strings: the field string of direct
interest is always last; if that field string is numbered
greater than 64, it is preceded by the same claim's Format 64, or claim summary, field string; in any case the
first field string is the policy's Format 1, or policy summary, field string. Thus a data item is always accompanied by the most closely related summary data.
Long form consists of a variable number and arrangement of field strings, depending on the amount
and complexity of the data recorded for the given policy
or cla,fm. In long form, all the field strings in a specified
section are transferred, in ascending order by Format
number; if the specified section is a claim section, the
Format 1 field string of the related policy precedes the
claim field strings. An application program receives
data in long form when it specifies a Format number of
zero; otherwise, transfers are in standard form.
This much is all the a:pplicatiQn programmer needs to
know about the data structure in Omnibus.

Policy
section

I

I

'- Format 8

POLICY. NO. 678-9015
~~~TN~~.
1

r------..,
I Format 1 - policy 8ummary

STRING ID*

CLAIM 04-00003 on policy 678-9015

H

I

Format 64 - claim sUDmlary Format

l-1

Format 65

I

}

Claim
section

POLICY NO. 678-9015
CLAIM NO.
FORMAT NO.
3
STRING ID*
17

, - - - - - - - - , . . . . . - - - - -....
Format 1 - policy summary
Format 3/17 (repeatable)
......- - - - - -.......-----~

POLICY NO. 678-9015

~~TN~~. 07-00~!

y _SUllllD8_r_y_1F_orm_a_t_64_-_c_la_im_summa_r_y.......
...
IF_orma_t_1-_P_Ol_iC_

STRING 10*

CLAIM 07-00001

--1

on policy 678-9015

I

Format 64 - claim sUDmlary Format

r- Format 65

I

f- Format 73
f- Format 75/02 (repeatable)

-- Format 75/05 (repeatable)

I

POLICY NO. 678-9015
CLAIM NO. 07-00001
FORMAT NO.
73
STRING 10*

J

Claim
section

I

,--------,.....-------'r---.. . .
Format 1 - policy summary
Format 64 - claim summary
......- - - - - - ' - - - - - - -_ _" ' -_ _.....

*When a Fomrat is defined as t'epeatabZe (meaning that a given section may contain mot'e than

one instance Of that Fonnat) > the instances >Jithin a section aPe distinguished from one
anothet' by a 2-digit string identifiet'. This tenn has no appLication to non-t'epeatabZe
Fomrats.

FIGURE 2-8tandard form
CLAIM 07-00002 on policy 678-9015

L{

Format 64 - claim summary l'ormat

I

}

FIGURE l-Logical structure of a policy's data

Claim
section

*Format 63 applies to field strings used for indexing the claims
of "HVC" policies, as described in the following section of this
paper; its instances constitute separate sections, called "claim
index sections," for Omnibus internal use only.

Omnibus
POLIC! RO. 678-9015
CLAIM 110. 00-00000
FORlfAT 110.
0
STRIIIG ID

---------'
POLIC! 110. 678-9015
CLAD! 110. 07-00001
PORIfAT 110.
0
STRING ID

FIGURE 3-Long form

Data interfacing and retrieval

Internally, however, different classes of fields, claims,
and policies are accessed in different ways, according
to their individual characteristics.

159

For instance, even though each policy and claim has
only field strings of such Formats as are appropriate
to its particular requirements, it is still true that
much of the space in most field strings is, in varying
degree, wasted: inapplicable fields are empty (blank
or zero) ,amounts are substantially smaller than the
maximum for which space is allocated, character fields
contain many low-order blanks.
To reduce the amount of comparatively expensive
direct-access storage so wasted, Omnibus defines two
representations of data for each Format: expanded and
condensed. In expanded representation, the number of
fields, and the size and usage of each field, for a given
Format, is fixed, and applies identically to every field
string of that Format. In condensed representation of a
field· string, unused fields are omitted, and noted as such
in a bit matrix stored with the data; high-order zeroes

FIGURE 4-Examples of expanded & condensed representation
"t$

"t$

~
(Q
~~

~~
~i-.)

~~

Field name

Ewpanded representation

~~

~i-.)

Condensed

2.
3.
4.
5.

Policy number
Insured's
name
and
address

~

C)

~

(Matrix)
1.

]~
Techni~e

2

,6,7,8,9,0,1,5,

3

,P,., ~·I rl11N'f$, ~;rgtB§ I I I' , I I ,
I III III I I I I I I I I I I I I I I I I I I I
,1J?i IBlWADl eT~,T, , I I' , , I I I I
,HMIiLsTPN,!, .NF,W, l,9¥1 , I , , ' I I

25
25
25
25

t111111P.·1 ~., J.gtiES eT~

omitted (see matrix)
10Fi!t~ ~ eT.R.U.T,
11 2,'IIJNW.I.G9N,!, IN¥J 1lpPE..

j}

Variablelength
character
string

:J
:}

Zoned

6.

Zip code

11 ,5 10,4,st

5

,15 ,"04 I 5-t,

7.

Agent number

,9 ,8 I 7 , 6 ,5t

5

198 176 1S+.

8.

Effective date

,12 125166,

6

~16 (359-66,0)

9.

Expiration date

112 ,24,67,

6

~ .. (358-67,,,)

10. Date cancelled

,00 ,00, 001

6

omitted (see matrix)

0

11. Date reinstated

,00 ,00,

oq

6

omitted (see matrix)

0

12. Premium

100 ,00l45 ,13 15:!!

5

~..J..2:b

13. No. claims

100 ,00, 3:!!

3

~

14. Claims amount

~010014312010i1

5

e3 120 ,0+.

15. Binary flags 1

,0 11 ,I, 0 10 10 ,0 ,I,

'0

8

~'6 (01100001,)

16. Binary flags 2

,I, 11 , 1 , 1 ,1 10 11"0

8

!!?l.. (10111101~)

TOTALS

170

°

Zoned~binary

:J
:}
77

~packed

Zoned MoDaYr
~binary

DayYr

Variablelength
packed
decimal
field
Zoned~binary

100

Fall Joint Computer Conference, 1968
from zero to about 15 claims each, and account for
nearly all policies, but scarcely more than half of all
claims. A particular section, ,when requested, is located
by Omnibus by simply searching the single logical
record for that policy on the single track that contains
all the policy's sections.
(2) A "two-track" policy is one that is too large, in
condensed representation, to fit onto a single direct-access track, but will fit onto two consecutive tracks without requiring any section to straddle them; these policies
have about 15 - 35 claims each, and account for a small
percentage of the total number of policies. Omnibus locates a particular section of a two-track policy by checking the last section in the single logical record on the .
policy's first track to determine which track should contain the requested section, then searching the appropriate track.
(3) A "high-volume-of-claims," or "HVC," policy is
one, the' condensed representation of which is too
large to fit onto two tracks; these policies have from
about 35 to several thousand claims. They represent
a relatively small number of policies, but they account
for nearly a third 0 f all claims. Two levels of index are

are dropped from numeric fields; numeric character
fields are stored either in two-digits-per-byte form or in
binary; and so on. For each Format defined to it,Omnibus uses a Format map to specify for itself the relation
between the condensed and expanded representations of
the fields that make up the field strings of that Format.
Each two-byte field descriptor in the map specifies, for
one field (or group of similar adjacent fi,eld~) of a Format, the particular technique of expandIng and condensing to be used, and the conditions under which
the field can be' omitted in condensed representation.
This characteristic alone of Omnibus reduces the storage requirements for o,ur data base by about sixty percent, a savings in mass storage cost that appears to
constitute a sufficient cost justification for the design
and programming effort.
Policies are recorded in, and retrieved from, directaccess storage in one of three modes, depending on the
size of their condensed representations.
(1) A "one-track" policy is one such that its policy
section and all its claims (if any) will fit, in condensed
representation, on a single direct-access track (on the
data cell drive, 2000 bytes or less); these policies have

FIGURE 5-Exa.mples of one-tra.ck and'two-tra.ck policies

Traak 47 - aontains five one-traak poliaies

678-9014

Policy 678-9012

678-9015

678-9016

I

678-9018

I

Traak 53 - aontains the first-traak portion of a two-traak policy

I

Policy 679-0017 (first part)
I

Traak

54 -

aontains the remainder of the

Policy 679-0017 (second part)
I

I,

tw~-traak

policy's

679-0018
I

data~

and three one-traak poliaies

679-0020

679-0021

I

Each rectangle above represents a section: blanks represent policy sections, and claim sections are marked as such. Each separate logical record is marked off by a heavy black outline; a single logical record contains data for one and only one policy.

Omnibus
used to proceed from an HVe policy's policy section to
a specified claim section. The first level is stored within
the policy section itself, in a field string of a special-purpose Format, not accessible to application programs;
this index points to the direct-access track(s) on which
the second-level index record(s) reside(s), normally
either the same track as the policy section or the ones
immediately following. A second-level index record for
an HVe policy contains one entry for each claim, within its range of claim numbers, recorded for that policy;
each entry points to the track on which its claim is currently recorded. Thus, when Omnibus has secured the
policy section of an RVe policy, and it seeks a particular claim on that policy, it searches that policy's firstlevel claim index for the pointer to a second-level claim
index whose number range includes the claim number
sought. Using that pointer, it secures the appropriate
second-level index, and binary-searches it for the entry
for the desired claim number, which points to the track
on which that claim is recorded. Some effort is expended, both when reorganizing the data base and when
maintaining it, to assure that all sections of an Hve

161

policy are recorded on the same data cell strip if at all
possible, in order to avoid excessive seek time.
Physically, the data base is divided into four regions:
a Prime area, where one-track and two-track policies are
stored sequentially by policy number whenever the
data base is reorganized, packed tightly into one- track
blocks; an HVC area, where high-volume-of-claims
policies are stored sequentially at reorganization time,
with overflow space reserved at the end or' each strip in
order to minimize the chance of a policy -being forced
by additions or modifications to straddle a strip; and a
pair of Activity areas (one each for the Prime and HVe
areas) to receive new policies and claims and relocated
data, as required, during the cycle between one reorganization and the next.
Whenever updating or adding data causes enlargement of the condensed representatioIJ. of a section, it is
possible that the new, larger, condensed data will no
longer fit its old home location. This could occur becaused a previously unused field comes into use, because
a .new field string is added, because an amount field
oomes to have fewer high-order zeroes, or for any of

FIGURE 6-Example of high-volume-of-claims policy.

. Tpaok 5096

'Olioy 777-1234

Format 1

/Format 2
\
\

I

Claim no.

Track no.

IFormat 3/02 !Format 3/07

----- --

- ---

Claim index - level J
01-00103 01-00435 01-00767
5096

Tpaok 5140

Poliay 777-1234

5140

Format 6/01

04-00091

04-00423

99-99999

7183.

5250

- 5193

777-1234

Poliay 605-6543
Claim 03-00222
....

-I

Claim no.

Track no.

Tpaok 5141

I

- - - - - ---:----- - - -

Format 63

--- ---

1 Format 63

Claim index - level 2
01-00436 01-00437 01-00440 01-00441

01-

5141

Poliay 702-1111

I03-00223

_--. - . ---

01-00766

01-00767

5191

7040

I

~~iay 777-123~

1 Claim 09-019921 09-007401 09-007441

Claim 01-00436

I01-004371 01-00441 1 Ol-OOij 01-004531

162

Fall Joint Computer Conference, 1968'

sevel'al other reasons. When this occurs, one general
rule obtains: the home track of data separable from that
being moved because of its own enlargement always remains the same. For example, if a one-track policy enlarges so that it will no longer fit its old space, Omnibus
does not move any data for other policies that may be
sharing the same track, but instead moves only the affected policy; if an RVe claim section enlarges so much
that it no longer fits, no policy section, claim index section, or other claim section is relocated because of that
claim's move. In the case of a two-track policy, both
parts are moved together, even though only one may
have expanded. After data are moved from a track, the
data remaining on that track, if any, are packed together, so that no trace remains on that track of the
removed data, and all its space is available for other
subsequent use, such as the expansion of some of the remaining data. Any affected pointers in indexes are, of
course, updated immediately when data are moved.
In spite of the breaks in physical sequence that may
be caused by additions, relocations, and the use of separate regions for RVe and other policies, Omnibus

BEFORE

can find any policy, a~d therefore any section, fairly
swiftly, using a very simple two-level indexing scheme.
A one-for-:-one index of policies is maintained on disk,
in sequence by policy number; it lists, for each policy
in the data base, its policy number, certain bit flags that
may obviate the necessity for retrieval, and a pointer to
the track in the data base on which the policy section is
currently recorded. This index is recorded in fixedlength, keyed blocks of 134 entries each, with each block
having as its key the policy number of its last (highestnumbered) entry; four keyed blocks are recorded per
track.
To access this index efficiently, a core-resident index
of some 1200 entries is used; this index consists of the
key, or last policy number, of the last block on each
track in the disk-resident index, in ascending order by
policy numbel. The relative position of each entry in
the core-resident, or first-level, index implies the relative track number of the corresponding track in the
disk-resident, or second-level, policy index. Thus the
nineteenth entry in the core-resident index consists of
the highest policy number indexed on the nineteenth

FIGURE 7-Moving a policy because of adding a new claim

Track 47 (Prime area)
IClaim IClm Iclml Clm
I

Policy 678-9012

II

II
678-9014

I

678-9015

~

678-9016
I

)

Track 1345 (Prime Activity area)

Policy 701-6992

AFTER

Track 47

II
Policy 678-9012

678-9014

Track 1345
IClm I Claim IClmlclmlclaim
Policy 701-6992

678-9016

f

IClai~

678-9015
I

~

II

IClaim

678-9018

IClaim

"

I

678-9018

Omnibus
track of the disk-resident index, the one-thousandth
entry in core corresponds to the one-thousandth
disk track, and so on. To secure the direct-access
address of a. particular policy, then, Omnibus performs a binary .search of the first-level index for
the first entry at least equal to the sought policy
number. The relative entry number of the selected
entry is used as a relative track number for the secondlevel.index, and the first block on that track having a key at least equal to the sought policy number is
read into core. This block, in turn, is binary-searched
for the entry matching the sought policy number; the
matching entry points directly to the track on which
the policy section is currently recorded. Failure to
find a matching entry in the second-level index ends the
search by establishing that no policy of that number is
recorded in the data base.
Thus Omnibus requires, at most, one disk seek and
one data cell drive seek to reach a specified policy, and
at most one disk seek to find that the specified number
is not in the data base. This is significantly swifter than
would be the case, for lIl:stance, witlt IBM's Indexed
Sequential Access Method applied to a data base this
size, which would require at best three or four relatively

163

time-consuming data cell drive seeks, whether the policy were present or not.

Data integrity
It was mentioned at the outset that Omnibus has as
one of its design objectives the maintenance of a
high level of data integrity, to be implemented through
error detection and prevention schemes, and through a
reasonably quick and very reliable means of recovery
from damage of one kind or another.
The detection requirement is approached in three
ways. First, when an application program presents new
or modified data for inclusion in the data base, Omnibus' field string condensing routines include checking
each field for proper data type. Detection of improper
data type, such as non-numeric data in what should be a
numeric field, is considered to render the entire request
unexecutable. This serves principally as a safeguard
against an incompletely debugged updating program, or
a program that has not yet been recompiled to reflect a
changed Format definition.
Second, Omnibus maintains a set of control totals
based on certain key summary fields· in the claim and

FIGURE 8-Policy indexing

Policy index - level 1
Entry no.
Entry

Tpaak 196 of Policy index - level 2 (disk-pesident)
blo,~c!k_1!.====:1

I

1678-900911
key

11678-9140
data

Policy no.
Track no.

block 2

I

key

~

II

_ -

46

47

,

-

-k~

11678-92681~1_---'

data

678-9010 678-9012

blo~c!k....;3:!.===::t

I

----.

data

I

Policy 701-6992
I

1678-9397
key

--- ---

,I

1222

52

IClaim Iclml Clm IClaim

II

'I Claim
678-9015
I

I

Claim

1721

---I

52

4~.------~

data

678-9014 678-9015 6 5 678-9136 67-8-9138678-9140

Tpaak 1345 of Data base (data aell pesident)
\Clm

block

I

164

Fall Joint Computer Conference, 1968

policy summary field strings. All of these totals, together
with a count of policies recorded, are maintained by
Omnibus at the volume and data set levels; the claim
summary totals are also maintained by Omnibus (not
by application programs) in the Format 1 field strings
of the corresponding policies. These various totals are
used to detect certain kinds of etrors, as follows: When
a data base updating program opens Omnibus, Omnibus provides to that program a copy of the then-current
data base grand totals. As the program prepares each
request for the insertion, deletion, or updating of data,
it is to compute the effect the change should have on
the control totals, then post that ~ffect to its copy of
the data base grand totals. On receiving the request,
Omnibus computes what the actual effect of the change
would be and compares the result to the program's copy
of the control totals. If they do not agree, the request is
rejected, and the application program is so notified.
This procedure assures, essentially, that the application
program "knows" what it is doing, and it keeps the program and Omnibus locked in step with each other on an
up-to-the-second basis.
Third, as Omnibus actually carries out its output
operations, it computes the net effect on volume and
data set control totals of the changes it makes to each
track; if either the sum of all track changes or the sum
of all volume changes caused by a request fails to balance to the expected net change, Omnibus catches itself in the error.
Error prevention methods in Omnibus are oriented to
two different types of errors: those caused by faulty
application programs, and those caused by mutual
interference of concurrently executing programs in a
multiprogramming environment.
Two aspects of the prevention of certain kinds of application program errors have already been touched
upon, namely, rejecting requests with improper
data in one or more fields, and rejecting requests that
incorrectly predict control totals. But nothing mentioned so far would affect the situation in which several
changes al'e to be made concerning a single policy or
claim, and at least one of them is faulty and detected as
such; under most circumstances, it would be deRirable to
rej ect all those changes as a package, so that they can
be "resubmitted later, in corrected form, as a· unit. To
accomplish this, Omnibus- collects all consecutively
issued requests for insertion, deleting, or updating relating to a single section into a queue, checking each request
for validity and control total balance as it is received.
The requests so enqueued are not executed until the
queue is complete, that is, until all the requests affectihg
that section have been issued and the program has explicitly requested queue execution. At this point, Omnibus executes all of the enqueued requests if and only

if each of them was valid and in balance; if any of them
was detected as being0faulty, the entire queue is purged
without execution, aud the application program is so
notified. This removes the difficulty for the application
program, or for a person later attempting to correct
data errors, of trying to recover from the partial execution of an integrated group of transactions, and it
eliminates one way in which conflicting data could come
to be recorded in the data base.
Two types of mutual interference by concurrent programs are prevented by Omnibus procedures: (1) If two
updating programs run concurrently, each could accidentally undo some of the work of the other by concurrently working on the same track or tracks, and neither
would be able to maintain valid control totals. (2) If
an updating program and one or more other programs
use Omnibus concurrently, the situation could arise of
one of the other programs using a pointer (such as an
index entry) that was secured before the update program
happened to move the data in question to a different
track, but used after the move, with the result that the
program doesn't find the data where the pointer points.
The former of these situations is prevented very
simply: Omnibus permits only one program to have
its updating facility in an open state at a time.
Sequence, Update program

, Inquiry program

T--------~-----------------------------,------------------------------,

: 1.
, Reads policy 123-4567 from
,Idle.
,
data base track 40.
,- - - - I- - - - - - - - - - - - - - - I- - - - - - - - - - - - ___
, 2.
, Manipulates data in core,
, Receives a request for data
,
preparing to add a new
concerning policy 123-4567.
,
' field string of Format 8.
,

'
'
,
:
,
,

,3.
Moves policy 123-4567 from
,
' track 40 to track 916.
,
,
,
,- - - - I- - - - - - - - - - - - - - ,4.
, Updates the disk-resident
,
policy index record for
,
'policy 123-4567, so that it
,
, now points to track 916."

Reads the disk-resident
, policy index record for
, policy 123-4567 (points to
track 40).
I- - - - - - - - _______
, Reads data base track 40,
expecting to find policy
'123-4567.
,

,
,
,
,
,
,
,
,
,

,5.

,? ? ? ? ? ? ? ? ? ? ? ? ? ? :

,- - - - r - - - - - - - - - - - - - - r - - - - - - - - - - - - - - ,

,- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - , Proceed with processing

l ________,_~~~~_~~~~~~~~:~~: ____________,_____________________________ J

T--------r----------------------------r---------------------------,
,4.
,
,

Updates the disk-resident
' policy index as above.
,

Waits for update program to
, release exclusive use of the
, data base.

,- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

,5.
, Proceeds with processing
, Reads track 40, expecting to
,
, next transaction, until
, find policy 123-4567.
,
next OMNIBUS request.
,- - - - L. - - - - - _ - _______ L. _____________ _

,6.
,
,
,

, Waits until exclusive use
of the data base is avail' abl~ again.
,

, Re-examines the policy indexes; finds pointer for
'policy 123-4567 pointing to
, track 916.

,
,

, Waits.
,

, Reads track 916, finds
, policy 123-4567.

,- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 7.

------------------------------------------------------------------FIGURE 9-"Musical sections"

Omnibus
The latter situation is a bit more complex. It could be
avoided by shutting out ali other access to the data
base during execution of an updating program, but
that seemed unduly restrictive. Instead, we assign to
the update program a relatively low priority, and we
assign a higher priority to inquiry programs. Omnibus
secures for the updating program temporary exclusive
use of the data base each time it begins accessing a new
section; this exclusive use, is retained until the updating program is through with that particular section, as indicated by-the purging with or without execution of a queue of output:requests for the section, or
the receipt of a request from the updating program
applying to a different section. At that point, exclusive
control is released, and all inquiry requests that have
accumulated in the meanwhile take shared use of the
data base until they have all been carried out; once that
is done, exclusive control returns to the updating program. This technique does not make it impossible for an
inquiry program to find a pointer before a change of location and use it after, but it does make it possible for
Omnibus, once such a situation is encountered (as indicated by data not being found where a pointer pointed),
to re-examine the indexes with the assurance that the
updating program cannot change the data base or any
of its indexes again until after the inquiry program's
data are found and secured from their new location.
In spite of these error detection and prevention
procedures, however, it is a commonplace that data,
program, and hardware failures can and do still occur;
means must be at hand to recover reasonably quickly
and very reliably from such failures. In a magnetic tape
oriented environment, such backup is provided by
the "grandfather" system, whereby, after each update
of a file, we would still have the tape from before the
update, permitting a corrected rerun if needed. In direct-access environments, however, with updating in
place, the predecessor of an updated block is lost; in
case of an error, either the file must be rebuilt or theindividual changes must be reversed. For dire~t-access
files of modest proportions (e.g., one occupying a single
disk pack), a simple and only moderately inefficient
prodecure is to copy the file onto tape before updating
it, so that, in the event of a glitch of whatever sort, the
file can be restored by simply copying the tape back
onto direct-access. With a very large data base, however, this approach would be most costly, in both time
and money: to dump the full contents of a data cell
drive to tape requires more than three hours and about
22 reels of magnetic tape. A reliable way had to be
found to individually reverse individual changes.
Omnibus accomplishes this as follows: each time the
contents of a track in the data base are to be altered,
we first write onto a magnetic tape file a single block

165

Track 1345 (contents before downdating begins):

IPolicy 701-6992

IpOliCY 678-9015
"
'---------'---------:--------

equal

Backup tape records for track 1345 (descending order by time, date):

track no.

1345

date

time

"before" image

"after" image

Dec. 6 111:59 pm 1701-69921
This image is
written onto track

1345.

Track 1345 (being in the Prime Activity area) is reset to empty
state by the regional reorganization program.

Backup tape records for track 1345 (ascending order by time, date):

I

1345

Dec. 3 1 3 : 30 pm

1345

Dec. 6 111:59 pm 1701-69921

1701-69921

1701-6992 1
equif'

701-69921678-90151
This image is
written onto track

1345.

FIGURE lO-Using the backup tape for error recovery

containing the address of the track being changed, the
date and time of the change, and an image of the track
both before and after the change. If, after executing all
or part of an update run, it is discovered that errors
have occurred, the run can be reversed by sorting the
before-and-after tape into descending sequence by
time within date within track address, then passing the
sorted result against the updated file, writing onto each
affected track the "before" image from its oldest backup record. The presence of both "before" and "after"
images provides a check on the validity of the procedure, since the contents of the track before reversal
should be, bit for bit, identical with the newest "after"
image on the tape. If several days' runs need to be reversed at a time, their backup tapes can be sorted together, and the same procedure is followed. Since the
control totals are recorded within the data base, .this
procedure will effectively restore them as welL The
disk-resident policy index is backed up by simply dumping it to tape before each update run; consequently, it
can be restored in a conventional manner. This procedure (using the "before-and-after" tape) is both swifter
and more reliable than attempting to reverse the updates with another application program: swifter because tracks are restored in physical sequence (thus
minimizing access time); and more reliable because- it

166

Fall Joint Computer Conference, 1968

does not require decisions about which transactions to
reverse and how, and because it is carried out by a very
simple program that is not sensitive to changing application and data specifications.
Similarly, this method provides backup in the event
of hardware problems, such as mangling a strip, scraping
a recording surface, or even losing an entire cell. The
last preceding data base reorganization is, in this event.,
rerun, but time is taken only to recreate the affected region, not t~e entire data base. At this point, all of the
data base except the affected region is at current status,
and· the affected region is at the status it had after reorganization, but before the intervening updates
occurred. All of the backup tapes created by updates
silice that reorganization are searched for before-andafter records of tracks in the affected region; these records are sorted into ascending sequence by time within
date within track address, then -passed against the data
base. This time, however, the first "before" image
should match the initial status of an affected track, and
the last "after" image should be written to bring it
up-to-date. Again, by proceeding in physical sequence,
and by processing only the area that needs restoring,
this procedure is relatively swifter than reorganizing
the entire data base and then rerunning all intervening
updates; and it is more reliable for the reasons mentioned above, not to mention the elimination of the need
to use more than one version, in proper sequence, of any
updating program that was changed in the meanwhile.
The procedure whereby we step backwards from the
current status of the data base to undo bad updates we
call "downdating"; the procedure whereby we step forwards to reconstruct It region of the data base we call
"unclobbering." Each is a very conservative, self-checking procedure.

Accommodating chariging data requirements
In the "noImal" data processing environment, once a
decision is reached to include additional data in a file's
records (perhaps to accommodate a new application or
to enrich the reporting vocabulary), a trauma must
occur in which each program that uses the file must be
revised, recompiled, and (possibly) retested; then a program to convert the records from the old format to the
new one must be written, debugged, and run; and steps
must be taken to assure that the coversion is total, so
that only new versions of programs are run against the
file in its new format. The next time a new field or set
of fields is required, the same sort of trauma must. be
endured again. In practice, this has the consequence
either that improvements to the system are made at
considerable cost and some danger, or (possibly worse)

that improvements are not made because of the cost
and risk involved in revision.
This sort of problem probably cannot be avoided
entirely. Omnibus does, however, possess several characteristics that materially increase our flexibility in the
face of unanticipated new data requirements.
When a new application arises, it will typically require, not just one or two, but a whole cluster of related new fields for each affected entity. With Omnibus,
such a cluster would be defined as a new Format. It
would be assigned an available Format number, in the
appropriate number range according to whether it
should be considered a policy or a claim Format. The expanded and condensed representations of the new Format would be designed, then defined to Omnibus in the
form of a new Format map. This would alter neither the
condensed nor the expanded representation of any
existing field strings, so no operational program would
need to be changed simply in order to continue valid
operation at the current level. No massive, all-at-once
conversion of data base and programs is entailed; programs that recognize, use, insert, and maintain the new
data may be put into operation when and as they are
ready.
When only a few new fields are to be added, they will
m05t probably be implemented as an addition to some
existing Format, rather than as a- new format; this
approach requires a little more effort. The map of the
affected Format must be updated to include definition
of the new fields; but, as when adding a new Format,
the data base need not be rebuilt, since it will simply
show these new fields as being empty and therefore
omitted from the individual condensed field strings.
Programs that use field strings of the affected Format do
have to be recompiled, in order to reflect the new expanded representation; to minimize this effort, among
other reasons, we maintain in direct-access storage a
cataloged description of the expanded representation of
each Format currently defined, coded in a form suitable for inclusion in source programs written in a highlevel language.* Consequently, when a Format is
changed, we simply alter the cataloged description of it
accordingly, theIl' recompile (without any further
change) each of the programs that use field strings of
that Format. This technique removes the need for a
massive file conversion effort and for individual, manual
revision of each affected program.
"'In a COBOL shop, these cataloged descriptions would consist of data definition statements for ~corporation in thc Data
Division 'by means of COpy statements. Fur PL/l, each would
consist of a structure declaration for incorporation by means of a
%INCLUDE statement.

Omnibus

167

Patterns of retrieval
The data base structure used by Omnibus permits
considerable flexibility in the patterns of retrieval to be
made available to application programs, while requiring
linkage maintenance techniques of only moderate
quantity and complexity.
First, and most simply, a program may proceed directly to the policy, section, and field string it specifies,
or it may sequentially retrieve consecutive instances of
a particular (repeatable) Format from a given section,
consecutive field strings in a given-section, field strings
for consecutive claims on a policy, or field strings for
consecutive policies within the data base, in any desired mix of directness and sequentiality. Since a large
share of our transactions currently carry with them the
policy and claim numbers to which they apply, this
provides efficient access for most of our current needs.
To provide effective and efficient ways' of collating
data related in other ways, however, a number of additional list processing techniques are feasible when using
Omnibus; it is anticipated that they will find extensive
application.
Some sections are related in rings: that is, each member of a group of related sections contains a pointer to
the next section, and to the preceding section, of the
The following policies constitute a six-member ring;
policies for the same insured.

Poliay
number
678-8930
678-8934
678-9008
678-9034
678-9124
678-9015

Nut poliay
"Zel:twards "

-

678-8934

Nezt poliay
"d:s.htwards "
678-9015

-

- - - .- - 678-8930
- - - - - - - -678-9034
678-8934
- - - - - - - - 678-9124
678-9008
- - - - - - - - 678-9015
678-9034
- - - - - - - - - -

678-9008

678-8930

they are all

678-9124

-

-

-

---------------------

In the diagram

be~ow.

each

rectang~e

represents a poZiay in the data base.

FIGURE II-Ring structure example

The following poliCies constitute a six-member simple list· they
represent succeeding "generations" of policies on the same' risk.

Poliay
_number

In force during
/iear endi?:!£l.

678-8927

December, 1964

Renewa~ of
rzoZi!:Ji. no.

Renewed by
rzoZi!:Ji. no.

- - - - - - - - - - - - - - - - 678-8955
- - - December, 1965
678-8927
- - - - - - - - - - - - - - - - 678-8989
- - 678-8989
December, 1966
678-8955
678-9015
- - - - - - - - - - - - - - - - 678-9015
December, 1967
678-8989
678-9125
- - - - - - - - - - - - - - - - 678-9125
December, 1968
678-9015
678-9138
- - - - - - - - - - - - - - - - - - - 678-9138
December, 1969
678-9125
- - - - - - - - - - - - - - - - - - - - - - - - - - - - "-'678-8955

678-8910
678-8934
678-8954
678-8962
678-8982
678-8991
678-9012
678-9017
678-9053
678-9092
678-9100
678-9129
678-9137

FIGURE 12-,...Simple list structure example

group; stepping though in either direction from any
member of the ring will eventually bring you back to
your starting point, having in the meanwhile retrieved
every member of the ring in turn. One use for the ring
structure is to link together different policies currently
in force for the same insured party.
Other sections are related in simple lists: that is, they
point to one another in a string, but no attempt is made
to close the ends of the list together to form a ring. One
use for the simple list structure is to point from each
generation of coverage on a single risk both backward
(to the policy of which it was a renewal) and forward (to
the policy, if any, that is a renewal of it); the list terminates at one end with the oldest policy Oil that risk in
the data base, and at the other endwith (typically) the
policy currently in force.
A wide variety of othel' patterns of retrieval is to be
available to us in an efficient way by means of inverted
lists, to be maintained on disk. **Each such list is a string
**Thc file containing these inverted lists is not managed by
Omnibus, and Omnibus does not include the routines for maintaining or using any of these list structures. They are mentioned
here to illustrate some of the uses to which a data base managed
by Omnibus is susceptible.

168

Fall Joint Computer Conference, 1968

To secure data concerning, for eXlllllple, the~ffect of the
1969 Duckburg earthquake (catastrophe nU1llber 77) on the customers of
tbe Drake Insurance Agency (producer nU1llber 69000), retrieve the data
at tbe intersections of the following pair of lists; that is,
retrieve ·the clai1ll8 ~n the first list the policy nU1llbers of which
also occur 1n the seconci list.

dating the related lists. This is a major simplification of
the list maintenance task.

SUMMARY
List 1.

Claims al'ising /'l'CMI
aatastl'ophB '1'1
(poUay

no./olaim

678-8930
678-8937
678-8937
678-8937
678-8981
678-8981
678-9010
678-9015
678-9034
678-9099
678-9124
678-9124
678-9124
678-913f
678-9136
700-1234

nO.)

/ 07-00004
02-00105
02-00106
02-00108
07-00004
07-00005
07-00003
07-00001
02-00047
02-00012
02-01005
07-00999
07-01005
0·7-00023
07-00024
07-00001

I
I
I
I
I
I
I
I
I
I
I
I
I
I
I

List 2.
Po Uoi.es pl'oduoed by
pl'oduoel' numbel' 69000
(poUay numbel') .
678-8927
678-8935
678-8981
678-9014
678-9015
678;9017
678;:'9095
67~-9124
67~-9138

678-9909
701-6992
702-1111
777-1234
777-1235
777-1236
777"-1238
77/1-1239

678-9140
678-9220
678-9221
'678-9227
678-9817
678-9819
678-9820

Thus, the relevant data consist of the following claims (expressed as
policy no. I cla1lll no.):
678-8981
678-8981
678-9015
678-9124
678-9124
678-9124

I
I
I
I
I
I

07-00004
07-00005
07-00001
02-01005
07-00999
07-01005

FIGURE 13..:.....-Intersections of inverted lists

of pointers to policies or claims related in some way. For
instan.ce, maintaining, for each insurance agency that
produces policies for us, a list of all the policies produced
for us by that agent, and also maintaining, for each separate disaster (such as a flood, civil disorder, or major
fire), a list of all the claims we have received arising
from that disaster, would enable us to swiftly find, for a
specified agent, a variety of data concerning the disaster's impact on that agent's customers. A very extensive library of such inverted lists is anticipated; they
entail no modification of the data base.
What makes such an extensive network of list structures feasible is the swift and direct indexing scheme by
policy number used by Omnibus. The pointers in each
list of policies are maintained simply as policy numbers,
not as direct-access addresses; since the me of the.index
increases the total elapsed time to find a policy by less
than 20% as compared with having the policy's address
Ito start with, * this does not seriously degrade retrieval
Speed. The use of the policy number (or the policy number/ claim number pair) as a pointer has, of course, the
desirable consequence that changing the location of a
section in mass storage does not require finding and up*It causes no increase at all if some other task is concurrently
using the data cell drive, so that the one task's index lookup can
be carried out during time that would be spent waiting in any
case.

In summary f I should like to review the ways in which
the Omnibus system addresses itself to the objectives we
defined for it.
1. Retrieval and maintenance functions are simplified
for high-let'el language application programs because a
group of shared routines, previously written and
debugged, provides the index searching, input/output,
condensing, expanding, relocating, control, and backup
functions required for execution of a simply-specified
task, and because use of source program library facilities
reduces the burden of keeping up with data base revisions.
2. The data base is made compact by the condensing
technique for omitting unused fields and portions of
fields.
3. The cost of implementation is kept in proportion to
the benefits, secured by means of the condensing technique (which helps minimize hardware costs) and the
philosophy of maintaining lists by policy and claim
number rather than by a.ctual address (which reduces
the complexity of data base maintenance).
4. Data elements of widely varying space requirements
are accommodated by means of the structuring of sections into variable configurations of field strings, and by
the use
of three different schemes to store and find
\
policies claims, depending on the space requirements of
each individual policy and its claims.
5. A high level of flexibility with respect to patterns of
access IS maintained by providing facilities suitable for
use through extensive and varied list-structuring and
list-processing techniques, so that the most effective
technique can be selected individually for each separate
pattern of relation.
6. Swiftness of retrieval is achieved by implementing a
simple, fast policy indexing structure, and by planning
for the use of inverted lists in high-speed mass storage
for most list-processing and logical search applications.
7. Data integrity is protected by forcing an updating
program to keep its control totals in step with those of
Omnibus, and by saving the before and after images of
each block being changed, as it is changed.
8. Flexibility in accommodating new data elements is
achieved by means of the open-ended Format structure
of the data base, and by the use of a changeable set of
Format maps (in combination with the condensing/expanding routines) to define the individual Formats.
Thus Omnibus provides significant advantages with

Omnibus
respect to each of the primary objectives of our large
data base management system.
ACKNOWLEDGMENT
The system described in this paper was·developed at
Industrial Indemnity Company during 1967 and 1968
by a team consisting of Donald Dewey, James Bolen,
James Otagiri, Dennis O'Donnell, Albert Holman, and

169

the author, with assistance from Lee Jensen, of Information Systems Design, Inc.
BIBLIOGRAPHY
A METAXIDES
Data base management
Special Interest Group on Business Data Processing Newsletter
Number 4 February 1968

A design approach to user customized information
systems
by ROB'E.R:T G. RANGEL
International Business Machines Corporation
Endicott, New York

Complex· information systems such as plant or
corporation manufacturing information systems,
serve a wide range of users and manufacturing
areas. These systems are often characterized· by
the requirement· to provide user options in order
to maintain the integrity of local procedures. Although there may be a strong effort at standardization throughout the system, the fact remains
that the system must serve different levels of
manufacturing, from components to end product,
and must interlace with a variety of personnel,
from manufacturing line operator to management.
Although a system such as this is normally required to fulfill a general set of needs, the system
design cannot ignore local requirements. The end
result can be a system consisting of numerous
programs, many serving similar functions but
each containing some distinctive feature.
This is particularly true in systems which have
traditionally been regarded as process or product
sensitive. A wide variety of manufacturing control systems, .including process control, quality
control and testing, are characterized by "special"
requirements. Normally, these systems start by
serving a limited number of process or product
centers.. Gradually, over a period of time, additional products and processes are added to the
system. The programming burden in such an environment is compounded as the system expands
its coverage and as added peculiarities must be
served.
This problem can be alleviated by the development of a number of generalized application programs which, as a group, can satisfy the overall
system requirement. At the same time, these programs provide, and in fact require, an extensive
degree of user (e.g., quality or process engineering) participation to customize the general set

of facilities to his requirements. The programming
burden is reduced by minimizing the amount of
specialized programming effort and providing the
user with the tools to do individual application
tailoring. After these tools are developed, systems
and programming become less involved with the
peculiarities of each new installation. In addition,
the user has a much more responsive application.
He may now interface directly with the system to
input new or updated processing specifications,
without going through the inherent delays of
design and programming effort.
Since the user now becomes deeply involved
in the design of the system and the subsequent
processing provided by the system, software support must be provided to control the use of his
specifications. This support, in the form of a logic
control subsystem, is an integral part of all phases
of the overall application system. The logic control subsystem provides: (1) support for programmer specification of allowable options during application program development, (2) processing of option specifications at installation time,
and (3) support for controlling the use of the
user specifications at execution time.
This logic control subsystem is being developed
to control user specifications in a manufacturing
quality assurance system which forms a portion
of a larger manufacturing information system.
The information system consists of a number of
local plant sites connected to a central site through
an interplant teleprocessing network. Each local
system will utilize "in-plant" terminals connected
to a dual processor configuration. 'Application
processing at each site will be performed in a
System/360 Model 50 or 65 with one background
partition and from three to seven teleprocessing
partitions. Application programs, written in As171

172

Fall Joint Computer Conference, 1968

sembler Language or PL/1, will run under Operating System/360 using Multiprogramming with
a Fixed number of Tasks (MFT).
The quality assurance portion of the informa. tion system, which will utilize the logic control
subsystem, is required to provide a wide range of
services in each manufacturing plant. These services vary with the type of product, process and
people being supported and also varies in the
amount of control and information desired. The
system must support both process control and
management information type tasks. Process control jobs involve interfacing with manual, semiautomatic and automatic manufacturing processes
for the collection and distribution of quality control data. Management information must be supplied to a number of management levels.
Although a general set of needs have been defined by the users, these needs vary within plants
and from plant to plant within the corporation. Because of this environment the logic control subsystem is being implemented to allow extensive·
quality engineer participation in defining processing requirements .. The quality engineer will interface directly with the system to specify his requirements. Application programs will then use
these specifications under the direction of the
logic control subsystem.
The manner of structuring application programs must lend itself to operation in the logic
control subsystem environment. It is important
to note, however, that this activity takes place
under the direction of the user specification: The
design principles used in system structuring are
as follows:
1. Modularity

This is an established concept which is required in the system architecture. Software
is developed in small, independent and easily
controlled modules, each with a limited function. Modules are designed to be independent
of their configuration with other modules.
This allows the building of programs by
linking modules in different combinations.
2. Generalization
Programs and the modules from which they
are structured are generalized to permit
their use over a wide range of processes.
Modules are generalized by coding in a
skeletal form. A number of internal parameters which affect the type and logic of
processing are left blank within the modules. VVhen these parameters are assigned

values, the module becomes customized to a
particular process. Programs are generalized by the inclusion of both required and
optional modules. The program becomes customized when the selection is made of the
actual modules to be used for a particular
manufacturing process or product.
3. A bility to Customize
The user is given the ability to customize
processing for his particular need. Services
are provided to input, store and access user
specified options. To a large degree, the user
has the ability to construct and modify the
system. Logic control information resulting
from user specifications is stored on a data
set. This information consists of two types
of options: (1) internal module parameters
which affect the mode of processing within
the modules and (2) routing information
which specifies the sequence of processing
from module to module within the application program.
4.. Execution Control
Programs are built from independent .and
generalized modules which require the control information described above for proper
execution. This control is provided by a logic
control module contained in each application program. This module accesses control
information, passes the processing parameters to the application modules within
the program, and directs the sequence of
execution from module to module. Applica. ~ion programs remain generalized until they
are actually used, since the control information required for tailoring is not accessed
and used until execution time. The logic
control module, therefore, plays a critical
role in the execution of any application sequence.
The logic control subsystem, which provides
the software support necessary to handle user
specifications,. is involved with the application system in three separate phases. (See Figure 1.)
Phase 1-System Development
a. At the time application modules are developed, the programmer's definitions of
module parameters are input to the logic
control subsystem for storage. These parameters are later assigned values by the
user to· vary the internal processing of the
module. The number of parameters defined

Design Approach to User Customized Information Systems

173

eter is used. Parameters are not identified
by the program which contains the module.
This permits the same· parameter information to be used when the module is utilized
in more than one program. At the time of
user input of processing specifications, the
parameter identification is employed to ensure that the user value is assigned to the
·correct parameter. The parameter ID is
also utilized during application program
execution to identify the values passed to
the modules within the program. The record
format of the parameter directory is shown
in Figure 2.

SYSTEM
INSTALLATION

SYSTEM
OPERATION

(or)
List of
Valid Values

Application
Program

1

I

Repeated for each parameter in module

FIGURE I-Logic control subsystem
FIGURE 2-Paramet.er directory record

and stored depends on the degree of module
generalization.
The parameter definition inforlnation provided by the programmer includes the followingModule ID-the identification of the
module containing the parameter.
Parameter ID-the unique parameter
identification within the module. This
will be referenced later by a user specification.
Data Type-indication of character, decimal, binary, etc.
Length & precision-indication of the
length and precision of the parameter.
Count-the number of values which the
user may assign to the parameter.
Range-valid high and low limits for
numeric data.
Valid values-valid values for character
data.
Default value-value to be assigned to
the parameter when no user value is
specified.
Parameters ar.e identified by the parameter
ID and by the module in which the param-

b. When the individual modules are combined
into application programs, processing se-.
quence information is input to the logic
control subsystem. These routing rules indicate the range of choices in which processing is permitted to proceed from one
module to the next within a program. The
actual sequence is determined by both
execution time decision and as the result
of user option selection.
A typical program layout js shown in Figure 3. The resulting program load module
consists of standard and optional modules
which are user selectable. If specified by
the user, optional modules will be used in
place of or in addition to standard modules.
All modules return completion codes after
execution. The completion code is used by
the logic control module to determine the
next module to execute. At execution time,
if an optional module has been specified,
control will pass to the optional module
rather than the standard module which had
originally been in its place.
Each module in a program is assigned a
node identification. The node ID is used by

174

Fall Joint Computer Conference, 1968
Option ID-a unique option identifier
which will be referenced by a user
specification.
Node ID-node at which this module will
replace a standard module.
Module ID-name of the optional module
Completion Code-same as standard routing
Next Node-same as standard routing

Xode 4

_ _ _ _ _ _. 0

~

Optional
Module ~
I

~:

.~

0

C

0

~--C~~

E

'---------cB
FIGURE 3-Typical program

the programmer to indicate which portions
of the standard program may logically be
replaced by optional modules.
When one or more option modules can replace an unlike number of standard modules,
dummy modules are included in the routing
information in order to maintain a one to
one correspondence' between optional and
standard modules. This facilitates module
replacement and ensures that information
is not included in the logic control record for
modules which will not be used during execution.
The programmer routing information input to the system is composed of the following items.

The resulting routing descriptor record
shown in Figure 4 is generated for the program illustrated in Figure 3.
c. The development of the user option language is a joint responsibility of systems
and user personnel. This definition is simply
a list of user keywords cross-referenced to
the module processing parameters and
routing options which they affect. A single
keyword may be cross-referenced to one
option in one mod:ule or to a number of
options in modules contained in different
programs. This allows a user specification
Standaru Routing
Program
ID
Prog. X

Node

Module
ID

CC

Next
Node

CC

LiJ__~ .-+-1_°-,,--1 2

1

2 3=~I~~~~L_~1_ ° I

4

(

(-;-r--~-----r-~--o

Program ID-program name
Node ID-unique node number within
the program
Module ID-name of the module which is
assigned to the node
Completion Code-completion code returned by the module at execution time
Next Node-next node to gain control for
the paired completion code. This also
indicates whether or not the calling
module expects control to be returned
at the completion of execution of the
module at the next node.
Optional Routing:

1_-?

--1-_

5
2~-~~[:~_1--,-oI----lo
?

Standard Routing:

Next
Node

(~~__ E I

0

I End?

OptiOllUl Routing
Next
Option Node Module CC
Node
In
ID

2

01

2

D1

0

5

?

(

02

4

C1

0

5

(

End

I

2

5

IDU1l\IIId__~-

FIGURE 4-Routing descriptor record

3

Design Approach to User Customized Information Systems
to have as broad an affect as desired.
The user takes an active part in defining
the keywords which make up his language.
This permits him to input option specifications in terminology familiar to him. The
user option language is completely independent of application programming since its
definition consists merely of a cross-reference. This means that it can be changed and
expanded with little effect on the application
programs. In addition, the logic control
system processing required to handle user
specifications is minimized. There is no
unique processing required for each keyword specification since all user input is
handled through the cross-reference list.
The sequence in which keywords are listed
in the cross-reference data set determines
the order of keYword processing at user
specification time. This is normally a strictly sequential mode of processing. To vary
the processing sequence, the programmer
may define "instructions" to the logic control subsystem. These instructions are included in the cross-reference data set and
allow non-sequential processing at the· time
user specifications are read into the system.
The instructions provide the ability to define parameter subsets and hierarchies.
A . conditional branch type instruction
causes bypassing of keywords in the crossreference data set when certain values are
specified by the user. For example, "if KEYWORD 1 = VALUE 1, go to KEYWORD
10, otherwise continue with KEYWORD 2."
A looping type instruction allows a set of
keywords, for instance KEYWORD 1
through KEYWORD 10, to be repeated by
the user with different values specified each
time.
The language definition and resulting
cross-reference data set consist of the following· elements as shown hi Figure 5.
keyword-user language keyword
module and parameter ID-list of all
parameters in. the parameter directory
which are affected by this keyword.
(or)
program and routing option ID-list of
all routing options in the routing
descriptor data set which are affected
by this keyword.

175

loop indicator-indicates the start or end
. of a group of keywords.
number of loops-indicates the maximum
number of times the group of keywords
may be repeated by the user ~
value and next keyword-indicates the
next keyword to be processed if the
.user inputs the specified value.

Optional - for looping and branching

~--------~---------~
Value-Next
Keyword List

I

l

(or)

:

'pr~-l;~;;I~

Routing Option
ID List

FIGURE 5-Language cross-reference record

Phase 2-System Installation
At local installation of the information system for a specific process or product, the
user inputs his local processing options via
the user option language. The user specifications, in conjunction with the previously
developed data sets, are used to generate
logic control records. These records are
used to control .the processing of the application programs at execution time. The
user specifications are also placed in a
catalog, to be referenced later when updates
are required to a previous specification.
Logic .control records, therefore, contain
user selected subsets of the options defined
in the parameter directory and routing
descriptor data sets. These values are selected by keywords which point to the desired options through the cross-reference
data set. Values are also selected by default,
when the user omits keywords which' are
not required in the input stream.
Each logic control record is keyed by program ID and user ID. At execution time,
inputs which invoke the application program contain the same key, allowing the
correct logic control record to be accessed
for the particular use of the program.
The resulting logic control record, as
shown in Figure 6, contains the following
elements.

176

Fall Joint Computer Conference, 1968

FIGURE 6-Logic control record

, Program ID-program identification
User ID-identification of the program
user. This element and the program
identification form the record key.
Module ID-identification of modules
within the program.
Completion code-completion codes returned by the module at completion of
execution.
Next module pointer-pointer to the next
module to execute for the corresponding completion code.
Parameter ID-unique identification of
parameters used by the module
Parameter value-values of the parameters used within the module.
Application modules access the parameters
'in the logic control record by parameter ID
rather than by the parameter position in
the record. This simplifies addition and deletion of parameters used by the module,
since changes in position do not affect accessing of the parameters. Additionally,
parameters are separated by module in the
logic control record. Therefore, parameter
changes for one module will not affect parameter' accessing in other modules of the
program.

in either a background or real-time mode.
When the application program is invoked,
control is initially passed to the logic control module. The user identification contained in the input is used to access the
correct logic control record. The control
module determines the first module which
will execute, as specified in the control
record, and gives it control. At this time
the module receives its parameters as contained on the record. The parameter values,
in effect, customize the function performed
by the module, as previously specified by
the user.
When the application module completes
processing it returns control to the logic
control module and passes back a completion code. This code is matched against all
completion codes which may be returned by
the module. When a match is found, the
pointer to the next module, contained on
the logic control record, is used to determine
the next module for execution. Control and
parameters are passed to this module and
the process continues until program completion. The application program layout is
illustrated in Figure 7.
The fact that control information is not accessed and used until the program is invoked
means that the program remains generalized
until execution time. This permits an individual
program to serve many users, each with varying
requirements. Users do not require individual
systems and programming at \ention, since re-

r- - r---_-.l.I_-;.oI

i-i

Phase a-System Operation
Each application program contains a logic
control module which serves as the interface between the logic control. data set and
the application modules within the program.
The control module is a common module
which is independent of the application program being controlled. It provides control

I
I--

I
Control
and
Parameters

1--

>

Logic
Con trol
Mouule
r

Application
Mouule
1------1 -

I
-

+I

I
I
+ - - - - - - l - - .I
I
Application
Application
Mouulc

Module
t-----l- -

I

..;J

Completion
Code

FIGURE 7-Application program layout

App1)cation
Program

Design Approach to User Customized Information Systems
quirements are specified through the user option
language and stored until needed. The logic control subsystem, which is independent of the ap-

177

plication being controlled, provides· the necessary
support to control the specification and utilization
of processing options.

B-LINE, Bell line drawing language
by AMALIE J. FRANK
Bell TelephOne Laboratories, bworporated
Murray Hill, New Jersey

INTRODUCTION
General De8cription
Over the past few years increasing interest has been
shown in the application of digital computers in the
graphics arts and publishing industries. Considerable
effort has already been made in developing systems for
the editing and publishing of text. Early work resulted
in the formulation of algorithms for hyphenation and
justification, followed by systems for page composition
and correction of text stored internally within the computer system. Initially, the output function of these systems was to control a conventional hot-lead typesetting
device. More recently,systems have been designed to
control the formation of images on the face of a cathode
ray tube (CRT). An image thus displayed is captured
by a camera aimed at the CRT, and the resulting film
is used to produce plates or mats for off-line volume
printing. Systems of this type have been successfully
implemented and are in full operation, as for example
the MACEI (Machine-Aided Composing and Editing)
system in use at Bell Telephone Laboratories, and the
PAGE1 2 (Page Generation) system developed by the
RCA Graphic Sys tems Division.
Paralleling the need to automate the handling of
text, is the need to produce graphic arts quality line
drawings with an equal amount of ease and economy.
This is of particular concern in the production of technical publications. To date, a number of computer programs have been developed to produce line drawings on
a CRT for specific applications, as for example· the
AUTODRAFT3 system for engineering drafting and
design, and the XYMASK4 system for generation of
integrated circuit masks. In addition, various FORTRAN subroutines have been written, as for example
TPLOT6 for drawing graphs, and the graphic subroutine package proposed by the SHARE Standard Graphic
Output Language Committee. 6 At present, a need exists
for a common computer language facility aimed at the
production of graphic arts quality line drawings. In

order for such language to be useful, it must have certain basic properties.
First of all, this language must be concise and easily
learned. It should permit the user to specify the various
features of a drawing in the natural order in which they
occur to him and in a continuous stream rather than in
segmented form in separate statements. For publication purposes, it must give the user direct and ultimate
control of every line drawn if he so desires. Yet, where
applicable, the user should be able to cause a particular
version of a whole superstructure to be generated by the
system merely by specifying a few simple options. Toward this end, the language should include the facility
to construct higher level statements from the basic
language statements. It is envisioned that a set of such
"user defined" statements could be developed by an
experienced. programmer for a particular application.
Once defined, such statements could then be used by
non-programmers without knowledge of their genesis.
Preferably, the language should meet the needs of users
of widely varying computer experience. At one end of
the scale it should appeal to a user essentially untrained in computer programming for the simple transcription of drawings from a rough draft. At. the other
end of the scale it should satisfy a user desiring to
generate pictures controlled by algorithm at execution
time. Drawing on a conditional basis is particularly
attractive for applications such as circuit drawings and
the production of musical scores. Finally, the implementation of this language should readi1y accommodate
minor changes in syntax dictated by user experience. In
addition, it should be designed to run easily on a variety
of computers, and hopefully on a variety of terminal
CRT systems, such as the Stromberg· Carlson 4060 or
the RCA Videocomp.
The B-LINE language was designed to meet the requirements indicated above. Initial application of the
language is to be made to the production of the illustrations in the Bell System Technical Journal. The remainder of this paper is devoted to a description of the

179

180

Fall Joint Computer Conference, 1968

B-LINE language. The following section summarizes
the general features of the language. A later section describes the composition of draw-strings in greater detail.
The last section contains a summary of the basic statements.

General features
The B-LINE~]anguage includes a set of eight basic
statements, which describe the drawing features to the
system in textual form. Included is the faciJity for the
user to define other graphic statements, germane to a
particular application. In addition, the user may
employ any of the FORTRAN IV statements in admixture with the graphic statements, thus supplying
the usual arithmetic and control functions. The total .
input describing a picture is a collection of B-LINE
basic, B-LINE user-defined, and FORTRAN statements. In any case, this input need not be a complete
FORTRAN program.
The formats of the eight basic statements are shown
in illustration 1; they are summarized in the next section. In brief, these statements perform the following
functions:
DRA W describes a part of a drawing by means of a
draw-string, consisting' of a string of elements which indicate a sequence of drawing functions. The effect of
DRAW is to resolve the draw-string into a set of line
segments to be drawn.
DEFINE gives the definition of a graphic variable.
It is roughly equivalent to a FORTRAN assignment
statement. However, the value of a graphic variable is a

BASIC GRAPHIC STATEMENTS

Arguments

Statement
DRAW

NAME, XSCALE, YSCALE:

STRING

DEFINE

SYMBOL:

DEFINE

SYMBOL, ORIGIN, XSCALE, YSCALE:

ERASE

TYPE, SKIN, XSCALE, YSCALE, Xl, Yl, X2, Y2

EXPAND

SYMBOL, EXPANSION

OPFORM

NAME, RESULT, TYPEl, TYPE2,

SIZOUT

BOTTOM, LEFl', LABEL, PAGEl, PAGE2

BORDER

LOCATION, SCALE, BASE, FIRST, LAST
SCALAB, AXlLAB, NODRAW

SIZIN

SIZEl, SIZE2

STRING

ILLUSTRATION 1

STRING

string of elements, which themselves comprise a drawstring.
ERASE causes a set of line segments, which had been
previously specified to be drawn, to be deleted.
EXPAND gives the definition of a symbol, which is
used in place of a contiguous part of the input describing
a picture. It is used to minimize preparation time where
it is anticipated that a set of pictures of a similar nature
are to be drawn and where certain parts of the input are
the same for each member of the set.
OPFORM indicates the structure hf a user-defined
statement or a graphic function.
SIZEOUT, BORDER, and SIZIN primarily establish the necessary scaling factors.
The various statements describing a drawing are
composed of characters from the standard character set.
This set consists of 64 symbols, as defined in Appendix
A. Each of the graphic statements, basic or user-defined,
consists of an optional label, followed by the name of
the statement, followed by a set of arguments. Labels
and statement names are to conform to FORTRAN
standards for labels and variable names respectively.
A statement must be followed by a space. Spaces are
significant only following a statement name or within a
string of characters representing text to be drawn.
Other spaces are ignored by the system and may be
used freely to give ~isual separation. At present, input
is on punched cards. Two successive statements on
the same card are separated by a semi-colon. In each
graphic statement there are a fixed number of initial
arguments. In some statements, such as the DRAW
statement, the terminal argument itself consists of a
string of elements, which indicate a sequence of drawing functions. A string of this type is called a drawstring. Commas are used to separate initial arguments.
A colon is used to separate the last initial argument and
a terminal draw-string.
The elements of a draw-string may assume various
forms: a coordinate pair, a symbol for a graphic variable,
a graphic expression, a text element, a range function
call, a graphic subroutine call, or a code for a control
operation. These are discussed in detail in section 3
below. The various elements of a draw-string may be
free]y intermixed, thus permitting the user to specify
the various features of a section of the drawing in a
continuous stream. Drawing data, such as coordinates
defining line segments, names of variables or predefined
substructures, text, and control parameters like line
thickness and font selection, may flow in the same
order as they occur to the user. Concatenation proceeds
naturally from the order established in a draw-string,
i.e., the last point specified for a draw-string element
becomes the concatenation point for the next element,
unless superseded where desired. Concatenation points

B-Line, B,ell Line Drawing Language
may also be variable. At execution time, a draw-string
is resolved into a set of line segments defined in terms
of CRT raster coordinates.
Of particular note is the handling of graphic variables. A graphic variable assumes two forms: a string
variable or a point variable. A string variable is itself
defined as a draw-string, which in turn may contain any
of the elements listed above for a draw string, including
other variables. A point variable consists of a pair of
elements, representing the abscissa and ordinate of a
point in the picture. A variable is assigned a symbol,
which may be used in various contexts in the initial
arguments of the graphic statements, or within a drawstring. A graphic variable may assume various values
thoughout the course of the drawing process. Thus, a
drawing feature may be represented in variable form,
and a specific form determined by algorithm at execution time. This is in contrast to describing each part of
the drawing explicitly in the input data. Variables are
discussed further in the following section.
In many cases, the user needs to arrive at the position
of various key points within the drawing, or such factors as the distance between two points, or the slope of
a given line. These factors may be calculated manually,
,albeit somewhat laboriously, by the familiar techniques
of analytic geometry. To relieve the user of this burden,
the system includes the facility to perform graphic
arithmetic, which manipUlates entities representing
points within the picture or scalar quantities. Expressions involving such entities may be used in various
contexts in the initial arguments of a graphic statement or within a draw-string. Such expressions are
evaluated at execution tine by means of the graphic
arithmetic facility. This is discussed further in a later
section.
For a given application, considerable economy can be
effected by incorporating user-defined statements. To
do so, the user first determines the actions that are to be
performed when the statement is used, and gives a
name to and determines the form of the arguments of
the statement. The user then writes a subroutine bearing the name of the statement and performing the indicated actions. In the main body of input describing the
picture, the user includes an OPFORM statement
declaring the name and format of the statement. The
user is then free to use the indicated statement in the
,main body of input. A user-defined statement may be
used as a separate graphic statement or as a graphic
subroutine call element in a draw-string. Either type of
usage results in a cal1 to' a subroutine bearing the name
of the statement. Such a subroutine may itself be written using the basic graphic statements, other user-defined statements, and any FORTRAN IV statements.
The arguments of a user-defined statement may assume

181

all of the forms permissible under ,FORTRAN. In addition, they may assume a number of other Jorms, and in
particular the terminal argunlent may be a draw-string.
A set of user-defined statements have been defined
for the production of graphs, and are outlined in illus- .
tration 10. User-defined statements are particularly
applicable where a class of structures to be drawn can be
specified in generalized form by means of a user-defined
subroutine. In this case, the statement is defineq so that
at a particular use of the statement, the argUments supply parameters which cause a particular version of the
structure to be drawn.
Implementation of the language is made using a
macro-processor written in the BSTRING7 language.
BSTRING is a string langl,lage, with special features
added to facilitate macro-generation. Its syntax is somewhat less pleasant than, but more powerful than SNOBOL, in particular permitting arbitrary recursion within
statements.
The macro-processor ingests the input describing a
picture, and treats each statement as a macro-instruction, which either expands into a sequence of FORTRAN statements, or causes the macro-processor to
use the indicated arguments to control the translation
of subsequent graphic statements. For the basic graphic
statements the code generated consists essentially of a
call or a series of calls to a collection of system subroutines. For example, the appearance of a coordinate pair
(2, X) as an element of a draw-string of a DRAW
statement results in a call to a system subroutine,
which .performs the following minimal actions. The
values of the constant 2 and the variable X are converted to r3tSter coordinates, if required. The converted values are incorporated into an instruction as required by the output CRT device, and the instruction
is added to an output stack. The code generated for a

USER DEFINED OPERATIONS FOR TIlE PRODUCTION J2!!...

4,-

i

I
I

of the variable:

, , ,-,

a quarter note, of a magnetic core inductor from
an inductor, as shown in illustration 5.
In the illustrations indicated above, the definition of the string variable yields a fixed image,
An example of a string variable which varies de.
pending upon the context in which it is referenceis shown in illustration 9. Note that in this cased
in the DEFINE statement for the image #BOX,
the ORIGIN argument is GLOBAL, thus setting
the point P, as indicated above, at (0, 0).

-------------------------~

EXAMPLE OF DRAW-STRING ELEMENT:

I

I

i
,. _.J

DEFINE #FLAG, CAT, XRAST, YRAST:

(0,60),

( 40, 50), ( 0, 40), $S, ( 0 , 0 )

(c) A graphic expression

A graphic expression is one using one or more
of the graphic operators, or referencing a graphic
function. The graphic operators invoke the system facility to perform "graphic arithmetic" at
execution time. This arithmetic manipulates
operands which are ordered pairs and in some
cases scalars. An ordered pair represents the
coordinates of a point within the picture. A number of graphic functions are supplied by the system. Provision is also made for the user to define other graphic functions. A graphic expression
may also contain the usual algebraic operators
and FORTRAN function references. At execution time, the expression is evaluated, and the
resulting value is in effect substituted in place of
the variable. In the present context, where a

Use of the variable:
-------

,

1. __

-I

L

DRAW EARNINGS, XDATA, YDATA:

(1,2), (2,3), (3,6),

#FLAG, (5,2), (7,7), #FLAG, (8,3)

ILLUSTRATION 3

EX~PLE

OF DRAW-STRING ELEMENT:

STRING VARIABLE

Definition of the variable:

4..;

185

f·
CONSTRUCTION OF IMAGES FROM IMAGES
l_~

,"L

E1ementar¥ Image

40

DEFINE #FLAG, CAT, XRAST, YRAST:

$3, (0,20),

( 0 , 80), (40, 70), ( 0, 60), $S, ( 0, 0 )

Compounded Image

-- r-07") 7D-lJI

Inductor

Use of the variable:

MagnetiC Core Inductor

Quarter Note
---L--._._

.L__.. _ ... __ --1-

4-

,;

DRAW EARNINGS, XDATA, YDATA:

\,/

Eighth Note

p.

(1,2), (2,3), (3,6),
-1'(.":<

r

:..

L_..

.....J
IC

-1.-

l ____ •• l__

o

ILLUSTRATION 4

the point P, as indicated above is (3,6), and for
the second reference P is (7, 7).
Au, image may be used in building another
image. A few simple examples, are the building
ofa prism from a triangle, of an eighth note from

40

",0

Prism

DEFINE #TRIANGLE, CAT, XDATA, ¥DATA:

i'

1 .......• J

20

Triangle

(10,-17.3),

(-10,-17.3), (0,0)
DEFINE #PRISM, CAT, XDATA, YDATA:

$S, (40'-26)~"

(0,-17.3), (10.0), (50,-8.7), #TRIANGLE
'I
...

ILLUSTRATION 5

- ... _-

---.--..... _-

186

Fall Joint Computer Conference, 1968
graphio expression is used as a separate element
of a draw-string, it is assumed to yield an
ordered pair.
The graphio operators and funotions supplied.
by the system are indicated in illustration 6. The
graphio operators parallel the arithmetio operators for complex numbers. For addition and subtraction, the operands represent points within
the pioture, or displacements from such points.
For multiplication and division, in general one
operand represents a point within the picture,
and the other operand oomprises rotation and
sizing faotors. The results of any of these graphio
operations is an ordered pair.
The system graphio functions operate on a list
of arguments each of which is an ordered pair or
scalar as applicable. These functions are sum'
marized as follows:
ANG(PI, P2) gives the angle that the line joining the two points PI and P2 makes with the
hOlizontal, originating at PI and extending to
the right.
DIS(PI, P2) gives the absolute distance between the two points PI and P2.
POL(P, ANGLE, LENGTH) gives the oartesian coordinate pair oorresponding to the point

GRAPHIC OPERATORS AND SYSTEM GR~PHIC FUNCTIONS
GRAPHIC OPERATORS
(Xl, Yl) + (X2, Y2),

=

(Xl, Yl) - (X2, Y2)

= (Xl

(Xl + X2,Yl + Y2)
- X2, Yl - Y2)

- (Xl, Yl) = (-Xl, -Yl)
(Xl, Yl) * (X2, Y2)
(Xl, Yl)/(X2, Y2)

= (XIX2

- YIY2, X2Yl + XIY2)

=( X1X22 + YIY2,
2
X2

SYSTEM GRAPHIC FUNCTIONS:

DI(l/ P2
p~~P2)

+ Y2

X2Y1- XIY2 ")
X2 2 + Y2 2

ANG, DIS, POL, PER, TAN
POL(P ,40,5)",

~/

)

0_

ILLUSTRATrON 6

given in polar coordinate form. As shown in
illustration 6, the components indioate a vector
originating at the point P, and making an angle,
ANGLE, with the horizontal extending to the
right from P. The length of the veotor is given by
the argument LENGTH. The value of this function are the coordinates of the end point of the
indicated vector.
PER (PI, P2, P3) gives the coordinate pair
which is the intersection of the perpendicular
extending from a point PI to a line, defined by
two pointsP2 and P3.
TAN (PI, P2, R, K) gives the coordinate pair
which· is the point of tangency of the line passing
through the point PI and tangent to the circle
with its center at point P2 and of radius R. The'
parameter K indicates which of the two possible
points of tangency is to be used.
The user may define other graphic funotions
either by means of a DEFINE statement, corresponding to a FORTRAN arithmetic statement function, or by an external subprogram. In
any case, the user must include in t~e main body
of input describing the picture, an OPFORM
statement declaring the form of the arguments of
the function and the number of elements in the
result draw-string returned by the function.
Exampies of graphic arithmetic are given in
illustrations 7 and 8.
(d) A text element

A text element represents textual matter to be
drawn. It takes two forms: a text string, and a
special character symbol as discussed below.
The primary form of a text element is a text
string, which is a sequence of characters drawn
from the standard character set, preceded and
succeeded by the double quote character. The
standard character set consists of 64 characters,
and is listed in Appendix A. For each character in
this set, the system contains an internal definition of the line segments to be used to draw the
character and additional factors for concatenating successive characters. In processing a text
string, the system accesses the appropriate definition for each character in the strjng, and
causes the indicated strokes to be drawn. The
font style for the standard character set is
News Gothic English.
In addition to the standard character set, the
system includes a set of special character definitions for the Greek alphabet and various
mathematical and other symbols. Associated
with each of these characters is s system name
starting with an & and followed by a combination

B-Line, Bell Line Drawing Language
of characters from the standard character set except the arithmetic symbols, and the punctuation
symbols used as delimiters. To cause a special
symbol to be drawn, the user includes its system
name as a separate element of a draw-string.
For the English alphabetics, definitions are
provided for upper and lower cases, in Roman,
bold, and italic faces. For the Greek alphabetics,
definitions are provided for upper and lower
cases. The case and face applicable for a text
string or special character element is indicated
by a preceding draw-string element that is a text
control operation, and is explained below.
Standard and special characters are defined
relative to an hypothetical origin. This origin is
assumed to be generally to the left and above the
character. Where a character is not preceded by
another character, the hypothetical origin of the
character is simply superimposed on the concatenation point which was defined at the end of
the previous element in the draw-string. Where a
character is preceded by another character, co.ncatenation proceeds according to an algorithm
which permits the spacing between any two
characters to be a function of the spatial relationship between the particular characters involved. 8
Provision is also made to rotate and size characters.
See illustr~tion 9 for an example of the two
forms of a text element.

187

form, the range function call requires two successive draw-string elements, one for each parametric equation. The first element states a function of the parametric variable, P, and the second
element states a function of the independent
variable, X. The range of computation is specified
for the parametric variable only. The range suffix
is appended to the first element, and must always
appear.
(f) A graphic subroutine call

This element is a user-defined statement imbedded in a draw-string. The only difference
between a user-defined statement used as a
separate graphic statement, and one used as an
element in a draw-string, is that in the latter case
the entire set of arguments is enclosed in parentheses. The action taken is the same in either
case.
(g) A code for a control operation

Control operations cause the system to take
internal aci,ions relating to the handling of a
draw-string. There are five control operations:
set, dash-dot, weight, space, and text. These are
explained individually below.
Set operation

In its simplest form, a range function .call
identifies the name of an independent variable,
and states a function of the variable. The system
evaluates the function for successive values of
the independent variable within a specified range
at appropriate small increments. The resulting
sequence of coordinate pairs is substituted in the
draw-string in place of the range function call.
The function may be stated in non-parametric or
parametric form. Where the non-parametric
form is used, the range function call is stated in
one draw-string element, consisting of an equals
sign, followed by the function of the independent
variable, X, followed by optional suffixes specifying the range, as shown in the example below.
Where a range suffix is deleted, the function is
evaluated over the entire range of the data scale.

The set operation 'consists of the characters
$SET followed by one or two arguments. The
arguments are separated by a comma, and enclosed by one set of parentheses. The first argument is always the symbol for a point graphic'
variable. This operation causes the system to set
the value of the variable to the current value of
the concatenation point, CAT. The second
argument is a code indicating the scale to be used
in setting the value of the variable. The variable
set by a set operation may be referenced at some
later point in the drawing process, either in
the same draw-string or in a separate context.
This feature is provided because the user will not
always explicitly know the exact position of the
concatenation point unless he performs cumbersome manual calculations. This is particularly
true where text or successive images are being
processed. Illustration 9 shows an example of how
the set operation is used to draw a rectangular
box around part of a line of text.

=

Dash-dot operation

(e) A range function call

LOG (X) + BTU (X = 2, UPPER) (Y =
A+6, DIS (P, Q))
When the function is stated In parametric

The dash-dot operation consists of the charaoters $D either alone or followed by an argument

isS

FaUJoint Computer Conference, 1968

enclosed in parentheses. Where . an argument is
present, this operation causes the ensuing drawstring ~lements to be drawn in a pattern of dashes
and/or dots. The argument is either a code indicating one of four standard patterns (long
dashes; short dashes; dots; alternating dashes
and dots), or it is a variable indicating a u~er-de­
fined pattern. Where $D Q.'t)pears alone, ,cursive
drawing is resumed.
Weight operation
The weight operation' consists of the characters
$W followed by an argument enclosed in paren~heses. The argument is a code indicating lines
of varying heaviness. This operation causes the
ensuing draw-strin~ elements to be drawn with
the idicatedline weight. In the absence of any
weight operation the lightest weight is assumed.
Space operation
The space operation consists of the characters
$S, and causes a space to occur between the line
segment indicated by the previous draw-st~ng
elements, and the following draw-string element.
In effect, it causes the concatenation point CAT
to be reset to the pair of coordinates specified
.by the following draw-string element.

This statement supplies a name to, and describes a
part of a drawing, referred to as a structure.
NAME is a unique symbol, consisting of any combination of characters from the standard character set,
except the arithmetic operators and the punctuation
symbols used as delimiters. In addition the initial
character may not be a #, &, or $, which identify a
string variable, a special character symbol, and a control operation respectively.
XSCALE indicates the scale used in specifying the X
coordinates contained in the STRING argument. It
may assume one of the codes XDATA, XCOPY
XFINE, XRAST, which correspond to the four ways
in which the. scale may be given: in terms of a data
scale, in inches as measured on an existing copy, in
inches in the final output' print, and in CRT raster
positions. XSCALE may also be null. In this case,
XDATA is assumed~
YSCALE indicates the scale of the Y coordinates in
the STRING argument. It may assume one of the
values YDATA, YCOPY, XFINE, XRAST, or it may
be null.
STRING is a draw-string, specifying the structure to
be drawn. Provision is also made to specify the structure
to be drawn in a separate set of cards prepared by subjecting an existing drawing to a digitizer.

Define statement

Test operations

DEFINE SYMBOL: STRING

These operations consist of a $ followed by an
alphabetic character as shown below. They con.;
trol the case and face settings for ensuing text
elements in the,draw-string. The case setting is
applicable for both the English and Greek
alphabetics. The face setting is applicable for the
'English alphabetics only. In the absence of a
case setting, $U is assumed, In the absence of a
face setting, $R is assumed.

DEFINE SYMBOL, ORIGIN,
YSCALE: STRING

Operation
$U

SL
SF
$R
$I

SB

Effect on ensuing text elements
Upper case
Lower case
First character upper case; succeeding characters
lower case
Roman face
Italic face
Bold face

Summary of basic statements

Draw statement
DRAW

NAME, XSCALE, YSCALE: STRING

XSCALE,

The DEFINE statement defines a graphic variable or
a graphic function.
The first form of the DEFINE statemep.t is used
where origin and scaling data for the defining drawstring either are not applicable or assumes the same
values defined for the parent draw-string containing the
variable. This form is always used to define a point
variable. It may be used to define a string variable
where applicable.
.
The second form of the DEFINE statement is used
where the origin and scaling data for the draw-string are
stated explicitly in the ORIGIN, XSCALE and
YSCALE arguments. This form of the DEFINE statement may be used to define a string variable only.
SYMBOL is the name of the graphic variable or
graphic function and consists of any combination of
characters from the standard character set except the
arithmetic symbols and the punctuation symbols used
as delimiters. In addition the initial character may not
be & or $ which identify a special character symbol and

B-Line, Bell Line Drawing Language
a control operation respectively. An initial character of
# is permissible, and identifiies a string variable. Where
the oper~tion defines a graphic function, the symbol is
followed by the dummy argument names, separated by
commas, and all enclosed in parentheses.
ORIGiN indicates the origin of the coordinates in the
STRING argument. ORIGIN may assume various
values as follows:
(a) the code GLOBAL to indicate that the coordinates are given relative to the global origin.
(b) the code CAT to indicate that the coordinates
are given relative to an hypotheticaZ origin. At a
particular use of the variable in a draw-string, the
hypothetical origin of the image is superimposed
on the current value of the concatenation point,
CAT.
(c) a graphic variable or expression which resolves
into two numeric values.
(d) the form of a coordinate pair (X, Y) as explained
in section I, 3 above.

YSCALE and XSCALE take the same form as these
arguments for the DRAW statement indicated above.
STRING is a draw-string defining the graphic variable or stating the algorithm defining a graphic function.
Provision is also made to specify an image on a separate
set of cards prepared by subjecting an existing drawing
to a digi~izer.

Erase statement
ERASE TYPE, SKIN, XSCALE,
Xl, Yl, X2, Y2

YSCALE,

This statement specifies a part of the picture to be
erased.
TYPE indicates the type of entity to be erased and is
coded with one of the values: BOX, CIRCLE, or a
variable name, or the name ofa structure specified by a
DRAW statement. Xl, Yl, X2 and Y2 give the various
parameters of the entity to be erased. Where TYPE is a
variable name, the area to. be erased is described by a
DEFINE statement defining the variable. Where
TYPE is the name of a structure specified by a DRAW
statement, the structure is erased starting at the point
with coordinates Xl, YI, and ending with the point with
coordinatesX2, Y2.
SKIN indicates if the borders of the indicated area,
as well as the internal area, or if only the internal area
is to be erased.
XSCALE and YSCALE indicate the scale used in
specifying the arguments Xl, X2, YI and Y2. XSCALE
and YSCALE are coded in the same manner as indi-

189

cated for these arguments in the DRAW statement.

Expand statement
EXPAND SYMBOL, EXPANSION
This statement defines a symbol which is used in
place of a contiguous part of the input describing a picture. The value of the symbol is substituted for the symbol at macro-processing time.
SYMBOL is the name of the entity begin defined. It
is constructed as indicated for the NAME argument of
the DRAW statement.
EXPANSION is the definition of the symbol.
This statement is used where a set of pictures of a
similar nature are to be drawn, and where certain parts
of the input specifications are the same for each member of the set. A common part is written once and assigned a name, SYMBOL. For a particular picture, the
user includes the symbol at the appropriate place in the
input. It is envisioned that a user may build a library
tape containing the EXPAND definitions pertinent to
his application.

Opform statement
OPFORM NAME,
TYPE2, ...

RESULT,

TYPEl,

This statement indicates the structure of the arguments of a user-defined statement or a graphic function.
The code generated by the macro-processor for a userdefined statement or graphic function consists essentially of a call to a subroutine which bears the name of
the statement or function. The arguments of the CALL
statements are derived from the arguments of the userdefined statement or graphic function. Depending upon
the type of the argument of the user-defined statement
or graphic function, the macro-processor takes different
actions to set up the corresponding argument of the
CALL statement. The OPFORM statement declares to
the macro-processor the number of arguments, and the
type of each argument. For a graphic function, the
OPFORM statement also indicates the number of elements in the result draw-string return by the function.
N AME is the symbol of the user-defined statement
or graphic function. This is constructed as indicated for
the NAME argument of the DRAW statement.
RESULT is the number of elements in the drawstring returned by a graphic function.
TYPEI, TYP E2, ... declare the types of successive
arguments in the user-defined statement or graphic
function, as indicated below.

190

Fall Joint Computer Conference, 1968

TYPE
code
FOR
GRl
GR2

LIT
STA
NAM
STR

Form of Argument
FOR TRAN numeric or logical constant, variable, expression
Graphic expression yielding 1 argument
Graphic expression yielding 2 arguments, or graphic point variable, or a
coordinate pair as described above
Literal constant
Executable statement number or FORMAT statement number
External function or subroutine name
or N AMELIST name
Draw-string

Any contingent set of TYPE arguments may be applied repetitively by enclosing them in parentheses and
preceding by a repeat count. A terminal set of TYPE
arguments may be repeated as many times as is required
at a particular use of the user-defined statement by
enclosing them in parentheses without a repeat count.
Provision is also made to specify default values for
null arguments.

Sizeout statement
SIZEOUT BOTTOM,
PAGE2

LEFT,

LABEL,

PAGEl,

This statement causes the system to determine a
subsection of the CRT within which to compose the
drawing.
BOTTOM and LEFT are the dimensions in inches of
the "drawing area" of the output picture to be produced. This area does not include page margins.
LABEL is coded LABIN, LABEX, or LABNO
respectively for the cases where the drawing area indicated above does or does not include space for scale
and/or axis labels, or where there are no labels.
Provision is made to handle two types of drawing
situations: a "stand-alone" drawing which bears no
relationship to any other drawings, and "series" drawings, which comprise a set of drawings to appear within
the pages of a single volume. The arguments PAGEl
and P AGE2 are used for series drawings only and specify the maximum drawing area of a page in the volume.
For stand-alone drawings, the system determines a
rectangular CRT area, A, called the picture proper.
The bottom and left borders of this area comprise a
pair of scaled reference axes, intersecting in a point
called the global origin. The scaling of the reference
axes is determined from the appropriate BORDER
statements. In general, coordinate values in a draw-

. string are given relative to the global origin. Where
they occur, scale and axis labels appear exterior to the
area A. For a series drawing, the system first determines
a CRT area, T, corresponding to the maximum drawing
area of a page in the volume. The system then determines the area A to be the appropriate subsection of
area T. By following this procedure, the same enlargement ratio is used to form prints from any microfilm
frame in the series. This insures that the line weights are
uniform for all of the drawings in the series, and limits
the number of standard type sizes required. Area A is
determined to usurp the maximum CRT area possible
to obtain the finest resolution possible.

Border statement
BORDER LOCATION, SCALE, BASE,
FIRST, LAST, SCALAB, AXILAB,
NODRAW
This statement specifies the range of the data scale
for a border of the picture proper and indicates if the
border is to be drawn. This statement may also give an
~ndication of the space required for the scale and axis
labels along the indicated border.
LOCATION indicates which border is being specified
and is coded with one of the v:;tlues: BOTTOM,
LEFT, TOP, RIGHT.
SCALE indicates if the scale is linear or logarithmic,
and is coded LIN or LOG as applicable.
BASE is the base of the scale if it is logarithmic.
FIRST and LAST give the initial and terminal
values in the data scale of the indicated border. They
must be specified for at least one of the borders TOP or
BOTTOM, and at least one of the borders LEFT or
RIGHT.
SCALAB indicates the number of characters in the
longest scale label along the indicated border.
AXILAB indicates the number of lines in the axis
label along the indicated border.
NODRA W is coded NODRAW if the indicated border
line is not to be drawn. Otherwise it is null.

Sizing statement
SIZIN BOTTOM,

LEFT

This statement is used where an existing drawing is
being used as a model for the drawing to be made by the
system. Various structures in the existing drawing are
subjected to a digitizer. This statement, in conjunction
with the SIZOUT statement, indicates to the system
how to convert the digitized data into raster positions.
BOTTOM and LEFT indicate the dimensions in
inches of the picture proper of the existing drawing.
They are assumed to cover the same range of the data

B-Line, Bell Line Drawing Language
scale, as specified in the BORDER statement above.
Note that the physical proportion of the width to height
of the area in the existing drawing need not be the same
as that for the CRT area.
APPENDIX A

Symbol
1\
I

<
>

191

Description
Logical And
Logical Not
Less Than
Greater Than
Space

Standard character set

Symbol

A through Z
o through 9

+
/

*
$

,
(
)

"
&
?

#
%
[
]

Description
Alphabetics
Numerics
Plus
Minus
Virgule (Divide, Slash)
Equals
Asterisk (Multiply)
Dollar Sign
Period
Comma
Open Parenthesis
Close Parenthesis
Apostrophe (Close Single Quote)
Double Quote
Colon
Semi-colon
Ampersand
Exclamation
Question Mark
Short Dash
Long Dash
Number Sign
Percent
Open Bracket
Close Bracket

REFERENCES
1 M V MATHEWS J E MILLER
Computer editing typesetting and image generation
AFIPS Conference Proceedings Volume 27 Part 1 1965 Fall
Joint Computer Conference p 389
2 70/9300 composition language system
RCA Graphic Systems Division Dayton New Jersey March
1968
3 0 D SMITH H R HARRIS
AutodraJt
Proceedings of the SHARE Design Autumation Workshop
June 1965
4 SPARDEE
XYMASK-A system for generating microelectronic circuit
masks
Unpublished memorandum
May 1967
5 JFKAISER EJSITAR
A versatile subroutine TPLOT for automatically generating
complete graphs on the 4020 microfilm printer
Unpublished memorandum July 1967
6 Specification for standard graphic outpvt subroutines as proposed
by the SHARE standard graphic output language committee
Original prepared by Q. B. Knight 1965 Revision prepared by
P Pickman 1966
7 SCJOHNSON
BSTRNG and A BSTRNG macro processor
Unpublished memoranda May and June 1968
8 MVMATHEWS
A utomatic Kerning program
Unpublished memorandum January 1968

Interactive languages: design criteria and
a proposal
by RICHARD K. MOORE and WALTER MAIN
Tymshare, Inc.
Palo Alto, California

The "Deck of Cards" assomption

INTRODUCTION
Algebraic languages currently available on time sharing
systems can be divided into two categories: batchoriented languages and conversational languages. The
batch languages (ALGOL, FORTRAN, PL/l:, though
quite powerful in their ability to express complicated
algorithms, are in many ways unsuited to an interactive
environment.
Batch languages unsuited as conversational tools .
The "Complete Program" requirement

Let us use ALGOL as an example. An ALGOL pfogram is a single compound statement, usually a block.
Thus it starts with
begin

and terminates with a matching
end
Within· the program must occur: deciarations for all
mentioned variables, the bodies of all calledprocedures,
the locations of all referenced labels, and matching end
for each begin. If any single component of the program
is missing or syntactically incorrect, the program as a
whole is invalid.
Preparing and testing a complete, well thought-out
program is quite appropriate to a batch environment,
where maximum output from each run is an economically sound goal. In a conversational environment however, the preferred practice should be to test and debug
each section of a program as soon as possible. Thus, the
number of untested statements in a program at anyone
time remains small, and debugging is straightforward.
Such incremental testing of programs is difficult in the
batch languages and usually can be accomplished only
in spite of the syntax.

193

No meta-statements are provided in the batch languages to allow manipulating or altering a program.
(The "compile time statements" of PL/l form a permanent part of any given program.) The assumption is
that a program will be altered by changing physically
the position of a card in the deck, or by punching a new
card and inserting it into the program. For time sharing
systems, text editors must be provided to accomplish
this card shufHing. Thus a programmer must learn two
unrelated languages to write programs effectively.
The "Perfect Program" assomption

No provision is made in FORTRAN or ALGOL for
the problems of debugging. The ON CONDITION
statement of PL/l is really more for detecting bad data
that for program debugging. Such features as core
dumps (shudder!) and variable tracing are considered
part of the specific "implementation" and usually are
not even adequate for the requirements of a batch environment.
In an interactive environment there is great potential
for computer aided dynamic bug detection. A language
which does not tap this potential must be considered
lacking.
The "Professional Programmer" assumption

A fairly bright non-programmer would probably need
50-100 hours of study before he could solve even trivial
programming problems in the batch languages. Because of the "complete program" requirement, considerable over-learning is required before. the student can approach the computer without apprehension. In training
a professi onal programmer, 50 hours is certainly a small
investment, but for an engineer who needs a simple calculation performed by a computer, 50 hours is more

194

Fall Joint Computer Conference, 1968

time than he can spare. Thus even for trivial programming tasks, an intermediary, the professional programmer, stands between the computer and its primary
user. This leads to inefficiency, communication difficulties, extra expense, and prohibitive delays. A
superior language can exploit its interactive environment to use the computer as a teaching aid. As the beginner types in his first program, diagnostic feedback
will terminate any erroneous learning path, immediate
confirmation of each correct statement will reassure
him; rapid display of program results will encourage
him to pursue the complete solution of his problem.
The introduction of specialized conversational languages

The need for conversational languages is clear. Two of
these languages, JOSS and BASIC, overcome most of
t he objections raised against the batch languages. The
most striking feature of JOSS and BASIC is their lack
of syntax structure. For example,
1. READX
2. PRINT SQRT (X), SIN (X)
is already a valid, executable program in either language. In fact, any collection of statements forms a
"complete program" provided only that each statement is individually complete. A call to an undefined
function is simply a run-time fault, much like an attempt to divide by zero. The programmer this is encouraged to exploit the conversationality of his environment through modular program development.
An integral part of each program statement is its line
number. The line number serves two purposes. It determines the order in which statements occur, and it
serves as a reference label for GO TO statements or
other control statements. A new statement can be inserted simply by typing in the new statement with a line
number which falls numerically in the desired position.
A section of the program can be referenced as a whole by
mentioning the first and last line numbers of the section.
For example, in BASI C, the command
LIST 1-5
displays att statements whose line numbers are between
1 and 5 inclusive. Line numbers, together with metacommands such as LIST, LOAD, MOVE, SAVE, and
EDIT, provide facilities within the framework of the
language itself to allow a program to be modified,corrected, and displayed.
Apart from "'modular program creation," there are
two features of the conversational languages which ease
the debugging burden.
First, there are immediate statements. Whenever a
statement is typed in without a line number preceeding

it, the statement does not become a permanent part of
the program, but is executed immediately. Thus if a
program is halted due to a run-time error, values of key
variables can be determined through an immediate
PRINT statement. Also, immediate statements can be
used to preset a program to some singular state, so that
particular paths can be tested.
The second debugging feature is partial execution.
Since every subset (by lines) of a program is also a program, the programmer can set his variables to reasonable values and then execute just that portion of a program which seems to be giving incorrect results. Taken
together, these two features allow the programmer and
the computer to interact in a dynamic way to pinpoint
any faulty program logic rapidly.
Despite their many virtues, the currently existing
conversational languages fall short of being ideal algebraic languages for an interactive system.
Conversational languages cramped by batch language
styles

An unnecessarily rigid subroutine structure has been
inherited from ALGOL and FORTRAN. In JOSS for
example, the basic program unit is the PART. "PART
4" refers to all statements from 4.000 through 4.999.
"DO PART 4" executes those statements from another
part of the program. As an algorithm is being developed,
the programmer must take care to group together those
statements which eventually will be part of the same
subroutine. This vestige of the "complete program"
requirement forces the programmer to think ahead to
the total structure of his program at a time when he
would rather concentrate on translating a few simple
ideas into program statements.
The situation in BASIC is only slightly more flexible.
In BASIC, a group of lines can be called remotely by a
GOSUB statement. For example,
GOSUBloo
transfers control to line 100 and executes statements in
normal order until a RETURN statement is encountered. At that time control returns to the dynamically
matching GOSUB. The specification of subroutine
boundaries is thus more flexible in BASIC than in
JOSS. A certain asymmetry arises in BASIC however;
whereas the beginning of a subroutine can vary dynamically from one call to another, the end (RETURN) is
relatively static. For example, the statement
GOSUBloo
calls a routine one line longer than does the statement
GOSUBIOI

Interactive Languages
but both must terminate on the same RETURN (barring conditional transfers).
While static subprogram boundaries are best not required in a conversational language, certain other features of the batch languages must be borrowed to allow
the clear, concise expression. of complicated algorithms

Conversational languages jound to be ove>rly restrictitle

Long variable names

The first conversational languages were implemented
under a somewhat unique' set of circumstances. The
machines were of smaH capacity, and the assumption
was that only small programs would be attempted in
the relatively "inefficient" real time mode. A restriction
of variable names to two characters (a let.ter-digit pair)
was seen to yield considerable compiling advantage at
minimal sacrifice in the readability of small program~.
As the capacity of time sharing systems has increased,
and as the technique of incremental compilation has become more widely used, this restriction has become less
beneficial and more bothersome.

195

Full-fledged subroutines and functions

Formal subroutines should not be required in simple
programs. The kind of control flow which can be
handled by a DO PART or a GOSUB should continue
to be handled by some direct, concise control statement.
However for more complicated tasks, provisions must
be made for mnemonically named subprograms with
multi-statement bodies, and with call-by-name' and
call-by-value parameters. Again, we wish to specify
this feature in such a way as to avoid the "complete
program" requirement. We do not want static structural forms.
The TCL synthesis

The result of these conE'iderations is TCL (Tymshare
Conversational Language). The salient features of TCL
include long variable names, symbolic statement lal?els,
totally dynam.ic statement. grouping, dynamically
bound variables, full-fledged subprograms with parameters, .and the ability to handle recursive procedural
algorithms.
Long variable names

Symbolic labels

The twofold function of line numbers is to be commended for its economy. Often a programmer will need
to refer to some statement as the operand of a control
statement, but no suggestive label for that statement
will come to mind. On the other hand, program read.:.
ability is enhanced if those statements in a program
which have a definite and easily named function in the
mind of the programmer can be distinguished and
referenced by alphanumeric labels. Such examples as
GO TO DONE;
GO TO ERROREXIT IF X <0;
substantiate this claim.

Local variables

The concept of identifier scope should not be imposed
on the beginning programmer (as it is in FORTRAN
and ALGOL). JOSS and BASIC allow procedural programming while maintaining globality of all variables.
. Although total globality is easily learned and adequate
for the most elementary programs, the advantages
gained by the ability to isolate symbolically sections of
a larger program are clear. In keeping with the spirit of.
incrementality however, this feature should be specified
in such a way as to avoid static structural forms such as
begin-end pairs.

Arbitrarily long strings of letters and digits beginning
with a letter are 1I.Ilowed as identifiers.
Examples

HEIGHT
ALPHA
HP124
"The names of the variables thus can suggest that which
they represent.
Statement labels

Any line of the program may be labelled by an identifier (optionally subscripted by a constant) followed by a
colon. The statement then can be referred to either by
its line number or by its label.
Examples

TOP:
NEXT:
L(I):
L(2):
Label'subscripts allow convenient .computed transfers.
Example'

GO TOL(I)
GO TOENTRY(I+2*J+4*K)

196

Fall Joint Computer Conference, 1968

If all GO TO's and other statement references in a
given program use labels rather than line num bers, that
program is, but for order, independent of its line numbers. The program can be saved on a file without line
numbers and then can be merged easily into other programs in any convenient line number range. Hence,
independently tested routines can be combined into one
program. The problem of identifier scope will be treated
belo)V.
StateEnentgronps

TeL allows any group of statements to be called in
the most direct possible way. Thus,
.
DO 1 :10, 120, 15
would execute line 1 through line 10, line 120, line 15,
and then return control to the statement immediately
following the DO. Marginal statements (initialization,
debugging. or I/O statements perhaps) can be included
or excluded as the "routine" is called from various
places.
Type declarations

Declaring variable types usually is unnecessary in
TeL. Variables dynamically assume the type of any
value assigned to them and are considered global by default. When declarations are used, they provide scope
information and allow TeL to reduce storage requirements and decrease system overhead. The storage savings are most significant where arrays are concerned.
Scope of identifiers

Declarations, when they do appear, are executed in
the normal order of program flow. Declared variables
remain defined only until termination of the inn~rm'Ost
group in which the declaration is included dynamically.
The scope is dynamic rather than static; that is, lines
which are called as part of a group perform as if their
text ,appeared at the point of call.
Example
1.
2.
3.
4.
5.
6.
7.
8.

D03:5
D06:8
REALA(10)
A(I) = OFORI=l TO 10
WRITE:A
INTEGER A
A= 7

D05

When line 5 is called from line 1, the array A is printed
out; but when line 5 is called by line 8 (as part of the
range of line 2) the integer-scalar A is printed.
A local variable of unspecified type can be declared by
the statement
DYNAMIC X(10), Y
X is then a local array each element of which can hold a
value of any type, and Y is a local simple variable.
Dynamic binding of variables accommodates the
most sophisticated recursive algorithm and the simplest
program with equal ease and economy. Thus,
a. The novice programmer needs neither scope nor
type declarations. He simply uses unique names
for each of his variables. When inside a called
group, an of his variables are available to him. If
he incorporates a library routine into his program, it is required only that the library program
exp1icitly declare all of it..~ local variables. The
user's variables win reappear (in case of any conflict) after exit from the library routine.
b. The sophisticated user will find dynamic binding
the functional equivalent of the conventional
block structured static binding. The dynamic approach actually will be more flexible in some cases.
Most important, the mechanism. of dynamic binding is m.ore transparent to the program.mer than
the subtle situations which can al'ise in a static
language like ALGOL ; for example, up level addressing and generalized call-by-name.
Subroutines and functions

A subroutine is declared by specifying the statement
group which comprises the subroutine body:
DEFINE SeX, Y) AS 10, A:B

's' now names a subroutine of two formal parameters
('X' and 'Y'). When'S' is called by the statement
DO SeT, 14.5)
any currently defined variable named 'X' or 'Y' will become temporarily unavailable; 'X' will be identified
with the object 'T', and 'Y' will become a variable with
initial value 14.5. Statements 10, and 'A' through 'B'
wouldthenbeexecuted.Upon termination of'B', 'X' and
Y' would recover their prior d'efinitions and valueE.
Such a subroutine may become part of the definition
of a later subroutine:
DEFINEP(U, V, W) AS Ll :L2, S(U, V +1), 15
In general, a subroutine ca11\ may appear as part of a
statement group:
DO TOP: BOTTOM, P(l, 2,5), S(O, 1)

Interactive Languages
. A function may be declared by specifying the desired
evaluation expression:
DEFINE LENGTH (X, Y) = SQRT (X t 2
Y1'2)

+

Or the evaluation can be deferred until completion of a
specified function body:
DEFINE F(A, B) = (B-A)/(T
F1:F2

+

V) AFTER

The function body has the same allowed generality of
structure as any other statement group'
DEFINE PROCESS(T1, T2) = T2-T1 AFTER
ORIGIN(T1), TOP: BOT, TERl\1(T2)
Thus, TCL subprograms impose a procedural structure upon a program quite like that permitted in a language like ALGOL, but, unlike ALGOL, the structure
comes into existence onJy at the time the subprogram is
called. Not only does TCL thereby permit the modular
program development so convenient in conversational
programming, but a structural flexibility is introduced
that far exceeds such ad hoc inventions as the PL/1
"multiple entry" feature. As a simple example, consider the following TCL subroutine declaratjon':
DEFINE SCI, J, X, Y) AS L(I): L(J)
The following sample TCL session is intended to impart the flavor of TCL as a dynamic programmjng tool.
A detailed specjfication of TeL syntax can be found in
the Appendix. NOTE: Underscored copy in the following example indicates what is typed by the user. All
other text is typed by the computer.
A sample session in the TC L system

>1.
>2.

S = 0
S= S+X(I) FORI= 1 TON

A test array is created by direct statements:

>REALX(10)
>X(I) = I FORI= 1 T010
Summation statements can be tested immediately:

>D01:2FORN= 10
> WRITE:S
55
The global function SUM js e::tsily defined and
tested:

> DEFINE SUM(X, N) = S AFTER 1:2
> WRITE:SUM(X,9)
45

197

SVM is used in an "adding machine" program:

>3.
>4.
>5.
>6.

READ:N
REAL A(N)
READ: A (I) FOR I = 1 TO N
WRITE: SUM(A, N)

The adding machine is checked out:

>D03:6
5,100,120,105,130,110
565
SUM js used to create an averaging function MEAN:

>DEFINE MEAN (X, N) = SUM(X, N)/N
> WRITE: MEAN(X, 10)
5.5
The mu1ti~line standard deviation function STD is
created. The function (not array) Y can be passed to
SVNI.

>7. M= MEAN (D,N)
>8. DEFINE Y (I) = (D(I)-M) 1'2
> DEFINE STD(D, N) = SQRT(SUM(Y,N)(N1» AFTER 7:8
> WRITE STD(X, 3)
1.581138
Finally a complete conversational program makes use
of the tested functions.

>9. WRITE: 'NUMBER OF VALUES ='
>10. WRITE: 'ENTER VALUES:'
>11. WRITE: 'SUM =', SUM(A, N), 'MEAN
=',MEAN(A,N),
'STANDARD DEVIATION = " STD
(A,N)
>DEFINE ANALYZE AS 9, 3:4, io, 5, 11
>DOANALYZE
NUMBER OF VALUES = 5
ENTER VALVES: 10,12,14,21,8
SUM = 65 MEAN = 13 STANDARD DEVIATION= 5
Now that the program is finished, X is unnecessary.
> DELETE X
The current program, including direct declarations is
printed on the t~rminal:

> LIST
DEFINITIONS:
SUM (X, N) = S AFTER 1:2
MEAN(X,N)= SUM(X,N)/N
STD(D, N) = SQRT(SUM(Y. N)/(N-l)
AFTER 7:8
ANALYZE AS 9, 3:4,10,5,11

198

Fall Joint Computer Conference, 1968

STEPS:
1. S = 02. S= S+X(I)FORI=l TON
3. READ:N
4. READA(N)
5. READ:A(I) FORI= 1 TON
6. WRITE: SUl\!J:(A, N)
7. M = MEAN(D, N)
8. DEFINEY(I)= (D(I)-M)t2
9. WRITE:'NUMBEROFVALUES='
10. WRITE:'ENTERVALUES:='
11. WRITE: 'SUM =', SUM (A, N), 'MEAN =',
MEAN(A, N), 'STANDARDDEVIATION=',
STD(A, N)
.The program is saved for future use:

> LIST ON "ANALYSIS"
NEW FILE

>
CONCLUSION
The sample session shows the ease with which a simple
problem can be solved in TOL. Not only can the program be built up and tested incrementally. but the final
program is concise and readable.
TCL js thus a self-documenting, conversational language, free of artificial structural specifications. Furthermore, the language natrually accommodates the statement and solution of increasingly complex tasks.
APPENDIX -

TCL

LANGUAGE

SUMMARY

1. Language Elements
• identifier or ident
Definition:
Alphanumeric string beginning with letter.
Examples:
A
B12S
ALPHA
• expression
Definition:
Usual definition.
Examples:

A

+

B

(S AND T) OR L7
• line number
Definition:
Decimal constant from .001 to 999.999
Examples:
37.5
12
190.002

• label reference
Definition:
ident or ident (expression)
Examples:
A
LOOP (3)
START (1+2)
• line ref
Definition:
line number or label reference
Examples:
12.21
L(A(J))
• range
Definition:
line ref or line ref:line ref
Examples:
1:10
7
A(I) :A(I)
I:NLUP
• subroutine ref
Definition:
subroutine name (expression list)
Examples:
SUBL(7, X + Y)
• object
Definition:
subroutine ref or range
Examples:
SeX, Y)
A:I0.2
• group
Definition:
object list
Examples:
1 :10,50, sex, Y)
1,5
• condition
Definition:
Boolean expression
Examples:
AANDXY

DEFINE DISTANCE (X,Y) = SQRT
(Xt 2 +Yt 2)
DEFINE F(X, Y, Z) = (A+B)/2 AFTER
F1:F2
• DEFINE ident [(parameter .list)] AS statement

• UNLESS condition

group
Definition:

Definition: ~

Execute modified statement if ·condition
false.

Examples:

DEFINE ident [(parameter list)] = expression
~~[AFTER group]

Modifiers

Execute modified statement if condition
true.

• mode variable list
Definition:

Type declarati on.

Assign new line number to a portion of program.

4.

Declarations

IS

Examples:

Y= SQRT(X)UNLESSX
ABC

In addition:
1. A ; will terminate a META PI statement (unnecessary in the on -line version) .
.~. () [parentheses] will be used to simplify BNF and
will indicate factoring.
3. A $ replaces BNF finite state recursion.

To solidify META PI syntactical symbolism a few
Dartmouth BASIC statements are shown below in
BNF and META PI.
BASIC READ statement

BNF
< READ statement> ::

=

READ < read list>

META PI
READST : = : READ: READLST
BASIC read list

BNF
< read list>

:: = < variable>


I

< read list> ,

META PI
READLST: = VAR$ (:,:VAR)
BASIC FOR statement

BNF
 :: = FOR 
= < expression> TO
< expression> < OPTEXP >
< OPTEX > :: = STEP < Expression>

META PI
FORST:=: FOR: SIMVAR :=: EXP : TO
EXP (: STEP: EXP/ . EMPTY)
These examples are included to illustrate the similarities of BNF and META PI syntax. For the purpose of

206

Fall Joint Computer Conference, 1968

these illustrations an effort has been made to name
syntactic components to convey the same meaning
they had in the BNF statement. For example the
BNF < expression> became EXP.
It should again be emphasized that BNF does not
include any facilities for including semantics operations
within syntax operations hence none of META PI's
semantic operations were shown.
META PI statements contain 3 types of elements:
1. Syntactic elements; these elements are compiled
into code in the user's compiler that will test for
syntactic elements in the source input to the user's
compiler. These elements, then, are used to generate the "sieve" statement identifier 01' syntax
checker of the user's compiler.
2. Semantic elements; the elements are compiled
into code in the user's compiler that will effect
the generation of object code.
3. META syntactic elements; these elements are
compiled into code in the user's compiler that
will enable it to efficiently resolve possible conflicts
(ambiguities) in the newly defined input source
statement via a backup facility. The user constructs META PI input statement.s by combining
these three elements so as to produce his own compiler.

1. True. This results if the input scanned as a result
of being called satisfies the expression. The called
routine will return with a truth indicator set, the
input pointer will be moved past the data correctly scanned.
2. False. The input does not satisfy the expression,
in this case the input pointer wi.ll be unaltered.
The truth will be set indicat.ing false.
3. Error. The expression prefix is correctly identified
but the suffix is not. For example the statement
GO TO 20.3
is an invalid GO TO statement. The prefix GO TO
is (possibly) correct but the suffix 20.3 is not.
When this occurs an error routine is called, the
input pointer is partially updated, the error
routine will then insert a ? (question mark) after
the last character successfully scanned.
These three condItions describe the behavior of the
code that is generated in the user's compiler by a
META PI expression. Some of the elements that comprise these expressions will now be discussed in detail.

Syntactic elements

:xxx ..... x:

The X's represent any character
string. This syntactic element will
create code in the user's compiler
to test the current input for the
string within the colons. In the
DIGIT statement, shown previously, code would be genera.ted
that would test for a 0 or a 1 or 2
etc.

ABC

This results in the generation of
code in the user's compiler whIch
wIll result in a call to the routine
named (ABC in this case). This
routine will presumably be written
by the user with META PI. DIGIT
defined above is such a routine; it
could be used, for example to identify a number.

The general form for a META PI statement is:
LABEL: = expression
The left hand side is a unique identifier which serves
as a reference to the expression on the right hand side
(a META PI identifier is defined as a letter (A-Z)
followed by an arbitrary sequence of letters or digits).
For example the META PI statement which defines a
digit would appear as:
DIGIT:

= :0:/:1:/:2:/:3:/:4:/:5:/:6:/:7:/:8:/:9:

The name DIGIT can then be used on the right hand
side of an expression to effect the test for a digit.
The character pair : = serves as a delimiter and
distinguishes META PI statements from FORTRAN
PI statements. The reader is reminded that META
PI and FORTRAN PI are one integrated language
pookage.
The expression is compiled into code· in the user's
compiler which is recursive, that is, the expression can
contain a reference to itself either directly or indirectly.
When META PI generates the code for the expression within the user·'s compiler it will be generated such
that it can have one of t1u:ee results after being called.

INUM:

=

DIGIT$DIGIT

The name could also designate one
of the currently existing FORTRAN PI routines. This syntactic element is one of two possible
methods available for linking to
subroutines within META PI. The

META PI
second method involves preceding
the routine name with a period.
When the period notation is used
META PI will assume that the
routine called is not recursive and
that a truth indicator is to be returned. When a routine is called
without a period recursion is then
possible by the routine called; a
truth value will be returned by the
called routines in either case.
. ID

This is the test for an identifier .
Code is generated to link to the
ID routin,e. N otethe use of the
period. The implication is that the
ID routine does not subsequently
link to itself.

. EMPTY

This is a special snytactic test
which forceS the true setting of the
truth indicator.

.INT

This is a test for a FORTRAN
integer.

. NUM

This is a test for a number which
could (approximately) be defined
by the following META PI statement:

simple yet it illustrates factoring,
iteration ($), tests for syntactic
elements and the use of .EMPTY;
a clear understanding of these elements will benefit the reader when
other examples are given later in
this document.
LKUP

NUM: = $DIGIT(:.:/.EMPTY)
$DIGIT(:E:(:+ :/: -:/ . EMPTY)
DIGIT (DIGIT/ .EMPTY)/
.EMPTY)
The code generated for this statement wiil identify numbers such as
1.23E-Ol
.OO137lE-15
1.361,0123, lEI

the definition could be read as:
"A NUM is equivalent to zero or
more digits followed by an optional period followed by zero or
more digits followed by the optional
sequence;
E followed by an
optional plus or minus followed by
a digit followed by an' optional
digit."
The· NUM definition is relatively

207

This results in code being generated in the user's compiler that will
link to the LKUP routine; this
routine scans the label table for the
last input detected. Label table
entries are statement numbers or
variable .names. Each entry also
contains appropriate control information such as type, memory
address and program level. The
routine will return one of three
possible results.
1. The input was in the label
table and assigned memorY
location is defined.
~. ,
2. The input was not found in
the label table .
3. The label was found but its
memory location is yet to be
defined. This type of entry
is caused by forward references. For example a GOTO
statement that specifies a
statement number that has
not yet been entered.

. TVPE(:NNYY:) This routine looks up "the input
passed .,to it in the label table and
tests if the type byte is in the class
allowed by the argument NNYY.
One function of this routine is to
check for mixed mode errors.
.XXXX

Here the X's represent an arbitrary
identifier. The use of this notation
will cause META PI to genera.te
linkage to the subroutine named
by the symbol. The execution of the
subroutine is assumed to effect a
test on th~ input string. The results
of this test will set the truth indicator which is returned to the calling routine. This notation is, in
fact, the vehicle used by META
PI in generating linkage to those
syntactic routines previously discussed (.ID, .LKUP, etc.). In

208

Fall Joint Computer Conference, 1968
parentheses (which are shown above
as ( ....) ). Three alternate actions
can occur depending on the structure of the semantic operations
contained within the .OUT( ...) command.

addition to the symbols already
defined, the user of META PI
can link directly to those routines
(written in META PI) that are
used in creating the FORTRAN
PI compiler; there are over 100
such ,routines most of 'Which perform functions common to algebraic compilers. The META PI
implementation of FORTRAN PI
appears in Appendix 1.

1. If the first character is not a
letter or a digit, then all subsequent characters are copied
directly into the code area until a final colon ( :) pair is
detected.
2. If the fourth character is a
period or a space it is assumed
that the output is an instruction using an index register
and with a symbolic address
following the period or space
located in position 4. The
symbolic address will be
looked up in the label table
and from information contained there a real machine
address will be generated.
3. If the above two cases fail,
the character string is assumed
to be machine code and it is
converted - directly into the
code area.

Semantics-Code generation in META PI
The syntax operations permit the user who is implementing his own compiler to perform the statement
identification function of the compiler being generated.
The code generation that will effect the intent of a
given source statement is handled by the semantic
functions, these functions are imbedded in the META
PI statement structure.
The semantic functions are composed of two sub
elements:
1. Semantic commands.
2. Semantic operations.

Semantic operations are always contained within
sEIDlantic cQmmands. The general form is
sematic-command (semantic-Operations).

.LABEL( ... )

This takes the current contents of
the output area and places it into
the label table. An error results if
the label is already defined. The
current value of the code area
location counter will be associated
with the label.

.IGN( ... )

This command will ignore .(delete)
the contents of the output area.
This is useful since several semantic
operations produce side efiects,
such as releasing registers, In addition to generating code.

.NOP( ... )

ThIS command is used to produce
the effect of the semantic operations
without doing anything else. The
results of the semantic operations
will be left in the output area.

.DO( ... )

This is a specialized command
whose effect is to cause META
PI to execute immediately the
instructions contained within the
parentheses.

Semantic commands
Every semantic command has a direct effect on code
generated by the compiler. When META PI encounters a semantic command in the input statement it will
generate in the user's compiler the object code necessary
to generate an element of an object program. There
are five basic semantics commands.
.OUT(. .. )

This command causes the current
contents of the output area (a temporary area where code is being
created by the user's compiler) to
be converted to internal form and
placed in the user's code area. The
output area is a staging area for
intermediate output that is in a
semi-symbolic form. The code area
contains the precise object code that
will be executed by the computer.
The output itself (the strings that
are entered into the output area) is
produced by the semantic operations that are speclfied within the

META PI

Semantic operations
The semantic operations are used to generate code in
the output area. The code generated in the output area
by these operations is in a symbolic form and not
immediately executable; additionally these operations
are generally constrained not to alter the input pointer
or the truth indicator. A pointer is maintained to
remember the next available location in the output
area.
This pointer is updated after each semantic operation. These operations are listed below.
:CCC ... C:

*

s
R

Suffix the string between the colons
to the output area. Note that no
ambiguity exists with syntactic
elements contained within colons
since this notation has unique
meaning depending on whether it
has occurred inside or outside of a
semantic command.
Suffix the current input to the contents of the output area. This is
generally used in conjunction with
a successful .ID test. To emphasize
the different roles being played by
META PI, the user's compiler
source statement which is input
to the user's compiler, and the
resulting object code, this simple
operation will be explained further.
When the * is found in a META
PI string, code will be generated in
the user's compiler to effect the
placement of the last input into
the output area. This code is part
of the user's compiler. When a
source statement is supplied to this
compiler the user's compiler will
effect symbolic code generation in
the output area. This output area
will then be converted into executable machine code.
Save a copy of the current contents
of the output area in a pushdown
list and push the list.
Restore (suffix to the output area)
the top of the pushdown list and
pop the list.

I

Ignore (pop) the top element in
the pushdown list.

x

Swap the top two elements in the
pushdown list.

*1

209

Generate a globally unique 4 byte
character string beginning with the
character #. This string will be
locally constan t and serves as a
convenient way to label and reference locations in the generated code.

There are a set of semantics routines which facilitate
the use of the general purpose and floating point registers of the Spectra 70 processor in the output code. A
type of pushdown list for both of these register types is
maintaine<;l at run time. There are 6 general purpose and
4 floating registers available to these semantic operations. If more registers are needed, coding will automatically be generated to implement saving and restoring of registers. This save and restore operation is
a side effect of the following semantic routines.

OF

Output the current general purpose
register.

o

Output the current floating point
register.

+

Output the next free general purpose register and make it current.

+2

Output the next free floating point
register and make it current.
Output two general purpose registers. The first one is the previous
register, the second is the current
register. When the operation completes the previous register will be
made current. The output is always
a digit pair. This format is specialized to take advantage of the
register to register operations available on the Spectra 70 class of
processors.

-2

Output a pair of floating point
The action is the same as
the semantic operation for general
purpose register pairs.
registers~

One final set of elements of a META PI statement
have yet to be discussed namely the lVleta Synta,ctic
Commands. These commands are included primarily to
permit efficient backup facilities in the user's compiler.

META syntactic commands
. LATCH (name)

This causes code to be generated
in the user's compiler that will result in the routine named in parentheses being called. In addition,
if the routine (or any routine sub-

210

Fall Joint Computer Conference, 1968
sequently called by the latched
routine) exits to the error routine,
backup will be affected.

c

This command can occur wherever
a semantic operator can occur; it
causes code to be generated in the
user's compiler that will suppress
the occurrence of a .LATCH in the
calling routine. This command is
generally used when initial ambiguity in a sub-expression has been
resolved. Typical examples· are
when·the first comma is detected in
a FORTRAN DO statement, or
when the logical operator is detected in a logical IF statement.
Backup will not. occur if a subsequent syntactic error is discovered and the error pointer will
more clearly reflect the location of
the error in the input statement.

. CLAMP

This command can occur wherever
C can occur. It directs the compiler
to suppress all preceding .LATCH's
that are still in effect. .CLAMP is
useful when .LATCH did not occur
on the immediately preceding level,
or when it is desired to inhiblt the
PI compiler or META PI from
later attempting to scan input
intended for the user's compiler.
The reaqer isteminded that META
PI, FORTRAN PI and the user's
compiler are, in fact, part of an
integrated language system.

The task now is to describe how the META PI
elements are formed into statements which are used to
create a user's compiler. The approach to be used in
accomplishing this end will be via example. First several simple examples will be described. Then the entire META PI implementation of FORTRAN PI will
be included as an appendix.
EXAMPLE 1.
FORTRAN PI allows the user to include comments
in each statement after a concluding semicolon. If the
user did not want this feature, but rather. desired to
permit multiple statements on one line (similar to
ALGOL), he could write the following META PI
command:
U8ERCC:

=

LABST.NOP(.CLAMP)$LABST

where LABST refers to the FORTRAN PI definition
of a (possibly) labelled statement (see Appendix). The
meta syntactic command .CLAMP disables the backup
mechanism, and allows the error pointer to clearly reflect the location of a possible error in the subsequent
arbitrary sequence of labelled statements ($LABST).
Thus, the program segment
X= i+Y
Z = SIN(X) +W
Y = Y + 10
PRINT 1,X,Y,Z
could become

x=

1 + Y;Z = SIN(X) + W;Y = Y + 10; PRINT
1,X,Y,Z

EXAMPLES.
There is no efficient way to shift lofrically in the
FORTRAN IV language. A FORTRAN PI user at
RCA Laboratories required such a shift in order to
improve the efficiency and readability of his program
in which he made extensive use of bit manipulation. He
used the following META PI statement:
USERCC : = :SHIFT~ .NOP(.CLAMP) (:L: .SAV
(:89:) /
.
:R: .SAV(:88:)) .ID (INTV) :,: IEXPI
.OUT(:58102000:R:103000:).OUT
(:50102000 05E9,:- .E901)
This permitted him to enter statements like
SHIFTRJ,3

shift the variable J 3 bits to the
right.

SHIFTL K, J + 5 shift the variable K J + 5 bits
to the left.
Note the use of .SAV( ...) to save the op-code of the
shift instructions. INTV and IEXP1 are references to
FORTRAN PI syntax. The "05E9" (BALR 14,9)
constitutes a return to the executive and allows variable tracing (and other debugging aids). The fact that
this is an assignment statement is communicated at
compile time via the .E901 function.
EXAMPLES.
To further illustrate how META PI can be used to
create new compilers, two statements from the imple-

META PI
mentation of Dartmouth BASIC language alluded to
later will be discussed. The BASIC statements have
been selected on the basis of their ability to convey the
structure of META PI statements and not on the
simplicity or complexity involved in their actual implementation.

BASIC operator

<>
<=
>=
=

<

>
The BASIC READ statement

211

Interpretation
not equal
less than or equal to
greater than or equal to
equal to
less than
greater than

The META PI definition for a relational is as follows:

This statement has the BNF format
REL = :< >: .SAV(:7:)/:< =: .SAV(:6:)/
< READ statement> : : = READ < read list>

:> =: .SAV(:A:)/:=: .SAV(:8:)/

In META PI the statement becomes
READ:

=

:<: .SAV( :4:)/: > : .SAV(:2:)

:READ:RIDS(:,:RID):;:

META PI will scan the statement from left to right
generating the following code:
1. A test for the word READ.
2. Linkage to the definition RID. This is a definition
contained within the META PI definition of
BASIC.
3. Instructions to effect iterative loop that will test
for a comma followed by a read identifier.
4. A test for the line termination character";". This
character is appended to the statement internally.

This META PI definition is t~tally syntactic. The
semantics for the READ statement are handled in the
RID definition.
.
Handling relational operators
BASIC allows six relational operators; these operators are used within the BASIC IF statement; the
operators permitted are:

META PI will generate the code equivalent to a
sieve on the six possible relational operators. When one
of the operators is detected a single character is entered
into the pushdown list. This is effected by the .SAV
semantics routine. This character is in fact the actual
machine code representation of the branching condition.
The REL definition is a sub definition of the IF statement. During the scan of the IF statement the character previously entered into the stack by REL will be
popped into the output area and the complete branch
instruction will be generated.

EXAMPLE 4..
The preceding example have shown how META
PI provides a vehicle to allow user controlled generation of code which may be executed later at run time.
The following example shows that the user can also
control the generation of code to be executed at compile time, that is, he can generate a compiler-compiler.
The example shows, first, the definition of a familiar
language called BNF. Then in the new BNF language
a simple syntax checker is defined. Then some test
strings are entered.

..... .

: : : :=:::>\1 :;:.0

.!J T ( : :3 7i'.\ : )

23 3X1:

=3X2!·(:! : .OllT( :531::. :*1) .OUT( :'0781::: )3X2) .LAEEL(*l)

32

~X2:=BX3.0~T(:53E.:*1).OUT(:~77E:)$(BX3.0UT(:477.E~~:)).LA3~L<*J)

42

BX3:=:c:(:E~PTY:.OJr(:0420:)/.ID.OUr(:41E.:*).OUT(:45J.LATC:»:>:

/srRING.OUT(~45E.TESr~).OUT(:::'R:::)

53

3TRI~3

:=

~LPHABET

.SAV<.) $(ALPHABET .SAV(R*»

212

Fall Joint Computer Conference, 1968

63

'LPH~SET

:=

LETTER lilIGITI :?:I:":I:$:I:':I:X:/ETC

7a LETTER := :A:/:J:/:C:I:D:/:E:I:f:I:G:I:H:I:I:/:J:I:K:I:L:/ETC
82 DISIT := :2:/:1 :/:2:1:3:/:4:/:5:/:6:/:7:1:8:1:9:
92  ::= Z ! 1<3Nf>1

lIZ 11Z11

12;3 11 1 1 11 1 1 II! 1 1 1 11 1 1 1 I 01 1 II! 1 1 11 ill I 1 1 1 1 1 1 1

ICO IjE
1 33 lIZ 1 1 !
130 ERR0~

11dl1? 1;

133111;)11
13:3
132

11Z11?

META PI

/PRINT'
Ul USERCC := .Nope.CLAMP) BNF :;:I:<:.ID.LABEL<*):>: u: I:: :=: BX1
:;:. OUTe :07FA:)
20 BX1 := BX2$<:1:.0UTe:58E.:*1>.OUT<:078E:)BX2).LABELe*1>
30 BX2 :: BX3.0UTC:58E.:*1>.OUTC:077E:)$CBX3.0ulc:477.ERR:»
.LABELC*1>
40 BX3 : = : <: C: EMPTY: .OUT<:0420:) I. ID.OUTC: 41 E. :*) .OUTC :450.LATCH:»
: >1 ISTRI NG.OUTC:45 E. TEST:) .OUTe:: :IRu:)
50 STRING := ALPHABET .SAVC*) $CALPHABET .SAVCR*»
60 ALPHABET := LETTER I DIGIT I :1:1:-:I:II/:$:I:%:I:&:I:'I/:C:/I)11
I*I/ETC
70 LETTER 1= :AI/:B:I:C: I: DIIIEI II F:I:H:I: I:I:J:/ETC

*

213

This is the time the Teletype was connected to
the computer.
Total Processor Hours - Less than .1 hour
This is the time the CPU was performing functions for the implementation of BASIC.

The results have in the author's mind further
strengthened the conviction that availability of interactive on-line compiler-compilers such as META
PI can increase language implementation efficiency by
an order of magnitude and provide computers which
the much needed capability of creating and modifying
languages to suit individual user's own special needs.

80 DIGIT 1= 10:/111/:2:1:3:1:4:1:5:1:6:1:7:1:8:1:9:
90  ::= 0 r I1

ACKNOWLEDGMENTS

Ul0 101
110 11011
120 11111111111111111111011111111111111111111

/CODE
130 111011
130 ERROR

The author wishes to express deep appreciation to
M. Pelligrini for his assistance in preparing this document and the examples, H. A.Freedman for his collaboration and implementation of the Executive routine, and N. L. Gordon and John Carr III for sugg~t­
ing and guiding the project.

11011 1 ;

130 111011111
130 ERROR

101111 11;

130

Mter the FORTR:AN PI compiler was succeSsfully
implemented the challenge to implement a different
language using META PI was irresistible for two
reasons:
1. Since META PI and FORTRAN PI evolved
simultaneously there was some question as to
whether or not the generality of META PI had
been seriously affected by efforts to accommodate
the peculiarities of FORTRAN.
2. Evidence had to be accumulated that would tend
to demonstrate the leverage that can be gained by
using the compiler-compiler approach,

It was decided to use Dartmouth BASIC as a test
case for gathering data to support conclusions for the
above hypotheses. The results of the implementation
of BASIC with META PI were startling, even to the
author.
With no pre-preparation of any kind the project to
implement BASIC began on April 15, 1968. On May 6,
1968 BASIC was available to users of BTSS lIon an
interactive basis; total elapsed time to implement the
language was 3 weeks.
. The entire implementation was done interactively.
The implementation hours for man, console and processor time are as follows:

*
*

Totfl,l Man Hours-9o
Total Console Hours-33

REFERENCE·S
1 PNAUREd
Report 01 the algorithmic language AWOL 60
CACM Vol 3 265 May 1960pp 299-314
2 DVSCHORRE
META-II a syntax-oriented compiler writing language
Proc ACM 19th National Conference 1964 p D13
3 ME WHITE
A remote processing systemJor the Apt language
Proc AFIPS current conference
The reference list is abbreviated since both an excellent list of
references and an excellent exposition is contained in:
4 J FELDMAN D GRIES
Translater writing systems
CACM Vol 11 No 2 F~b 1968 pp 77-113

APPENDIX
The following pages list the actual input to an offline version of the compiler-compiler. The off-line
version has several ininor differences from the on-line
compiler-compiler, and one major difference. The major
difference is that the off-line output is a symbolic
Spect~a 70 assembly input tape from .which the FOR'r.RAN PI compiler is assembled, rather than the
direct ma.chine code generated on-line.
Some other ditierences are:
1. "=" as statement delimiter rather than ": = " .
2. Absence of "." as delimiter before some semantic
operations (E2, E3, E986, E987, E1, E900, E901,
... , E908).

214

Fall Joint Computer Conference, 1968

3..EL is a pseudo semantic operation. It actually
performs a test for a ; and "return"s or generates
the "SHOULD END HERE" message.
4..ERR(: .... :), when used, denotes the actual error
message to be displayed if the preceding test fails.
5. EFF OFF and EFF ON are special commands to
the off-line compiler tell it to turn off and on some
special internal optimizing code.
6. The X semantic operation he~e is identical to the

on-lineZ.
7. There are several subroutines referenced but not
defined. This is usually because they have been
partially hand coded. At any rate, the explanation of all the features of the off-line compilercompiler is beyond the scope of this document.
Any of these FORTRAN PI routines can be accessed
by the user (via his own compiler).

META PI

215

A-I

INTV=(.IIO,OU1(:41:+: :.)/.IPR.OUT(:58:+; :*»SUBEXP;
RLV::( .FJD,PUT( :41 :+: ,:*)/,SPR.OUT( :5S:+: :~q )SU6EXP;
RLDV::(, TYJ'EC :t::~~0:) .OUT( ;41 :+; :*)/,TVPE( ;EF82t) ,UUTe :58:+; :*) )OSUl
CMPXV=(.TYPE(:E~AO:).OUT(:41:+: :~)/.TYPE(:EFA2:)~OUT(;58~+:
IEXP1=IEX~2$C;+:lTERM.OUT(:lA:~E2)/;-:ITERM.OUT(lio:-E2»;

;

;*~)CSUOXP;

SEXPl=SEXP2$C;+:STERM.OUTL!3A;-2E~)/:-:STERM.OUT(:3B:-2E2j);

DEXPl=DEXP2$C:+:OTERM.OUT(:2A;-2E2)/:-;OTERM.OUTC:2B:-2EZj);
C( : + : • SAV ( : A : S ) I : - : • SA V( : 8 ; S ) ) CTER'" • OUT ( : 2 : R- 4 , • OUT ( : 2 : R"" 4 ) ),;
B~XP1=BTE~M~(:+:BTERM.OUT(:16:-E2»;
,
- SUB2ST=,OUT(:47F09ED40080:R:OO:),ic:SUBRSC.DUTt:947FIOO:R)S):/.EMPTV
.00T(:~OOO:».NOP(.EL); ,
EQST=.LATtH(OUSr'/EQ2ST;
CE XP 1 =CEXP? $

NEQ$T=DEC~T/LABST/ENOST/SURST/FCARD;
EQ2ST::.LAiCH(LI~ST)/.RLATCH(IUST)/ASSTJ
LABST=GUStl.LATC~I(IFST)/;RE1URN;:.OUT(;47F09E98:E908}IENDOST;

OOST=:OU!;SAV(*l),INT.SAVC*: ;).16.IID.SAV(*),SAV(E981S).UUT(:41:+; 1*>:=;IEXPl
~(lUT( :;0302000;):,:. IGNCC-) IEXP1,F.RR( :NOT INTEGER:) (:,: IEXP1.ERR(
jNOT INTEGER:)/.EMPTY.OUT(:41:+:00001:»,OU~(;411:RE986).OUTi:45E09f22'
---E901).LABEL(*1).NOPC.~L);
llFS1=:IF~:C.LArCH(LSUnlX).UUT(;19:~E2).IGN(-)1
-DEXP1(R~LOP.NUP(C»DEXPl.ERR(:NLJT AN EXP;).OUT(129:-2E2).lGN(

... 2»):):
.ERR(:MIssiNG ):>.OUT(~~8E ;*1).UUT(:47:R:09034:)L2ST.~R~(:NOT A ~TATEMENT;
- ).LA8ELC*1);
,
GUST=;GUTU:C.lNt,OUTC:58E :*>.OUT(:47F0904C:F o 02)/,(:.OUT(:58E :*1).OUT(:05;+:
E: >.OUT(:4120000141F090 /fC: )COHn.ERR( :NOT AN INTEGER~ )$(:, :GOJNT,ERR ,
( : NOT At~ I N lEG l: R : ) ) : ) : .E Rf< ( : MIS SIN G ):), 0 UT ( : 4 5 tOt) 0 1 8 : ) • LAB EL ( *1 ) • (J P T ( : I : )
~Expi.uUT(:07F2 :--E902».NOPC.EL);
,.
END~T=:ENU;:.UltIC:47F09038IE900)ENasn.'ERR(;UNTERMINATEO 00 LOOP;»)
ENOUST=:CUNTINUl;;.OUT(:O~E9:~9001/CA(LST/LIFST/C~T/IUST/;.:
(:UU1(i.STRJNC.OUT(*E900)/:1AB~L(:,STRING.LAB~L(*»::):;

:C.EQUAlSCEQZST)1
ENDOST).ERK(:INVALIO DU ENO:)
DOGEN}: :(.lQUALSCEQST)/NEQST)/:a:BODLST/.INT,lABEl(*,::,ERR(:BAD LABfl:>

ST::!NOP(C,(.LATCH(CCST)/~UOEND~lNT,LABEL(*):

(.EQUKL5(EQST)/LABST)/FCARDI.EHPTY:

I.E~R(:DAD (ABEL2»;IGN()~IGN().IGN();

FCARD=(:F' :1:l:X;ERNAL:)'
" . '
.ID.EKR(!SAD LABEL:)CALLSBS(J,:.ID.ERR(:SAD LA8EL;)CALLSB),NOP(~EL);
L2ST=.EQUALS(~Q2Sr)/LABST;
IEX~2=:-:iTERM.UUT(:13:0FOF)/:+:ITERM/ITERM;

SEXP2=:-:~TERM.UUT(:33:00)/~+:STERM/STERM;

DEXP2=:+:UTERM/~-:OTERM.OUT(:33:00)/DTERM;

-

BIEKM=BPRIM$(:*:BPRIM.OUT(:14:-E2»;

ITERM=IPRiN$(:*:lPRIM.OUT(:181;OF~2).IGNC~).OUT(;lCO:OF:1620F:l:)1

:/:.sAV(O~)lPRIH.OUT(:180:R:8E0000201uo:or),IGN(-).OUT(:lS:OF;l:»;

STERM=SPRlM$C:*:SPRIM.OUT(:3C;-2EZ)/:/'SPRIM.UUT(:3D:-2EZ»;
OTERM=DPRiM$(:*:DPRIM.OUTC:2C:-2E2)/:/;OPRIM.DUT(;2D:-2E2i);
CEX~2~:+:tTERM/:-:CTERM.OUT(:33:00:33;XX)/CTERM;
,
CTERM=CPRiM$«(:*:.SAveXX)CPRIM/:/:.SAveXX)CPRIM.OUT(:45Eo9BOCO:XX;O:»
, ,OUTt;45tO~BBOO:R:O :-2),IGN(-2»J
'
"
SUBtXP=SUUSCL .OUT (: lE: OF: 1: ) I. ENPTV; .OSUBXP=SUBSCL~OUTe:1EII1E;OF:1:)/.EMPTY;

CSUBXP=SUUSCL~O~Te:1EII1E1IIE:OF:ii)/.~MP1V;
ASS 1 =• I 0 ( 1NT Vl : =: • E t{ R ( : E XP f CT l: 0 = HER E I ) C• LA T CH ( I t XP 1.) • 0 UTe : 50302000 : - ) /

t.RLATtH(StXPl)/.RLA1CHCDEXP1)/CEXP1.lGNC-2».UUT(:45E69E60500Q2000 :-2»/
=HERE:)(RHIEXP/
.LATCHCSEXPl)/.'RLATCH1DEXP1)/CfXP1.IGNC-2»
• ERR ( : NOT AN EXPRESS J ON; ). UUT C: 70002000 ; -2) IRLDVL: =: • ERRC : EXPECTED .= HERE:)
, (RHIEXpi.lATCHCDEXP1)/CEXP1.IGN(-2»
,
.ERR(:~OT AN EXPRESSI0NZ).DUTCi60002000 ;-2)iCMPXVL:=:,ERR(;EXPECTED = HERE')
, (RHI~XP.UU1(:2F:+20)/CEXP1).ERRC:NOT AN lXPRESS10N:)'
.OUT(:6020200sor~02000 :-2-2».OUTe:05E9 ;-E901),NOP(.EL~;

kLVL:=;.ERR(:~XPECTED

216

Fall Joint Computer Conference, 1968

A-2
RHI~XP=.lATCH(ItXP1).UUT(;lH0345E09~OO

J f S1

=: IF: ( ; ( •. L ATe H ( H: XP 1 )

v

0 U T ( : 1 2 22

:-+2);
: - ) I ( • f'L ATe II ( 5 E: Xr 1 ) / DE XPl.)

,
, .E:RR(:BAD l:XPRESSIUN:)~OUT(:3200 t-Z»U:END.f:RR(;HISSING ););
BUOlST=.DUF.NO.INT,LABEL(*): :BASS1Cl)OGEtO/(,un.LA£3El.(';Q: :/: ~ )(,EQUALS

(B~SST)/bIFST);
, .
o U GL~ N =!, ( • l) UI ( : 4 1 ~ : RE 986 ) • UUT ( : 4 1 2 : R I ) • 0 U r ( : 5 BE: K ) • 0 UTe : It 5 F- 09 E ') C : [ 903 ) • M0 RE:: DO ) ;
CCS I
I • EM P T Y ) (-, LA TCIt ( uc C ) / • I D. LAB E.l (
NOP ( C ) CCX2 $ ( : / : • UU T ( : 078 A: )

=(: :
* ): : =: •
CCX2):;:.llUl(:O"FA:»;
.
, CST =( : F L IJ \'i n N : • S AV ( : 02 8 : ) / : f L(j ~~ 0 F F ; • S AV ( : 02 C : ) / : S T LJ P : • S A V ( ; 038 : ) / : P AU S l
:9210HOOO: ).SAV( :Ot't: )/1CI;;Sl'
.00T(:45~09:KE900)~NUP(.EL)/NICEST;

'
: • 0 I,J i (

"

SUBST:( :SlIBROUT!NE:I:SLlBR,: ).ID.ERR( :lNVAkIO ~IA~'E; ).OUT( :47F09038;E900)SUlIRSAe
~UB2ST).OUT( :O~E9:);

III S 1 ::. ( ALG'lOS T /

.

« (:t~EI\D(: .SAV( :OlU: )/:\AJRITE::(: .SAV( :()OO:) )IEXP1.ERR( :NJT A.N INTE::GER:):.I:
.INT(H.B).I:RK(;AAD FURI'lAT lABEL:),.SAV(;581 :*>;):.E:RIU:MISSING ,;)/
(:PRiNr: .SAV( :000: )/:READ: .SAV( :018:)
"
(.INT(FLB).~AV(:581 :*)/.lMrTY.SAV(:4110B02C:».OUT(:lF2:~».OUT(R).OUT(:5BFoU
iR).oui(:O~Et :-).orT(;J:)(IOSlQ$(:J:IUS[Q)/,E~PTY)
-'

,OUTt :'t5f:OfOOC:)/
( : RE WIN [) : • !> AV( : 008 : ) 1 : B I~ CK SPA Ct

: , SAV ( : 00 C: ) ) 1 EX Pl. ERR ( : NJ TAN I NT l: GE R : )

.OUT(:~BFOb00045~Of:R:

:-»).OUT(:05E9:E900),NOP(,EL);
GUINT=.lNr.our< :lF32: ).ULJl( :58E p~).fJUT( :O?2F:);
'
LsutilX=IE~Pl(KELOP)lfXP1;
RELlIP=:.: (:LE: .~AV( :3: )/:£Q: ,S/l.V( :7: )/:NE: .Sf\V( :9: )/:(;T: .SAV( :[); )/:GE:: .SAV( :5:)1
,- : l T : • !) AV ( : b : ) ) , £: Rk ( : RADD PER A1 (J R : ,) ; • : t [R R ( : 5 H(j U LOB EAt : ) 1 : <; • S A V ( : rj ; )
/:=:.~AV(:7:)/:>:.SAV(:D:);
,.
' ,
BAS S T I 0 ( I NT V L / R l VL ) : = : • t: RK ( : SH 0 UL () B E =;) 8 E X Pl. l:: RR ( : NOT B J 0 LEA tH ) , Ul) T ( : !> () 3 0
200005E9 %--E901).NLlP(.El); •

=•

SUBSCL=;C:GJNUlX.ERR(:NUT AN ARRAY:)IEXP1.ERR(:Nor INTEGER

EXPRESSI0N~)

(~q[XPS)/.)OUT(: 180:0'r :45EOE064 :-):); ,ERRe PllSS1NG ););
B P RIM::: • CHe ON .Ull l( : 58 : + • C4 GEN) / ( : • FA L S E • : 1 : 0: ) • DU T ( : 1 F : +0 F ) /
.Rcnr~s'T .UUT,C :5a:+.BCGEN)/:-':IJPRH1.UUT( :57:0F:0I301C:)i
( : • TRUE, : 1 : i : ) . UU T ( : 48: + : 0 BOle: ) / : ( : Bl: XP 1 : ) : • ERR C: MIS ~ I \~G ):) I
.ID(INTV/KLV).OUT(:58:0F:O:OF:OOO:El);
.
CAL LS l'
CAL L : ( : (. HfI It H: I I;: XP 1 : ) : • (; RIU n.q 5 S H l G );" II UT ( : 0 h 0 1 : - ) 1
.1~CAlLSB.SAV(*)(:(:PLISl :):,ERR(;EXPECTEO ):)
/PLIST) .UlrJ (:58F :R» .UUT( :05EF:E90 /.. ) .NOP( .EL);
ICE ~ T :: ( : T RAe [ : ( : 11 N : • S/\ V ( : 0 It It : ) 1 : 0 F F : • S A V ( : 04 8 : ) ) I ; 0 lJ MP : • SAV ( : 0 3 c.: : )
/:PDUM~): ,SI\V( :040:) )PlIST;
IPR1M={PRl.;
SPR i ~, =S P R i $ ( : t.'
L ATe II ( I PR I ) • 0 UT ( : 1 80 : 0 F E2 ) • I GN ( - ) • 0 U T ( : 45 E09 F BE 0 ; 00 : 1 : ) /
. .OUT ( : 45tO'iFOIIO: 00:).: ) SPI{ I. OUT ( : 3C: -2: 45E09FtCO: 00:
»);
P R H1:: DPR 1 $ ( : ;:n;,: ( • L i\ T CH ( I PR 1 ) • DU T ( : 1 80 : 0 F l2 ) • I GN ( ~ ) • 0 U T ( : 4 5 ~ 0 9 F B EO: 00 : 0: ) I

=:

* : (.

1:

o

.oUTi:45t09F040:00:0:)UPKI

.

~ERR(: ILLEGAL

tXPONENT:) ,[JUT( :2Cl-2:45E09FCCO:OO;O:»);
CPRIM=CPRi$(:**~.UUT(:45E09CBOO:XX:O:).SAV(XX)CPRi,UUT(;4~E09~BOO:R:O :-2).IGN
( - 2 ) • (H) T ( : 5l 09 C£> (, 0 : X X : 0 : » ; '
.
IUS£:Q=:(:~nLJT(:!>8E :*1,.DUT(:05:+:Eln;+:1:)$.LA-CH(PARCOH).lD.IIDtOLJT(~'1f
• S AV ( [ '-J U -, S ) • (Ill T ( : 4 1 1 : r,~ E9 8 (, ) • UU 1 ( : It 5 E09 t F C 1 8 1 : 0 1-: : - ) "
'
~ 0 l) T ( : 0 7 A : () F : 0 7 r- 1 : ) • L 1\ 1.3 E L ( ::( 1 ) , S A V ( :~ ) :
I;: RF: ( : t XPEe '1 f:. D = HER E : ) • N0 P ( • CL A t1 P )
I EXPl. t; RR ( : BAD EXP RF. ~ S 1 [l N : ) • () UT ( :
0 F; : R ) ~ I GN ( - ) : J : ~ r. RR. ( : ~l r sSIN G ,;)
1 EX Pl. t:, RR C: BAD E XPRE S S I ON : ) ( : , : 1 EX Pl. F; RR ( : fl AD f:: XPRE: S S I UN: ) 1 • E. r", P TY
~OUT( :/t1 :+:00001:» .UUl (:1,,11 :Rf:986) ,(JUT(; ItIO:Of: :-) .()UT(: 181- :OF: :-)
, • nUT ( : 90 r 0 1. () 0 0 0 51 : 0 f-=: : - ) : ) : • E. RI~ ( : i11 5 S r NG ):,

't

:*>

5() :

1 • S A V ( : 0 : S ) I IJ P '~R AM. (J lJ r ( ; '+ 5 [ Q 9 [
1 U!:)EQ: J : ;
I N T V L = • TYP E ( : r F It 5 : ) • LEV l • ERR ( : I. E F 1 S' I D[
RLVL=,TYf)f( :FFC5:) .LEVL.EP.R( :lEFT SIDE
R L 0 V L :: , T Y P E ( : 1- F 05 : ) • l. ElL. E P. R ( : l. [ T SID E

=: •

86 : ) ;

PARCO~1=

r

I S F lJ ~1CT 1 UN: ) , DUT ( ; 4 1 : + : 0 DO 30: ) lIN TV;
IS FUNcrllJN:) ,Dl'T( :41:+:00030: )/f?LV;
I S FUf'l C UN: ) • [J U T ( : it 1 : + ; 0 DO 3 0 : ) , R.l DV;

-n

META PI

217

c: NPX VL :: _ T Y P f.: ( : F f II ~ :

) • LEV L • £: Rh ( : L [ F 1 SID I: I S F lJ NeT IlJ N : ) • 0 U T ( : 4 1 : + : 0 DO :3 0: ) ! C~1 P X VJ
R J F S T == : 1. F ( ! B[ XP ). • E Rk ( : NC T BUU L E l'l. N ; ) • 0 UT ( : 1 2 2 2 : - ) i FEN 0 • ERR ( : SHnUL 0 B t: A');,;
IFEND=:) :'.INl.U{R( :j"U"j AN' 11~TEGER; >,OUT( :41F0904C: );OUT( :~aE :*).DUT( :O-'4F:)
: , : • l ~~.I~ { : I~ j S!> I NG ~:). I NT. E j{ R ( : N D TAN I NT (:: GE R : ) • 0 U T ( ; 58 t: :
Uu1 ( : () 7 CF : E 3 )
:,:.l~~{:r'11S~ING ,:).Ir~T.F.'{K(:NfJr AN INTEGER:)~Ol.JT(:S8E :*~.UUT(:()7FF:t3
E(02).NUP( .l.L);
CCX2=~CCDtccx::n .UUT (:;)~H:. :*1) ,OUl (:077E: )$(CCO/CCX3.0UT( :47-(.ERK:»
.LAUF.LP:'·ll90);
N 1 Cf:: S T:: ( ( : r:: X Ecur f: : .. DO ( ; S R (;,8 : ) / ; SAV E ~
(.unc :LA 8,30:) :Sl1UPCr.:; I.DU( :LA b,B:) ;lJnJECT: I.DU( ;LA 8,44:) .OPTC .EMPTV»I
: SQlH: E l E : • on ( : L /\ A, 16 : ) I : CALC; .. OPT ( : l) LA Ti:JR : ) • DO ( i L A8, i 6 ; )
,
.DP I (,Ei"lPTY» .OPT(UNOFF) .OPl'e .E~·lPTY)
I:BATCH:.OO(:LA A,Z/i:»;;:.ERR(:SHOUL.DtND HEREl),DO(:L 1,SAVSTK;)
.DO(:EX 0,~"+8(B):).O(J(:B *+56".DD(:USIN('; SlACK,l;)
~ [) U ( ; n 1- S ~J, 1 : ) • f)[1( : N I S \-1" 2 5't ; ) • 0 (J ( ,N I S \~ I 253 : ) • 00 ( ; 0 1 !) tv I 2 : )
; DtJ( : t-U <.: L HJ E, 251 : ) • Dn ( : U I CLIN E14; ) • DO ( fLJ I ,C LIN
126; )
.
~DO(:Cli SW,131:).OU(:NI S~1/12/t:)
,
~ nn ( : N i sW, 1 2 7 : ) ~ 0 [J ( : 0 I S \.J, 1 2 H : ) • DO ( : N I S W, 1 2 5 : ) • DJ ( : DIS \'J I 1:3 0 : )
" 0 U ( : DR 0 P -1; > • DO ( : SP M 2: j;
.
A L. G 1 Cl S T ;.: ( : RE h D ( < : • S t.. V ( : () : , / : f-' R I IJ T ( <: • 51\ V ( : It : ) ) • (l U T' ( : 580 : 1 )
.
,OUT(:~OOOL00"5000C06C~).OUT(:~8fOU02:R)rWORDC$(:,<:PWOR6c)
• 0 LJ T ( : 1 r t.: E !> 0 L: 0 L 06 : : n.5 H I:: 0 C0 (> C() 7 r 9 ; E900 ) • l /\ BEL ( 1 ) : ) : • ERR ( H1 r S 5 I NG ):). NO P ( • E L ) ;
URG
f~lGIUS1+14 FUR Tfd)l.,E CE:NERATION ONLY

* ).

t,

*

*

CPR~=.lATLH(CtLLMF)CExrl:):.OUT(:4~EOY:R:O:X~:O:

XCON(:, :XCflN.(:RR( :NUT

I~

r~U~W[R:

)1

)/,Ei"',PTY.UUT( %2F:+20»1

.L/l.Ttil(XCDNSf;I:(:C[XP1:):.£:Rr~(:~H!)SIN&

):)1

.10(CMPXV.UUT(:68:+2:0:0F:00068:+2:0:0F~OOB :-)/,TYPf(:F5A5:)FCN
• S A V ( RS ) • UU T ( : 68 : 'i' 2 ; 0 : R: 030 (,8 : + 2 : 0 : fU 038 : ) II.) PRID. [) U 1 ( : 2 F : + 2 0 ) );
DP,'R 1 =• L l'~ T CH ( F.l: U-' F ) 0 t XP 1 : ) : • uuq : tIl S SIN G ):). 0 UT ( : I~ 5 EO') F ; p. () 0 : 0 : ) i . L ATe H ( A 8 SF)
DE XP 1 : ) : c un\( : HIS S I :.~ G ):), 0 UT ( : 30 ; 00 ) I XC [) N! ! ( : DE XP 1 : ) ; • ERR ( : MIS SIN G );) I
• 1 D ( Dr Pin) • t R R ( : Bfl 0 TY P l : ) ;
.
DPRID=RLnV.OUI( ~68:+2:0:0F:OOO:tl).IGN(-)I.TYrE(;F585: )FCN

-

.OlJrC:6i$:+2:0:R:030:)1

-

R LV. ~ A V ( : 7 b :'+ 2 : 0 : 0 F : 000 : r.: 1 ) • LJ U 1 ( : 2 F : 00 ) • 0 U T ( K: : - ) 1 • TY P E ( : F 5 C5 :
,[JUT( :?F:+"LO:7fj:O:O:P,:030: )/ITURD;
S P R 1 ::. , L f~ T t. II ( [ L E1'1 F ) S L X P t : ) : • t RK ( : ~H 5 5 I N G );). 0 u T ( ; 4 51: 09 f : ROO ; 1 : ) I

) ( FeN)

- .CHCGN.OUT{:IB:+2.C4GEN)/.BCUNST,OUT(:78:+2,SCGEN)/
_ '. i~J Ut-' • UU I ( : -( d : + ? • N G[ N ) 1 : ( : SEX P 1 : ) : • ERR ( ; M I ~ SIN G ):) 1
.• If,TCHetIHSF)SEXPl.:): .UUlC :30:00)/, IU(SPRID);
"
I P R 1 :: , I NT. fJ UT ( :- ~ R : + • I G£.: r~ ) I • CHe (J N • 0 U T ( : 5 a : .... CIt GEN) 1
- .BCUNST~OUT(:SB:+.RCGEN)/:(:IEXPl;);.ERR(:MiS$ING );)
r.lA)CH(~n~F)IEXP1: ):.ERR(;MISSING );)~OUT(:lO:OFOF)
I.II)( INTV.lIUT( :58:QF:O:OF:OOO:El)!.TYPE( :F54!>: )FCN.ouT( :58; ...
M1 EX P S =: J : I E X Pl. f RR ( : NO 1 Hn f: GER [ X PRE S S HI N ; )

:O:R:030;»;

tMIEXrS),OUT(:1BO:OF:05EE ;-)/.EMPTY,OUT1:41E09F4E1Fll:R);
SPR 1 D=R LV. (JUT ( : 18: +2: 0: OF: 000: E 1) , I GN (-) I. TYPL ( : F!)C 5: ) FeN, OJT ( : 78: +2; 0; fU 030: ) I
I10KO;
.
ITO~D=(INTV.OUT{

:,SQo:or:ooo

:[;1-'1

• T Y r t e : F , I. ~ : ) ( FeN ) ~ UU T ( : 5800 : Po : 030 : ) ) • [J U I ( : 4 5 E If I T J R : + 2 ) ;
FCN=.SAV(~):(:PLIST:):.ERR(:MlSSING ):),OUT(:5~F iR).UUT(:O~Ef:t904),SAV(;1:)
/ • f:: HP T Y , LEV L • t; I< k ( : EA. D F l)N CT I LIN Ci\ L L ; ) , S AV ( I : D: ) ;
P L I !> T :: • UU r ( : 5 U : + :·0 0 0 0 0: ) • S A V ( 0 r ) • UU T ( : 1 : + : 0 : F, : 0 3 (,; : )
( P A f~ " n 2 • S A V ( : 0 : ) $ ( : 1 : PAR /1.111 • EK R ( : r~ U 1 A P" F. AME j E R : ) • S A V ( I : 4 : ) ( : , : PAR AHZ

't

,ERR( :hnT A P~R/\HE1[:h:) .~AV( I :0: )/,EUPTY»
.Q0T(:~~lo:or:oou: ».lGN(-).IGN(-)j

,OUT( :C)660:0~:OO:R)/ .. Et1PTY

'" B S f- =: 1\ BS': ,u r I ( : F : ) : { : _:
.
.
ELENF::( :SqHT: ~SI\V( :0(0: )/:SIN: .SAve :[40; )/:COS: ,SAve :ECO: )/( :LOG:/:ALOG: ),SI\V
( : () 4 0: ) / : f. x p : ~ 51\ V ( : CC() : ) I : /\ T Ar~ :. SA V ( ; C 60: ) I : 1 AN~{ : • S h V e : F 40: ) ) • uP T (.: r : ) ; ( : ;
XC[) N S T =: ( : DI': XF 1 : , : • :~ 0 P ( C ) DEX P 1 , r.: R K ( : NUT AN E X V) n. E: 5 !) I [) I'J : ) : ) ; • ERR ( : ~1I 5 SIN G ):);
XCUN~.DNUM~OUI (:6B:+2.0GEN)/.C~UCUN.OUT(:6B:+2.CBGEN)/.BaCO~ST

218

Fall Joint Computer Conference, 1968

.UU1( ~6u:+2.BaGEN)/; .PI:
PARAHl=.S~V(,:4:~)PAkAM;

.OUT( :68:+2:09DFO:);
,

PAR 1\f·12 =• S(" V ( :, ti : !) ) PAR At·1 • u\rr< : '+ 1 ; 0 F ~ 0 : 0 f ; 008 : );
eEL EMF =( :!) QRT : • ':> A V ( : C90 : ) I : SIN: • S AV ( : coo: ) I ; CDS: • ~ A V ( : C0 8 , ) 1 ( : LOG I 1 : A LOG: )
• S A V ( : CB0 : ) / ( : r;j AG : I : A BS : ) • S " V ( : C14 : ) I : ARG ; • SAV ( : C2 C : ) 1
,
: EX P : ~ S f~V ( : (; 6 (): ) I : ATAN: • SAV (: U3 A: ) 1 : TAN H : • SAV ( : [) 0 2 : ) ) ; 0 Pr ( ; F : ) : ( ;, ;
IJ N0 f F = aJN i 1 : nt- r : , DU ( : L A 8 J 4 ( 0 J 8 ) : ) ;
.
' .
-'
ceo:: ( : . OUT ( : / : • 1GN ( : • OUT ( : 92 F f 900 A: ) ) $ ceo 1 : ,) : , OUT C: 05 E9 : ) 1

ceo
EFF

;.LABE({:$~c01;):.UUT(:45E.lABE:)/:.DO(:$(.SR.UUT(*):::):):I:,OPT(;CCX1:):1
: • S A V (: $ (,; CU 1. : ) : • 0 U T ( : 4 !j E • SA V ; ) / :, NLl P ( : $
1 : ) :;
1 =CCU S~J B • 0 UT '( : it 5 E. :
1 : C : • LJ UT ( : 920 15000 : ) / • SR , UU T ( : 05 E4 : ) • 0 UT ( PI : #

OFF

ceo

*) '

*: : : ) : : :;

, . . . . .

CCOSUB=:*l:/:R:/;I:/:+2:/:+:I:S:/:-.2:11-4:1:-:I:X:/:OF;1:0:1:*;/:#:/'; .. :,10;
EfF ON
'
CC X 3

,

=• 10. UU T ( : 41 E ~ : * ) •[) UT ( : 0503: ) /

* ; : : ): c : 1
*l ) • UUT ( : 078 E : )

4! SR. OUT ( : 45 E • T f. S T : > • flU T ( ; # : 1#
: ( : CCXl: ) : / : • Er'l PT Y : • 0 UT ( : 0 '+ 20: ) / : $ : • LAB E L ( 1 ) CCX3 • 0 UT ( : !) 8 C. ;
.DUT( ;0420: )/:.LATCH( :.lD.DUT( :41E. ;~c).OlJT(·:4!)O,LATC:): ):1

*

:.TYP~(:.SR~OUT(:4~E.TYP:).UUT(*)::::):1

:.:.ID.OUr(~45E.:*);'

CCXl:: CCX2 ~ ( : / : • UU T ( : 58 E • :

*

our ( ;

,

..

*

1) •
078 t • ) CC X2 ) t LAB El, ( 1 , ;
FCNS1=:~UNCTIUN~.lD.ERR(:INVALIU NAME:)~OUT(:47F09038:E900)FC~SB(SUBZSr)
.OUTt:45fO~~BE:.X2)J
'

SUBV=.TYPl:( :l!>O!>: ).(JUT(:58:+:

;*»

The organization and formatting of hierarchical
displays for the on-line input of data
by GORDON T. UBER, PAUL E. WILLIAMS and BRADNER L. HISEY
Lockheed Missiles and Space Company
Sunnyvale, California '

and
ROBERT G. SIEKERT
Mayo Clinic and Mayo Foundation
Rochester, Minnesota

INTRODUCTION
On-line terminals, which we shall call "list selecti'On terminals," are being investigated here and
elsewhere as input devices f'Or inf'Ormati'On systems. These display lists 'Of alphanumeric entries
fr'Om which a user may select entries by p'Ointing.
Whereas users 'Of m'Ost terminals (including 'Ours)
P'Oint with a light-pen, users 'Of the C'Ontr'OI Data
Digiscribe select by t'Ouching electrically c'Onductive regi'Ons 'On the faceplate with a finger, thus
c'Ompleting a radi'O-frequency circuit. The lists
are displayed 'On either a cath'Ode ray tube 'Or an
'Optical rear-pr'Ojecti'On screen, and they may be
changed rapidly under c'Omputer contr'Ol. The user
c'Omposes input t'O the system by selecting w'Ords
and phrases fr'Om the lists. As he pr'Oceeds, new
lists are displayed as required.
This appr'Oach t'O c'Omputer input takes advantage 'Of the wide bandwidth 'Of this class 'Of
displays, and 'Of the human eye, t'O rapidly c'Onvey
informati'On t'O the user; he may then resP'Ond
manually at a l'Ow rate. It is particularly useful
f'Or users, such as physicians and managers, wh'O
generally are not go'Od typists. Alth'Ough their
entry selection rate with a light-pen is l'Ower than
. their hunt-and-peck typing rate, the inf'Ormati'Oninput rate when using selecti'Ons is generally higher than with a keyb'Oard because entries each c'Onsist 'Of many characters. In one application, the
input of medical laboratory test 'Orders, the entry
rate was c'Omparable to handwriting. Alth'Ough

dictati'On is a faster method 'Of inf'Ormati'On entry,
it interposes a stenographer and results in delay
between the user and the computer system.
This approach has several features that impr'Ove
user accuracy and system acceptability. This
user, presented with a list of acceptable and meaningful resp'Onses t'O the system, is 'Only required
to rec'Ognize an acceptable resp'Onse rather than
to recall it from his mem'Ory. In this sense, the
system is tut'Orial. The tut'Orial aspect can be further exploited by including explanat'Ory material
on the displays themselves. Because an ent~y can
be transmitted t'O the c'Omputer with a single selection, it is n'Ot necessary to substitute an abbreviation 'Or a numeric c'Ode f'Or the entry in 'Order
t'O sh'Orten the input transmissi'On time. Thus, the
err'Ors inherent in manual enc'Oding are eliminated.
Spelling err'Ors are eliminated, and thr'Ough the
pr'Oper organization 'Of the displays, most syntactic err'Ors can be eliminated as well.
F'Or many applications, the entries are arranged
int'O a hierarchy c'Omparable t'O that used in inf'Ormation st'Orage and retrieval systems such as
AESOP.l This hierarchy is essential as an index
t'O the many possible responses that the user may
make in entering inf'Ormati'On. Through the entry
process, he becomes familiar with the structure
of the hierarchy, and thus, he is familiar with the
organizati'On 'Of the c'Ontent within this system
when he desires t'O retrieve. The entries, alth'Ough
appearing in full f'Orm f'Or the user, may have invisible coding associated with them f'Or use by the
219

220

Fall Joint Computer Conference, 1968

computer system. Thus, there is an inherent
translation from a man-understandable to a machine-understandable form. The syntactic structure of the user's responses also can be preserved
for further processing by the system. Thus, the
time-c'Onsuming scanning and analysis of character strings that are normally done in informati'On retrieval systems are not required. The syntax can be tightly c'Ontrolled when the computer
must act on the input data and may be left uncontrolled when only narrative input is required
for the subsequent reading by users.
In the remainder of this paper, we shall discuss
the 'Organization 'Of informati'On hierarchies,
search strategies, and the manual and automatic
f'Ormatting 'Of displays. The examples will be taken
from medical informati'On systems f'Or entering
lab 'Oratory test 'Orders, 2 ~edical hist'Ories, 3 and xray reports. 4

Hardware
For our experiments we are using an experimental Lockheed Vide'O-Matrix Terminal 2 ,5 shown
in Figure 1. The word "matrix," which refers to
a display page, was derived from the row-andcolumn arrangement of the entries. This terminal
of the cathode ray tube has a 24 row-by-40 column
display, 7 by 9 inches in size. Although the present display is adequate f'Or the routine entry of
medical orders, we would prefer a larger display,
f'Or example, 24 by 64 characters, for the entry of
narrative data and especially for information re-

Figure I.-Display and use of light-pen, with experimental
video matrix terminal.

trieval. Selecti'Ons are made ,by use of the lightpen, and the output signal from the light-pen is fed
back int'O the vi4eo signal S'O that the characters
that are aimed at are brightened. Except for inf'Ormation retrieval and automatic f'Ormatting experiments, this system has maximal response time
of 0.5 second. Such fast reSP'Onse is essential to
av'Oid interrupting the user's th'Ought pr'Ocess.
Function codes
The bott'Om two rows of the screen (Figure 1)
c'Ontain light-pen selectable functi'On codes through
which the user initiates system actions. In the
n'Ormal Operational M'Ode, the c'Ode ERR enables
the user to sequentially cancel the effects of as
many as 16 previous light-pen selecti'Ons. The
c'Ode BACK permits him t'O sequentially back up
t'O 16 previ'Ous matrices. As the user makes lightpen selecti'Ons, New Text is accumulated, the last
tW'O lines 'Of which appear at the top of the screen.
The entire page 'Of New Text is aut'Omatically
presented to him (New Text M'Ode) when a full
page of message has been accumulated. The user
also may enter the mode by selecting NEW TEXT.
In either the Operational or New Text Modes, a
typing cursor is displayed when a key is depressed.
This cursor indicates where the keyed character
is to appear and may be positi'Oned either with the
light-pen 'Or with the carriage return, backspace,
tab, and space keys. Characters may be keyed in
'Or erased at the positi'On designated by the cursor.
In the New Text M'Ode, the functi'On code ASBL
(ASsemBLe) closes in any gaps left by erasure.
The New Text may be entered permanently into
this system with code ENTER or may be totally
erased by CLR (CLeaR). The permanent patient
record may be accessed by the functi'On code OLD
TEXT. The user may page through this rec'Ord
in the f'Orward direction either a full page 'Or a
half page at a time by NEXT 'Or HALF or in a
backward directi'On by BACK. The Operati'Onal
Mode is entered by selecting RETURN.
Matrices may be created and modified on-line
in the Edit M'Ode, accessible to systems programmers. Each light-pen selectable entry is terminated by the entry marker character (:1:), which
is visible 'Only in the Edit Mode. By means of
special functi'On c'Odes and the cursor-positioning
features, entries may be moved vertically and
horizontally. New entries also may be inserted.
After an entry has been selected in the Edit Mode,

Organizati'On and F'Ormatting Hierarchical Displays
a function code enables the control data f'or that
entry to be accessed. These c'Ontrol data define
the f'Oll'Owing f'Or the Operati'Onal M'Ode:
The character string t'O be added t'O the
New Text. This may be fr'Om any matrix.
2. The next matrix t'O be displayed. This is
often the present matrix.
3. Punctuati'On t'O precede the new character
string bef'Ore it is added t'O the New Text.
1.

These c'Ontr'Ol data may be m'Odified in the Edit
M'Ode. The ability t'O d'O 'On-line editing has enabled
the rapid devel'Opment 'Of 'Our present set 'Of ab'Out
2,000 matrices.
A l'Ogging feature enables us t'O rec'Ord and
subsequently rec'Onstruct the acti'Ons 'Of' a user at
a terminal. All light-pen selecti'Ons and the time
interval preceding- each may be printed 'Out. L'Ong
intervals indicate areas 'Of user difficulty t'O the
matrix designer. This feature is als'O a potential
s'Ource 'Of success'Or pr'Obabilities f'Or use in the 'OPtimal design of hierarchies as described bel'Ow.

l)ata hierarchies
T'O facilitate their retrieval, selectable entries
are arranged int'O a multilevel hierarchy. An example 'Of such an entry hierarchy is a set 'Of medical 'Order matrices rep'Orted' by Siekert and ass'Ociates 2 fr'Om which physicians may 'Order any
c'Ombinati'On 'Of ab'Out 500 lab'Orat'Ory tests (Figure
2). Since these test names will n'Ot fit on a single

221

matrix, it is necessary to organize them into a
number 'Of matrices. It is further necessary t'O index these matrices S'O that the user may find the
matrix c'Ontaining the test that he wishes t'O 'Order.
There are numer'Ous ways in which these test
names may be classified. Let us examine several
'Of them. M'Ost c'Omm'Only used and easily underHt'Ood is the' alphabetic arrangement 'Of entries.
The t'Op level matrix can c'Ontain the letters A t'O
Z. Selecti'On 'Of a letter such as "A" takes the user
t'O the matrix c'Ontaining tests beginning with
"A" (l'Ower left c'Orner 'Of Figure 2). In this instance, tW'O matrices are required t'O c'Ontain all 'Of
the tests named. The entries 'On these matrices can
be arranged in alphabetic 'Order, but if the user
wishes an entry appearing near the end (f'Or example, Aut'Ohem'Olysis-RBC), he must page
thr'Ough t'O the last matrix in 'Order t'O select it.
If such an entry 'Occurs with great frequency, this
is a nuisance. T'O reduce the number 'Of selecti'Ons
required t'O reach a c'Omm'On item, a sec'Ond classificati'On method may be used: that 'Of frequency 'Or
pr'Obability. The c'Omm'On tests beginning with the
letter "A" may be placed 'On the first matrix, the
less c'Omm'On 'On succeeding matrices. Because a
test name can be 'Overlooked, we have f'Ound it desirable t'O repeat the c'Ommon tests with the less
c'Ommon t'O ensure that they can be f'Ound.
Such alphabetic hierarchies w'Ork efficiently
when 'Only a single test is t'O be 'Ordered. Often a
gr'Oup 'Of perhaps 10 tests is required. T'O facili-

Figure 2.-Hierarchy of laboratory test ordering.

222

Fall Joint Computer Conference, 1968

tate the selection of such ,groups of entries, several
alternate classification methods have been developed. The user· may use any or all. of them as
he wishes. In particular, test names have been
classified by the specimen on which they are performed (such as cerebrospinal fluid), the laboratory in which they are performed (blood chemistry), and the disease category (hypertension)
with which they are most commonly associated.
Tpe disease categories are most commonly used
because the users are generally able to order a
number of tests rather than just one from a given
disease test matrix.
In any classification system based on meaning,
different people may place the same item in different categories. To ensure that a user will find
an entry in the category to which he assigns it, entries are placed in all applicable categories. Users
may use different names for a given test or different permutations of the words in the test name.
All such synonyms are included. Thus, the test
for serum alkaline phosphatase is listed both under "alkaline phosphatase-serum" and under
"phosphatase, alkaline-serum." It should be noted
that the probability of a given test being ordered·
varies with different users or different classes of
users. Furthermore, the probabilities vary with
time, as various tests are introduced and in turn
superseded by newer tests. If the number of selections required to select a test is to be minimized, then the system should have the capability.
to modify the matrix content for each user and as
the probabilities of ordering vary. The automaticformatting procedures described in subsequent
sections are a step toward this capability.

Search strategy
Let us organize the hierarchy so that the user
can select the entries he wishes with a minimal
number of selections. One selection is required
either to go from one list to any other to which it
is connected or to select an entry on a list. Initially, let us consider the selection of a single leaf (an
entry which does not link to another list) with the
user starting at the top of the structure. We shall
consider only the probability of an entry's being
selected and shall in general follow the synthesis
procedure developed by Huffman. 6 If all of the
items are equally probable, then an optimal hierarchy is one· in which the entries are on the lowest
level, with the higher levels being indices to the

lower level lists. If some items are much more
probable than others, however, then these higher
probability entries should occur higher in the
hierarchy. The criterion for placement follows
Huffman's synthesis of minimal length codes. Assume that we have N items to be organized into
a hierarchy of lists, each list having a capacity of
B items. We rank the items by their probability
and assign the B lowest probability items to a list.
(In practice we may have to add dummy items to
make all of the lists full during the synthesis;
these are deleted when the synthesis is complete.)
We replace the B items on the list thus formed by
a new item that is assigned a name and has a
probability equal to the sum of the probabilities
of the items in the list. We have thus eliminated
B-1 items from the. pool of those to be assigned.
We re-rank the pool and repeat the assignment.
Doing this until all items are continually assigned,
we reach the point at which names (that is, lists)
are being assigned, and the synthesis of the nextto-the-bottom level in the hierarchy has begun.
With the creation of the top level list, the pool is
exhausted.
Although this procedure has produced an optimal hierarchy, it has not satisfied the condition
that the user must know which list a given item
is on. The lists must contain meaningful combinations of items, and the list names must relate
meaningfully to their contents. Fortunately, items
may be reassigned to different lists at the same
Ie"Vel so as to meet semantic criteria without affecting optimality.
Thus far we have considered the selection of a
single entry. If a sequence of entries is to be selected for which the probabilities are independent
of previous selections, then we may still achieve
optimality merely by automatically transferring
the user to the top of the hierarchy after each selection of a leaf. In practice, successive entries are
generally related so that a single hierarchy is not
optimal. If the size of the structure were no limitation and we knew the conditional probabilities,
given a choice of succeeding selections, then we
could use these conditional probabilities in the
Huffman synthesis to yield an optimal set of hierarchies. Weare deterred from this approach by
the difficulty of storing or dynamically generating
such a large set. Extensive training is required to
bring the user's selection rate up .to a satisfactory
lev:el for the large number of matrices which result. In practice, we approximate the optimal set

Organization and Formatting Hierarchical D.isplays
by providing upward and lateral transfers to previously selected lists and to related lists at the
same level.

20

Q.)

Optimal list size

15

.§

If we assume all lists to be of equal length, then
the number of leaves in the structure equals the
list length raised to the number of levels. To minimize the number of selections required to reach
a leaf, we minimize the number of levels by maximizing the list size. The maximal list size is limited by the number of entries that can be placed on
a matrix, as will be discussed in the section on
display formatting. Experienced users have memorized the position of entries on matrices and can
find a given entry in an interval of time that is
relatively independent of the number of entries
on a matrix. With fewer lists, fewer list names
need be assigned, and this simplifies the problem
of list identification, as discussed by Fuller:;
Tests of inexperienced users revealed an additional psychologic constraint on list length. These
users scanned lists entry by entry until they found
the entry they desired. They did this even when
lists were alphabetized and more efficient search
strategies were possible. Assume a hierarchy
with N leaves and B items per list, a selection time
t and a scan time of

!

r

per entry. Assume also

that, on the average, a user scans half of a list
to find an entry which he then selects (although
some will scan the entire list to ensure that they
have not overlooked anything). The total time to
select a leaf is given by the expression

(U
Bt + t) I
N•
- - - - OgB
r

Differentiating this expression with Nand t constant, we obtain a minimum
r = UB (In B-1),

which is graphed in Figure 3. Typically, the scan
time is 0.5 second per entry, and the selection
time is 2 seconds per entry, so that r equals 4.
The corresponding value of B is 7.7, which is the
minimal list length that is optimal under these
conditions. Because experienced users know the
positions of the entries they wish to select and
also can scan the lists more .efficiently than with

223

Q.)

.........

.~
~ ..;:::

'.;::::

§
Q3 ~
V)

10

II

5

~
Q.)

~

o

o

5

10

15

20

8 = List length
Figure 3.-0ptimal relative scan time per entry versus list length.

the method used in the above model, practical
values of B range from 10 to 40. Because a matrix
usually is "composed of several different lists, the
optimal numbe.r of entries per matrix is greater
than B.
Display formatting

The following is a summary of some empiric
rules for display formatting. Lists in column fornl
may be scanned more easily than those in row
form; at least three columns of blank character
should be left between lists. Matrices should be
given meaningful titles, and lists themselves
should be titled when more than one appears on a
matrix, although this latter requirement can be
ignored for certain classes of experienced users.
To facilitate learning, each area within a class 6f
matrices should have the same function. For example, transfers to other matrices are usually
placed in the lower right-hand corner. Although
it is possible to include explanatory material within the matrices, we have preferred the alternative
of keeping the organization simple enough so that
it can be used without explanations after a few
hours of training. We have introduced several
cueing symbols to guide the users. N onselectable·
entries are either underlined or bracketed, and entries that cause transfers to other matrices are
preceded by an arrow. Abbreviations, when used,

224

Fall Joint Computer Conference, 1968

should be familiar to all users of a set of matrices.
Full terms may be inserted into the message area
for clarity, even though the entries are abbreviated. Although users tend to concentrate on
light-pen selection and to ignore the message, the
use 'Of full terms does facilitate communication between groups of users who are unfamiliar with
each other's abbreviations. For example, VERT
P is an abbreviation for VERTICAL PORTION
OFT'HE ANTERIOR COMMUNICATING AR~
T'ERY (Figure 5).

A utomatic display formatting
In many of the classes of displays we have developed, a small number of format types is sufficient. Examples include displays for drug ordering, alphabetic lists of lab'Oratory tests, and descriptions of medical symptoms. In such cases it is
feasible to separate the data and the format just
as in FORTRAN programs. This makes it possible to standardize the format for a class of displays and to revise the f'Ormats of the entire class
merely by revising one format definition. Sepa. rate procedures may be used for revising the content, which now takes the form of a set of lists.
In'developing displays for the input of medical
histories, for example, the physician selects the
descriptors relevant to a symptom from a master
list of descriptors. Thus, a headache location, for
example, may be BE HI N.D' EYE, FRONTAL,
GENERALIZED, or MAXILLARY. A headache
m~y be precipitated by ALCOHOL, BENDING,
and so forth. This approach enables the user to
develop display content directly in many cases
without knowing either computer programming
'Or display programming. Further, it greatly simplifies display updating and maintenance as, for
example, when new drugs are made available for
use. Although at present our formatting rules
are incorporated within the formatting routines,
we hope to develop programs in the near future
that will accept external format definitions. A
system could be designed to maintain statistics on
the frequency 9f selection of each item (either for
each user or for all users as a group) and to automatically revise the hierarchy based on these statistics, thus making common items easier to select.
Sample matrices

The following .examples indicate the range of

Figure 4. -Acetylsalicylic acid matrix for drug ordering.

applicability of the list selection approach. Figure
4 is a matrix for ordering the drug acetylsalicylic
acid. This matrix, one of 500 drug matrices is
displayed whenever the physician selects either
acetylsalicylic acid (generic name) or one of the
two equivalent names, aspirin or ASA. This
series is the first of olir automatically formatted
matrices. The data specific to each drug are stored
in compressed form and are expanded into the format shown when the matrix is selected. It is an
example of what we call the "Forcing Technique"
in which the user cannot leave a matrix until he
makes a selection from each of the columns. This
technique ensures c'Ompleteness of the message by
forcing the user to remain on the present drug
matrix until all three selections are made, for example, "600 Mg-PO, Q4H, PRN PAIN" (600
milligrams by mouth every 4 hours as indicated
for pain). Although users can be trained to use
this technique, any condition in which the system
does not respond to the user leads to frustration
and confusion. In this case, if the user attempts
to leave this matrix without completing his order
it is desirable to display a message informing hi~
of his omission.
Narrative generation is exemplified by the Arteries matrix in Figure 5, yhich is part of the system developed by Uber and Baker for reporting
roentgenographic findings of the blood vessels
(angiograms) of the head. An experienced neuroradiologist can use this matrix for generating
such -statements as "LEFT DISPLACEMENT OF
THE ANTERIOR CEREBRAL ART E R Y,

OrganizatiQn and FQrmatting Hierarchical D·isplays

225

in wQrds that are n'Ot present 'On the matrix fr'Om
the consQle. If the applicatiQn requires it, it is
PQssible tQ pr'Ohibit type-in entries and tQ restrict
sequences 'Of entries tQ thQse that are syntactically
CQrrect. This CQuid be dQne either by m'OdificatiQns 'Of the "FQrcing Technique" 'Or by displaying
'Only thQse entries that are cQrrect. This apprQach
has prQved useful fQr 'On-line prQgramming in
systems such as, AESOP.1. In a prQgramming
language such as COBOL, the key w'Ords such as
BEGINNING-FILE-LABEL CQuid be single entries. N ames 'Of variables CQuid be typed in 'Once
and subsequently selected frQm lists.
DISCUSSION
Figure 5.-Arteries matrix for neuroradiologic reporting.

MARKED ELEVATION OF THE CALLOSOMARGINAL ARTERY, AND DILATATION OF
THE MIDD·LE MENINGEAL ARTERY. DEPRESSION OF THE SYLVIAN TRIANGLE."
The system is ab'Out half as fast as dictatiQn.
A second example 'Of narrative generatiQn is
frQm the ,medical histQry entry system repQrted
by Kiely and assQciates.a The matrix (Figure 6)
exemplifies the use 'Of the digital keyset. A typical phrase relating tQ severity 'Of chest pain is
"MILD AT ONSET, VARIABLE PAST 2
MONTHS, and SEVERE AT PRESENT."
In bQth 'Of these examples 'Of narrative generatiQn, the user is free tQ select the entries in any
, sequence he desires ..He may, if he wishes, type

The art 'Of designing man-machine systems is still
in its infancy. List selectiQn terminals, by placing
the 'Output burden 'On the data system, are able to
increase the input rate that an untrained uS,er
can achieve. By SQ dQing, terminal 'Operati'On is
made feasible fQr a much brQader class 'Of users.
SQ far this apprQach has prQved useful in applicati'Ons in which the vQcabulary is limited tQ several
hundred w'Ords. We are just beginning tQ devel'OP
the aut'Omatic f'Ormatting prQcedures that will expedite the design 'Of the next generatiQn 'Of matrices. The potentials 'Of inf'OrmatiQn systems that
adapt tQ the user's reSPQnse patterns are yet t'O
be realized. T'O the retriever, this appr'Oach 'Offers
the ability tQ c'OntrQI the quality 'Of the data at the
time that they are entered with'Out, we hQpe, placing an undue burden 'On the enterers. (FQr 'Other
experIments with 'On-line terminals see the paper
by DQuglas C. Engelbart elsewhere in this Proceedings.) AlthQugh we have been heartened by
'Our limited successes in' facilitating man-machine
cQmmunicatiQn, we have at the same time been
humbled and challenged by 'Our ignQrance 'Of hQW
a dialQgue shQuld be structured, hQW we shQuld
m'Old the machine t'O fit the man. It is perhaps in
this area that the next advances will be made.
ACKNOWLEDGMENTS

Figure 6.-Severity matrix for medical history.

We thank 'Our c'Olleagues 'On the MaYQ Medical InfQrmatiQn System PrQject and in the Lockheed
and MayQ 'OrganizatiQns fQr their help. These experiments WQuid nQt have been possible withQut
the dedicated effQrts 'Of 'Our pr'Ogrammers, Miss
Ruth ShQrt and Mr. David C. Schrantz, b'Oth 'Of
whQm have made substantial cQntributiQns tQ this
WQrk.

226

Fall Joint Computer Conference, 1968

REFERENCES
1 E BENNETT E CHAINES J K SUMMERS
AESOP: A prototype for on-line user control of organizational
data storage retrieval and processing
AFIPS Conference Proceedings Vol 27 Part I 435-455 Spartan
Books Washington DC 1965
2 R G SIEKERT B L HISEY P E WILLIAMS G TUBER
A video terminal/light-pen device for ordering medical tests
JAMA In Press
3 J M KIELY J L JUERGENS B L HISEY
PEWILLIAMS

A computer-based medical record: Entry of data from the history
and physical examination by the physician
JAMA 205: 571-:-576 August 191968
4 GTUBER HLBAKERJR
System for recording neuroradiologic diagnoses in a computer
Radiology In Press
5 WDFULLER
Physician-machine interface in a hospital information system
Proceedings of 8th National Symposium on Information Display May 24-261967 pp 111-122
6 DAHUFFMAN
A method for the construction of minimum-redundancy codes
Proc lnst Radio Engineers 40:1098-1101 September 1952

Projections of lllultidimensional data for use in
man-computer graphics
by THOMAS W. CALVERT
Carnegie-Mellon- University
Pittsburgh, Pennsylvania

INTRODUCTION
The utility of man-computer graphics as an engineering
design tool is now well recognized. 1 With the use of an
interactive visual display it is possible for a designer to
input information graphically or digitally, observe the
results of his input and then modify his data to achieve
a more satisfactory result. By using preprogrammed
subroutines the designer can quickly perform quite complex manipulations on data and observe the result.
Unfortunately, this very powerful design tool, which
allows a designer to use both sophisticated mathematical techniques and his own intuition has found little application to a class of problems where the data are essentially multidimensional. Typical problems of this class
jnclude:
a) signal design where a signal js represented as a
point in a multidimensional space of time or frequency samples,
b) controls ystem design where systems are described by multidimensional state vectors, and
c) pattern recognition where pattern feature vectors are multidimensional.
Although in a few cases, it may be possible to obtain
a useful graphical representation of multidimensional
data with an orthogonal projection onto two dimensions,
in general this is not feasible. This paper presents a
method of obtaining a meaningful two dimensional representation which can be applied to a wide class of problems.
Projections of multidimensional data

Multidimensional data can be represented as a collection of vectors. Consider m vectors each with n dimensions say XI, X2, ••• , x m • These might represent points
on a hyperobject (e.g., vertices of a hypercube), feature

vectors describing patterns or state vectors of control
systems. The n-dimensional vectors can be projected
into a two-dimensional space by a linear transformation
e.g. y = T'x (prime denotes transpose) where y is a twodimensional vector, and T is a matrix with n,rows and 2
columns

then Yl = x .

tl

Thus tl and t2 are two basis vectors for the two-dimensional subspace. It will be seen that there are an infinite
set of choices for T, some of which may give a useful
representation of the data and most of which will not.
Perhaps an obvious transformation to try is that where
tl and t2 are chosen to be orthogonal and to represent the
data with minimum mean square error. These can be
calculated by finding the eigenvectors of a grammian
matrix. 2 Define a mean vector
1

p, = -

m

and matrix X (nxm)

=

m

LXi
i=l

[(Xl - p,), (X2 - p,), ... , (Xm

-

p,)].

Then the grammian matrix G for the data is

G (nxn)

= XX'.

The eigenvalues Xj and eigenvectors Uj for j = 1, ... , n
are found by solving GUj = XjUj. The basis vectors U 1
and U2 corresponding to the two largest eigenvalues XJ
and X2 give the transformation which projects to a plane
with minimum mean-square error. An example of this
227

228

Fall Joint Computer Conference, 1968

projection is shown in Figure 1 where a four-dimensional hypercube is projected to two-dimensions. Most
observers find this projection of a simple hyperobject
through a modest decrease in dimensionality too difficult to interpret.
.
This problem has been studied by N 0113 who used perspective projections to produce two slightly different
displays side by side. When these displays were viewed
appropriately a stereoscopic effect was obtained, so that
the observer could obtain a three dimensional impression of the four-dimensional hypercube. Noll's interesting results included the effects of rotating the hypercube. They showed that it was possible to obtain some
intuition about a hyperobject from perspective projections if the original dimensionality was four, but that
for hyperobjects of five or more dimensions the displays
became confusing.

)(

)(

)(

)t

~

"Pseudo" projections
From the above discussion it seems clear that it would
be desirable to have some "pseudo" projection from
multidimensional space to two dimensions where the
only requirement is that result be meaningful and easy
to interpret. No such technique can possibly give a complete representation of n-dimensional data in two dimensions. However; in another context, Shepard and
Carro1l4 have developed an approach which gives poten-

,~

___l

~l(

~

y.~

~

~YO

I~~

FIGURE l-Orthogonal projection of a 4-dimensional hypercube.
(Vertices are indicated by an "x" and cube edges are shown).

YO

~

FIGURE 2-Pseudo projection of a 4-dimensional hypercube.
(Vertices indicated by an "x" are slightly displaced so that cube
edges can be added).

tially useful results. Their method consists of "unfolding" hyperobjects into two-dimensions by maintaining
the interrelationships between points which were originally close together. The application of this technique to
a four-dimensional hypercube is illustrated in Figure 2.
Another example, which has been taken from Shepard
and Carroll is shown in Figure 3 where points originally
on a three-dimensional torus embedded in four dimensions are shown unfolded into· two dimensions. It is
claimed that this method is useful since a point in the
new two-dimensional space bears approximately the
same relationship to its neighbors as it did in the original space. Thus local interrelationships between points
can be studied, conveniently. Since unfolding a hyperobject involves "cutting" it open, points on the edge of
the two-dimensional representation may originally have
been neighbors to points on the opposite edge of the display (c.f. two-dimensional projections of the world).
Shepard and Carroll's method, which was developed
to study psychological data, depends on maintaining
"continuity" between the original and the new space.
This is done by minimizing a criterion function K which
is defined as

K=

Projections of Multidimensional D'ata

=

where i,j

229

1,2, ... ,m are the points defining hyperobject,

d ij = distance from point i to point j in original n-dimensional space,

D ij = distance from point i to point j'in new
two-dimensional space,
S = normalizing function to ensure K does not
depend on scale of D ij,
W ij = weighting function to ensure neighboringpoints (i.e., shortest distances) have
most effect on K.
I t will be seen that K has an absolute minimum when

di~,
D is constant for each pair of points.

In general this

~)

will not be possible if the dimensionality of the new
space is less that that of the original, and a constrained
minimum will result. The procedure starts with an arbitrary set of m points in two-dimensions and uses gradient methods to iteratively move each point to minimize K. The weighting function W i~ is chosen to decrease with interpoint distance so that neighboring
points tend to maintain their interrelationships in the
new two-dimensional space. Satisfactory results have
111
been obtained with W ij = D i ), , D2 ,.' and :oa "
1)

FIGURE 3(a)-An example from Shepard and Carroll.' A threedimensional torus embedded in four dimensions.

With W ij

=

')

Dl..2 the expression for K becomes
1)

Lij
K~[

Lii

dir

Dij2
1 ]'

Dil

The algorithm to minimize this function can be efficiently implemented, and has been ~sed as a subroutine
with an interactive graphic display system. The dimensionality of the original space has little effect on the
computation since the di/s are only calculated once.
The efficiency is mainly determined by the number of
points m since there are m (m-l)/2 interpoint distances.
A n application to pattern recognition

FIGURE 3 (b)-Two dimensions.

Patterns are generally described by n-dimensional
feature vectors.2 It is a serious problem to choose a good
measurement system and to extract from the measurements an efficient set of features so that patterns belonging to different categories are easily classified. Although mathematical techniques are available to test
whether classes of patterns are separable on a given set
of features, the techniques give little intuition as to

230

Fall Joint Computer Conference, 1968

which features should be changed if categories cannot be
separated. Thus any graphical display system which
gives some indication of interrelationships between pattern classes can be useful in designing feature extraction
systems.
In principle the approach described above could be
applied directly. Suppose there are PI examples of class
1, P2 of class 2, and so on up to Pr of class r, then the
r

total number of feature vectors is m =

L:

Pi. Un-

i=l

fortunately this is typically quite large (80 in an example below), and the procedure becomes very inefficient. A more efficient approach is to represent each
of the r pattern classes by one or more representative
feature vectors. This can simply be the mean feature
pi

vector for each class,

Zi

= L'

Xij

where

Xij

is the jth

j=l

example feature vector of class i. If the classes are
multimodal, this can be detected and each mode
represented by its mean. Then the class representatives
Zi, i = 1, 2, ... , r are projected into two dimensions as
described above.
A two-dimensional display of class means is interesting in itself, but it is also useful to display all examples
of each class. A transformation from the original n-dimensional space to two dimensions can be obtained by
applying linear regression to the class means. Let.
Z (n%r) = [ZI, Z2, ••• ,Zr] represent the original class
means and let Y(2%r) = [Yl, Y2, ... , Yr] represent the new
class means in two-dimensional space. Then the wellknown linear regression approach gives Y = T Z where
T = Y (ZZ') -1 Z' if ZZ' is nonsingular or more generally
T = Y Z+ if Z+ is the generalized inverse of z.e
This approach is a compromise between the "psuedo"
transformation which "unfolds" the hyperobject described by class means and a linear transformation
which linearly projects members of each class about
their means. That satisfactory results can be obtained
is shown by the examples below.
This technique was applied to data obtained from
hand drawn characters. There were 8 examples of each
of the 10 digits from 0-9. These were drawn on a 4 X 5
grid and 20-dimensional data resulted. Thus r = 10,
n = 20, PI = P2 = ... = PI0 = 8 and m = 80. TheresuIts of the pseudo projection are illustrated in Figure 4.
If this diagram is studied it will be seen that some
classes were linearly separable and all others could be
linearly separated with only one error each. Thus the
original features were quite useful, but could be refined
by changing the measurement. scheme and observing
the new display to see if the classes were more separable.
An orthogonal projection to minimize the mean square
error (as described above) resulted in a display with
several classes completely overlapping each other.

FIGURE 4-Pseudo projection of hand-drawn character data.
There are ten categories (digits 0, 1, ... ,9) and eight examples of
each. The original data were 20 dimensional. Class boundaries are
added for clarity and points falling outside the boundaries are
surrounded by a square.

Another example involves data from what might be
described as a speaker recognition experiment. (In fact,
this was not the motivation, and the data resulted from
research into synthetic spelled speech used in a reading
aid for the blind.) The data consisted of 4 examples of
each of the 5 subjects making the same sound at the
same pitch. The features describing each speaker were
the amplitudes of the first 24 harmonics of the fundamental frequency. Thus r = 5, n = 24, Pl = P2, = ...
= P6 = 4 and m =. 20. The results are illustrated in
Figure 5. It can be seen that the speakers are linearly
separable on these features and in addition some judgment can be made as to the differences and similarities
between the speaker's voices.
DISCUSSION
The examples described here show that it is often possible to obtain useful two-dimensional representations
of multidimensional data. For research on pattern recognition the procedure described has been implemented as a subroutine in ALGOL-20. It is used in connection with the Philco graphic display "SCOPES" connected on a time-shared basis to Carnegie-Mellon
University's CDC G-21 digital computer. It has already been found that with this "pseudo" projection
technique it is possible by a man-machine interaction to

Projections of Multidimensional .Data

231

approach should enable a number of other problems involving multidimensional data to be solved more simply by use of a computer and an interactive visual display.

ACKNOWLEDG l\1ENTS
The author wishes to thank W. D. Strecker for provid':'
ing the data used in the speaker recognition example.

S2

REFERENCES
1 MDPRINCE
M an-computer graphics for computer-aided design

Proc IEEE vol 54 pp 1698-1708 Dec 1966
2 FE HOHN
Elementary matrix algebra

Macmillian Co New York 1958
3 AM NOLL
A computer technique for displaying n-dimensional hyperobjects

Comm ACM vol 10 pp 469-473 August 1967
4 R N SHEPARD J D CARROLL
Parametric representation of nonlinear data structures

FIGURE 5-Pseudo projection of speaker recongition data.
There are five subjects (S1, ... , S5) and four examples of each.
The original data were 24 dimensional. Class boundaries are added for clarity.

Proceedings of International Symposium on Multivariate
Analysis ed by P R Krishnaiah Academic Press N ew York
1966
5 N JNILSSON
Learning machined'

efficiently investigate a wide set of features for a number of pattern recognitjon problems. It appears that the

McGraw-Hill New York 1965
6 L A ZADEH C A DESOER
Linear systems theory-The state space approach

McGraw-Hill New York 1963

The on-line firing squad simulator*
by R. M. BALZER and R. W. SHIREY
The RAND Corporation
Santa Monica, California

INTRODUCTION

Problem statement

The purpose of this study is to investigate man/machine interaction in the context of solving a conceptually difficult, formal problem. We want a problem
that requires no specialized knowledge, so that a fair
comparison can be made between computer-aided and
unaided attempts at solution. We also want a problem
that is graphic. The firing squad synchronization problem satisfies these criteria extremely well. It has the
added advantage that no optimal solution has yet been
produced.
The system designed for these purposes is essentially
a collection of problem-solving aids that can be divided
in~o three main groups: the first includes bookkeeping
aids, useful displays of information, ability to get hard
copy, and other basic services; the second, means for
testing and simulating solutions; the third, specialized,
high level heuristic aids for creating solutions. All three
groups attempt to extend the user's power in exploring
the universe of the problem, enabling and encouraging
him to approach the problem in ways that might otherwise be prohibited by immense amounts of necessary
hand calculations or the human tendency toward error.
We hope that this system will result in interesting
new solutions to the firing squad problem, and will provide new information on the reactions of humans in such
man/machine interactive environments.
We begin by stating the problem and noting some
of its inherent difficulties. Next, we discuss the necessary tasks for solving the problem, and then go on to
show how and why some of these tasks should be automated. Tlien, finally, we make general recommendations concerning the design of similar computer systems,
based on the experience gained while constructing this
one.

This Memorandum concerns a problem publicly
first presented in 1964 by E. F. Moorel :
The problem known as the firing squad synchronization problem was devised about the year 1957 by
John Myhill, but so far as I know the statement of
the problem has not yet appeared in print. It has
been widely circulated by word of mouth, and has
attracted sufficient interest that it ought to be
available in print. The problem first arose in connection with causing all parts of a self-reproducing
machine to be turned on simultaneously. The.problem was first solved by John McCarthy and
Marvin Minsky, and now that it is known to have a
solution, even persons with no background in logical design or computer programming can usually
find. a solution in a time of two to four hours. The
problem has an unusual elegance in that it is directly analogous to problems of logical design, systems design, or programming, but it does not
depend on the properties of any particular set of
logical elements or the instructions of any particular computer. I would urge those who know a solution to this problem to avoid divulging it to those
who are figuring it out for themselves, since this
will spoil the fun of this intriguing problem.
Consider a finite (but arbitrarily long) one dimensional array of finite-state machines, all of which are
alike except the ones at each end. The machines
are called soldiers, and one of the end machines is
called a generaL The machines are synchronous,
and the state of each machine at time t + 1 depends on the states of itself and of its two neighbors
at time t. The problem is to specify the states and
transitions of the soldiers in such a way that the
general can cause them to go into one particular
terminal state (i.e., they fire their guns) all at
exactly the same time. At the beginning (i.e,.

*This research is supported by the Advanced Research Projects Agency under Contract No. DAHC15 67 C 0142. Any views
or conclusions contained in this Memorandum should not be
interpreted as representing the official opinionor policy of ARPA.

233

234

Fall Joint Computer Conference, 1968

t = 0) all the soldiers are assumed to be in a single
state, the quiescent state. When the general undergoes the transition into the state labeled "fire
when ready," he does not take any initiative afterwards, and the rest is up to the soldiers. The signal
can propagate down the line no faster than one soldier per unit of time, and their problem is how to
get all coordinated and in rhythm. The tricky part
of the problem is that the same kind of soldier with
a fixed number K of states is required to be able to
do this, regardless of the length n of the firing
squad. In particular, the soldier with Kstates
should work correctly, even when n is much larger
than K. Roughly speaking, none of the soldiers is
permited to count as high as n.
Two of the soldiers, the General and the soldier
farthest from the General, are allowed to be slightly
different from the other soldiers in being able to act
without having soldiers on both sides of them, but
their structure must also be independent of n.
A convenient way of indicating a solution of this
problem is to use a piece of graph paper, with the
horizontal coordinate representing the spatial position and the vertical coordinate representing time.
Within the (i, j) square of the graph paper a symbol
may be written, indicatiug the state of the ith soldier at time j. Visual examination of the pattern of
propagation of these symbols can indicate what
kinds of signaling must take place between the soldiers.
Any solution to the firing squad synchronization
problem can easily be shown to require that the
time from the General's order until the guns go off
must be at least 2n-2, where n is the number of
soldiers. Most persons solve this problem in a way
which requires between 3n and 8n units of time,
although occasionally other solutions are found.
Some such other solutions require 5/2n and of the
order of n-squared units of time, for instance. UntH
recently, it was not known what the smallest possible time for a solution was. However, this was
solved at M.I.T. by Professor E. Goto of the University of Tokyo. The solution obtained by Goto
used a very ingenious construction, with each soldier having many thousands of states, and the solution required exactly 2n-2 units of time. In view of
the difficulty of obtaining this solution, a much
more interesting problem for beginners is to try to
obtain some solution between 3n and 8n units of
time, which as remarked above, is relatively easy
todo.*
*Ref. 1, pp. 213-214.

Goto's solution 2 apparently has not been published.
However, Abraham Waksman 3 has found a 16-state
minimal-time solution using essentially the same ideas
presented in the next section. P. C. Fischer 4 has also
used these ideas in discussing other properties of onedimensional iterative arrays of finite-statemachines. The
best solution to date is R. M. Balzer's Ii 8-state minimal-time solution.
Common approaches and basic considerations

The firing squad synchlonization problem can be
solved by successively subdividing the. line into any
number of equal parts, then subdividing each of these
parts similarly, and so on, until all the members of the
line become division points, at which time they all fire.
Most existing solutions use this technique, and it can
provide solutions of minimal time, 2n-2. Balzer's solution Ii divides the line into halves, quarters, eighths, etc.
Finding a solution entails construction of a finitestate machine by defining for the machine a transition
function that yields appropriate behavior when placed
in the iterative array. Although automata are usually
defined by state tables, here it is easier to interpret a
function as a set of rules called productions. These rules
take ihe fotm
LMR~S.

This rule states that if, at time t, a machine is in state
M, and the machine on its left is in state L, and the machine on its right is in state R, then the machine's state
at time t + 1 is S. We call S the "resultant" of the prow
duction.
In particular, we are concerned only with minima]~
time solutions. To treat the problem resulting from the
soldiers at each end of the line, we use an additional
state as an end marker, and, at each end of the line, a
virtual additional machine which forever remains in the
marker state. Since no other machine is ever in them arker state, a single set of productions can be defined fOJ all
machines in the array.
Exhaustive search for the function is out of the question, even with the help of a computer, because the
number of possible state tables is far too large. For example, if we seek a solution with ten states (plus the end
marker), there will be 93 + 2.92 - 2 = 889 productions.
(The problem statement excludes certain productions
and fixes the resultant of two others.) Each of the 889
productions can assume ten values, for a total of 10889
functions.

Solution by hand
While building a function, say with ten states, the

-The On-Line Firing Squad Simulator

experimenter faces a number of separ~te tasks-some
routine, some challenging, many time-consuming and
tedious. He obviously must maintain a large production
table. Given some table, perhaps only partially completed, he will need to test it on firing squads of different
lengths. This simply involves retrieving values from. the
table and copying them onto graph paper. Both tasks
are routine; nevertheless, performing them will consume much of the experimenter's time.
After several attempts, he may discover that someproductions are more important than others, that they are
keys to the solution, and he might wish to mark these in
order to remind himself that their values should not be
altered without special consideration.
The challenging tasks are the creative ones, and the
foremost of these is the creation of ingenious approaches
to the problem. These schemes usually appear as a twodimensional plan for propagation of signals along the
squad through time. One method for simultaneously
implementing and testing an approach is to draw on the
graph paper a skeleton diagram of the intended function behavior, and then force the productions to conform to this plan. This method of defining productions
eliminates many false steps.
Special cases arise when the squad is quite short, say
less than fifteen men. After a large portion of the production set is defined, especially key productions, and
the function has been tested on longer squads, exhaustive search may become feasible for filling in the special
productions required for these cases.
If an error occurs in a simulation, such as a soldier
firing too early or too late, or if contradictions arise
while attempting to fit productions to a behavior skeleton, some production must be changed. The experimenter then becomes interested in why be originally made
this definition. Therefore he finds it useful to keep a history of production usage, particularly a table of first
usages in the simulation he is currently considering.
In all these tasks there is a high probability of human
error due to the large size of the tables, the large number of separate acts to be performed, and, of course, the
repetitious nature of most of the work.

Solving with computer aids
The mechanically repetitious nature of some tasks
naturally leads to thoughts of automating them-providing computer aids for the experimenter. The obvious
candidates for automation are those tasks which primarily consist of information storage and retrieval, su~h
as table maintenance and simulation. Exhaustive
search, where feasible, is handled best by a computer.
Having provided these basic services, other more
sophisticated tools become possible as well. Finally, the

235

graphic nature of both the problem and the methods
previously described influences the choice of computing
hardware; graphic input and output quickly come to
mind.
The use of interactive graphic equipment is implied
because the reactions of humans to a computing system
are highly important. A rapid interaction between man
and machine tends to stimulate the intuition and perceptivity of the experimenter; immediate response from
the machine maintains a high level of human cerebral
activity. Just as not having cOIIlPuter aids at all, using
them off-line would slow the response from a second or
less to hours. Progress might become so slow that the user
would lose interest in the problem.

Summary remarks on the problem
Let us summarize the above discussion-of the problem and the comparison between attempts at solution
with and without computer aids-in order to draw some
conclusions about the value of this study.
The problem is interesting enough to have attracted
wide attention, but difficult enough that no optimal solution has been demonstrated. It requires no special
background, and is simple enough that at least an inefficient solution can be found by hand in a few hours.
Conversely, it is rich enough to suggest a computer implementation of a number of tools and techniques to aid
the investigator. Also, it is naturally oriented toward
the use of interactive graphic hardware.
Furthermore, since exhaustive search for a solution
is not practical, the computer aids are only tools, and
the user still must provide the creative insights and
approaches necessary to finding a solution. Thus, the
firing squad synchronization problem is a particularly
suitable vehicle for evaluating the effectiveness of
interactive, graphical problem-solving aids by comparing their effects with the results of unaided efforts.
The system in general

The Firing Squad Synchronization, Simulation and
Solution System (FS5) is a highly interactive, graphical
computer system. It furnishes three basic groups of
tools: the first includes bookkeeping for tables; the
second deals with simulation and testing; a third contains the more sophisticated tools, including the ability
to draw and implement a skeleton plan, request exhaustive searches, and other functions not obviously needed,
but included on the basis of experience with the problem.
Associated with these three main categories is a corona
of minor devices (e.g., for obtaining hard copy of displays).

236

Fall Joint Computer Conference, 1968

Hardware, software and interaction
The FS5 program is written in IBM system/360
PL/I language and runs on an IBM System/360Model
40. A user communicates with the computer via a
RAND TabletS in conjunction with an IBM 2250
cathode ray tube (CRT) display. The tablet hardware
consists of a horizontal 10.24-inch-square writing surface and a pen-like writing instrument, together having
a resolution of 100 lines per inch along both Cartesian
coordinates.
As the user moves the stylus near the tablet surface,
a (hardware generated) dot on the CRT follows the
stylus motion; this direct feedback helps the user to
position the stylus for pointing or drawing. When he
presses the stylu5 against the tablet writing surface, a
switch in the stylus closes, notifying the computer that
the user is beginning a stroke. As he moves the stylus
across the tablet, the stylus track is displayed (via
software) on the CRT; the stylus thus seems to have
"ink." When the stylus is lifted, its switch is opened
notifying the computer of a stroke oompletion, and
"inking" ceases. A user may "point" at an area on the
CRT by closing and opening the stylus switch on the
corresponding area of the tablet surface.
The FS5 program uses a set of graphics subroutines
written at RAND and called the Integrated Graphics
System (IGS). Both character and geometric pattern
recognition are included in IGS 7. A character written
by the user is replaced on the display by the corresponding machine-generated character.
The FS5 system presents the Usel with a picture of a
contlol panel (Figure 1). The controls are used as if they
were physical buttons; they are "pushed" by .touching
them with the stylus. Problem information is displayed
in three main areas. On the left, FS5 shows the simulations of firing squads from length one to length 25.
On the right, there is a scroll display of productionusage history. At the top center, FS5 offers a variety of
messages concerning its own use and status. The use and
function of the controls are described in the following
sections.

Number of states and external state names
Suppose an experimentel wishes to search for a 10state solution. He begins by writing "10" in the space
provided:

# OF STATES

/10

For mnemonic purposes, he well find it convenient to
have the states represented by alphabetic characters or
other symbols. For example, he might use acronyms:
"Q" for the quiescent state; "G" for the general; "F"

for the firing state. Thus, after the number of states is
selected, FS5 displays an initial alphabetic choice for
the state names:
STATES

ABCDEFGHIJ

At any time, the experimenter may write over this display to replace these choices by his own.

The message center
If we remove the burden of tedious work only to replace it with a large set of system rules and procedures
to be learned, the experimenter has gained very little.
To avoid this pitfall, FS5 has a MESSAGE CENTER .
which plompts the user on system usage, informs him
of conditions, and suggests actions to take when errors
occur. In other words, FS5 supplies copious run-time
diagnostics.
For example, when the experimenter begins to write
in a value for the number of states, FS5 prompts him
with

ENTER NUMBER OF STATES
SWEEP TO EXIT.
If he begins to reWlite the external state names, he sees

ENTER NAMES OF STATES
1 = QUIESCENT
2 = GENERAL
LAST = FIRING
SWEEP PEN TO EXIT
Furthermore, FS5 guards against such illegalprocedures as trying to enter one of the three reserve state
narnes--"#", ".", "?"- in this case by refusing to acceptthem.
The policy on a user error is to announce it, correct
it and leave the system in a usable condition whenever
possible, or else inhibit further action until the user
makes a correction, and advise him how to do so.

Entry, storage and retrieval of function values
For a 10-state solution, as many as 891 function
values might be needed. As a complication, a large number of productions might be undefined at any given
time. FS5 provides several ways to entel, retrieve and
alteI productions, and takes appropriate aotion when an
undefined production is referenced.
To illustrate, the experimenter may enter a production by writing
DEFINE FROZEN

QQG~G

The On-Line Firing Squad Simulator

successive rows. Because the QGG production is
undefined, simulation will cease at time 2.

If he later wishes to reo all this value, he writes
QQG~?

DEFINE FROZEN

o

and FS5 replaces the "?" by the value; here "G", or by
"." if the produotion is undefined.
Alternatively, the system might have been designed
to display the entire state table upon request. However,
at anyone moment the expelimenter is usually interested in only one produotion. Moreover, many table
entries might never be of interesi, beoause no simulation
needs them.

Q Q Q G
Q Q G G
Q G

1
2
3
4
5

6

F

F

F

Undefined.

F

The message center will contain
ERROR: FUNGNULL & SQAD FREE,

Simple simulation of a firing squad
After defining several produc,tions, the experimenter
will want to test the function on firing squads of various
lengths; FS50fIers several modes of simulation and testing. For a simpie case, suppose that a simulation is desired for length 4. The user enters the "4" with the
stylus:
LENGTH

237

4

and the undefined production will be displayed,
DEFIN'E FROZEN

QGG~

ready for the experimenter to enter a value.
A simulation may be temporarily halted at any time
to check its progress. During these manual stops, FS5
continues to advise on system status; and messages are
also provided for automatic stops.

FS5 responds by initializing the firing squad:

Entering constraints

o

Q Q Q G

1
2
3
4
5

6

F

F

F

F

In addition, the system always provides two productions:

With these simple services at his disposal, the experimenter can turn his attention to finding good solution approaohes. FS5 enables him to enter two-dimensional skeleton plans which really are a set of constraints on the function behavior.
The state at time zero and the constraints at the firing
time are fixed by the problem statement and provided
by the system. To enter other constraints, first the user
touches
DEFINE CONSTRAINT

where" #" represents the end-marker state. These are
the two productions required by the problem statement.
Let us further suppose that the user has entered
QG#

~

G,

QQG;~

G, QGQ

~

Q, and #GQ

~

after which FS5 replies with instructions. N ext, the
user touches two points to define a line segment on the
simulation display, and then a name in the STATE display.

G.
0

He starts the simulation by touching
START SQUAD
Then the message center will display

1
2
3
4

Q Q Q G
G
G
G

Constraint to be entered.

5
6

F

F

F

F

FIRING IN PROGRESS.
Simulation proceeds from time 1 down, left to right on

In other words, a constraint is a line segment of states
which is "drawn" on the display.

238

Fall Joint Computer Conference, 1968

Any number of constraints may be entered, and one
may be drawn over another. The "." 's in the display are
intended as guides in determining straight lines, and FS5
automatically provides other temporary guides and
markers. If an error is made or a change de"sired, the
last constraint entered may be erased:
REMOVE LAST
The ability to enter constraints becomes a powerful
tool when used in conjunction with the simulation
modes described in the following two sections.

Simulation withconstralnts
If the experimenter starts a simulation for length 4
with all productions undefined except for # QQ ~ Q
and QQQ ~ Q, and with the three-position constraint
of the previous example, then FS5 will define the production QQG ~ G from the constraint. However, the
simulation will terminate as shown below because
neither is QG # defined nor is the simulation constrained at the position where QG # is first required.
0

1

Q
Q

2
3

G

4
5
6

F

Q
Q
G

Q
G

G

F

F

F

Defined by constraint
Undefined

The ability to draw large numbers of complicated constraints thus relieves the experimenter of the task of
tailoring many individual productions to produce the
same behavior; all the necessary definitions are made by
the system.
The system also detects contradictions between constraints and previously defined functions. Such an error
would have occurred had the resultant of QQG been set
to Q. These contradictions often escape notice when
simulations are performed by hand.
As an alternative to drawing constraints, a language
to describe them might be devised. However, it is hard
to imagine a language as easy or as natural to use as the
FS.5 method.

Simulation with backtracking
As mentioned above, exhaustive search for a function
might become feasible when relatively few productions
remain undefined. The use of constraints also can make
exhaustive search feasible, because these constraints act
as implicit definitions. To take advantage of constraints
FS5 was equipped with a widely used method of effi-

cient search called the "backtrack" technique. &-10
For readers not familiar with backtracking, or who may
know it by another name, a brief review is in order.
Many combinatorial problems can be stated in the
form, "Find a vector (SI, S2, ... , sm) which satisfies Pm,"
where SI, S2 ... , Sm are to be chosen from a finite set of N
distinct objects, and pm is some property. The "brute
force" approach is to form in turn each of the Nm possible vectors, testing whether or not it satisfies Pm. A
backtrack algorithm is designed to yield the same result with far fewer trails.
The backtrack method consists of defining properties
Pk for 1 ~ k ~ m in such a way that whenever (SI, B2,
... , Sm) satisfies Pm, then (SI, ... , Sk) necessarily satisfies Pk. The computer is programmed to consider only
those partial solutions (SI, ... , Sk) which satisfy Pk; if Pi:
is not satisfied, then the Nm-k vectors (SI, ... , Sk, Sk + 1,
... , Sm) are not examined by the program. When all
choices for Sk are exhausted, the program backtracks to
make a new choice for Sk-l. If the properties Pk can be
chosen in an efficient way, comparatively few cases are
considered.
In the firing squad problem, the vector (SI, S2, ... , Sm)
consists of production definitions. The backtrack
method applied in FS5 serially defines the productions
as they are needed in the simulation of a firing squad
of fixed length n.
The method begins with all productions undefined
except the two required by the problem statement.
After initializing the firing squad for length n, the
program begins to find the new state of each position in the simulation according to the productions
which are already defined. If a production is encountered which is not already defined, and this occurs at an
unconstrained position, then the resultant is set·· to
either the firing state ·or another state, depending on
whether or not this occurs at firing time. If the positiDn
is constrained, the resultant is set to the constraint
value.
The process of serial definition continues until an
error occurs. An error is defined to be either a soldier
going into the firing state before firing time, a soldier
not firing at firing time, of a conflict between a constraint and a production already defined. When an error
occurs, FS5 backtracks to find the most recently defined
production whose resultant is not the firing state, which
is first used where there is no constraint, and for which
all the choices of a resultant have not been exhausted.
All productions defined after this are now undefined,
and this production is set equal to a value which has
not yet been tried for it. The program then returns to
the positiol1 in the firing squad simulation where this
production was first defined, and simulation continues
from there.
The above process of finding the new state of a soldier

The On-Line Firing Squad Simulator
and defining productions as needed is continued until
either a solution is found for length n or else no productions remain which are alterable. In the latter case,
we have tried all possibilities which could lead to a solution for the given length with the given constraints and
a given number of states. Thus there is no solution in
this form.
The e~perimenter can request FS5 to simulate in
"AUTO" mode, in which case backtracking will be applied to any undefined productions which are needed.
Backtrack mode may be used with or without either
constraints or explicit production definitions having
been entered. Simulation will only cease if either a successful function is found or all possibilities are exhausted.

Frozen and free productions
The experimenter can .'freeze" the value of a production
if he wishes to prevent its alteration without his explicit
consent; the key productions are of this nature. Frozen
productions are not altered by any simulation mode.
Hence, a frozen production is another form of constraint
and, if used, may further reduce backtracking effort.
Other productions are termed "free" because the backtracking mechanism is free to alter them.

Snap view and bright positions
While in backtracking mode, it is useful and necessary to view the progress of the simulation. Sometimes
the experimenter can notice an area where much backtracking occurs, and enter explicit frozen productions or
additional constraints to eliminate such bottlenecks.
Furthermore, if the constraints are neither numerous
nor strong, the number of search possibilities could still
be astronomical. In this case, if the experimenter
periodically views the progress of the simulation, he can
decide when it should be aborted.
With the "SNAP VIEW" option "ON," redisplay of
the simulation occurs after each row is completed and
also whenever the system must backtrack. Otherwise
(and in all cases of "STOP" mode) , redisplay occurs only
when simulation terminates. Since a position in a simulation at which a production is first used is of special
interest, all such positions may be brightened by pushing
a button:
BRIGHT
Both features are optional because frequent redisplay
significantly increases running time.

History scroll, freezing and deletion
Although the experimenter may never be interested

239

in seeing the entire production table at one time, he
may have occasion to view significant portions of it. A
scroll display gives him the list of productions used in
the current tenninated simulation, in order of original
usage, and indicates which are frozen.
If production definitions were generated by constraints or backtracking, he might want to freeze some
or discard others. Either can be done by pushing the
appropriate button
FREEZE VALUE
DELETE VALUE
and touching productions on the scroH.

Image solutions
Experience with the problem, and general consideration of the form that any solution must take, led to giving FS5 another heuristic tool, which requires explanation because its motivation is less obvious that that of
other program features.
In any Golution, signals must travel the entire length
of a squad in both directions because the general, before
he can fire, must know that the order to fire has reached
the last soldier on the opposite end of the squad. If the
signal sent by the general is 1, and the signal returned
by the last soldier is 2, then we may think of signal 2 as
being the image produced by the reflection of signal 1
from the end of the squad. In other words, the general
bounces signal 1 off the end of the squad; the imageecho- returns to him as signal 2.
Experience with various solution methods has demonstrated many other instances in which the image analogy is helpful. For example, suppose that we are applying the techniques of successive subdivision, and have
contrived a partial skeleton plan:
0
1
2
3
4
5
6
7

1
1
1
1

2
2

8

2

9

10
11

3
3
3

1

1
1

3
3
3
G
G 4
G

4

G
G
G
G
G
G
G
G
G
G
G
G

240 Fall Joint Computer Conference, 1968
The general emits signal 1, and it travels to the left at
the maximum possible rate of one man per unit of time.
This signal arrives at the end of the squad and produces
an image, signal 2, which travels at the same rate in the
opposite direction.
The general also emits signal 3, and it travels ,at onethird the rate of signal 1. Thus, signals 2 and 3 meet at
the midpoint of the squad and produce the first division
point. This central soldier is then promoted to general,
and the process can be repeated for each of the two
halves.
To repeat the process, the central general sends signal
1 to the left as before, but now a signal 4 is also sent to
the right. 8ignal 4 is intended to behave in the same
manner as 1, except that 4 travels in the opposite direction. 8igna14 is, therefore, an image of signal 1, created
by reflection about the center of the squad.
Images imply that certain symmetries will probably
exist between sets of productions and between pairs of
states. Therefore, an additional heuristic for the problem is to look for solutions having the property that for
every production LMR ~ S, there exists a production.
Image (R) Image (M) Image (L)

~

Image (8)

where the Image function maps the set of states onto itself such that Image (Image (8)) = 8 for all states S.
In F85, if the image-solution mode is selected and the
user defines a proper image mapping, then whenever a
production is defined, the image production is also defined. The image method may be used separately or in
combination with constraints and backtracking. Obviously, the image method also improves the feasibility
of exhaustive search because the number of free productions is again reduced.

Miscellaneous
Other controls allow for reinitializations, for simulation testing over any range of lengths up to 500 men,
and for hard copy of displays and tables.

Implementation experience and prerequisites
Any system like FS5 endeavors to provide the researcher with tools and response time that encourage
and allow him to apply methods of so~ution which might
otherwise be impractical. On the other hand, if the labor
of writing the software' s greater than the hand calculation it eliminates, a researcher finds small en"'louragement. In general, if the cost of building an ·interactive
system exceeds the importance of the problem area, the
system will not be built. Our feeling is that the cost of
F85 is reasonable, and that costs relative to more important problems will be significantly lower.

The requir-ed hardware includes a digital computer, a
CRT display with appropriate graphic input device,
and associated interface equipment. The choice of input
device is crucial to human react on. A light pen is at
best a clumsy pointing instrument, and a typewriter
keyboard with display cursor is an unnatural tool. Had
these been the only devices available, many FS5 features would have been neither conceived nor implemented. An appliance used in the manner of a pencil,
such as the RAND Tablet, is central to the efficacy of
interactive problem-solving systems.
FS5 required three software types, exclusive of programming language and operating system: a graphic
software system (IGS); routines to service displays and
controls; and routines providing non-graphical aids.
IGS allows the user to think globally about displays for
his problem, rather than about intricate hardware and
bit patterns. Routines to generate and manage displays
consist primarily of calls to IGS. Non-graphical routines, such as table maintenance and backtracking,
were no different than they would have been if all output was printed.
Thus the major efforts in writing FS5 were to design
displays and to interface with the existing graphic software. With such high-level languages as PL/I or FORTRAN, and a good package such as IGS, this is not a
very difficult task.
CONCLUSION
An on-line, graphical, man/machine interactive computer system can provide greatly increased research
power over a system lacking these attributes. This is
true even when a problem is not inherently graphical.
Anyone who is planning a computer system to investigate a difficult problem area should consider extending
the design to make it graphical and interactive. Since
most medium and large computer facilities already have
the necessary hardware and basic software, and since
construction of routines to generate and to manage displays is quite simple, the added cost should be very
small compared to the extra utility gained.
REFERENCE
1 EFMOORE
Sequential machines selected papers
Addison-Wesley 1964
2 EGOTO
A minimum time solution of the firing squad problem
Dittoed Course Notes for Applied Mathematics 298 Harvard
University May 1962 pp 52-59
3 A WAKSMAN
An optimal solution to the firing squad synchronization problem
Information and Control Vol 9 No 1 February 1966 pp 66-78
4 PC FISCHER

The On-Line Firing Squad Simulator
Generation of primes by a one-dimensional real-time iterative
array
Journal of the Association for Computing Machinery
Vol 12 No 3 July 1965 pp 388-394
5 RMBALZER
Studies concerning minimal time solutions to the firing squad
synchronization problem
ARPA SD-146 (PhD Thesis) Center for the Study of Information Processing Carnegie Institute of Technology,
Pittsburgh Pennsylvania 1966
'
6 M R DAVIS TOELLIS
The RAND table A man-machine graphical communication
device
AFIPS Conference Proceedings 1964 FJCC Vol 26 Part I
Spartan Books Inc Baltimore Maryland 1964 pp 325-331 also

The RAND Corporation RM-4122-ARPA August 1964
7 GFGRONER
Real-time recognition of hand-printed tezt
The RAND Corporation RM-5016-ARPA October 1966
8 RJWALKER
An enumerative technique Jor a class of combinatorial problems
AMS Proc Symp Appl Math 10 1960 pp 91-94
9 S W GOLOMB and L D BAUMERT
Backtrack programming
Journal of the Association for Computing Machinery
Vol 12 N,) 4 October 1960 pp 516-524
10 MHALLJR DEKNUTH
Combinatorial Analysis and computers
The American Mathematical Monthly Vol 72 'No 2 Part II
February 1965 pp 21-28

MESSAGE CENTER

0
I
2
3
4
5
6
7
8
9
10
II
12
13
14

I

I
LENGTH

I

~

I

I

f OF STATES

20

ABCDEFGHIJKLMNOPQRST

I IMAGES I ABC D E F G H I J K L M N 0

P Q RST

. FIRST OCCURENCE RESPONSES
STOP

IS
16
17
18
19
20
21
22
23
24

I

l_~U.!~_J

NORMAL

L~~~~!_J

DEFINE CONSTRAINT

REMOVE LAST

CLEAR SQUAD
CLEAR CONSTRAINTS

CLEAR FUNCTION
FREEZE VALUE

START SQUAD

DELETE VALUE

STOP SQUAD
PRINT FUNCTION

PRINT SQUAD

2S
26
27
28
29

I

30

EXIT PROGRAM

I
ABC

DEFINE FROZEN

31

FREE

32
33
34

3S
36
37
38
39
40
41
42
43

I

CHECK SOLUTION

I

SNAP VIEW ON

I

SOD

sc.o

D

~

I !~~ ~I~W=~~ = = J

I IMAGE SOLUTION ON I I~G! ~o..':~i2~21i~

....
45
46
47
48

I

I
2S

,

I

241

CONFIRM ACTION

I

FIGURE 1

SCROLL

UP DOWN

I

Interactive telecommunications access by computer
to design characteristics of the
nation's nuclear power stations*
by D. W. CARDWELL
Oak Ridge N aiional Laboratory
Oak Ridge, Tennessee

INTRODUCTION
Computer-aided information storage and retrieval
systems have been pointed to, frequently, as a
means for efficient handling of large masses of
data so that users of such systems can rapidly
find selected specific items with a minimum degree of effort.! In engineering and scientific fields
(except for certain rather specialized areas),
major progress toward such an objective has been
limited to bibliographic sorting of technical publications by keyword· search of authors, titles, or
abstract context. 2 The developme:p.t of a comprehensive system to provide varied users with
access to factual technical data, on a broad basis,
has awaited a need sufficiently important. to warrant the substantial effort required for such an
undertaking.

e
,

II

The remarkable sudden surge, since 1965, in
electric utilities "going nuclear" has placed a
back-breaking burden upon the U. S. Atomic
Energy Commission's Division of Reactor Licensing to fulfill their responsibilities in reviewing
engineering design proposals for each nuclear
power plant to evaluate the adequacy of safety
provisions. Figure 1 (a) and (b) show on maps of
the United States locations of the many large
nuclear power plants now committed for construction as contrasted to the few units that were committed three years ago. In January 1967, the
Reactor Division of the Oak Ridge National
Laboratory, aided by Union Carbide Nuclear Company Computing Technology Center, was com-

CO'-lPLETF.D
UNDER CONSTRUCTION

PROPOSED

eCO~PLETED
!L'NDERCONSTRUCTION

II

PROPOSED

FIGURE 1

missioned to develop a computerized system capable 'Of responding to selective search requests
with readout of factual data to a family of telecommunications terminals used by reactor engi-

*Research sponsored by the U.S. Atomic Engery Commission
under contract with Union Carbide Corporation.

243

244

Fall Joiut Computer Conference, 1968

neering specialists who are engaged in nuclear
power plant design evaluations.
This project was given the acronym label of
CHORD-S to represent "Computer Handling of
Reactor Data-Safety." The CHORD-S telecommunications system became initially operational
during 1968, processing information in certain
technical categories of greatest current int~rest
to the Atomic Energy Commission. Expanding
the data bank volume, improving man-machine
dialogue capabilities, and adding to the number
and versatility of terminals are a continuing operation, each of these activities directed toward
increasing the real value of the system to its
potential family of users.
The CHORD-S information system has been
designed to include the following unique combination of features:
1. Factual technical data organized in ten level
hierarchical structure for input to the Data Bank.
2. Computer input formatted on magnetic
typewriter/converter, to provide
a. Off-line localized verification by originators.
b. Reductions in turn~round time, cost, and
frequency of errors as compared to conventional punchcard input.
3. Multipurpose central computer storage capacity of several hundred million characters, retrievable by rapid random access.
4. Direct access via telephone line from family
of remote terminals, in time-sharing mode, at
distances up to several hundred miles from computer center.
5. CRT display included in terminal capabilities, in addition to conventional telecommunications typewriter.
6. On-line dialogue (conversational mode), employing almost exclusively common English language words, queries, and responses.
7. "Lead-in" program allowing user option of
being guided rapidly by the computer to selected
areas of interest without advance knowledge of
file structure or reference to code books.
8. "Compare" program wherein computer automatically contrasts values of large blocks of design parameters for several power plants to provide "Readout by Exception," only where differences are significant, withholding undesired
alphanumeric data that has no significant value
to user's query.
9. Open-ended file maintenance provisions for

frequent efficient up-dating, additions or deletions.
10. Optional tutorial program wherein computer
gives user step-by-step online instructions for
operation in any of the available modes.
11. Access from terminals to key-worded bibliographic nuclear safety reference files and
computational programs that already reside in
the central computer. These and other residual
resources of the computer serve to enhance the
primary capabilities of CHORD-So
The unprecedented combination of user
oriented features provided by the CHORD-S system, should be applicable to many technical areas
(in addition to nuclear power plants), where
large masses of factual data must be efficiently
searched to yield specific responses to queries
posed by professional personnel who are engaged in sequential progressive activities wherein
real-time output is essential.
System design philosophy

Initial development of design philosophy for
CHORD-S was materially aided by use of hardware plus operating experience available from an
existing computerized (key word bibliographic)
information system that has successfully functioned within the overall ORNL Nuclear Safety
Program since ,1963. That operating system is the
Nuclear Safety Information Center (NSIC).4 By
such direct observations and intensive study of
current reports on other automated information
storage and retrieval systems,5,10 plus knowledge
of the specific needs of potential users, we directed the development of the CHORD-S system
within the following primary guidelines:
1. Queries originated by users must be as free
as practicable from regimented "computereeze"
language and format, with heavy dependence
upon natural language expressions, limited in
number.
2. Potential users cannot afford delays occasioned by manual look up in extensive code
books.
3. For the inexperienced user, computer programmed "lead-in" techniques must be readily
called forth in response to simple commands,
to automatically reveal the contents of file structure and provide rapid guidanc'e to areas of individual interest.
4. For experienced users, optional short-cuts,

Interactive Telecommunications Access by Computer
directed to selected bodies of data, must· be available to avoid unsolicited, time consuming pathfinding.
5. Responses to queries at telecommunications
terminals must be compatible in speed to normal
human sensory perceptions to minimize breakinu
"trains of thought."
6. Data drawn from source material must be
expressed and organized for file entry in fashions
appropriate to conventions prevailing in each
technical category, and be carefully screened to
include only items of greatest significance to potential users.
.
7. File structure in the computer memory must
be flexible and open ended to easily accommodate
frequent additions, revisions, and updating, to
keep pace with changes in the nuclear power industry.
8. Output options to telecommunications consoles should include a capability for rough rapid
scan to reveal highlights of data file, to then be
followed by progressively deeper selective probes
for ultimate retrieval of specific data desired by
indjvidual users.
9. Terminal readout should allow rapid visual
display of information of only transitory value,
accompanied by user control of commands for
producing selective hard copy of printout.
10. Priority should initially be given to obtaining alphanumeric output. The extent. of capability
for graphical, diagramatic, or pictorial type information to be provided must be determined by
evaluation of cost of such features against their
relative worth to users.
11. System hardware and software must be
designed to handle a progressively increasing
number of terminaIs- to the network and have
. flexibility for innovations of an unpredictable nature determined from early experience to be of
practical benefit to users.
12. Selection from the many options available
for long distance communications transmission
must be based on a utility/economy optimization
of several factors such as speed, capacity, reliability, and adaptability to newly developed I/O
devices.
13. Compatibility features for future interface
connection with other information systems being
developed for the U. S. Atomic Energy Commission must be provided whenever logical and practicable.
It was obvious to us that fulfillment of so demanding a set of criteria required a merging of

245

the talents of several specialized disciplines: (1)
computer technologists (software and hardware),
(2) CHORD-S project nuclear information engineers, (3) communications engineers, and (4)
nuclear reactor power plant safety specialists
from potential user organizations. Although it is
always difficult to combine talents of personnel of
contrasting technical backgrounds and interests,
we believe that we have gradually fulfilled most
of that mission. It is our strong belief that the
road to success for a complex computerized information system must be paved by an established
willingness on the part of computer technologists
to understarid and accommodate genuine needs of
potential system users; and those same potential
users must exert significant effort to obtain at
least a surface working knowledge of the capabilities and limitations of computer related hardware
and software. Also, where telecommunications is
to be· employed, practical up-to-date technical
knowledge of current advances in the field of
communications engineering is an essential ingredient. Rather than seeking rare so-called
"generalists" to bridge gaps between the established disciplines, we have depended upon strong
overall leadership guidance, with some forcing to
the extent necessary for acco:rt:lplishing essential
merging of specialties. 11

The man-machine interactive concept
Information storage and retrieval systems, until recently, have been limited mainly to batch
processing of .queries by the computer, requiring
that the user wait an appreciable length of time
between successive sets of data readout. The advent of third-generation digital computers, with
greatly increased capacity and versatility of
hardware and software, have made it feasible for
users to communicate directly on-line with a central computer in essentially continuous conversational dialogue. 12 CHORD,-S provides such canability for reactor specialists who are engaged in
. assessing the design of existing or proposed
nuclear power stations.
For automated on-line information systems to
serve responsible busy professional people, such
systems must possess dominant operational
features that match the natural habits of these
people. 13 We look upon dialogue between user and
the system in a closed loop cybernetic sense. Although the human being in the loop may, for
varying justifiable reasons, be relatively slow in
formulating and entering queries at his remote

246

Fall J'Oint C'Omputer C'Onference, 1968

terminal, he has a right t'O expect intelligent,
efficient reSP'Onses pr'Ovided in a f'Orm and at a
speed m'Ost c'Onductive to his understanding. 1.4
Figure 2 presents an elementary diagram t'O quantitatively emphasize s'Ome 'Of the fundamental
traits of man in c'Onsrast with the capabilities 'Of
digital c'Omputers as they have ev'Olved fr'Om the
first t'O the current third-generati'On machines. The
m'Ost striking difference apparent in this· diagram
is that 'Of speed; as each new generati'On 'Of machines has made its appearance, the magnitude 'Of
this disparity has bec'Ome greater. C'Ommercial
time-sharing c'Omputer systems whereby 20 'Or
m'Ore c'Ons'Oles c'Onverse, essentially simultane'Ously, with a single central c'Omputer have capitalized
'On this difference. Central pr'Ocessing units (CPU)
'Of m'Odern c'Omputers 'Operate at near electr'On
speeds (micr'Osec'Onds and nan'Osec;'Onds) ,whereas
acti'Ons by human beings ar.e limited t'O tenths 'Of
sec'Onds.

In systems such as CHORD-S, users I'Ocated
many miles fr'Om the c'Omputer center depend
UP'On I'Ocal c'Ons'Ole equipment with built-in speed
limitati'Ons as sh'Own, c'Onnected t'O c'Omputer P'Orts
by s'Ome f'Orm 'Of public c'Ommunicati'Ons link.
C'Onventi'Onal v'Oice-grade teleph'One lines are I'Ogically empl'Oyed f'Or such service because 'Of their
ready availability, dependability, and relative
economy.15 As noted in the diagram, data messages are transmitted via 'Ordinary teleph'One lines
at rates 'Of 120 t'O 400 char/sec. Suchc'Onventi'Onal
rates 'Of transmissi'On fix an additi'Onal time limiting parameter 'On the 'Overall system.
In the CHORD-S interactive system where diaI'Ogue flows back and f'Orth rapidly between a user
and the computer, each link 'Of the I'O'OP needs t'O
be 'Optimized in design t'O pr'Ovide time reSP'Onses
appr'Opriate to the key human perceptive senses.
As may be seen ill Figure 2, man's voice is the m'Ost
efficient medium f'Or formulating queries at a

FIGURE 2
TRANSMISSION SYSTEM
A.

B.

C.

His Communication Capabilities
1. Sensing Senses
a. Speech: S-2U charlsec
b. Handwriting: 3-10 charI sec
c. Typing:l-s charI sec
2. Receiving Senses
a. Sight
-Pictorial: Very fast
-Reading: 10-15 charI sec
b. Hearing: Fast
His
a.
b.
c.

Memory Capabilities
Total Storage: Up to (10)15 char
Prompt Recall: 1-10% of total·
Speed of Recall:
-Up to 10% fast; remainder
slow (and inaccurate)

His Psychological Reactions
a. Rational - Likely predictable
b. Emotional - Unlikely predictable

A. Terminal 1/0 Equipment
1. Telecom Typewriter
Printing Speed: 10-15 charlsec
Char/line: 72-156
2. Cathode Ray Tube (CRT)
Display Speeds: 240-100,000
char/sec
Total no. of char:
1,000-4,000
3. Remote Batch Printers
Printing Speed:
600-660 charI sec
B. Telephone Network
1. Voice Grade - Single Channel
Speed: l20-400·charlsec
2. Broad Bank - Multi-Channel
Speed: Up to 23,000 charlsec

MACHINE
(Third Generation Digital Computer)
A.

Central Processing Unit
1. Execution rate 106_l0B
2. Memory cycle time:
Microsec to nanosec
3. Core memory capacity:
10(10)3_10(10)6

B.

Peripheral Storage
1. Access Speed: Up to
300(10)3 char/sec
2. Capacity:
Up to 1.~(10)9 char

Interactive Telecommunications Access by Computer
terminal. Although rapid advances are currently
being made in voi.ce communication with computers, we have concluded that, except for limited
vocabularies, such an approach is not yet ready
for broad exploitation. This leaves only man's
sense of touch for initiating communications,
which usually is applied by operation of a typewriter keyboard, an inefficient avenue for self expression by most technical people. Handwriting
is usually more rapid than typing, and for some
circumstances that medium ("Rand tablet," etc.)
is used for computer input, although it may not
now be practical for application to a broad data
base system, such as CHORD-So The most encouraging development for speeding up manual
direction of computer operation involves the use
of a Jight pen, or cursor, to select from computer
generated cathode ray tube (CRT) displays
items for further exploration. 16 Also, CRT terminals, when of the vector type, can display on
screens complex graphical output, a form of
communications very effective in appealing to
man's facutly for quick pattern recognition. 17 In
any event, it has been clear that terminals for
the CHORD-S interactive system should require
mInImum amounts of input from the user to
eliminate excessive tedious efforts by amateur
typists.
It has been obs,erved18 that for psychological,
as well as for practical reasons, technical personnel seeking on-line responses from the data bank
become impatient and dissatisfied whenever the
time between the end of their query and the beginning of response extends beyond a few seconds.
For the system to be acceptable, readout at the
terminal should approach the rate for natural
efficient comprehension by the user. Comprehension, at present, depends almost solely upon the
human's exercise of vision accompanied by his
mental reaction, which, depending upon the complexity of the information received, is fairly
rapid. Consequently the speed, format, size, etc.,
of visual display provided at the terminal is
closely related to user acceptability, and hence
the success of the system.
In addition to man-machine considerations
given to terminal hardware ·characteristics, the
ease of entering CHORD-S queries and obtaining
useful rapid responses from a computer is highly
dependent upon the degree of naturalness of terminal language employed for information exchange. 19 The development of a terminal language
for CHORD-S has included involved original ideas

247

as well as ideas found to have been successful in
other IS&R systems. Opportunity to use the CTC
IBM 360/50 general purpose computer for initial
operation of the CHORD-S system has presented
advantages in early availability of equipment with
basic telecommunications and operational programming. However, in order to pursue the theme
of optimum man-machine response throughout
the entire l<;>op, considerable ingenuity has been
necessary in the development of special CHORD-S
programming to assure compatibility with fixed
features of the computer center.
In addition to accommodating form and speed
of dialogue considerations: we have extrted considerable effort to make certain that users are provided with built-in programming options that always allow them full control over any decision
making processes that they wish to exercise. This
minimizes any chances of the automated system
"jumping to unwarranted conclusions."

Functions of the information network
A general layout of the CHORD-S system as an
information storage and retrieval network is
shown in Figure 3. The following steps are followed by CHORD-S project personnel to establish
flow of information between sources and users of
the system:
1. Technical data are primarily drawn from

documentary material that has been prepared by
nuclear reactor power plant designers and operators for license application submitted to the U. S.
Atomic Energy Commission. Auxiliary informa-

FIGURE 3

248

Fall Joint Computer Conference, 1968

tion of pertinence comes from other sources such
as those shown on the diagram.
2. Reactor specialists originate standardized
power plant system characteristics listings of
greatest significance to nuclear safety with specific data for each plant organized systematically
for efficient computer handling. The multi-hierarchial structure of the data file demands that
careful attention be given to recognizing logical
technical relationships between major headings
and successive sublevels as items of information
progress from the general to the more specific.
Examples of data retrieval, to be given later, will
show how this type of file structure· when intelligently organized for input, off·ers users an 'Opportunity to obtain readouts that collectively encompass spans of subject matter individually selfsufficient in the evaluation of specified areas of
engineering design.
3. Technical and clerical personnel, with the aid
of automated magnetic tape typewriter equipment
(IBM-MT/ST with Digidata Converter), 20 structure reactor data in standardized formats, producing at the point of origin, magnetic tapes suit~
able for direct entry into the computer, eliminating keypunching. Where prime responsibility for
originating complete and accurate file additions
resides with individual technical specialists, there
is considerable advantage in applying this newly
developed data entry technique because it provides centralized capability for rapid and efficient
off-line verification.
4. Data on reels of seven-track magnetic tape
are entered and stored in the memory of the IBM
360/50 computer at the Oak Ridge Computing
Technology Center (CTR) 21 by means of special
programming developed by CTC specialists. The
basic Data Bank is built as an over-night batch
operation, on-line input from remote terminals
being· unnecessary. Output of data at the computer center. can be obtained whenever desired as
a batch processing operation from several conventional types 'Of readout devices as shown in Figure
3. Such batch output may be a partial file dump for
checking the accuracy of updating operations, or
it may be a selected set of engineering data considered too lengthy for efficient remote terminal
readout. Ports providing interactive access to the
CHORD-S Data Bank from remotely situated terminals are indicated in the diagram' by symbolic
telephone lines emanating from the computer
center.
5. A representative operating telecommunica-

tions terminal is shown at the lower left of Figure
3 time sharing with other terminals. Meaningful
conversational exchanges via telephone line between terminals and the central computer employ
query and response techniques developed jointly
by CTC programming personnel and ORNL reactor engineers. As' illustrated in Figure 3, a telecommunications typewriter transmits queries, and
prints at a rate of 15 char/sec output data selected
for preservation in hard copy. An alphanumeric
CRT console provides rapid (up to 200 char/sec)
visual display of transitory output information.
(Rapid responses displayed by the CRT hasten
progressive dialogue up to the point of obtaining
ultimate search objectives.) A vector-type CRT
may be employed to provide graphic displays for
the system users to gain the advantage of information in pictorial form.22 Diagrammatic illustrations and voluminous material, not readily adaptable to computer storage, are referenced in the
data bank to guide automated retrieval from local
terminal auxiliary files which are mechanized- by
microfilm storage-readout devices.
Entry of data into computer

Figure 4 shows how CHORD-S data has been
entered in the central computer and how the special programming has been handled. 23 Note how
new or revised technical data are merged with
basic CHORD-S update and input programs to
produce revis,ed master files for data cell storage
and terminal access. The computer input program
makes a diagnostic scan of the data to check for
errors. Obvious errors, such as improper formats,
incorrect field type and length, and the absence of
flags and delimiters are detected by the present

FIGURE 4

Interactive Telecommunications Access by Computer
program. Another class of errors, known as logical errors, is much more difficult to detect. These
errors can only be found by providing the computer with a greater knowledge of the ranges that
variables may assume and the possible conflicting
attributes of data items. That being impractical,
these types of errors are found and corrected by
the nuclear engineers who originated the computer
input information by systematic review of batch
dump output. (It is important to note that checking of input data for accuracy throughout is the
responsibility of the originator. Any erroneous
information in this Data Bank could have an effect of delaying the construction of one or more
$100,000,000 nuclear power stations.)
After being screened for errors, the input data
are sorted by the computer S'O that they are in the
same order as that on the master file. The file
maintenance program mat.ches the updated information against the master file, and records are
added, deleted, or replaced as required. The updated file is now written onto a disk or data cell,
and an index file, consisting of keycodes with
pointers to records in the master file, is created
on a disk to permit direct access.
Writing the master file and index file on direct
access devices permits the remote terminal and
batch query programs to retrieve the data in a
nonsequential manner. Later additional index files
can be created and used to index the master file
on the basis of other parameters.
File organization for such large volumes of data
is a .critical problem especially when using direct
access, devices to support remote consoles. The
problem is one of minimizing the external storage
requirements and at the same time providing efficient computer use and fast terminal response.
This problem has been solved, in part, by the local
implementation of several computer software routines which provide for variable length record
blocking and track overflow capabilities.

Modes of access
Several modes of access to the CHORD-S data
file have been developed and placed into operation
to accommodate various needs of users. One output program responds toa direct .command of
"$ Display" from the user to read out factual data
selected by subject matter key codes. In another
mode of retrieval ("$ Compare"), the computer
scans selected lists of data from various reactors
for major differences and reports these as "readout by ex.ception" thus selecting only that data

249

relevant to the user's interest. Here, a variable
element in the query is set to fit the degree of difference desired by the user. In the third mode of
operation ("$Lead-in"), the computer assists an
inexperienced user in finding information he needs,
by automatically guiding him into the data file
structure without requiring familiarity with the
organization of information. Options are available for each mode of access whereby slight
changes in user queries will either restrict or
broaden the degree of detail of readout. For all
of these retrieval modes, the user sits at a remote
console and participates in an interactive dialogue
with the computer. As his search progresses, he
calls on whichever retrieval mode that satisfies
his immediate needs. A built-in tutorial program
advises the terminal user of the nature of any
error in query structure. If desired, the "tutorial
program" can be called to read out step-by-step
instructions to the t.erminal for any program available.

Examples of dialogue via remote terminal
In the following search sequence, we assume the
user has not had previous experience with the
CHORD-S console; he, therefore, first uses the
"lead-in" program which instructs him in the use
of the console and guides him into the data bank.
(On subsequent uses, he may remember from his
earlier experience the way information is organized except for details and could enter the search
sequence at a more advanced stage.) Since there
is no need to preserve hard .copy of initial lead-in
dialogue, the user elects to save time by employing
the CRT terminal. as illustrated in Figure 5. By
simply typing "A.$lead-in." there is flashed upon
the screen major "Summary Section" subject
matter headings of the file with corresponding key
codes. Assuming that the engineer, in this evaluati'On, wishes to investigate design features of the
core of certain nuclear reactors, he continues his
guided search by typing in or moving the CRT
cursor to AC. The next computer response will be
a list of subheadings in that area of the data bank.
By successive continuation of this rapid pathfinding query-resp'Onse technique the more detailed
subject matter file structure is revealed. Each file
entry has a unique key code label which can be
used in requesting readout of detailed information on individual characteristics of selected nuclear power plants. An example of CRT readout
is given in Figure 6 where the "$compare" program was employed to retrieve from the computer

250

Fall Joint Computer Conference, 1968

FIGURE 5

summary data on reactor core fuel characteristics
(key codes ACBB to ACBC) of two plants designated by name abbreviations. From evaluation
of the data shown, the user then called on the
"Sdisplay" query to simply find the· value of one
related parameter of interest to him, "Maximum
Fuel Thermal Output" (key code ACACH).
Up to this point, the user elected to employ CRT
display, so that turnaround on the dialogue proceeded about as rapidly as his natural senses normally function. If he should decide that he needs
to retain hard copy of CRT display, he signals the
typewriter to automatically copy from the local
terminal controller memory. Where time required
for mechanical machine copying would handicap
the user's next deliberations, this can be avoided
by use of a speedy photo-optical device (if such
recently developed equipment is available at the
terminal).
As users of the system become familiar with
their most frequently used code designations, they
can address their queries directly to individual
codes or to code ranges, for immediate readout of
descriptive data, skipping "$leadin."
The "$compare" query is a development original with this project, that places tremendous
power in the hands of terminal users to contrast
at various levels' of detail, design characteristics
of one or more nuclear power stations. This important feature functions as follows: Nuclear
safety information engineers, when the originally establish their standard characteristics listings, assign for storage in the computer memory
a ".Delta Factor." This represents their profes-

sional opinion of parametric deviations of significance, such as +10ro. When a user wishes to make
a rapid scan of large volumes of data to find contrasting design features of different power plants,
he uses "$compare" with a controllable modifier
"m." Different degrees of course or fine comparison are obtained by the terminal user designating
larg~ or small values of "m." Efficient "readout by
exception" is then accomplished by means of computer programming which causes the system to
ignore data values (where numerical) that contrast by a lesser difference than that requested.
By successively varying the value of "m" from
large to fractional values for different sections of
the file, the user can rapidly "close in" on items
wherein the degree of difference corresponds to
his specific search interest. The "$compare" feature of the CHORD-S information system could
be given broad application to other information
systems.
In the following example, employing "variable
depth compare" with typewriter readout, the engineer is exploring design data on three nuclear
plants in the area of "Heat Transfer at Initial
Full Power (IFP) "
ac~c

al"a<1.cl il sl.m=3

~coIllPare.
n!~·PT·2

C-Yfa(

SETCI
I-tEATTIlANS/,TIFP
AVr. PI)~iFt: 0[11, K:I/l

Ar;ACA
ACACq
ACAce

..

::[t! ON'!: (IJ-3) t')~ CI'!:IT HEAT FluX [lATlO

AVr. PF.L TO CLA£) GAP TIJf."t'

CO·IOUCT,CTl.j/lm.~nI:T-r:F.r;F

AVr:. FUEL THHr' DUTPIJT,Kt.:/FT
.J(}~

SL:R!l:Y·l
SFTOI

r.F.TOl
~

2.S2
NS
'J5

1.81
1, ooo.~.

l.SU
1,000.
G.2

rQr'PArlr. [w)rr-. T lI~r: CPI' ::0011112. ELAP!)F:) '" DC: 10,07.
ExplanationofSymbols1nPrintout.

NS - Data not supplied in source references.

* -

~o

significant deviation from data shown in first column.

On his first approach, he assigned no value to
the multiplier "m" so the computer automatically
selected for readout differences based on a delta
factor of 1. If we assume that he had been working with a much larger span of subject matter
than is practical to illustrate here, he could decide that the volume of readout is too massive
for isolating major differences. In that case, he
may choose to enter another query specifying that
m=3. This effort on his part then would produce
the following output at his terminal, which much
more clearly highlights the major differences in
design that he seeks:
acacacad.r:lilsl
$cnrnpare.
CHARACTERISTIC AND UNITS

ACACA
ACACq

ACACF
ACACF
ACAce
ACACH
ACAC I

JOr.

co~·rARE.

f-IEATTRANSATIFP
AVG PC!:m D!:tI,KH!L
MI~1 ON8 (W·3) OR CRI T HEAT FLUX RATIO
AVGPElTOCLADGAPTHERp.4CONDUCT,8TU!HR·SDFT-Cr-r.F
ACT I VF. I~F.AT TRAN~ SURF AQ[A, SQFT
AV(',H(AT FLUX, 'Hl'jI-lR-SOFT
l'AXIIEATFLUX,8T1'!f-IR-SOFT
AVG FUEL THER,., OUTPUT,KWFT
MAXFUELTHERMCUTPl:T,KWjFT
~lAX CLAU SURF TEMP ,OEGF

nmED. TIME: CPU "00ilIt1, ELAPSED" 00:08.73.

c-Ym:

IN('I-PT-2

SO 01

,~ s
2.82
"$

35,900.
135,1100.
il21,50~S

13.7
625.

SFTOl

SURRY-l

SETOl

"

92.8
1.86

1.81
1,000.
52,200.
175,r,OO.
570,800;

191,000.
538,700.

18.5
659.

6S7.

1,OOO~

6.2
17.5

Interactive Telecommunications Access by Computer

251

The tabular output format of the previous examples is popular with engineers, but has an
obvious built-in limitation on the number of columns of data that can be displayed. In order to
overcome that restraint, responses from the
CHORD-S system that would exceed horizontal
space limitations automatically shift to a vertical
listing, such as shown in the following example:
acac acach. c1 i1 sl 01
$compare.

ACAC

HEAT

ACi\CA
C1
Sl
01

AVG

ACACB
C1

MIN UNB (W-3) OR CRIT HEAT FLUX RATIO
2.82
1.81
1.86
1.6

11

Sl
01
ACACC
C1

TRA~S

PO~JrR

AT IFP

OEtl, KW/l
N5
92.8
79.6

AVG PEL TO CLAD GAP THERM

CO~OUCT,BTU/HR-SQFT-CFGr

rlS

1,000.
1,000.

11

51
ACACD
C1
11
01

ACTIVE HEAT TRANS SURF ARFA,SQFT
35,900.52,200.
48,578.

ACACF.
C1

AVG HEAT FLUX , BTU/HR-SQFT
136,400.
175,600.
191,000.
167,620.

11

51
01

ACACF
C1
11
51
01

t!AX HEAT FLUX,BTU/HR-5QFT
421,500.
570,800.
538,700.
543,000.

ACACG
Cl
Sl
01

AVG FUEL THERt: OUTPUT ,K~~/FT
N5
G.2
5.4

JOB COMPARE. ENDED. TIME: CPU =00485, ELAPSED = 00:09.85.
Cl

Conn. Yankee

II

Indian Point'

SI

Surry 1

01

Oconee 1

The foregoing examples of data retrieval have
mainly focused on cases where °a user of CHORD-S
wishes to make an efficient comparison of selected
gesign features of two or more nuclear power
plants. That is because of the uniqueness of this
capability, and its great utility to design evaluators. There are othe:r important capabilities of
the system that are not included in the examples.
A simple query can be placed that will yield com-

FIGURE 6

plete bodies of data covering the design of a single
designated plant. Where desired, sets of parametric design values can be obtained representative of different assumed accident conditions.
Sources of data can be called for yielding stored
bibliographic reference information. Employing a
computational program .available from the general purpose computer (TERMTRAN), 24 a terminal user can perform a wide range of calculations using design data retrieved from CHORD-So

Future outlook
Development of CHORD-S has produced an operating system that provides conversational mode
access from telecommunications terminals to a
central computer data bank. Data stored, thus far,
is representative of some of the more important
factual design characteristics of certain U. S. nuclear power reactOr plants. As additional information is added, Atomic Energy Commission personnel will be engaged in evaluating the worth of this
IS&R system from actual operating experience.
The nature of further development of CHORD-S
will be guided by results from such experience.
The particular.computer and the initial terminal
hardware employed to demonstrate feasibility and
long range future potentials of CHORD-S has been
based largely upon the matter of ready availability. Commitments for a permanent system require
the completion of extensive evaluations of the
wide ranges of hardware and software offered by
industry to achieve the most desirable operating
features within limits of reasonable economy.
As CHORD-S is developed to full potential, the

252

Fall Joint ,Computer Conference, 1968

data bank in addition to increasing substantially
in volume, will encompass deeper levels of design
detail than can readily be expressed in concise
alphanumeric terms. Information structures will
~eed to accommodate more lengthy narrative de~criptions, diagrams, graphs, etc. The most efficient· methods for presenting such material to
I terminal users in meaningful forms are under intensive study, evaluating the applicability of sophisticated hardware and software, much of which
is just becoming available from commercial
vendors.
If the data bank increases in size for more complete inclusion of design characteristics and progressively builds to receive input from larger numbers of nuclear power stations (around 30 currently being committed each year), many hundreds of millions of characters will need to be
stored. File structure and search techniques will
likely be altered as necessary to assure rapid
cross-reference access to individual areas of specialized interest.
Long range plans include a gradual increase in
the number of terminals to accommodate various
groups of AEC Headquarters personnel in the
Washington area. Also, it is intended that the network will be expanded to provide terminals at
other locations throughout the United States. Requirements for extensive telecommunications features are being preliminarily evaluated to make
certain that the system can be efficiently expanded
without basic overall reworking of hardware and
software provisions.
In \riew of the pioneering features of much of
the CHORD-S undertaking, care is continually
exercised to assure compatibility with other information systems of the government, particularly those of the Atomic Energy Commission. Opportunities for certain interconnections are already obvious and can be expected to increase
rapidly in the future.
ACKNOWLEDGMENTS
The initial development of the CHORD-S project
reported herein has been accomplished as a part
of the Nuclear Safety Program of the Oak Ridge
National Laboratory under the direction of W. B.
Cottrell, in fulfillment of objectives established
by S. E. Levine, Assistant Director of the U. S.
Atomic Energy Commission Division of Reactor
Licensing.
The author has served as co-director of
CHORD-S, being mainly responsible for areas re-

lated to computer applications and project administration. Noteworthy contributions are much in
evidence throughout the paper from W. E. Browning, Jr., in his capacity as co-director for nuclear
safety data selection and processing. Specialized
computer programming for CHORD-S has been
originated by S. L. Yount and M. Magnuski under
the direction of E. M. Kidd, UCNC Computing
Technology Center. A. Goldenson of UCNC Process
Analysis provided assistance with query language
development. The extensive task of developing
technical data for acceptable computer entry has
been accomplished by the following ORNL
C:gORD-S Group staff engineers: F. A. Heddleson,
J. O. Kolb, R. E. Lampton, I. K. Namba, and P.
Rubel. Mrs. J. D. Joyner, Mrs. B. K. Seivers, and
Mrs. J. M. Copeland have materially aided in editing and producing the text and illustrations that
make up the manuscript.
REFERENCES
1 DPARKHILL
The challenge of the. computer utility

Addison Wesley Publication 1966
2 DCARDWELL
The impact of recent computer developments on the future of
engineering

Address to the Raleigh N C Engineers Club Nov 14 1966
Unpublished
3 JHOGERTON
The arrival of nuclear power

Scientific American Vol 218 No 2 Feb 1968
4 J BUCHAN AN F HUTTON
Analysis and automated handling of technical information at the
nuclear ~afety information center

American Documentation Institute Vol 18 No 4 Oct 1967
5 LBERUL
Survey of equipment developments in the information storage and
retrieval field

Auerback Corp FID /FIP Conf June 1967
6 W SLACK B PECKHAM L VAN CURA

W CARR

A computer-based physical examination system

Journal American Medical Association Vol 200 April 1967
7 P CASTLEMAN
Information storage and retrieval cycle

Hospital Computer Project Mem Six-D Bolt Baranek and
Newman Inc Cambridge Mass
8 W HUBBS J McBRIDE A LEVY
The Baylor medical school teleprocessing system

SJCC Vol 32 May 1968
9 CLYNCH

4. communications revolution
Science and Technology April 1968
10 T BOTHWELL
Computer communications systems

Computer Design Dec 1967
11 B SPINARD H McDONALD C TUNIS
W SUTHERLAND R WARD J ARCHIBALD
Panel discussion on man-machine interface

SJCC Vol 32 May 1968

Interactive Telecommunications Access by Computer
12

13

14

15

16

17

18

:b EVANS B PINE D SCOTT J WEINER
Panel discussion on time-sharing status report
SJCC May 1968
I ASIMOV
The human brain, its capacity and functions
Houghton Mifflin Co Boston Mass 1964
PABELSON
The human use of computing machines
Science Vol 153 No 3733 July 15 1966
H STEADMAN G SUGAR
Some ways oj providing communications facilities for lime-sharing computing
SJCC Vol 32 May 1968
P RUBEL D CARDWELL
Telecommunications system access to computers: Basic characteristics of terminal equipment
ORNL-CF-68-6-35
S BOWMAN R LICHALTER
Graphical data management in a time-shared environrrumt
SJCC Vol 32 May 1968
SSMITH
Man-computer information transfer

19

20

21

22

23

24

253

Electronic Information Display Svstems James A Howard
pp 284-301
A GOLDENSON D CARDWELL
Query methods in information retrieval
ORNL TM-2376 1968
Input verification methods vary among inscribers
Computer Wcrld p 5 June 19 1968
Computing technology center
Brochure Union Carbide Nuclear Division Oak Ridge
Tennessee
Computer industry annual 1967-68
UNITECH DIV AES Corp subs of Simon & Schuster Inc
New York New York
"'M MAGNUSKI
CHORD-S A system oJ programs for computu handling oj
Reactor data for safety
Information Systems Department Computing Technology
Center Union Carbide Nuclear Division Cak Ridge Tenn
Report No K-1756
GKNIGHT RNEU
Termtran, a programming systemjor engineeringcalculaltion8'Via
remote terminals
UCND CTC Oak Ridge Tenn Report No K-1735 Feb 1968

Computer-driven display facilities for an experimental
computer-based library*
by DONALD R. HARING
Massachusetts Institute of Technology
Cambridge, Massachusetts

BACKGROUND

library whereas the digital data will constitute the
augmented catalog of the library from which the
library user gleans information about the library data
and documents by conducting on-line computer
searches.
One of the concerns of Project Intrex is to conduct a
series of experiments to determine how the traditional
library catalog can be effectively augmented and com.bined with on-line computer operation to provide users
with a more powerful, comprehensive, and useful guide
to library resources. Present plans call for augmenting
the traditional library catalog in scope, depth, and
search means. For example, the augmented calatog will
contain entries for reports and individual journal articles as well as the traditional entries for books. Furthermore, in addition to the title and author of each item,
such things as the bibliography, an abstract, key words,
and key phrases of each item will be included as part of
its catalog entry.2,3 A user will be able to conduct
searches on nearly any combination of the data contained in a catalog entry. Present plans also call for providing alphanumeric communications between user and computer by means of a high-speed, flexible display console.
Another concern of Project Intrex is to conduct a
series of experiments in an effort to devise a workable
system that will ultimately provide guaranteed, rapid
access to the full text of journal articles, books, reports,
theses, and other library materials at stations that are
remote from the central store. This goal has several
implications. Guaranteed accessibiHty implies that text
never leaves its store and is therefore available to users
at all times. Availability with minimum delay at remote
locations implies transmission of text in electrical signal
form, except in special, limited situations where physical transmission (perhaps by pneumatic tubes) might be
appropriate. Remote accessibility implies more conven-

Project Intrex (information transfer experiments) is a
program of research and experiments intended to provide a foundation for the design of future informationtransfer systems. The library of the future is conceived
as a computer-based communications network, but at
this time we do not know enough details about such a
network to design it. Lacking are the necessary experimental facts, expecially in the area of user's interaction
with such a system. To discover these facts, we want to
condll:ct experiments not only in the laboratory, but
above all, in the real-life environment of a useful operaing library. 1.2
The initial efforts of Project Intrex have been concerned with the problems of access-bibliographic access through an augmented library catalog, and access
to full text. This paper describes the design of the initial
computer-driven display facilities being developed for
the Project Intrex experimental computer-based library. To provide further background information, we
will first give some details of the augmented library
catalog and the text-access system that are being developed.
For a number of reasons, computer-based libraries
that service a wide spectrum of users, such as is found in
a university, will be faced with operating on two basically different types of data-that which is digitally
stored and that which is photographically stored in
some micro-film form. The latter will be images of the
original full text of the documents contained in the
*The research reported here was made possible through the
support extended the Massachusetts Institute of Technology,
Project Intrex, the Electronic -Systems Laboratory, Under Contract NSF-C472 from the National Science Foundation and the
Advanced Research Projects Agency of the Department of Defense, and under Grant CLR~373 from the Council on Library
Resources, Inc.

255

256

Fall Joint Computer Conference, 1968

ient library use, and in addition is a preliminary step toward realization of a network of computer-based
libraries coupled together by means of data communicationlinks.
In order to conduct meaningful experiments, a smallscale experimental total computer-based library system
containing some 10,000 systematically-chosen documents in materials science and engineering is being designed and constructed at M.LT. The computer-driven
display facilities discussed here are a part of this system. Figure 1 illustrates the general organization of this
experimental library. The library operates roughly as
follows: The digital data and the photographic images
are created from the original documents. The former are
placed into the storage of the time-shared computer (an
IBM 7094 system) and the latter are placed into a
microfiche storage and retrieval unit (a modified Houston Fearless CARD machine). The stored data are then
accessed through the augmented-catalog user consoles
and the text-access user terminals, respectively. This
paper is concerned with the display facilities required by
the experimental library , for more details about other aspects of the experimental library see References 2 and 3.
Several consideration.8 have led to the decision to
construct the experimental display facilities at M.LT
as opposed to purchasing a commercial system that almost satisfies the needs of the experiments. First,
there is no commercially available system in which the
"almost" is close enough to the requirements of the experiments. Second, these experiments are designed to
identify the functional characteristics of a system
ide~lly suited for a computer-based augmented catalog
and 'full-text access. Duling the course of these experiments, the system is expected to experience modifications which can be more easily performed on lo~ally
designed and con.structed equipment. Third, an objective of Project Intrex is to develop competence in the
field of information-transfer engineering at M.LT.

10,000 JOURNAL
ARTICLES,
REPORTS
THESES"
BOOKS
IN MATERIALS SCIENCE"

"'1

r".1

MULTI-ACCESS
COMPUTER

ENGINEERING

~-J'-~
~jjl- ~:}iI
I
~I

!

.. - - - -

~' ~

1

'l~'~ ...... ~..."",(,...,

Lll~ ,1
-A.

CATALOG

ON MICROFICHE

~

~

"" ,....,,'
;2~ ~~ ;

l.;8

·fff:
·~A ..... '
;j ~

IIIICROFILMf

STORAGE :SYSTEM

W

rL

PROGRAMS

.

••

10,000 DOCUMENTS

INFORMATION
STORAGEs RETRIEVAL

-

,,---'_/
MICROFILM

~

REMOTE TEXT

'

RETRIEVAL SYSTEM

S~~~:N STru~- ~~=
STATION

FIGURE I-Project Intrex expeiimentallibrary storage and
retrieval system

Several points concerning the Intrex program should
be emphasized. First, through operational experimentation we wish to obtain information that will be helpful
in defining attributes of a large-scale system; that is,
our goal is to make full text and its attendant augmented catalog available to a selected well-chosen community of users in order to test user reactions to equipment as well as learn about capabilities and limitations
of the technologies used in the equipment. For a discussion of the selection processes used in the choice of
the community of users and choice of the material
contained in the experimental library to serve them,
see References 2 and 3_
Second, in our experimental program, close attention
is being given to its scalability. Although the first expelimental store of textual material is only a representative fraction of a full-scale library, our purpose is to
employ only' those techniques and technologies that
show promise of being extendable to full library context. Third, the research program envisioned is evolutionary; therefore, the experimental system now being
developed is the first of a series that will be needed before the characteristics of a full-scale augmented-catalog
and text-access system can be postulated.
The plan of this paper is to first discuss the requirements of the display facilities and then to describe the
present Intrex facilities that are being developed. Because of the differences between the storage form and
content of the catalog (digital, alphanumeric) and the
full text (photographic images, graphic), and because
of the differences between user interaction with the
catalog and full text, we find it convenient first to describe the two facilities separately, and then to describe
the operation of the integrated facilities by means of an
example of its use during a library-user's session.
The augmented-catalog display-console requirements

Effective testing of user interaction with the augmented catalog requires a remote computer console optimally suited to the task. Currently available consoles,
however, exhibit serious shortcomings as regards
catalog experimentation. Impact-printing teletypewriters operating at ten to fifteen characters per second,
for example, are clearly too slow for rapid scanning of
large quantities of bibliographic data. The cathode-raytube (CRT) alphanumeric display terminals now
offered by several manufacturers do allow for more
rapid, quiet display of computer-stored data. However"
they, too, lack features essential to effective user interaction with the augmented catalog. For instance, there
is generally a lack of flexibility in operating modes, in
formats (e.g., no superscripts and SUbscripts) and a
servere limitation on the size of the character set. On the
other hand, the CRT graphic display terminals that are

~omputer-driven

currently available can be programmed to circumvent
these deficiencies but are very expensive as regards original cost, communications requirements, and utilization
of computer time.
As a result, a study program was initiated to identify
the functional characteristics of a console ideally suited
for augmented-catalog experimentation. Space does not
permit a full exposition of the study program. The program involved an investigation of the reactions of
various types of users to the terminal facilities serving
present time-shared computer utilities, for example,
Project MAC, 7 and some experimental specialized co~­
puter-based information networks, for example RECONS and TIP. 9 The program also involved an investigation of promising relevant new technologies and discussions with many people as regards their thoughts on
the input/output requirements of a computer-based
library system. The most important items considered in
this study program were: (1) the user community that
will be served by the augmented-catalog, (2) the type of
data that will be contained in the augmented catalog,
and (3) the operation of the computer-based library
system. The salient point of each of these general considerations are now discussed. The interested reader can
find greater detail in References 1-4. Results of the experiments performed on the console system described
here will be reported by Project Intrex as they become
available.

The user community
The background of the community of users ranges
from first year students to researchers on the outer
fringes of science, technology, etc. They may be interested in finding such things as the specific heat of carbon
steel or the latest theory about semiconductor surfaces.
They may use the console occasionally, as in the case of
most students, or use the console daily, as in the case of
many librarians. It is safe to say that the majority of
users will not be computer "buffs" and that they will
be demanding of the system. The users will want to be
able to operate the system with a minimum amount of
re-learning at each session, that is to say, they will want
to maintain a useful level of competence as regards the
system and have tutoring on specific features of the system operation as needed in a session. Furthermore, the
console should not be tiring to use. This effects not only
the manner of displaying the data but the layout and organization of the console manual inputs as well.

The augmented-catalog data
The data contained in the augmented catalog are
basically alphanumeric' and are contained in a special
disc file attached to a time-shared computer system. Of

Display Facilities

257

particular consequence to both the display-console design and the entire computer-based library is the large
number of alphanumeric symbols that is required. The
set of 128 USASCII standard symbols is insufficient,
and thus must pe augmented. Furthermore, provisions
for superscript~, subscripts and underlines must be included to properly display to users in forms with which
they are familiar, such items as chemical formulas and
mathematical equations.
Relationships among key words and phrases jn the
catalog as shown in a .thesaurus are perhaps most easily
displayed as a tree. Thus, as an aid to the user, the display consol~ should have the graphical capability to
display a simple tree structure amongst word phrases.

The computer-based library operation
Central to the Intrex computer-based library operation is the concept of an on-line, remote access, interactive time-shared computer system. The advantages and
disadvantages of such a computer system are now fairly
well known. Of course, the design of the computer-based
library should make fullest use of this knowledge.
As opposed to the usual type of short statements
interchanged between the users and the computer in the
present time-shared computer operations a library user
frequently will require a large quantity of data to be
sent to him so that he might scan through it. On the
other hand, the library user will spend most of his
central processor time on generating search specifications rather than generating programs or numerical
data.
A library continually receives new acquistions and
library procedures change from time to time. Hence,
the augmented-catalog display console must be able to
evolve and. gracefully accept various types of changes
witJ:1 a minimum of disruption to library services and at
a minimum cost.
Since a computer-based library will operate for a long
period of time before being replaced, cost of ownership,
which not only includes original cost but recurring costs
of such items as maintenance, communications and updating, is of great importance.
The augmented-catalog display-console facility

Several basic hypotheses resulted from the study program and have been used in the formulation of the
initial design concepts. First, it is advantageous to handle many routine operations at the console in order to
minimize communication between the console and the
time-shared computer. This approach reduces the demands on the central computer and should result in
more rapid access to the central machine when required.
It further reduces the cost of transmitting information

258

Fall Joint Computer Conference, 1968

from the time-shared computer to the console, an important consideration in any large operational system.
Second, careful attention should be given to the size and
content of the console alphabet, the ability to produce
superscripts and subscripts, and to the human engineering aspects of the console in order to ensure favorable
user reaction to the console and to the overall system.
Third, it must be possible for the uninitiated user to become familiar with the operation of the console and the
catalog system rapidly and easily. Finally, the
design of the console should be such that it can be
economically rep~oduced. This feature is a necessary
prerequistite to the wide-scale use of computer-based
library systems. Consideration of these hypotheses has
led to the formulation of the design concepts described
in the following paragraphs.
A console has been built that uses a cathode-ray tube
(CRT) display with approximately 1,800 alphanumericcharacter capacity. The data communication between
central computer and console is 120 characters per second with provisions for higher data rates. Several
character sets are possible in addition to the English
alphabet. User communications are entered by means of
a typewriter keyboard, and special function buttons
which designate frequently encountered commands.
The user's message is displayed on the CRT prior to the
transmission to the time-shared computer, and editing
of displayed commands is possible. As the user's conversation with the catalog system progresses, certain data
I

supplied by the computer may be stored locally for future ref erence, edited as required, and eventually
printed in hard-copy form.
In order to reduce the cost of individual consoles, it is
advantageous to cluster consoles around a local station
which includes data storage and processing that is common to all clustered consoles. Initial investigations indicate that it should be possible to design economical
console systems which cluster about ten consoles at
distances of a thousand feet from a local station. Thus,
the consoles could be placed in several different rooms of
a single building. Interconnections between the consoles
and the station are made with coaxial cables, while thp.
connection between the station and the time-shared
computer utility are made by common carrier. In the
future, a high-speed photographic printer will be located
in the vicinity of the console to produce hard copy on
command from any of the consoles.

Basic Augmented.Catalog Console
System Description
Figure 2 shows the present Intrex display facilities
that are being developed. The major components of the
augmented-catalog console system are identified by
broken line!'!. Note that individual user console has the
following components:
1. A CRT to display information.
2. A set of lights to display information about the

FIGUR'E 2-An experimental display system for project Intrex

STORAGE
CRT

LIGHT
PEN

/

TEXT-ACCESS
USER TERMINAL ·1

/J
If

!

CONTROL LOGIC

! LOCAL STORAGE

CRT Proorommable Buttons

'oOooOnO

14----:=--:~ !LOCAL PROCESSOR

System Status Liohts

I

I

! CONTROL LOGIC!

BUFFER I
TIA USER TERMINAL #2

I ~UGMENTED-CATALOG USER CONSOLE·I
L. ____________ _

r
I
I
I

AIC USER CONSOLE #2

I
I

i-Ate
~SER-CONSOLES - 3-thr:9- ~- _-l
L ________________

.•

MICROFILM
PROCESSOR
TERMINAL

-oJ

•

AIC USER CONSOLE #10

r-----------I
TIA BUS

~g~Jt~L

....------------.-----------':""1
FLYING-SPOT
(COAXIAL CABLE)
I1
SCANNER
I

-----~

:
TEXT-ACCESS
I
I
STORAGE a RETREIVAL
(PHOTOGRAPHIC):

I

~ __ :'E~T-=A~~:'S_C':~T~A~ _S~S~~M__ J

Computer-drive~

Display Facilities

259

status of the display system and time-shared
computer.
3. A set of CRT programmable buttons or function
switches that are mechanically operated by the
user to select the modes of console operation and
the frequently used operations. The labels and
functions are determined by the computer program and the labels ale displayed on the CRT
screen.
4. Mechanical function switches to supplement the
CRT programmable buttons.
5. A typewriter keyboard to enter specific information into the system.
6. A light pen to point to information on the CRT
screen.
7. A character generator to produce a large alphabet
of alphanumeric symbols on the CRT.
8. A format generator to produce the approximately
1800 character spaces on the CRT screen, ;and provide superscripts and subscripts.
9. Control logic under the direction of the console's
CRT programmable buttons, light pen, and function switches and the buffer/controller.

character generator. Since one of the displayed lines of
characters must be devoted to the labels for the CRM
programmable buttons, approximately 1700 character
spaces are available for textual information.
The control logic of the console interprets commands
generated by either the console or the processor in the
B/C and through these commands the control logic
establishes the console's "state" and hence its mode of
operation. Through the console commandEl, the control
logic establishes interrupts to the processor which in
turn processes these interrupts when its own time is
available to treat the console's interrupt. The major
items specified by the console state are as follows:

Specific details of these components are discussed in
Reference 5. Briefly, the console is organized as follows:
All information displayed on the CRT must be stored
on a magnetic-drum track located in the buffer/controller (B/C) and pass through the character generator located at the console. A special character geneIator based
ona lensless, flying-spot scanner is being developed for
Project Intrex and is thoroughly described in References 2 and 5. It can produce up to 192 high-quality
characters. Since the character set is specified by a
photographic slide, the set can be easily changed. Each
console has its own character generator to provide a
flexible system in which each console can operate with
a different alphabet. The format generator, which is always connected to the CRT, periodically produces a
raster of 31 lines with spaces for 56 characters per line.
Human factors studies indicate that the character size
resulting from this format is good for the viewing distances at which the console will be operated.lO •n The
format generator is synchronized to the magnetic drum
so that one complete revolution of the drum corresponds
to one complete raster. Consequently, drum addresses
correspond to specific positions on the CRT screen,
thereby simplifying logic. With a refresh rate (controlled by the drum speed) of approximately 57.5 refreshes per second, and 10 bits per character, approximately 1,175,000 bits per second are transferred from
the drum to the character generator, hence a coaxial
connection between the user console .and the B/C is,
therefore, required. The time per character is approximately 8.5 microseconds, which is ample time for the

The control logic is itself under the direction of the
CRT programmable buttons, the mechanical function
switches ~nd light pen, and the processor in the B/C.
The second part of the console system, the B/C, contains four major components. The memory drum, with
its associated electronics and logic, stor~ the display
information for the consoles, labels for the CRT programmable buttons, routines for the controller, and
-instructions on the use of the consoles. The processor,
which is actually a small digital computer (a Varian Data
Mochin.es 620 I), controls the operating modes of the
consoles and the data flow among consoles, drum, and
central time-shared computer. The input-output buffer
~nd its electronics matches the different data rates in
the drum, consoles, and communication link. The buffer
also defines code groups corresponding to characters.
Direct data communication is provided between the
central time-shared computer and B/C.
The low-cost Vermont Research VRI004S drum
memory being used can provide up to 128 data tracks.
Each track represents one complete CRT display,
which is called a "frame." One console has five frames
dedicated to its exclusive use. Also, a drum track is devoted to the possible labels for the CRT programmable
buttons. Another set of drum tracks is devoted to instructions for the use of the console, and still another
set to tpe processor's use. N ondedicated data tracks will
be dynamically allocated, giving an individual user a
potentially large number of frames viewable instantaneously with no action required by the time-shared
computer.

1. The drum track that is being displayed. One track
corresponds to one complete display on the CRT
and is referred to as a frame.
2\. Whether data are being transferred to or from a
particluar drum track or to or from the time-shared
computer.
3. The labels of the CRT programmable buttons, and
hence the function of these buttons.
4. Disposition of data generated by the keyboard.

260

Fall Joint Computer Conference, 1968

When data phones are used in the communication
link, experience with existing display systems indicates
that several data phones are required to handle many
user consoles from a single B/C. Data phones now
available for switched telephone networks provide up to
2000 bits per second of data, but within the near future
this rate will be approximately doubled. ~2 Since one
CRT frame contains approximately 20,000 bits, at least
ten seconds is required to transmit a complete single
frame. Fortunately, the majority of the messages between the user and the time-shared computer are in the
order of one line of text requiriig only onh-third of a second. However, since a single tiser might' wish to request
up to five frames at a time, ,n maximum of 50 seconds
might be required to serve' a single user. In' order to
avoid prolonged delays in,service to other users who
may be awaiting service at that instant, one 2000-bps
data phone must be dedicated to a small number of consoles, or the servicing of the consoles must be interlaced,
or combinations of these two must be employed. At the
present time, our thinking runs toward use of one data
phone for every three consoles, and interlacing the service to provide response time of less than 30 seconds
under worst-case conditions. Since, in actual practice,
users most frequently will be sending and receiving
much less than a complete frame and furthermore,
since the probability that several users will be communicating data simultaneously is very small, as regards the
communications delays, the service would typically be
less than a second.
The processor in the BIC is a small digital computer
which operates as the process controller and has interrupt features. A commerically available small computer
is being used instead of a specially built computer. This
provides a very powerful and flexible console system
on which to conduct the Intrex experiments. Although
the data rates are high in the CRT channel, by proper
organization of the control logic in the user consoles the
control data rate, which is the rate important to the
processor,. can be si~ificantly reduced.
Further details of the augmented-catalog display facility can be found in References 2,4, and 5.
The text-access display requirements

Much of discussion concerning the augmented-catalog display-console requirements in a previous section
are applicable here. The difference between the two sets
of requirements are due to the differences of the storage
medium and types of user interaction with the stored
data. The catalog data are digitalJy stored in a file that
is attached to the time-shared computer and is accessed
through and processed by that computer. The library
user can conduct computer searches on this data and
modify his copy of the data. Thus, if he wants hard-

copy of this data he can have the data organized in any
desired form. On the other hand, the full-text data are
photographic images that are accessed through a me'"
chanical storage and retrieval unit that is attached to the
display facility. These data do not pass through either
the time-shared computer or the buffer/controller
computer. Their form cannot be modified (except for
magnification) and the user cannot conduct computer
searches on the data. The only access to full-text data is
is by call number. Once the data are obtained, the user
can read it, can ask for other pages of the same document or ask for a magnification of portions of the page
of the document. In short, the dynamics and the dialog
between man and computer are considerably different
between the two display facilities.
With the original text stored in image form, the problem of remote access of text becomes that of reproducing a high-quality image at a remote point. Our experiments have shown that at least 2000 scan lines, with
comparable system resolution, appear to be needed .for
remote reproduction of microfilmed technical documents (18-to-l reduction ratio) having average quality
and containing the subscripts, superscripts and. mathematical symbols that frequently appear in these texts. 2
Closed-circuit TV requires high bandwidth (80 MHz)
to achieve the desired resolution of 2000 lines per page.
Also, because the image is continually refreshed, a separate scanner and transmission line would be required
for each simultaneous user. Hence, a facsimile-like system is used in which each text page is scanned and'
transmitted only once, and the information is captured
. and stored at the receiver for transient viewing (soft
copy) or printing (hard copy). This organization permits
a tradeoff between signal bandwidth and transmission
time, and also permits time multiplexing of the microfiche on which the image is stored, the microfiche storage and retrieval device, the scanner and the transmission line to serve a number of users. For example, with a
transmission time of ~a second per page, signal bandwidth for a 2000-line scan is reduced to about 4.5 MHz
(standard TV channel bandwidth) and a single text·
access system can perhaps service 20 to 30 receivers, assuming that users would request new pages at 10 to 15
second intervals.
Let us now describe the present Intrex text-access
.system being developed in order to further specify the
display requirements. The salient features of the textaccess system are shown in Fig. 2, and are seen to be an
automatic microfiche storage-and-retrieval device (a
modified Houston Fearless CARD machine) capable of
accommodating 750 microfiche (each with a standard
60-pageCOSATI format) and of being operated under
computer control, a single-scan, 2000-line flying-spot
scanner for converting microfiche images. to video sig-

Computer-driven Display Facilities
nals, a 4.5 MHz bandwidth transmission system, two
types of receiver stations and a spare station, and the
necessary control logic to access documents through the
augmented-catalog console. One receiver station provides 35-mm microfilm as its output, a second station
produces a visual display of text on a storage tube, and a
third station is available for installation of other forms
of output equipment as such equipment becomes available.
The document collection for the experimental systems
is the full text of the documents in the augmented catalog. Therefore, both catalog and full-text information
is available at stations that are remote to the c.entral
time-shared computer.
The text-access system is controlled by the augmented catalog buffer/controller unit through its connection
to the central-station control unit. Control of the textaccess system resides mainly in the buffer/controller
(B/C). Thus, for example, if a user requests the transmission of an entire do(;ument, the B/C remembers the
number of pages to be transmitted and keeps track of
the access and transmission operations so as to issue an
appropriately timed command for each page. The access
number of a document occupies a field in its augmentedcatalog entry that is stored in the central timeshared computer. The document number is retrieved
automatically whenever a document title is retrieved
and thus is available to the B/C for issuance of
the text-access command. Our decision to connect
the text-access system to the augmented catalog
B/C rather than to the central computer is based
on our belief that the full-text accessing process
could be slowed down by the wait-time of our present
time-shared facility.
The text-access display facility

The usefulness of future operational text-access systems will depend to a great extent on the capabilities of
the users' terminals. Low cost for the terminals will obviously be of paramount importance. In addition, we
are presently facing, in the realm of terminals, severe
technological limitations, especiallY'In the area of transient displays (Le., soft-copy displays in which the user
cannot take a copy of the displayed data with him).
Substantial research and development activities in the
industrial sector should, if successful, contribute markedly to text-access-terminal advancements. In light of
these external pending developments we plan, for the
present, to employ a minimum number of terminals~
We shall have one terminal for each major type of output device, that is, a terminal for transient display of
text, another for film copy, and a third for experimenting with new devices as they come along. We also expect
to have a separate terminal for making paper copy.

261

Weare favoring the transient-type terminal, since it
approaches most closely the capability of providing
immediate text access and is potentially the least expensive to operate. Unfortunately, no fully satisfactory device is available for our purpose; however, the Tektronix
eleven-inch storage tube does afford limited capabilities
and it will be incorporated into one terminal. The second class of terminal, the film terminal will also enable
us to test the acceptability of film as a primary hardcopy output; that is, we shall be able to decide if film, is
an acceptable substitute for the more expensive paper
copy.

Storage-tube terminal
The storage-tube terminal, diagrammed in Fig. 3
makes use of the Tektronix Type 611, eleven-inch storage display unit. An evaluation of an experimental
engineering model of the Tektronix direct-view storagetube display indicates that the resolution and brightness
of this display are adequate for the reader who wishes to
make a preliminary examination of text in order to
verify its relevance to his requirements. 2 Resloution
may be marginal, however, for perception of poor-quality print or small symbols and characters. (It is estimated that an improvement of approximately 25~) in
resolution is required). To overcome the resolution limitation, an enlarged version of anyone of nine overlapping portions of a page of text can be requested.
Operation of the storage-tube terminal is straightforward. Upon receipt of an ERASE command from the
demodulator, any image appearing on the screen is
erased. One-half second later the BEGINSWEEP command will be received, followed by the video signal for
one page of text. After being written on the screen the
text remains on the tube face until the next ERASE
command. Because the writing speed of the Tektronix
Type 611 display is relatively slow, the scanning of a
frame of the original microfilm and the transmission of
the corresponding signal must be extended from the desired one-half second writing time to four seconds.

Video

Tektronix
Type 611
ll-Inch
Storage
Display Unit

Erase Signal

FIGURE

3-Storag~tube

terminal

Viewing
Screen

262

Fall Joint Computer Conference, 1968

Microfilm-facsimile terminal
The microfilm-facsimile terminal, shown in Figure 4,
consist of a high-resolution cathode-ray tube with its associated sweep and focus circuitry, an automatic cameraprocessor, and control logic required to operate the terminal. On command from the central station the microfilm-facsimile terminal will reconstruct on the face of a
high-resolution cathode-ray tube the image of a full
page of text from a video sign9.1 of 4.5-MHz bandwidth
transmitted from the central station. The automaticcamera and film-processor unit will record on 35-mm
film the image of the text displayed on the cathode-ray
tube and deliver to the user a fully processed strip
of film in a convenient form for viewing in a microfilm
reader.
The operation and configuration of the high-resolution cathode-ray tube with its associated sweep and
focus circuitry is described in the Intrex Semiannual
Activity Report dated 15 March 19672 and Reference 6.
The operational requirements for the camera and film
processor are as follows:
1. The automatic-camera and film-processor unit

2.
3.

4.
5.

shall record on 35-mm film the image of a full page
of text which is obtained in a single scan and displayed on the screen of a high-resolution cathoderay tube. It shall also deliver to the user a fully
processed strip of film in a convenient form for
use in a microfilm viewer.
Each strip of film will contain a mini.mum of one,
and a maximum of ten, adjacent images.
The maximum combined length of unexposed
leader and trailer on each film strip shall be five
inches.
The film transport of the camera and processor
shall handle unperforated 35-mm film.
The microfilm-facsimile terminal shall not require
an attendant for normal operations and the camera and processor shall not require routing main-

tenance, other than the loading of film and chemicals, more than once per week.
6. The camera-and-processor unit shall be designed
for operation by electrical-control signals.
7. In view of the experimental nature of the terminal,
the camera-and-processor unit shall be designed
with emphasis on flexibility; that is, it shall be
possible to change the type of film, the size of the
image on the film, the type of chemicals utilized,
or the lens, without major equipment alterations.
Since no camera-and-processor unit that satisfactorily meets all the above requirements was found to
be commercially available, a Kodak MCD-II microfilm camera and GAF Transflo Type 1206 leaderless
film processor were purchased and have been merged
into a camera-and-processor unit. 2
Display software

Display software operates in the time-shared computer and the small computer contained in the buffer/controller. The time-shared-computer software' provides
the more sophisticated segments of the man-machine
dialog, handles the thesaurus, and the search routines.
The small-computer software provides the user with
the simple segments of the man-machine dialog, simple
editing procedures, buffer/controller storage management, and communications control between the user
console and the time-shared computer.
The combination of these two software packages
makes a very versatile system such as is required in the
types of experiments to be conducted by Project Intrex.
Console software2 is being developed simultaneously
with the console hardware with close communications
between the two development programs in order to effect design modifications in both programs so as to produce realizations of tasks that simultaneously make
efficient use of hardware and software. This paper will
not discuss the details of the software packages.
An example

Film
Processor

Co

ite

Signal

FIGURE 4-The 35-mm film copy terminal

Let us illustrate some of the ~eatures that are being
included in the lntrex augmented-catalog and t?xt-access system by means of a simple dtalog that could occur
during an operating session using the display facilities
described here.
The User establishes his right to use the informationtransfer system by typing on the console keyboard the
appropriate identification. The System (S) indicates
that it is prepared to servic~ th~ User (U) by displaying
READY at the console. The dia'og may then continue
as follows:
. U: Search for infonnation on display consoles.

Computer-driven Display Facilities

S: Search being made for informat:on on display consoles. Search will be completed within X seconds.
(Two features are noted !n the system's reply. First it
repeats the query made in order to ensure that it has
received the proper request. Second, the number X is
determined by the present demands on the System. If
it is lightly loaded, for example, X would be very small,
whereas a heavily loaded System would have a larger
value of X.)
... By X seconds, the dialog continues ...
S. Five hundred documents found. Do you wish
titles?
(The number of documents that is found in a search is
usually an easy criterion for a user on which to base his
next step.)
U: No. Search only for documents on digital..computer display consoles.
S: Fifty documents found. Do you wish titles?
U : No. Search only for documents on alphanumeric
consoles published since 1966.
(Two qualifiers [more could be usedJ have been used
in this request, plus, the user simply says "consoles"
instead of "display consoles" since all documents now
being searched are concerned with display consoles.)
S: Ten documents found. Do you wish titles?
U: Yes.
(Ten documents is a manageable number.)
S: (Displays author, title, publication data, and the
library identification numbers of the ten documents on the console CRT.)
U. Erase documents number 2 and number 7.
(By inspection the User knows he does not want to see
these two documents. He can make this command in
several ways. First, he could point to the document
descriptions 0)1 the screen with the light pen and push
the ERASE function switch. Second, he could point
with the cursor and push the ERASE function switch.
Third, he could type the command directly.)
S: (Displays the remaining eight documents, renum
bering them 1 through 8.)
U ; Display technical levels of the documents and
group the documents together that are of the same
technical level.
S: (Display three groupings of documents. The first
group of two documents are under the "primer"
heading, the second group of five documents is
under the "company report" heading, and the
third group of 1 document is under the "recent ra-

263

search" heading. Documents are again renumbered in the order in which they are displayed.)
U: Display the abstracts of these documents. (The
. User points to documents number 2 and number 8
with light pen.)
S: (Display the two abstracts).
U: Print out abstract and previous data on document
number 2.
S: (Makes a hard copy of author, title, pUblication
data, library identification number, technical
level and abstract of document number 2.)
U: Is the full text of this document available?
S: It is available in the text-access retrieval unit, on
microfilm and in bound volume. Volume on loan.
Due· back in five days. Call number is 617 369
2257.
(At this point the User could place himself on the waiting list for the volume, he could order a microfilm copy
of the document, or he could place the console into a
"text-access mode." Suppose he does the latter.)
U: Go into text-access mode, and show me page 1 of
document number 1.
S: In text-access mode, document number 617 369
2257, page 1 is being displayed on the text-access
console. (This page is displayed on the StorageTube Terminal which is adjacent to the augmented catalog console.)
U: Show me the next page of the document.
S: (Displays page 2 on Storage-Tube Terminal.)
(At this point the User can access all pages of the document by "remotely turning pages" back and forth. If,
on this inspection, he decides that he wants a copy of a
certain page(s) he .could request a microfilm copy [or in
future systems, paper copy] to be generated at the Film
Output Terminal that is located in close proximity to
himself. If he found the name of a new reference, or obtained a new lead upon reading the document, he could
return· to the augmented-catalog mode, and conduct a
new search.)
This example can only give one the most rudimentary
idea as to the operation of the display facilities being
implemented at Project Intrex. Space considerations do
not allow further elaborations in the area of operation of
facilities.
(Joti)Jole mechanical design

Heretofore not much has been said about the mechanical design features of the consoles. A great deal of
design effort is being applied to the human engineering
aspects of the consoles since it is imperative that the
user's initial contact with the consoles, the only part of

264

Fall Joint Computer Conference, 1968

the Intrex experimental library which the average user
sees, be a pleasant one. The objectives here are to retain sufficient flexibility in the initial consoles to permit
effective user evaluation of various features and options
while at the same time to maintain a finished look to the
consoles.
The augmented-catalog console takes the form of a
two-pedestal desk. One pedestal houses the console
electronics and the second pedestal is free for storage
of user's materials. Figure 5 is an artist's sketch of the
console. The display CRT is in a movable mount that is
attached to the center rear of the desk. This places the
display directly in fro~t of the user at a comfortable
distance from his eyes and hands. The mount allows the
display CRT to be moved up or down, left or right, and
to be tilted up or down to accommodate user preference.
The movable mount is normally firmly locked to its supporting member and is released with a single pushbutton for adjustment. Since the mount is counterweighted,
its position can be changed with a minimum amount of
effort while the user is sitting down.
The CRT programmable buttons are on the displayCRT mount located at the bottom of the CRT, as
shown schematically in Fig. 2. The keyboard is connected to the console with a cable of sufficient length to
permit positioning it anywhere on the surface of the
desk.
The text-access user terminals are receiving similar
attention. Furthermore, integration of the text-access
and augmented-catalog user terminals is under study.
SUMMARY
Two basically different computer-driven display facilities for an experimental computer-based library have
been described. The first facility is for catalog access. It

is designed to· operate on digitally-stored catalog data
in an interactive mode. It consists of several user consoles that are connected by means of coaxial cables to a
station containing a drum memory, and a small digital
computer. The station in turn is connected by common
carrier lines to a time-shared computer to which the data
banks for the augmented library catalog are attached. A
user console has an alphanumeric, refreshed-CRT display (which is maintained by the drum memory in the
station), a typewriter keyboard, mechanical function
switches with fixed and dynamically- programmable
labels, and a light pen. The small digital computer in the
station allows the user to do simple operations on the
displayed data and to obtain a certain amount of tutoring on system use without recourse to the central timeshared computer, thus relaxing demands of a single
catalog user on the resources of the time-shared computer and the communications facilities serving it.
The second display facility is for text access. It is designed to operate in the full-text photographic images of
the documents in the library. It consists of several user
terminals and microfilm-processor terminal which are
connected to a microfiche storage and retrieval unit by
coaxial cable. The storage and retrieval unit in turn is
connected to the station containing the drum memory
and small digital computer by common carrier lines. A
user terminal has a storage CRT that is driven in a facsimile mode to produce a soft copy of the images, and
some mechanical function switches. Control of the terminal is through the augmented-catalog console. The
microfilm -processor terminal produces microfilm copies
of the text image when requested to do so by a user at
a text-access telminal.
The display facilities are presently being constructed
at the Electronic Systems Laboratory of M.LT. and is
scheduled to become operational the fall of 1968. It is
expected that the Intrex experiments will provide new
insights into the functional characteristics of· display
facilities ideally suited for a computer-based augmented
library catalog and full-text access. As new functional
characteristics are identified they will be incorporated
into the facilities described here. Thus, we view the facilities described here. as the first of a series of experimental display facilities to be implemented.
ACKNOWLEDGMENT
The author wishes to. acknowledge the people in Project Intrex and the Electronic Systems Laboratory for
their many contributions to the work reported here.
REFERENCES

FIGURE 5-Augmented-catalog console

1 C F J OVERHAGE R J HARMAN (eds)
IntreJ; report of a planning conference on inJormation transfer
experiments

Computer-driven Display Facilities
The MIT Press Cambridge Massachusetts 1965
2 Project intrex semiannual activity reports

3

4

5

6

MIT Project Intrex Cambridge Massachusetts 15 March 1967
15 September 1967 15 March 1968 15 September 1968
A R BENENFELD
Generation and encoding of ihe project intrex augmented-cata/o{!
data base
Proceedings of the 6th Annual Clinic on Library Applications
of Data Processing University of Illinois Urbana Illinois 7 May
1968
DR HARING J K ROBERGE
The augmented-catalog console for project intrex part I
MIT Electronic Systems Laboratory Report ESL-TM -323
October 1967
DR HARING
A display console for an experimental computer-based augmented library catalog
Proceedings of the 1968 ACM National Conference August
27-291968 Las Vegas Nevada
U GRONEMANN S TEICHER D KNUDSON
Remote text access for project intrex
MIT Electronic Systems Laboratory Report ESL-TM-312

265

July 1967
7 Project MAC progress reports
MIT Project MAC July 1963 July 1964 July 1965 July 1966
8 D MEISTER D SULLIVAN
Evaluation of user reactions to a prototype on-line information
retrieval system
NASA Contractor Report No NASA CR-918 October 1967
Prepared under Contraet No NASw-1369 by Bunker-Ramo
Corp Canoga Park California
9 MMKESSLER
The MIT technical information project
P~ysics Today Vol 18 pp 28-361965
10 C T MORGAN J S COOK III A CHAPANIS M W
LUND (eds)
Human engineering guide to equipment design
McGraw Hill Book Company Inc New York New York 1963
11 HHPOOLE
Fundamentals of display systems
Spartan Books Washington DC 1966
12 RLSIMMSJR
Trends in computer/communication systems
Computers and Automation May 1968 pp 22-25

Response time in man-computer conversational
transactions
by ROBERT B. MILLER
International Business Machines Corporation
Poughkeepsie, N ew York

Operating needs and psychological needs

INTRODUCTION AND MAJOR CONCEPTS

An example of an operating need is that unless
a given airplane's velocity exceeds its stall speed,
the airplane will fall to earth. Velocity above stall
speed is an undebatable operating need. In a superficially different context, it is a "fact" (let's
assume we know the numbers) that when airline
customers make reservations over a telephone, any
delays in completing transactions above five minutes will reduce their making future reservations
with this airline by 20%. A related form of need
in this context is that the longer it takes to process
one reservation, the larger the number of reservation clerks and reservation terminals that will be
required. These are just two examples of the context of. operating needs. This report will not look
into the problems of operating needs except to
mention when they may be more significant than
a psychological need. The following topics address
psychological needs.

The literature concerning man-computer transactions abounds in controversy about the limits of
"system response time" to a user's command or
inquiry at a terminal. Two major semantic iss,ues
prohibit resolving this controversy. One issue
centers around the question of "Response time to
what?" The implication is that different human
purposes and actions will have different acceptable
or useful response times.
This paper attempts a rather exhaustive listing
and definition of different classes of human action
and purpose at terminals of various kinds. It will
be shown that "two-second response" is not a universal requirement.
'The second semantic question is "What is a need
or requirement?" In the present discussion, the
reader is asked to accept the following definition:
"A need or requirement is some demonstrably better alternative in a set of competing known alternatives that enable a human purpose or action to
be implemented." This definition intentionally
ignores the problem of value versus cost. It is not
offered as a universally useful definition of "need."
It does enable us to get into a systematic exposition of problems, alternatives and implications. A.
value-based definition, in contrast to the rational
one given here, inevitably leads to a vicious regress
that dead-ends only with the 'agreement that all
that humans really need are food, water, and a
place to sleep.
Another point of view, compatible with the
present one, is that need is equivalent to what is
demanded and what can be made available; need,
therefore, is a cultural and technical outcome. It
is the outcome of many vectors, at least one of
which is what the marketplace has to offer and
the number of Joneses who have one, too.

Response to expectancies
Psychological "needs" (in the information processing context) have two major forms, with overlap. One is in the nature of response to an expectation. If you address' another human being, you
expect some communicative response within x seconds-perhaps two to four seconds. Even though
his response may not have the message context
you want, you expect him to respond within that
time in some fashion, if by no more than a clearing
of the throat or a grunt. In conversation of any
kind between humans, silences of more than four
seconds become embarrassing because they imply
a breaking of the thread of communication. This
is similar to a phone line going dead. Conditioning
experiments (which, of course, should be intro267

268

Fall Joint Computer Conference, 1968

duced only with great caution in the context of
cognitive activities) suggest an almost magical
boundary of two-second limits in the effectiveness
of feedback of "knowledge of results," with a peak
of effectiveness for very simple responses at about
half a second. There is much evidence to suggest
that two seconds in human behavior is a relatively
long time. Of course even the lower animals can
be conditioned (acquire expectancies) to delays,
although as the delay is extended the reliability of
the performance rapidly deteriorates. The parameters differ for different species.
These points are made only to suggest that the
behavior of organisms is time-dependent, and that
time spans in the order of one to ten seconds have
significance for some f'Orms of behavior involving
information transactions with an environment.
Activity clumping and psychological closure,
There is a second class of psychological need in
communications. This need recognizes that humans spontaneously organize their activities into
clumps that are terminated by the completion of
a subjective purpose or subpurpose. When I search
in a phone book for a telephone number with
which to dial a person I want to talk with, I have
a sense of temporary completion when I find the
telephone number. I have another when I have
completed dialing the number. I will more readily
tolerate an interruption or delay after such a completion than during the activities preceding thiR
completion. Psychologists call this subjective
sense of completion a "closure" and that is the
term used henceforth in this report. Tl}e rule is
that more extended delays may be made in a conversation or transaction after a closure than in
the process of obtaining a closure.
Human short-term memory
Here is a rationale for this phenomenon. Performing any task calls for holding a body of information in mind-I call this short-term memory.
When I am .looking up the telephone number, I
am holding in mind the image of the name I am
searching for as well as the goal-which. is locating this name in the list. .When I shift from
temporarily memorizing the telephone number to
dialing it, short-term memory is holding this set
of digits and the goal action of completing the
dialing. An interruption or delay in achieving a
goal usually results in a degree of frustration. The

longer a content must be held in short-term memory, the greater the chances of forgetting or error.
Thus, on both counts (short-term memory and
goal aspiration), waiting times within a clump of
activities have deleterious effects. A psychological
closure results in at least a partial purging of
short-term memory or the internal activities that
support it.
In very complex problem solving, short-term
memory is heavily filled. It is becoming clear in
the psychological literature that the degree of complexity of problems that can be solved by a human
is dependent on how much information (and in
what form) he can hold in short-term memory.
~uman memory is never passive. Spontaneous
noise from within the thinking system, as well as
(ii~tracti'Ons from outside, can interfere with
short-term memory contents, and of course these
effects rapidly increase when the individual has an
awareness of waiting. This awareness comes as
soon as several second s-two seconds still seem to
be a good number here.
That is why the tasks which humans can and
will perform with machine communications will
seriously change their character if response delays
are greater than two seconds, with some ,possible
extension of another second or so. Thus, a system
with response delays of a standard ten seconds
will not permit the kind of thinking c'Ontinuity
essential to sustained pr'Oblem solving, and especially where the kind 'Of problem or stage of its
solution contains a high degree of ambiguity.
Such a system will have uses, but they will be
different from those of a two-second system.
Psychologi,cal step-down discontinuities with
increasing response delays
The point here is that response delays are not
merely matters of "convenience" to the user, unless the word "convenience" is made to mean more
than it usually does. There is not a straight-line
decrease in efficiency as the response delay increases; rather, sudden drops in mental efficiency
occur when delays exceed a given point. These
sudden drops at given delay points can be thought
of as psychological step-down discontinuities.
Thus, a ten-sec'Ond response system (aside from
operating inefficiencies) may be no better for
the human-in some tasks at least-than a 'Oneminute resnonse or a five-minute response. If the
human diverts his attention from the thought
matrix (e. g., waiting to be filled or completed by

Response Time in Man-Computer Conversational Transactions
system response to some other train of thought),
the significance of response delay changes dramatically.
The statement that "In the past it took two
days to get an answer to a question that now is
given in fifteen minutes" means, perhaps, an increase in operating efficiency for the system, but
does not in itself materially change the cognitive
(psychological) behavior of the person getting
the information.
Psychological closure comes in different degrees.
In the telephone example, I get a partial closure
when I find the name in a telephone book, another
when I complete dialing the number, and another
when I am talking to the right person. Talking
to the person I have in mind completes the closure
of the series of transactions that led to hearing
his voice and name. Just as there is a hierarchy
of closures in a given task or goal-directed behavior sequence, so there are probably varying
amounts of acceptable delays. The greater the
closure, the longer the acceptable delay in preparing for and receiving the next response following
that closure.
A general rule for guidance would be: For
good communication with humans, response delays
of more than two seconds should follow only a
condition of task closure as perceived by the human, or as structured for the human.
Response time, or system response time, has
not yet been defined in this report, so that the
two-second rule applies to "meaningful replies"
to _human requests or commands, and these are
defined, along with others in the pages to follow.
In addition to definitions and examples of inquiry and response modes, estimates are made of
acceptable response times.
Som,e qualifications about the analysis
The analysis of qualitative behavior and conversion of the analysis into quantitative limits -is
prone to misinterpretation. This is especially true
when the subject is human behavior. Therefore,
the following provisos are made explicit.
1. The ,classes of response categories are not
exhaustive.

The seventeen types of response category
and response time cited in the next section
of this report are certainly not exhaustive
of all the possibilities. Without too much

269

strain, however, they seem to cover a large
proportion of interactive behavior between
humans and information-processing systems.
2. A response signal can ,communicate several
messages at the same time.
A signal can communicate several messages
to the user concurrently. Thus, if the system replies to a user query or command
with the statement that is the equivalent of,
"I've started doing your work," the user
knows (a) his request has been listened to,
(b) his request has been accepted, (c) that
an interpretation of his request has been
made, and (d) that the system is now busy
trying to provide him with an answer.
In the next section, the elements listed
above are differentiated into four different
kinds of response, but in system operation
they may (or may not) be combined into a
single communication. If so, the response
time that should be met is that demanded by
the component in the group which demands
the fastest response time.
3. The language in the text does not indi,ca te
the form of inquiry or response.
In most cases, a topic will be introduced
by a title such as "Response to 'Here I am,
what work should I do next?'" This expression is intended to simplify communication to the reader of the report. It does not
imply that these words would be entered as
such into the system. In many cases, the
expression of the inquiry, or of the system's
response, may be implicrt in some other
behavior. Thus, lifting the telephone receiver and putting it to my ear has the
implicit question, "Are you listening to me
and can you give me service?" The dial tone
says that it can.
The reader, therefore, is urged to look
at the context under a topic title for proper
orientation.
4. Tasks can be done in other than the conversational mode.
Whereas in traditional batch activities by
computer or by humans, responses to queries
may have taken days, a' response time of

270

Fall Joint Computer Conference, 1968
two seconds may be stipulated in the following pages. Therefore, the critic will ask:
"Isn't a response time of 30 seconds or even
an hour, better than 24 hours? If so, why
isn't it good enough?" The answer must be,
"Yes, 30 seconds is better than 24 hours
for some purposes, but it is not good enough
to maintain the continuity of human thought
processes." Where discontinuities in human
thought processes are irrelevant or unim.portant, both to effective problem solving
and to effective use of the professional's
time, then the conversational mode is beside
the point. But it will be easily demonstrated
that many inquiries will not be made, and
many potentially promising alternatives will
not be examined by the human if he does
not have conversational speeds-as defined
in this report-available to him. But tasks
will still be completed as indeed they have
been in the past, without conversational interaction, and at least some of them will be
completed more poorly by any criterion.
This assertion is certainly a testable hypothesis.

5. Permissible ranges of variation are not cited.
Any specification intended for implementation should include not only a nominal value
but acceptable tolerance values within which
the nominal value may randomly fluctuate.
These tolerance limits are not generally
specified for most of the response time
values cited in the following pages. In
principle, the range of acceptable variation
of delay in a given category of response
time is that range within which the human
user cannot detect differences under actual
conditions of use. By "use" is meant the
context of the human performing a task in
which the delay of the response element
occcurs.
Some laboratory data * of indirect reference are available for making preliminary
estimates of response time tolerances. Subjects judged intervals between clicks as
"same" or "shorter" or "longer" than a
comparison or reference interval between
clicks. They gave their full attention to
*See in S. S. Stevens, Handbook of Experirnental Psych')[ogy,
Chap. 32, "Time Perception" by H. Woodrow.

making these judgments. When the duration of the interval was between 2.0 to 4.0
seconds, the subjects made 75% correct
judgment of "same" or "different" at the
limits of an interval between minus 8 % of
the stimulus and plus 8 % of the stimulus.
For example, 75% of the time an interval
of 1.84 seconds was judged shorter than 2.0
seconds, and an interval of 2.16 was judged
longer than 2.0 seconds. This is about the
same as giving a "tolerance" range of 160/0
of the value of the stimulus. This value of
161'0 applies in the range of 2.0 to 4.0
seconds.
The most accurate jUdgments of time
(under these experimental conditions) were
between 0.6 and 0.8 seconds where the tolerance range is somewhat less than 10% of
the value of the stimulus duration (e. g.,
10% of 0.6 seconds delay between clicks).
With intervals longer than 4.0 seconds such
as 6.0 to 30 seconds, the equivalent tolerance
ranges were shown to be 20 to 30%. Substantially the same .relationships held where
the interval was started and stopped with
a pulse of light.
The foregoing results were based on carefully controlled stimuli and full attention
to the interval by the subjects. Where the
stimulus changes from one display to another, and where there is subjective variability introduced by the human operator
making a control response that initiates a
machine delay, it is likely that response
time variations may exceed these tolerances
substantially. By exactly how much would
require empirical data from subj ects in
simulated task environments.
Of indirect significance to this report are
the findings by a number of investigators
(cited by Stevens) that the time interval
that bounds what is subjectively felt as the
"psychological present" is between 2.3 to 3.5
seconds, although under some special conditions the boundary may extend to 12 seconds.
This interval contains "the physical time
over which stimuli may be spread and yet
all perceived as present . . . the maximal
physical time over which may extend a
temporal stimulus pattern . . . which is
perceived as a whole."

Response Time in Man-Computer Conversational Transactions
Basis of response-time estimates
The estimates of delay times offered in the followin'g pages are the best calculated guesses by
the author, a behavioral scientist, who has specialized in task behavior, including thinking and
problem solving. These estimates are based on
rationales, some of which are cited above and
others in context. They should, indeed, be verified
by extended systems studies-not in artificial
laboratories using abstract tasks-but in carefully designed, real life task environments and
problems. The human subjects in these studies
must have had many dozens of hours practice in
acqu~ring .r,elevant task skills (and not merely in
manIpulatIng the controls at the console) in order
for the findingst 0 be useful. Novices have their
short-term memory registers heavily filled with
what they are trying to learn; therefore they
~re not guides as to what the problem-;olving
user (or other user) will be able to do and want
to do when he is highly skilled. Traditional research practices in psychological laboratories
would delay, answe~s on these questions for years,
however, and perhaps provide them after a new
generation of large data-base systems are already
on the market.
Nevertheless, the reader should accept the
parameters cited as indicative rather than conclusive. It is relatively easy to arrange demonstrations for the skeptic about short response times
that will impress him 'with how long four seconds
can seem to be. The demonstration requires merely
that he become absorbed, motivated, and emotionally aroused by the demonstration task.
De~itions

of response time

. Response to human inC'tiry, with few exceptIons, serves as feedback to a continuity of
thought. Human behavior occurs at a variety, of
information handling levels. Different kinds of
response and response delay will be appropriate
at different behavior levels. The definitions that
follow depend in part for their time estimates
on psychological rationales given in Part I of' this
report.
Topic 1. Response to control activa:tion
This is the indication of action given, ordinarily,
by the movement of a key, switch or other contro~ member tha~ signals it has been physically
actIvated. The chck of the typewriter key, or the

271

change in control force after moving a switch
past a detent position are examples. They indicate responsiveness of the terminal as an object.
This response should be immediate and perceived
as a part of the mechanical action induced by the
operator. Time delay: No more than 0.1 second.
See also Topic No. 13, "Graphic Response from
Light Pen."
A second form of feedback to the user at a keyboard is evidence of the key's being struck. In a
typewriter, this is given by the printed character
on the paper. This appears practically simultane.
ously ,( to the user) to striking or activating the
key. Even if printed feedback of text being entered by the user goes through the computer before it is printed on the platen or CRT, the delay
between depressing the key' and the visual feedback should be no more than 0.1 to 0.2 seconds:
(Note that this delay in feedback may be far too
slow for skilled keyboard users. These people are
able to attend to the display, not the keyboard,
while activating keys, and they will be aware of
an out-of-synchronization relationship between
ey~ and hand. Some' adaptation can be made-the
mechanical pipe organ had delays estimated at between 0.1 and 0.2 seconds. Part of the organist's
skill was learning to adapt to this delay. Recognize, however, that the sense of hearing is more
time-dependent than the sense of vision.)
If the light pen is used to select characters for
a message, confirmation by brightening the selected character should be identifiable by the user
within 0.2 second.
Topic 2. Response to "System, are you
listening?"
The hum of the dial tone is the response the
telephone gives to' this implicit query. No dial
tone means: "There's no point in trying to do anything further on this channel now."
Time delay: Up to three seconds. The time for
onset of this response may be variable, but at some
cost in user confidence. Confidence will, of course,
be highest if the response signal begins within a
second after activating the ON ·switch.
Comment: These statements apply only, to the
condition in which the user is becoming "initialized" in a session with the console. If he is actively engaged in a working conversation with , the
console, he must get immediate (as perceived by
him) attention for making an input to the system
such as pressing a control key or other form of

272

Fall Joint Computer Conference, 1968

·entry. Having to wait four seconds, or even half
a second for any reason, when he wishes to enter
information is violently disrupting to thinking.
This question has two levels. On the first level,
the user wants to know if the system is available
to )Vork for him. After favorable acknowledgment, the user-depending on his task--will specify the programs and data he requires for his
"private working area" at this session.
Topic 3 Response to "System, can you do
work for me?"
A. Because in many cases a "yes" or "no" to
the question of system availability may depend on
the kind of work to be done, the user must key
in'a request for a given service. As the user does
this, he is becoming psychologically locked into a
conversation, and his capacity for annoyance' with'
the quality of service is increased.
Time delay: For a routine request (as defined by
the user perf'Orming a task) the acknowledgment
should he within two seconds. A routine request
is likely to be a demand for an information image
in the store. For an impromptu, complex request,
the delay may extend to five seconds.
B. The loading of the programs and data called
for by the user should be within 15 seconds, although delays of up to one minute should be tolerable. The user will spend his time during this delay in arranging whatever notes he has, and in
organizing his thoughts preparatory to work.
C. Response to the user requesting "Set up my
job f~om where I left off yesterday" should be
within 15 seconds for most favorable acceptance,
up to one minute fur acceptance.
Topic 4. Response to "Sy!stem, do you
understand me?"
This implicit query may precede Topic 3, or be
concurrent with it. Assume the user has entered
a 7-digit telephone number as a single, meaningful operation. If he has made an error that the
system can detect, he should be allowed to complete his s·egment of thought hefore he is interrupted 'Or told he is locked out. After two seconds
and before four seconds following completion 'Of
keying in his "thought," he shQuld be informed of
his error and either "told" to try again, or told 'Of
the error he made.
Comment: It is rude (i.e., disturbing) to be interrupted in mid-thQught. The annoyance 'Of the in-

terruption makes it more difficult tQ get back to
the train of thought. The two-second pause enables the user to get his sense of completion following which an error indication is more acceptable.
Topic 5.

Response to Identification

Assume a badge-reader type of terminal. The
user is on his way to his work station 'Or. is at his
work station.
He inserts the card, badge, or other identifying
medium. Ideally, he should have two kinds 'Of
feedback.

Feedback to correctly positioned card. This
should be in the 'Order of direct mechanical
response, such as activating a detent or producing a click 'Or snap, with a delay 'Of less
than 0.4 to 0.5 second. If failure to position
the card properly occurs rarely, this form of
feedback is unnecessary.
2. Feedback saying the equivalent" of "OK, I've
read you." This reSPQnse time should be
within two seconds, and be a fixed length of
time. In general, people on their way to an
activity experience mild annoyance at having their progress interrupted in' order to
be identified as an employee. The annoyance
may be mitigated by making the interrupti'On brief, simple, and standardized so that
it can be accomplished practically by a
series of reflex actions. That is why the
confirmation of the identification shQuld be
made. to the user in a standard length of response time. When a user clocks out, he is
apt to be even more impatient with impediments. Then, a two-second delay will seem
four times as long as a 'One-second delay.
Another factor in identification speed is .
th~ bottleneck likely to exist at entrances tQ
work locations where many employees arrive at about the same time. Small lines 'Of
employees were informally observed as they
punched hi at time clocks. Cycle time per
.employee-when he had his time card in
his hand-was about three seconds at the
clock. The clock itself had a response time
of about one second after the time card was
seated. Cutting this response time to 0.5
second would reduce the cycle time per employee by 16 %, assuming other factors rem~ined constant. But if the response time
1.

Response Time in Man-Computer Conversational Transactions
was four seconds, and it were to be cut to
one second (and the 'Other factors remained
c'Onstant), people would pass through the
line twice as fast with a one-second delay
as with a four-second delay imposed by the
action of the mechanism.
Comment: The delays prop'Osed in this secti'On are
intended t'O apply only to that kind of identification implied by the statement, "Here I am and
ready t'O go to work." Where the user sits at an inquiry terminal and says, symbolically, "This is
who I am and I want to use your facility," a longer
delay in acknowledgment is likely to be acceptable-say, up to five or seven seconds. (Note that
this estimate is consistent with that 'Of "Response
to, 'System, can you do w'Ork f'Or me?' " when the
user is initiating an impr'Omptu, c'Omplex request.
See T'Opic 3.)

Topic 6. Response to "Here I am, what work
should I do next?"
This inquiry is that of aproducti'On worker in
a factory who has completed an assignment, acknowledged its completi'On, and requests fr'Om the
terminal his next assignment. It is likely that this
will be displayed to him in the form of a printed
slip or card prepared at and by the terminal. Acceptable delays could range from 10 to 15 seconds.
This c'Ondition d'Oes not apply t'O the user in conversati'On with a terminal, such as in computerassisted instruction. If the student has completed
a segment of study and wishes to continue into
another. topic, the delay should be less than five
seconds.
Topic 7. Response to simple inquiry of listed
information
This f'Orm of inquiry presumes that the query
addresses an existing record, or record-string,
which can be directly retrieved and displayed. Example: Part #123456: give physical description.
Or, Richard R. Roe: give man number. Or, Standard circuit #12345: give description.
If a terminal is frequently used by an employee
for this kind of inquiry (say, m'Ore than once an
hour), the response should be within· two seconds.
The employee is likely to have in mind some specific issue which the display response may resolve.
It is als'Olikely that the employee may have to scan
several responses to his queries before hitting on
the frame that fits his intent.

Topic 8.

273

Response to simple inquiry of status

An example would be: "Current order status 'Of
inventory Part Number 123456." This is a simple
inquiry because it asks for one category of information about an unambiguously identified obj ect. The system may have to do s'Ome searching
and processing from several storage locations to
assemble the response. Where the user recognizes
this requirement, the two-second delay limit may
be relaxed to seven to ten seconds.
The user will be holding an idea in mind while
waiting for the response, but it will be a single
idea rather than a complex one. For example,
"Can I or can't I take an order for 2000 items of
this part number?"
Topic 9. Response to complex inquiry in
tabular form
A complex inquiry is one which· requires c'Ollecting and displaying data on the basis of logical
relationships among categories. It assumes an
"image" 'Of the displayed response does not preex. ist in the system. An e.."'{ample : "How many 'Orders
for Product X, placed since January 1, 1967, have
been cancelled to date?" Assume that master records are filed by custome'r name to which details
of the order are added as attributes. These attributes include "date that order was placed," and
"status" -of which "cancelled" is a subcategory.
The system must search these records (perhaps
via indexes) and pull out the relevant items. (This
is a simple example of c'Omplex inquiry.)
The user will certainly have a continuity of
ideas in mind when he makes complex inquiries.
This particular inquiry should get a complete response within four seconds.
Assume, however, the user had asked the same
question for Product X, Y and Z. It would now be
acceptable to display the answer about Product X
within four seconds, about Product Y within four
seconds after that, and about Product Z within
the next four seconds.
The principle here is that it takes time for the
user to assimilate the elements in a complex pattern. In many situations, four sec'Onds per item
would be longer than necessary, and two-second
delays would in all cases be preferable.
If the display is graphic rather than tabular in
format, additional considerations will apply. (See
Topics 13 through 16 on graphics.)

274

Fall Joint Computer Conference, 1968

Topic 10.

Response to request for next page

Assume a graphic or high-speed printer output
at the display. The user has completed reading
or skimming a section of text which overruns into
another "frame." The user activated the "Next
Page" control.
Here, time delay should be no more than one
second until (at least) the first several lines of text
on the new page appears. You can test the annoyance of longer delays by becoming engrossed in
some' text and, when you are about to turn the
page, be restrained from doing so to a slow count
of four by an associate.
Delays of longer than one second will seem intrusive on the continuity of thought.
There is another page-turning condition. This
is when the user is searching for some item of content which may lie on any of several pages or
frames. A half second is a relatively long time,
subjectively, for getting a page turned while
searching for items of information.
A problem may be created when the user wants
to scan through category indexes and therefore
would like to flip pages quickly, unless the index
already exists as an "image." In some cases, however, the index may have to be custom-built on the
basis of the user's specific request. Where this
occurs, the user must be informed that he can expect two-second delays when requesting the next
frame of index terms.
If delays in advancing from a previous frame
to a next frame in a viewing series are more than
two seconds, it is increasingly unlikely that the
user will use this medium for scanning and searching. It seems possible that adequate design of the
application, however, can minimize the need for
impromptu organizations of new indexes on immediate demand.
Skipping a number of pages or frames should
be manageable with the help of a displayed index
on one segment of the screen. The user should be
able to skip ten pages all at once, as rapidly as the
next page would appear.
Topic 11.

Response to "Now run my problem."

Assume that an engineer or scientist has written a short program to solve a specific equation.
He has written the program at the terminal. He
presses the GO button.
(a) How long he will wait with patience will

be partly a function of how long he took to
write the program and enter the data.
(b) His patience will also depend on the number of additional data runs or changes he
expects to make before selecting a particular set of parameters.
(c) His patience will also depend on how anxious he is to get back to other work for
which the calculated result is a step towards solution.
If the result is returned to him within 15 seconds, he may remain at the terminal "in the problem-solving frame of mind." If the delays are
longer, he will, to a corresponding degree, tend not
to think of the terminal and system as in-line with
his thinking, and attempt to fill in the wait times
with secondary activities-probably an unsatisfactory arrangement to him, but less so than staring
at a blank screen, or waiting hours for a response
from the Computation Center. These interruptions may also tend to make him satisfied with a
result after less experimentation than if he could
continue uninterruptedly. (We assume he wants
to see an "answer" before he tries another hypothesis. ) This is a net loss to both system -utilization and a user's problem-solving potential.
Topic 12. Response to delay following keyboard
entry vs. light-pen entry of category for inquiry
Let us distinguish between light-pen entry of a
category of information (such as a request for a
given image or format by touching the light pen
to a code name), and using the light pen as a
stylUS or drawing instrument. In this topic only
the use of the light pen as category or functionselector is relevant.
Because it is easier for a nontypist to select instructions by light pen than by keyboard, he will
expect a faster response to light pen. The difference may be that between the two-second response
time to the light pen, and three-second response
time to the keyboard. We can also expect a one
to one-and-a-half second adaptation time required
by the user for shifting his attention from the
keyboard to the display.
This distinction disappears, however, when the
user is activating a "page-tu'rning" function on the
display he is viewing. If he is continuing the reading of text (graphic or perhaps even tabular rna..,
terial) from one displayed frame to another, one-

Response Time in Man-Computer Conversational Transactions
second delay after activating the control, (light
pen or function key) is a maximum. This is too
long if he is scanning pages while searching for
some specific content. (See Topic 10 which calls
for less than one-second response time.) The user
who is scanning a series of frames will- keep his
finger (or the stylus) poised over the "Advance to
N ext Frame" control, and activat'e it without
shifting his attention from the screen.

275

in an ongoing task-example, localizing the cause
of an exception by means of category search.
Other - examples of such continuity in thinking
would be the use of historical files during problemsolving sessions where the outcomes of these sessions would result in plans and hypotheses for organizational changes (operations research) or for
growth (systems analysis).
Note: Many variables cited in p·revious topics
also apply here.

Topic 13. Graphi,c response from light pen
There are two 'major ways in which the light
pen is used as a stylus (as contrasted with its use
as a control selector or alphameric message composer). One is that of drawing lines on the scope
face where the direction and shape of the line have
significance. That is, the actual path travelled by
the light pen is the input to the system.
Where the lines are drawn with deliberation by
the user-relatively slowly as compared with
slashing sketch strokes-a delay of up to 0.1 second seems to be acceptable. There must not be
variability perceived by the user in this delay.
Another way of using the light pen for graphics
is to compose an image from a "menu" of image
parts. For example, a glossary of references at
the side of the image frame may be symbols of
resistor, diode, transistor, and so forth. The user
places his light pen over one of these symbols and
moves the light pen to the position on the frame
that he wants the symbol to be. A copy of the symbol follows the light pen. The response delay in
the image following the light pen may be as much
as one second because the user is not tracing a line
but positioning an image that, for him, is completed when his stylUS touches the destination for
the image.
Similar delays of up to one second would be acceptable when the user is constructing the format
for a graphic display of, say, a bar chart or line
graph from a menu of symbols.
Topic 14 Response to complex inquiry in
graphic form
Assume the same kind of inquiry as described in
Topic 9 "Response to Complex Inquiry in Tabular
Form" except that the response will be a display
of bar chart, schematic, or graph.
The graphical response should begin within two
seC'onds and certainly be completed within ten seconds if the user is to maintain thought continuity

Topic 15. Response to graphic manipulation of
dynamic models

It is, of course, possible to animate a diagrammatic representation of a logical system (such as
a computer), or a process system (such as a factory or inventory), or a topological system (such
as transportation routings and flow). Pulses can
simulate messages or transactions~ and the thickness of a bar at the input to a symbolic work station may r.epresent the size of a queue. Dynamic.
changes in the distributions of wait times at each
of many stations can be shown on bar charts,
whereas changes in the profiles of the bars show
different patterns of queues or delayg.
Experience with this kind of display is not sufficiently widespread to suggest the limits of analytical perception of human viewers of this kind of
graphical simulation. We can expect that after
many hundreds of hours of stUdious effort with
this form of display, great improvements in perceptual sensitivity, retention, and interpretation
will be achieved by at least some individuals with
talent for it.
The problem-solving user will want at least
three special properties in this kind of display.
One is that of enlarging a segment of a display
field. A second is that of selectively suppressing
details in the representation of action or structure-similar in principle to going from lower
levelt 0 higher level diagrams of a mechanism. A
third will be an easy means of visually enhancing
some given path or paths in a complex representation, while suppressing the remaining content into
visual phantoms.
Response-time limits for these functions are not
even readily c'onjectured. The serious problem
solver will, of course, be prepared to spenq many
hours planning and executing the design, optimization, or simulated test of a complex system facility. Flexibility in his ability to get the display

276

Fall Joint Computer Conference, ·1968

to shift rapidly from one degree of time compression or ,expansion in simulated system behavior,
or from one level of detail to another, will be important. This flexibility. will determine how much
and how well he can perceive, interpret, hypothesize, control, and modify. But putting minimum
limits to the words "flexibility" and "shift rapidly" in the preceding sentences would be premature
beyond the guess that whatever "scenario" of
events the user must comprehend and work with
should be compressible into 50-minute periods of
time. Even this may be 10 times greater than the
chunk of information that even' a problem-solving
specialist can hold in mind and work with as a designer or evaluator.
It is here that we need inventive, developmental
studies somewhat similar to that conducted by the
RAND Corporation in the early 1950's about how
rnucha SAGE operator could assimilate-and under what conditions.
Statements about response times for graphic
simulation of dynamic models will, therefore, not
include even guesses at this point in knowledge.
Topic 16. Response to graphic manipulation in
structural design
Examples of structural modelling are a highway
engineer's designing a bridge, or an engineering
architect's designing a building.
When the designer adds an element to the design, one system requirement is that of applying
sets of algorithmic rules to that design element.
For example, "Only one physical body can occupy
a given space at onet ime/' or "Building codes require that. . . . " Another system requirement is'
remembering what the design~rhas already done.
A third requirement is translating sketch responses into the equivalent of appearance renderings and engineering renderings.
The intensity of design conceptualization demands rapid response from the medium onwhi~h
the designer is working. But the designer will
have to accept some constraints (disciplines) in
how he attacks and sequences or stages his design
effort in order to obtain reasonable system response (I.e., two-second response time, to be informed that he just sketched in a dimension that
violates a rule, or type of rule).
During creative effort, idle time beyond a couple
of seconds by' the designer, while he waits to see
the consequence of a unitary action, will be inhibit-

ing and intolerable. But, after the designer has
completed working out an idea-a chunk made up
of a number of individual actions-he will be inclined to wait a minute or two, while the system
"catches up to him."
Comment: People engaged in creative activities
recognize the relatively large amounts of work
that can be executed during concelltrated and continuous "mental heat" 'in a single session. This
heat can cool off in interruptions lasting less than -'.
a minute. It is this heat of attention that the system should attempt to preserve.
Graphic motion that the designer perceives as
relevant to the design task will help keep his attention and state of arousal, at least if it continues for no longer than ten seconds in consummating some design action. In other words, it is possible to present artifacts to the designer that will
maintain his psychological "coupling" to the' system. .The concept precludes setting fixed response
time limits to various response functions, except
that their limits will be in seconds (usually)
rather than in minutes.

Topi,c 17. Response to "Execute this command
into the operational system."
An example of such a command is a manager's
intervening in an automatic ordering process and
designating an alternate vendor. Or, the manager
may insert a command which, when effected, results in a change in scheduling of some manufacturing operation. Or, as a result of simulation and
modelling of certain activities of the business, a
revised operating budget is introduced and its
implications for a number of affected departments
are exploded and disseminated.
Although the user should be informed by the
system within four seconds that it has understood
and can interpret the co~mand, its' execution and
final confirmation to the user that the command
has been executed may have long and variable delays of minutes. The user hasterminated one level
of activity when he enters the command. It will
be psychologically incomplete only to the degree
that he expects a feedback telling him of interference with its execution. These delays, howe~er,
are partly dependent on operating activities outside the scope of the automatic system, such as a
remote manager's being unable to accept a budget
cut or change in schedule.

Response Time in Man-Computer Conversational Transactions

Postcript 1
Discontinuity of waiting time at 15 seconds
Assume an inquiry of any kind has been made.
The user-and his attention-is captive to the
terminal until he receives a response. If he is a
busy man, captivity of more than 15 seconds, even
for information essential to him, may be more
than an annoyance and disruption. It can readily
become a demoralizer-that is, a reducer of work
pace and of motivation to work.
If, therefore, response delays of more than 15
seconds will occur, the system had better be designed to free the user from physical and mental
captivity, so that he can turn to other activities
and get his displayed answer when it is convenient
to him to do so.
A possible, but doubtful, exception may arise
when the user is in series with some process or
continuity that demands (as soon as possible) the
answer from him, which, in turn, depends on information he is trying to get at the terminal. In
this case, the operating demands dictate acceptable time delays.
In any event, response delays of approximately
15 seconds, and certainly any delays longer than
this, rule out conversational interaction between
human and information systems.

Postcript 2
Time recovery from errors and failures
A dimension of response time is the question,
"How quickly can I get going on my task again
after something goes wrong?" What may have
gone wrong could have been a machine failure, a
failure in an operating program, an operator error, or an error by the user in mid-task.
The design of the system, including the application, should simplify both the effort and shorten
the time required for recovery as perceived by
the user.
If the user was in simple-inquiry mode, he will
probably have a record of his last inquiry at the
terminal, and can input the inquiry again.
If the user was in complex-inquiry mode, the
last index of categories that he was using before
the failure should have been retained and made
available to him, so that he can pick up his inquiry
from a position of good context.

277

If the user was in conversational problem-solving mode, there should have been retained a copy
of all the parameters and starting structure of the
model he constructed. Reconstructing this model
would, from the user's standpoint, be the most
arduous and unreliable of activities. (As an example of this almost universal dread of work getting lost, many writers and engineers save their
yellow-sheet draft sketches in desk drawers until
the job is entirely completed.) One can tolerate
the loss of a machine run, which can be rerun
later, but the loss of even an hour's creative work
is obviou~ly demoralizing. Rarely does one feel
confidence that the reconstruction has all of the
magic contained in the original.
When a system failure occurs, from whatever
cause, the user is likely to feel an irrational sense
of failure if his job has been lost. In some degree,
it will be remembered as personal failure, and various psychological defenses will be inevitable. (One
form of defense is to avoid the cause of the threat
in the future.) It is therefore desirable, for motivational reasons as well as operating reasons, to
attempt to restore the system as quickly as possible
so that he can pick up and continue. "As quickly
as possible" means "while he is still in dialogue
(or work session) with the system"-and that
means within 15 seconds, or failing that, within
less than five minutes. The system should tell him
how long he may have to be patient, and it should
do so immediately ·after the failure, whatever it
may be.
BIBLIOGRAPHY
WBLAKELY
The discriminatiQ'r/,--'2ishortempty temporal interval
PhD disertation University of Illinois Library 1933
JRNEWMAN
Extension of human capability through information processing
and display systems
System Development Corp Santa M.onica December 196€
HSACKMAN
Experimental investigation of user performance in time-shared
computing systems
System Development Corp Santa Monica May 1967
HSIMON RKMELLON
Reflections on time-sharing from a users point of view.
In Computer Science Research Review
Carnegie Institute of Technology 196f·
SSSTEVENS
Handbook of experimental psychology
Wiley N Y 19S1

Linguistic methods in picture processing-A survey*
by W. F. MILLER andA. C. SHAW**
Stanford Linear Accelerator Center

Stanford,' California

INTRODUCTION
By "picture processing" we mean the analysis and generation of pictures by, computer, with or without
human interaction; this definitjon includes both computer graph~cs and digital patt~rn recognjtion.
A number of people have ad,,\rocated til at picture processing problems be attacke9 with linguistic methods;
perhaps the strongest early exponents were N arasimhan l and Kirsch. 2 The basic:idea was to extend the notions of syntax and semanti~s to n-dimensional patterns
(n> 1) and then apply some adaptation of the techniques of natural and artifical language processing
Several researchers have attempted to develop this concept during the last few years. While the work is still
experimental, several practical uses have been demonstrated and ideas seem to be emerging that could form
the basis of a picture theory.
This paper surveys research in linguistic methods for
describing and processing pictures. The next section
discusses the rationale and application area for a linguistic approach. We then present a .general lingujstic
picture processing model as a basis for the survey discussion.The central idea within this model is that of
a formal picture description. The survey itself is contained in section IV. In the concluding section we extract some common features and difficulties, and indicate directions for future research.
t

Models for picture processing

The term "model" denotes the general framework or
"paradigm" 3 within which workers pose and solve
problems. Until recently, most theoretical work in picture analysis ,has, either implicitly or explicitly, been
, *Work supported by U.S. Atomic Energy Commission and
National Science Foundation, Grant GP-7615.
**Present Address: DE>partment of Computer Science Cornell
University, Ithaca, N.Y.
'

279

based on the receptor / categorizer . model (RCM)
described in Marill and Green. 4
The analysis of pictures (or pattern recognition) proceeds within the RCM: A picture is first reduced to a
"feature set" by the receptor; this is a set of quantities
which may range from the raw digitized values at one
extreme to the results of a complex feature extraction
process on the other. The feature set is then assigned to
one of a finite number of classes or patterns by the
categorizer. The assignment is the recognized pattern
class to which the picture supposedly belongs. Most of
the theory has dealt with the problem of categorization
or classification. The principal technique is one of treating the feature or measurement set as a point in a muJtidimensional space. The task of the categorizer then be·
comes one of partitioning the space so that measurements from pictures belonging to the same pattern class
are ,"close" (according to some metric) and measurements from pictures of different classes are far apart.
(Sebestyen5 and Nilsson6 are references for the RCM.)
The RCM is the basis for a number of recognition systems, notably in character recognition. 7 The model fails
to be useful for analyzing complex pictures where the
structure and interrelationships among the picture components are the important factors. To illustrate this
point in a simple setting, consider the one-dimensional
pattern recognition task required of a pro~ramming language. translator. One purpose of the syntax analysis
phase of the compiler is to categorize an input program
into one of two mutually exclusive classes-the class of
syntact.ically correct programs and its complement.
Theoretically, one can envision a receptor which produces a feature vector from an input program; the
categorizer then determines in which of the two possible
subspaces the feature vector lies. While this can be cone
in principle, it is never considered seriously because of
the complexities involved; for example, what is the feature set for a program? Even if this approach were
practically feasible for program classification, it would

280

Fall Joint Computer Conference, 1968

not produce the most i.mportant by/product of a successful analysis, i.e., a description of the structure of the
input program.
Richly-structured pictures that are difficult, if not
impossible, to analyze within the RCM include those
produced in particle detector chambers by highenergy particle physics reactions; text and standard
two- dimensional mathematical notation (not isolated
characters); line drawings, such as flow charts, circuits,
and mechanical drawings; and complex biomedical
pictures. What is required in these examples is a description of the pictures in which the meaningful relations
among their subparts are apparent. The appropriate
place to apply the RCM is for the recognition of the
basic components of the pictures. In a series of papers,
Narasjmhanl ,8,9,10 has forcefully stated this case:
"Categorization, clearly, is only one aspect of
the recognition problem; not the whole of it by
any means. It is our contention that the aim of
any recognition procedure should not be merely
to arrive at a 'Yes,' 'No,' 'Don't know decision
confusion about aims might have been avoided
if, historically, the problem had been posed as
not one of pattern recognition but of pattern
analysis and description. "I
Much of the research in computer graphics* has been
concerned -primarily with data structuresl l and command and control languages. Picture descriptions are
embedded in the data structures; in fact, the data structure is the description. This could be viewed as a linguistic specification of a picture since the structure (syntax)
and values or interpretations of each structure (semantics) are explicitly contained in the data structure in
most cases. However, the processing (analysis or synthesis) of the pictures is not directed by the data structure description but rather towards them through the
mand and control languages.
In this survey we shall consider only those works
where some attempt is made to describe pictures and
classes of pictures, and use these descriptions to direct
the processing. The analogy to linear language processing is evident and hence the term "linguistic
model"** is employed.
A general linguistic picture processing model

The linguistic model for picture processingl2 is comprised of two parts:
*"Computer graphics" has usually referred to that set of techniques for computer processing of pictures using on-line displays
and plotting equipment.
**Narasimhan1 first used this term as applied to picture processing.

1. a general model within which pictures may be

described (i.e., a meta-description formalism)
and
2. an approach to the analysis and generation of pictures based directly on their descriptions.
The description, D, of a picture, a, will consist of
two parts-a primitive or terminal symbol description T,
and a hierarchic description H. T specifies the elementary patterns in the picture and their relationship to one
another and H describes groupings of the elements into
higher level structures. This can be written D(a) = (T
(a), H(a)). T and H, in turn, each have a syntactical (or
structural) component Ts and H s , and a semantic (interpretation or value) component Tv and Hv. That is,

H(a)

(Hla), Hv(a)) .

Ts(a) names th~ elementary component classes or
primitives in a and their relationship to one another;
T v(a) gives the values or meaning of the primitive components of a. The primitives in T sea) will denote classes;
tet  (  ), for example,
8T(1, 2, 3), where the  labels those points
that may be linked to other phrases. Finally, there are
additional rules of 9 for combining phrases into sentences. The hierarchic description Hs of a picture is a
list of sentences and phrases. Analysis proceeds from the
"bottom up," first labeling all points as basic sets or
roads, then forming phrases and, last of all, sentences.
Narasimhan does not define a general form for either
9 or the description D. In the bubble chamber application, the hierarchic system of labeling imposed by 9
is slightly different than above, starting with points at
the most primitive level; 9 is implicitly defined by the
computer porgram itself. On the other hand, the generation of English "hand-printed" characters is explictly
directed by a finite-state generative grammar 9 and an
attribute list 9 , the latter specifying some geometric
properties of the characters, for example, position,
length, and thickness. The primitives are simple geometric forms, such as straight lines or arcs; the definition of each primitive includes a set of labeled vertices
to which other primitives may be attached. Produc
tions or rewriting rules in 9 are the form:

where 8 1is a terminal symbol (primitive name) or nonterminal symbol (phrase name), 8 2 is terminal symbol,
8 is a non-terminal symbol-the defined phrase-,
ns
IS a list of nodes of concatenation between 8 1 and
. 1 2
S 2, .ns18 and n B2S define the correspondence between the
nodes of 81 and 8 2 that those of 8, and ns is a node list
labeling the nodes of 8. Figure 2 illustrates N arasimhan's rewriting rules for generating the letter "P ," the
primitives required, and the generated letters. All nodes
of possible concatenation must appear in the description; this is cumbersome for simple pictures such as the
English alphabet, and might be unmanageable for more
8

Narasimhan
The pioneering work in suggesting and applying a linguistic model for the solution of non-trivial problems in
picture processing was done by N arasimhan. 1,8 ,9 ,1 0,22,23
He first proposed a general linguistic approach in 1962,
calling it a "linguistic model for patterns" ; he has since
experimented with it in the analysis of bubble chamber

Lingu,istic Methods in Picture Processing

283

PE(l, 2,3) - v • d'(ll, 23; 2, 3; 2)/

{3

{3

r • d'(ll, 23; 2, 3; 2)

H

P-PE

a

H
H

H

O!

I

Rewriting Rules

Sample Production: a € {L, I}, {3 €{H, w}
1

d'

~

~
3

Primitives

.f.

W

H

L

H

I

L

H

I

I

L

B

B

B

R

or

V

Pand PE

FIGURE 2-Narasimhan's generation of the letter "P"

complex pictures. The system can only describe connected pictures and some other mechanism is required
when dealing with pictures whose subparts are not connected. This scheme has been used successfully as part
of an experimental system for the computer generation
of posters. 23 To our knowledge, it has not been applied
to other picture classes.

Kirsch
Kirsch,2 in a stimulating article, argues that the proper way to view picture analysis is within a linguistic
framework. Following this line of thought he poses
several problems: How does one
1. express picture syntax or structure,
2. generalize the idea of concatenation to several
dimensions,
3. describe geometric relations among picture components,
4. do syntax analysis of pictures, and
5. define picture primitives?
Kirsch gives a two-dimensional context-dependent
grammar for 45° right triangles generated in a plane
divided into unit squares; this is suggested as an illustration of the possible form of picture grammars.

A Derived Triangle
:FIGURE 3-Kirsch's rIght trIangle description

Figure 3 contains a sample production and a derived
triangle. Here, Ts is a two-dimensional 45° right
triangle with labeled unit squares (the primitives);
T v is the meaning of the labels. There is no semantic
portion corresponding to the grammar. As Kirsch admits, it is not evident how this approach may be generalized for other pictures; it is also a debatable point
whether context-sensitive grammars are desirable since
the analysis would be extremely complex. More recently, Lipkin, Watt, and Kirsch24 have argued persuasively for an "iconic" (image-like or picture) grammar to be used for the analysis and synthesis of biological· images with a large interactive computer system;
however, the search for suitable iconic grammars continues. The work of Kirsch and his colleagues is notable
for their clear and early recognition of the importance of
a linguistic approach to picture processing problems and
for their detailed enumeration of some of the difficulties.
Ledley

Ledley25 and Ledley et al. 26 employed a standard
BNF grammar to define picture classes. Their pub-

284

Fall Joint Computer Conference, 1968

lished method for the analysis of chromosomes26 •27 il·
lustrates this approach. Here Ledley's "syntax-directed
pattern recognition" is embedded in a large picture processing system that searches a digitized picture for
objects, recognizes the primitives of an object, performs a syntax analysis of the object description, and
finally computes further classifications and some
statistics on all the chromosomes found. The object
primitives consist of five types of curves from which
chromosome boundaries can be generated. An edge-following program traces 'the boundary of an object in the
picture and classifies each boundary segment into one of
theprimitiveclasses; since the boundary is a closed curve,
a linear string or ordered list of its segment types is
sufficient for the description T 8' If T 8 represents a
chromosome, the parse H. will contain a categorization
of it as, for example, submedian or telocentric in type;
otherwise the parse fails, indicating the original object
was not a chromosome. Figure 4 contains samples from
the ch.romosome syntax, examples of the basic curve,
types, and some. chromosome descriptions. Ledley and
Ruddle2 ' state that the human complement of 46
chromosomes can be processed in about 20 seconds (on
. an IBM 7094) using this system-a factor of 500 as

(arm) ::= B(arm>I (arm> BI A

I

(side) : := B(side>l< Side> BIB D
 

Sample Productions

A

B

'0
C

<

~

E

D

Basic Curve Types

compared to manual methods- but no data are given
on the quantity of pictures examined and error rates, or
how their methods compare with others, for example,
chromosome classification by moment invariants. 28 Ledley's work is an example of a direct application of artificiallanguage analysis methods to picture classification.
It is difficult to generalIze this approach to figures other
than closed curves unless relational operators are included as part of 'T 8; in the latter case, the most difficult
task is obtaining T s , not parsing the reSUlting string.
Guzman
Guzman29 ,30 q.escribes pictures consisting of sets of
isolated points and concatenated straight line segments
using a figure description language (FDL). The primitive syntax T is given in FDL by listing every node in
the figure and its immediate neighbors, and adjoining
to this an arbitrary property list; Tv is a list of the
actual coordinates of each node. Figure 5 contain~ two
. possible descriptions of an isosceles triangle and one of a
quadrangle and a rectangle. Hierarchic descriptions and
the equivalent of a grammar may be specified in FDL by
assigning names to both primitive descriptions, and sets
of names and descriptions. This is illustrated at the bottom of Figure 5, where a POLY is defined as either a
RECT or an ISOSl. Several figures may be concatenated to form new ones by listing in a = TIE = state. ment the nodes of concatenation. The FDL language is
used to drive some general scene analysis programs. A
given scene is first preprocessed to produce a symbolic
description in terms of points forming line segments and
isolated points. A scene analysis program then accepts
a series of "models" described in FDL and searches the
scene for all or some instances of the models. Experiments with the system have served to pinpoint a number of extremely difficult problems associated with the
analysis of two-dimensional projections of three-dimensional objects. While restricted to concatenated straight
line segments and isolated points, theFDL language has
some very desirable features. Chief among these is the
ability to define "open" or bound variables (X, Y, and
Al in Figure 5) in the property Hst; this allows an e]egant description of the relations among picture components.
8

Evans

BCBABDBABCBABDBA

BCBABEBA

Submedian

Telocentric

Chromosome Examples

FIGURE 4-Ledley's chromosome description

The earlier work of Evans 31 • 32 on solving geometricanalogy-intelligence test problems employed picture
description methods similar to those suggested by
Minsky.21 Recently, Evans 33 has developed a linguistic
formalism for picture description and an associated pattern analyzer that is driven by a "grammar" 9 written
in the formalism. The syntax of a class of pictures is

Linguistic Methods in Picture Processing
B

A~

_____

~

C

(=OEF= I8OS1 « A (B C) C (B A) B (A

C»

~«LENG

A B X)

(LENG B C X) (VARIABLES X) »)
(=OEF= I8OS2 ( ( A (B C) C (B A) B (A C» ~ «ANGLE B A CAl)
(ANGLE B C A Al) (VARIABLES Al»})

o

B

C

(=OEF= QUADR ( A (B 0) B (C A) C (0 B) 0 (A C»)
(=OEF= RECT (QUADR ~ «LENG A B X) (LENG 0 C X)
(LENG A 0 y) (LENG C BY) (ANGLE 0 A B 900)
(VARIABLES X Y»»
(=OEF= POLY (=OR= (RECT I8OS1) ) )

FIGURE 5-Guzman's FDL notation

given by a set of rules, each of which has four components: (L R P I) (our notation). An exaJIlple of a rule
that we will use in the discussion below is:
(TRIANGLE (XYZ) ( (VERTEX X) (VERTEX Y)
(VERTEX Z) (ELS X Y) (ELS Y Z) (ELS X Z)
(NONCOLL X Y Z) )( (VERTICES (LIST X Y Z»».
The first component, L, names the construct or pattern whose components are defined by Rand P; in the
example, the pattern TRIANGLE is named. R is a list
of "dummy" variables, one of which is associated with
each constituent of the defined pattern. P is alistofpredicates which names the pattern type represented by
each dummy variable, and describes the relationships
that must exist among these patterns. X, Y, and Z are
named as type VERTEX; ELS is a predicate which
tests for the existence of a line segment between two
points, and NONCOLL tests for noncollinearity among
3 points. The last part I of the syntax rule can
specify any computation over the properties of the
pattern components; during analysis, it assigns the result to the new construct defined by the rule. After a
successful analysis TRIANGLE will have attached to .
it the name VERTICES followed by a list of the values
of X, Y, and Z. These attached properties can then be

285

used by predicates in subsequent syntax rules. In terms of
our model, the I component can be viewed as part of the
syntax in some instances or as an interpretation or semantic rule of £l in others.
.
Evan's pattern analyzer assumes that :;t picture is first
preprocessed to produce a list of its primitive elements
and their properties; this is the primitive description T.
The patern analyzer (a LISp34 program) accepts a preprocessed picture and a grammar, and parses the picture
to produce hierarchic descriptions of all patterns satisfying the grammar; the library of predicates may first
have to be extended if new relational predicates appear
in the grammar. While the description and analysis systems are very general, they have only been tested on
simple examples and it is too early to predict how useful
they will be.
Shaw, Miller, and George
In the Shaw papers12 ,35 a picture description language
(PDL) is presented and applied. PDL is a language for
expressing the primitive structural description T, of a
picture. The basic components or primitives may be any
pattern having two distinguished points, a tail and a
head; primitives can be concatenated together only at
these points. The PDL language can describe the concatenations among any connected set of primitives. By
allowing the definition of blank (invisible) and "don't
care" primitives, a large class of pictures may be described in terms of concatenations and simple relations
among their primitive elements; these include photographs produced in high energy particle physics experiments, characters, text, flow' charts, and line drawings
of all varieties.
Figure 6 illustrates the use of PDL to describe a sim-

-

-h
Primitive Classes

T8(~=1

dp+ ( ( (

til

dp+dm

A

l*hf+dmII

4

~

A
Ts(F)=( vp + (h x (vp + h) ) )

FIGURE 6-8haw's PDL language

286,

Fall Joint Computer Conference, 1968

pIe "A" and an "F." For each primitive, the figure contains its class name, a typical member, and an arrow
pointing from its tail to head; for example, h denotes the
set of all horizontal line segments of a restricted length,
with tail at the left endpoint and head at the right endpoint. h can be defined more precisely either theoretically or pragmatically by an equation, an attribute list,
a recognition program, or a generation program. The
tree beneath the "A" indicates how the letter is
generated from its description. The operators +, x, and
* describe particular combinations of tail/head concatenations of their operands. Each PDL expression,
and the pictures they describe, has a tail and head defined respectively as the tail of the first element and
head of the last element in the expression. Thus
(S1 + 8 2) has a tail equal to the tail of 81 and a head
equal to the head of S2; the "+" describes the concatenation of the head of S1 to the tail of 8 2• One more
binary operator (-), a unary tail/head reversal operator (""), and a "rewriting" convention complete the
description scheme. PDL has a number of useful formal
properties that permit descriptions to be transformed
into more convenient forms for processing, and forms
the basis of a picture calculus discus sed in Miller and
Shaw. 36 The primitive semantic description Tv consists
of a list of the primitives and their attributes.
A hierarchic structure is imposed on a class of pictures
by means of a restricted form of context-free grammar
9 generating sentences in PDL. Figure 7 contains
several productions from a flow chart grammar for a
small ALGOL-like language. The tail and head of each
primitive are labelled t and h respectively. The line
segments with arrow heads leading from enter, in and
, cond may be any sequence of concatenated segments
thus allowing the head of these primitives to be placed
anywhere in a picture relative to the tail. The box in in
is a function box and pred represents a predicate or test.
cond may be either the true or false branch of the predicate; the initial blank (dotted) part at its tail carries it
to one of the vertices of the diamond. In the syntax')
the / and superscript labels indicate "rewriting" so that
both appearances of TEST in the STEPUNTIL rule
refer to exactly the same entity. The hierarchic structural description Hs is defined as the parse of T s according to g; no mechanism for attaching arbitrary semantics to 9 has been developed vet.
A goal-oriented picture parser (analyzer) (8haw12) accepts a pattern recognition routine for each primitive
class and a grammar and uses the latter to direct the
recognizers over pictures and produce their primitive
and hierarchic descriptions; tail and head pointers are
moved over the two- or three-dimensional picture space
in a manner analogous to the movement of a string
pointer in linear language analysis. An implemented sys-

enter t

Or----.~ h

exit

tOh

to

pred

• h

cond

or

• h

Primitives

STMNT -

BASIC ICNDTNL

I

I

BASIC -ASSIGN FOR BLOCKb
FOR STEPUNTIL -

STEPUNTIL I WHILE
(INIT + ( ( ( (TEST

sU

+ cond) + STMNTs~

*( - INC) ) x ( (/TESTS~ + cond) ) )

INIT-fn
INC-fn
TEST-pred
Partial Flow Chart Syntax

Stepuntil Element

FIGURE 7-Example of Shaw's flow chart descriptions

tem has been applied to the analysis of some digitized
spark chamber film. Each picture consisted of a data box
with 22 identification digits; 4 fiducial markers C"X"s);
and 2 views of 6 spark chambers containing sets of isolated and collinear sparks. 39 syntax rules were used to
describe the possible contents of all pjctures. The
description DCa) of each picture a was produced in
approximately 7 seconds on an IBM 360/50. With the
picture parser available it took less than 2 man months
to put together the spark chamber system. The spark
chamber application, even though experimental, has
demonstrated certain pragmatically useful advantages
of the above methods. These may be summarized as follows: There can be significant simplifications in
implementing and modifying picture analysis systems

Linguistic Methods in Picture Processing

and one need not pay an exorbitant price in computer
processing time when compared with the more ad hoc
systems in use in various physics laboratories.
GeorgeS7 and George and Miller 36 employ PDL as the
basis of an interactive graphics system. Pictures are
generated and modified on-line by manipulating PDL
descriptions. Pictures can be stored and retrieved by
assigning names to their descriptions; the picture data
structure is the PDL description itself so that the
machine always contains a structured representation.
Any changes to a named sUbpicture are immediately reflected in all pictures that refer to it as a component.
The chief limitations of the descriptive scheme are the
restricted set of relations that may be expresed, the
practical constraints resulting from only two points of
concatenation for a primitive and the absence of a
general mechanism for hierarchic semantics.

term

Graphical Form of Replacement Rule

term--81: expression

P1: cOl> c 21 and c 03 < c 23
and c

Anderson
Anderson 39 ,4o syntactically analyzes standard twodimensional mathematical notation after the primitive
elements or characters have been classified by conventional pattern recognition techniques. The value T of a
primitive is its name and 6 positional coordinates:
X min , Xcenter, X max , Ymin, Y center, Ymax, where (Xmin ,
X mar , Ymin, Ymax) define the smallest enclosing rectangle of the character and the point (Xcenten Ycenter)
is its typographic center. Each syntax rule consists
of four structural parts (elements of 9 ) and one semantic part (element of £1). Figure 8 contains a typical
syntax rule. The meaning of the notation is as follows:

287

> c 26
04

C1: c

82: horizline

P2: ¢

C3: c

83: expression

P3: cOl> c 21 and c 03 < c 23

C4: c

R:

¢

M:

(Sl)/(S3)

and c

06

<: c 24

21

C2: c 22

C5: c
C6: c

23
34
25
16

11

Si: the ith syntactic unit of the right part of the rule.
Pi: a partitioning predicate that Si must satisfy. Cij
is the jth positional coordinate of Si; the positional coordinates above are numbered from 1 to
6 so that C13 represents the 3rd coordinate
(Xmax) of syntactic unit Sl. Coj refers to ·the jth
coordinate of an arbitrary character in the syntactic unit.
R: a predicate testing the spatial relationship among
successfully parsed elements of the right part of
syntax rule.
Oi: each higher level structure (syntactic unit) is
given 6 positional coordinates similar to those of
a primitive. Oi i = I ... 6 defines the 6 coordinates assigned to the left part of the syntax rule
in a successful parse.
M: the semantic rule indicating an action to be taken
or the meaning to be given to the rule.
2

The mathematical expression a + b satifies the syn.
c
tax of "term" in the figure; the typographic center is

Tabular Form of Replacement Rule

FIGURE 8-Example of Anderson's syntax rules

(02, 05) which is defined in the replacement rwe as

the center of the primitive "horizline."
Anderson has described several non-trivial classes of
pictures in this notation including two-dimensional
arithemtic expressions, matrices, directed-graphs, and a
proposed form for a two-dimensional programming
language.
A top-down goal-directed method is used for analysis;
the basic idea is to use the syntax directly to partition
picture space into syntactical units such that the predicates Pi and R are satisfied. The analysis algorithm
has been implemented in several experimental systems
and tested with hand-printed arithmetic expressions in
an interactive mode. He assumes that the primitive·
characters are correctly classified by recognition routines and that the expressions satisfy some reasonable
constraints on their form, for example, the limits above
and below an integral sign must not extend further to
the left than the leftmost edge of the integral sign. Simple expressions can then be parsed. successfully in a reasonable amount of computer t;me. The expression
(C22, C25),

IN Ix I dx takes approximately 5 seconds to analyze on
an IBM 360/50 with an un optimized PL/I version of
the general system; a program optimized especially for
mathematical notation and running on the Digital

288

Fall Joint Computer Conference, 1968

Equipment Corporation PDP-l takes le~s than half a
1 + Z - Z2
second to recognize the expression 1 _ 1 .

Z
One of the virtues of Anderson's model is the provision for arbitrary predicates to test spatial relationships
as part of the syntax. In order to handle this generality,
the analysis algorithm must test a large number of possible partitionings of the picture space before rejecting
an inapplicable syntax rule. However, in the case of
mathematical notation, increased efficiency can be obtained by taking advantage of its normalleft-to-right
flow. While adequate for driving a picture analyzer for a
restricted class of pictures, the descriptive scheme does
not appear suitable for synthesis problems. (Anderson
argues that these two aspects of picture processing are
fundamentally different and should be treated by entirely different methods.) Anderson has demonstrated
the feasibility of interactive mathematics using the
above concepts; he concludes, and the authors concur,
that future efforts could be directed towards engineering
such systems.

Other Works
We conclude the survey by noting several other works
which employ either linguistic methods or closely related techniques.
Clark and Miller 41 use the language of graph theory to
describe spark linkages and the topology of physics
"events" appearing in spark chamber film. These descriptions are embodied in computer programs that
apply elementary graph theory to assist in the decisionmaking process and perform the film analysis. The
primitive elements of the pictures are sparks; a multilist structural provides the description T, and T, of the
spark' connectivies. Hierarchic descriptions result from
combining sparks according to their geometric and
graph properties to form tracks and events. While an
explicit linguistic approach is not employed, the underlying graph model acts as a formal description language
much as in the work of Sherman and Narasimhan. The
above program formed the basis for a practical production system that was used for several physics experiments.
Clowes42 employs a set 9 of Boolean functions on pictures to define the syntactic classes for hand-written
numerals; the successive execution of these functions
from the bottom up serves to analyze and describe the
pictures. More recently, he 43 has been working on a
scheme based on transformational grammars and
Chomsky's model for natural language syntax; Other
efforts which are explicitly linguistic in nature include
Feder," Watt,45.46 Inselberg and Kline,47 Inselberg,48
Breeding,49 Knote and Wiley,50 and Nir.51

A related area of research has been pursued by
Kirsch,2 and, more recently, by Coles52 and others.
N aturallanguage statements about pictures are translated into some formal notation, usually the predicate
calculus; the predicate calculus statement then describes a set of pictures-those for which the statement
has the truth value of true. The natural language statement "Each polygon smaller than a black triangle is a
square," could be translated into the predicate calculus
as '(Vx) (P(x) /\ (a y) (B(y) /\ T(y) /\ Sm (s,y))~Sq
(x) )" which may be read as "for all x, if x is a polygon
and if there exists a y such that y is black and y is a
triangle and x is smaller than y, then x is a square." The
predicate calculus expression directs a picture analyzer
to determine the truth value of the statement with respect to a given picture. By these methods, Coles52 is
able to recognize some fairly complicated electric circuits and chemical molecules drawn on a computer-controlled display. One of the aims of this research is to provide interactive question-answering systems with a
pictorial data base. A principal, and extremely difficult,
problem is that of translating natural language input to
the formal notation. In terms of our description model,
the predicate calculus statement is the primitive structural description T 8; hierarchic descriptions do not exist
in these schemes.
CONCLUSIONS
As this survey indicates, there has been a great deal of
research in picture description methods and associated
processing systems; most of this is recent and is still in
progress. A principal reason for this research has been the
lack of adequate techniques for dealing with complex
richly-structured pictures; we fell that relevant techniques are now emerging. All of the reported work is experimental in'the sense that, to our knowledge, there do
not exist any "production systems" that employ linguistic methods to any large extent. However, in several
instances, notable in the work of Anderson4o and the
authors,12.36 the benefits and practicality of these
methods have been demonstrated.
With the exception of Kirsch's triangle example,2 all
of the descriptive schemes are basically linear. One suspects that the development of explicit two- and threedimensional picture languages would lead to much
greater insight into picture processing problems (and,
quite possibly, human perception); we are still waiting
for a breakthrough in this direction. Regardless of the
detailed forms of the descriptive notation and grammars in the various systems, each syntax rule essentially
specifies a list of patterns and a set of relations satisfied
by them. Practical analysis systems will clearly have to
restrict the class of pictures and the types of relations
that may exist among the elements of a picture. This

Linguistic Methods in Picture Processing
is entirely analogous to the linear language situation
where extremely efficient parsers exist when the grammar form and class of languages are restricted, for example, in simple precedence grammars. 53 One of the
most difficult problems in pattern analysis is the classification of primitive patterns; in many situations, ambiguities and recognition failures can be resolved by
examining the picture field surrounding the pattern in
question, i.e., by using contextual information. Most of
the surveyed works assume that the primitive elements
have been_ classified before entering the analysis; in
Shaw,12 the grammar 9 directs the primitive recognizers about the picture and assists the classification
process by using the contextual information embedded
in g. Work in this direction should be pursued further.
Finally, we note that, with the exception of Eden19 •2o
Narasimhan,Io.23 and Shaw, Miller, and George,12.35.36.
8'1.38 the research has been concerned only with the
analysis of pictures. As we argued in section III, there
are advantages in treating both analysis and synthesis
problems within the same formalism. However, picture
generation using formal description schemes has not
yet been examined in depth and remains a fruitful area
for future work.
REFERENCES
1 R NARASIMHAN
A linguistic approach to pattern recognition

RepOrt No 21 Digital Computer Laboratory University of
Illinois July 1962
2 RAKIRSCH
Computer interpretation oj English text and picture patterns

IEEE Transactions on Electronic Computers EC-13 4
August 363-376 1964
3 TSKUHN
The structure of scientific revolutions

The University of Chicago Press Chicago 1962
4 T MARILL D M GREEN
Statistical recognition function.s and the design of pattern
recognizers

IRE Transactions on Electronic Computers EC-9 4 December
472-477 1960
5 G S SEBESTYEN
Decision-making processes in pattern recognition

The Macmillan Company New York 1962
6 N JNILSSON
Learning machines

McGraw-Hill New York 1965
7 Character recognitions

British Computer Society London 1967
8 R NARASIMHAN.
Syntactic descriptions of pictures and gestalt phenomena of visual
perception

Report No 142 Digital Computer Laboratory University
of Illinois July 1963
9 R NARASIMHAN
Labeling schemata and syntactic description of pictures

Information and Contro17151-1791964

289

10 R NARASIMHAN
Synta-directed interpretation of classes of pictures

CommACM 93 March 166-1731966
11 JCGRAY
Compound data structure for computer aided design: a survey

Proc of 22nd National Conference of ACM Thompson Book
Co Washington 1967 355-365
12 ACSHAW
The formal description and parsing oj pictures

PhD Thesis Computer Science Department Stanford University
Stanford California Also published as CS 94 Computer Science
Department Stanford University and SLCA Report No 84
Stanford Linear Accelerator Center Stanford California 1968
13 NCHOMSKY
Syntactic structures

Mouton and Co London 1957
14 JFELDMAN DGRIES
Translator writing systems

Comm ACM 11 2 Febmary 77-113
1968
15 ACSHAW
Lectures notes on a course in systems programming

Report No CS 52 Computer Science Department Stanford
University December 1966
16 JFEDER
The linguistic approach to pattern analysis-a literature survey

Technical Report 400-133 Department of Electrical Engineering New York University Febmary 1966
17 R L GRIMSDALE F H SUMNER C J TUNIS
TKILBURN
A system for the automatic recognition of pattern8

Paper No 2792 M The Institution of Electrical Engineering
December 210-221 1958
18 HSHERMAN
A quasi-topological method Jor machine recognition of line
patterns

Proceedings of the International Conference on Information
Processing UNESCO Paris 1959 232-238
19 MEDEN
On the formalization of handwriting

Proceedings of Symposia in Applied Mathematics
American Mathematical Society 12 83-881961
20 MEDEN
Handwriting and pattern recognition

IRE Transactions on Information Theory IT-8 2 160-166
1962
21 M MINSKY
Steps toward artificial intelligence

Proceedings ofthe IRE 491 January 8-301961
22 R NARASIMHAN
A programming system for scanning digitized buhble-chamber
negatives

Report No 139 Digital Computer Laboratory University of
Illinois June 1963
23 RNARASIMHAN VSNREDDY
A generative model for handprinted English letters and its computer implementation

Technical Report No 12 Computer Group Tata Institute of
Fundamental Research Bombay India. June 1966
24 LELIPKIN WCWATT RAKIRSCH
The analysis synthesis and description of biological images

Annals of the New York Academy of Sciences 128'3 January
984-10121966
25 RSLEDLEY

290,-

Fall Joint Computer Conference, 1968

Programming and utilizing digital computers
McGraw-Hill New York 1962 ChapterS
26 R S LEDLEY L S ROTOLO T J GOLAB
J D JACOBSEN M D GINSBERG J B WISLON
FIDAC: film input to digital automatic computer and associated
syntax-directed pattern recognition programming system
Optical and Electro-Optical Information Processing Tippep J
Berkowitz D Clapp L Koester C and Vanderburgh Jr A (Eds)
MIT Press Cambridge Massachusetts 1965 Chapter 33
27 R S LEDLEY F H RUDDLE
Chromosome analysis by computer
Scif"ntific American 40-46 April 1966
28 JWBUTLER M KBUTLER ASTROUD
A utomatic classification of chromosomes
Proceedings of the Conference on Data Acquisition and
Processing in Biology and Medicine Pergamon Press New
York 1963
29 AGUZMAN
Scene analysis using the concept of a model
AFCRL-67-0133 Computer Corporation of America Qambridge Massachusetts 1967
30 A GUZMAN
Some aspects of pattern recognition by computer
MAC-TR-37 Project MAC Massachusetts Institute of
Technology February 1967 M S thesis
31 TGEVANS
A program for the solution oj a class of geometric-analogy
intelligence-test questions
PhD Thesis Department of Mathematics Massachusetts
Institute of Technology Cambridge Massachusetts 1963
Available as Physical and Mathematical Sciences Researc h
Paper No 64 Air Force Cambridge Research Laboratories
L G Hanscom Field Massachusetts
32 TGEVANS
A heuristic progr'f,m to solve geometric-analogy problems
Proceedings of Vie AFIPS Spring Joint Computer Conference
Spartan Books Inc Washington DC 1964 327-338
33 TGEVANS
, A description-controlled pattern analyzer
Proceedings of the IFIP Congress Edinburgh 1968
34 J McCARTHY P W ABRA HAMS D J EDWARDS
T P HART M I LEVIN
LISP 1.5 programmers manual
The MIT Press Cambridge Massachusetts 1962
35 ACSHAW
A proposed language for the formal description of pictures
GSG Memo 28 Computation Group Stanford Linear Accelerator Center Stanford California February 1967 internal
report
36 WFMILLER ACSHAW
A picture calculus
Emerging Concepts in Graphics University of Illinois
November 1967 in press
37 JEGEORGE
Picture generation based on the picture calculus
GSG Memo 50 Computation Group Stanford Linear Accelerator Center Stanford California December 1967 internal report
38 J E GEORGE W F MILLER
String descriptions oj data for display
SLAC-PUB-383, .Stanford Linear Accelerator Center Stanford Calif()rnia Presented at 9th Annual Symposium of the
Society for Information Display 1968
39 RHANDERSON
Syntax-directed recognition of hand-printed two-dimensional
mathematics

Proceedings of the ACM ,Symposium on Interactive Systems
for Experimental Applied Mathematics to be published 1967
40 R H ANDERSON
Syntax-directed recognition oj hand-printed two-dimensional
mathematics
PhD Thesis Applied Mathematics Harvard University
Cambridge Massachusetts 1968
41 R CLARK W F MILLER
Computer-based data analysis systems at Argonne
Methods in Computational Physics Adler B Fernbach Sand
Rotenberg M (Eds) Volume 5 Academic Press New York 1966
47-98.
42 M BCLOWES
Preception picture processing and computers
Machine Intelligence 1 Collins Nand Mitchie D Eds Oliver
and Boyd London 1967 181-197
43 MBCLOWES
A generative picture grammar
Seminar paper No 6 Computing Research Section Commonwealth Scientific and Industrial Research Organization Canberra Australia April 1967
44 JFEDER
Linguistic specification and analysis of classes of patterns
Technical Report 4po-147 Department of Electrical Engineering New York University October 1966
45 WCWATT
Morphology of the Nevada cattelbrands and their blazons-Part
One
National Bureau of Standards Report No 9050 US Department of Commerce 1966
46 WCWATT
Morphology 0.1 the Nevada cattelbrands and their blazons-Part
Two
Department of Computer Science Carnegie-Mellon University
Pittsburgh Pennsylvania 1967
47 A IN SELBERG R KLINE
A syntactic and contextual pattern recognizer: a preliminary
study
Technical Memo 45 Computer Systems Laboratory Washington University St Louis Missouri October 1967
48 A INSELBERG
An approach to the syntax-directed analysis of graphic data
Technical Memo 52 Computer Systems Laboratory Washington University St Louis Missouri January 1968
49 K BREEDING
Grammar for a pattern description language
Report No 177 Department of Computer Science University
of Illinois May 1965 M S Thesis
50 P J KNOKE R G WILEY
A linguistic approach to mechanical pattern recognition
Digest of the First Annual IEEE Computer Conference
Chicago Illinois September 142-1441967
51 MNIR
Recognition of general line patterns with application to bubble
chamber photographs and handprinted characters
PhD Thesis Electrical Engineering University of Pennsylvania Philadelphia Pennsylvania 1967
52 SCOLES
Syntax directed interpretation oj natural language
PhD Thesis Carnegie Institute of Technology Pittsburgh
Pennsylvania 1967
53 N WIRTH H WEBER
Euler-a generalization of A 19o1 and its formal definition: Part I
Comm ACM 9 1 January 13-25 1966

Decomposition of a visual scene into threedimensional bodies
by ADOLFO GUZMAN
Massachusetts Institute oj Technology
Cambridge, Massachusetts

INTRODUCTION
~ e consider visual scenes composed by the optical
Image of a group of bodies. When such a scene is "seen"
by a computer through a film spot scanner, image dissector, or similar device, it can be treated as a two-dimensional array of numbers, or as a function of two
variables.
At a higher level, a scene could be meaningfully described as a conglomerate of points, lines and surfaces
with properties (coordinates, slopes, ... ) attached t~
them.
Still a more sophisticated description could use terms
concerning the bodies or objects which compose such a
scene, indicating their positions, inter-relations, etc.
This paper describes a program which finds bodies in
a scene, presumably formed by three-dimensional objects. Some of them may not be completely visible. The
picture is presented as a line drawing.
When SEE-the pretentious name of the programanalyzes the scene TRIAL (see Figure 1 'TRIAL'), the
results are:

(BODY 1. IS :6 :2 :1)
(BODY 2. IS :11 :12 :10)
(BODY 3. IS :4 :9 :5 :7 :3 :8 :13)
SEE looks for three-dimensional objects in a twodimensional scene. The'scene itself is not obtained from
a visual input device, or from an array of intensities or
brightness. Rather, it is assumed that a preprocessing
of some sort has taken place, and the scene to be analyzed is available in a symbolic format (to be described
in a later Section), in terms of points (vertices), lines
(edges), and surface (regions).
SEE does not have a pre-concieved idea of the form or
model of the objects which could appear in a given

scene. The only supposition is that the bodies are solid
objects formed by plane surfaces; in this way, it can
not find "cubes" or "houses" in a scene, since it does
not know what a "house" is. Once SEE has partitioned
a scene into bodies, some other program will work on
them and decide which of those bodies are "houses."
Thus, SEE is intended· to serve as a link between a
pre-processor 1.2 which transforms intensity pictures
into point or line pictures, 5 and a recognizer (such as
TD 3 or DT 4), which handles this line picture and
finds bodies, objects or zones matching with certain
patterns or models. Instead of searching through the
whole scene looking for parts to match its models, the
work of the recognizer becomes simpler after SEE has
partitioned the scene into bodies, because the data to be
searched (matched) are smaller and better organized.
The analysis which SEE makes of the different scenes
generally agrees with human opinion, although in some
ambiguous cases it behaves rather conservatively. Distributed over these pages, the reader will find examples
of scenes analyzed by SEE, and the peCUliarities and
behavior of the program will become clear.
The program SEE, written in LISP, has been tested
in the PDP-6 machine of the Artificial Intelligence
Group, Project MAC,at Massachusetts Institute of
Technology. A preliminary version, written in CONVERT,6 was used extensively for a quick test of ideas
which shaped the program to its actual form. The analysis of a scene takes from 30 to 90 seconds, with the program running interpreted under the interpreter of the
LISP programming system.
A more technical description of SEE can be found in
an unpublished memorandum. 7

Related work
Rudd H. Canaday 8 in 1962 analyzed scenes composed of two-dimensional overlapping objects, "straight291

292

Fall Joint Computer Confe.renee, 1968
wards the realization of a mechanical manipulator, i.e.,
an intelligent automata who could visually perceive and
successfully interact with its enviornment, under the
control of a computer. Naturally, the mechanization of
visual perception forms part of their research, and important work begiris to emerge from them in this area.

14

Organimtion of the paper

It is formed by the following headings:
• Introduction and related previous work.
• Input Format. The representation of the scene as
it is entered to the computer·.
• Format of a Scene. The representation of the scene
as SEE expects.
• Type of Vertices. Classification of vertices according to their topology .
• The program. Analysis of the algorithm, description of heuristics.
• Interesting examples. Discussion. Future work.
Input Jormat

For testing purp'oses, the scenes are entered by hand
in a simplified fo.rmat (called input format), and then
some routines convert this to the form required by SEE.
Eventually, the data will come from a visual input device, through a preprocessor .2.6
FIGURE l-TRIAL
The program analyzes this scene and finds 3 bodies:
(BODY 1 IS :6 :2 :1)
(BODY 2 IS :11 :12 :10)
(BODY 3 IS :4 :9 :5 :7 :3 :8 :13)

sided pieces of cardboard." His program breaks the image
into its component parts (the pieces of cardboard), describes each one, gives the depth of each part in the
image (or scene), and states which parts cover which.
Roberts [9] in 1963 described programs that (1) convert a picture (a scene) into a 1ine drawing and (2) produce a three-dimensional description of the objects
shown in the drawing in terms of models and their
transformations. The main restriction on the lines is
that they should be a perspective projection of the surface boundaries of a set of three-dimensional objects
with planar surfaces. He relies on perspective and
numerical computations, while SEE uses a heuristic and
symbolic (i.e., non-numerical ) approach. Also, SEE
does not need models to isolate bodies. Roberts' work is
probably the most important and closest to ours.
Actually, several research groups (at Massachusetts
Institute of Technology, 10 at Stanford University, 11
at Stanford Research Institute 12) work actively to-

Examples of a scene

Suppose we want to describe the scene 'CUBE.' We
begin by giving (in LISP) a value to 'CUBE.' (See Figure
2 'Cube')
(SETQ CUBE (QUOTE (A 1.0 1.0 (:1 B :4 G)
B 1.0 5.0 (:1 E :2 C :4 A)
C 3.07.0 (:2 D :4 B)

D 8.0 7.0 (:2 E :3 F :4 C)
E 6.0 5.0 (:2 B :1 G :3 D)

F 8.03.0 (:3 G :4 D)
G 6.0 1.0 (:1 A :4 F :3 E)

))
Thus we associate with each vertex its coordinates
and a list, in counterclockwise order, of regions and vertices radiating from that vertex.
The conversion of the scene, as just given, iiIlto the
form which SEE expects, is made by the funct~on
LLENA; thus, (LLENA CUBE) will put in the prop-

Decomposition of Usual Scene into Three-Dimensional Bodies 293

8 •

B

2 ·

4

2

6 ·

E

4 ·

G

0

C

6

3F

1

F

A

..

o

2

A

6

8

FIGURE 2-'CUBE'-A scene.

erty list of CUBE the properties REGIONS and
VERTICES; in the property list of each vertex, the
propertiesXCOR, YCOR, NREGIONS, NVERTICES
and KIND are placed; ahd in the property list of each
region, it places the properties NEIGHBORS and
KVERTICES. It also marks region :4 as part of the
background.
In other words, LLENA converts a scene from the
'Input Format' to the 'Format of a Scene' described in
the next section.

Format of a scene
A scene is presented to our program as a scene in a
special symbolic format, which we now describe.
Essentially, it is an arrangement of rela.tions· between
vertices and regions.
A scene has a name which identifies it; this name is an
atom whose property list contains the properties
'REGIONS,' 'VERTICES' and 'BACKGROUND.'
For ex~mple, the scene ONE (see Figure 3 'ONE')' has
the name 'ONE.' In the poperty list of 'ONE' we find

B

FIGURE 3-'ONE.' A scene. Vertices and surfaces (regions)
are the main components of a scene.

Region
A region corresponds to a surface limited by a simple
connected curve. For instanc~, in ONE, the surface delimited by the vertices ABC is a region, called :1, but
GIJKDHisnot.
Each region has as name an atom which possessesadditionaJ properties describing different attributes of the
region in quEtstion. These are 'NEIGHBORS,' 'KVERTICES,' andY 'FOOP'. For example, the region in
scene ONE formed by the lines AE, ED, DK, KC, CA,
has' :2' at its name. In the property list of :2 we find:
NEIGHBORS

-

(:3:4:6:1 :6)
Counterclo~kwise ordered list of
all regions whi~h are neighbors to
:2. For each region, this list is
unique up to cyclic permutation.

KVERTICES

(DEACK)
Counterclockwise ordered list of
all vertices which belong to the
region :2. This list is unique up to
cyclic permutation.

FOOP

-(AB CD E F G HI JK)
Unordered list of vertices composing the scene ONE.

(:3D :4E :6A:1 C :6K)
Counterclockwise ordered list of
alternating neighbors and kver..
tices of :2. This list is unique up to
cyclic permutation.

BACKGROUND- (:6)
Unordered list of regions composing the background of the scene
ONE.

The FOOP property of a region is formed by a man
who walks on its boundary always having this region to
his left, and takes note of the regions to his right and of
the vertices which he finds in his way.

REGIONS

VERTICES

-(:1 :2 :3 :4 :5 :6)
Unordered list of regions composing
scene ONE.

294

Fall Joint Computer Conference, 1968

Vertex

A vertex is the point where two or more lines of the
scene meet; for instance, A, G, and K are vertices of the
scene ONE.
Each vertex has as name an atom which posseses additional properties describing different attributes of the
vertex in question. These are 'XCOR,' 'YCOR,'
'NVERTICES,' 'NREGIONS,' and 'KIND.' For
example, the vertex H (see scene ONE) has in its property list:
XC OR

3.0
x-coordinate

YCOR

15;0

y-coordinate
NVERTICES

form varies with the type-name and contains information in a determined order about the vertex in question.
(See Table I 'VERTICES').
TABLE I-'VERTICES' Classification of vertices of a scene.

>

'ARROW'.-

-

(:3:5 :4)
Counterclockwise ordered list of
regions to which H belongs.
This list is unique up to cyclic
permutation.

KIND

-

(:31 :5G :4 D)
Counterclockwise ordered list of
alternating nregions and nvertices
of H. This list is unique up to cyclic permutation.

Type8 of vertice8

Vertices are classified according to the slope, disposition and number of lines which form them. The function (TYPEGENERATOR L), where L is a list of vertices,performs this classification, putting in the property list of each one of the elements of L, the typa to
which it belongs.
The TYPE of a vertex is always a list of' two elements; the first is the type-name: one oi'L,' 'FORK,'
'ARROW,' 'T,' 'K,'·'X,' 'PEAK,' 'MU,LTI';thesecond
element is the datum, which generally is a list, whose

'T'.-

-I

Three concurrent line., two of
them colinear.

'(.
'It'.- Two

of the vertic.. are CoUnear
with the center, and the other
two fall in the same side of such
a line.
.

~
'

The KIND property of a vertex is formed by·a man
who stands at the vertex and, while rotating counterclockwise, takes note of the regions and vertices which
he sees.
NREGIONS and NVERTICES are then easily derived from KIND: take the odd positioned elements
of KIND, and its even-positioned elements, respectively.

'FORIt'.- Three line. fOl:lllina
anale. _ller than 180 o.

Three line . . .eUng at a
point, with one of the
angle. bisaer than 180 o.

(I G D)
Counterclockwise ordered list of
vertices to which H is connected.
This list is unique up to cyclic
permutation.

NREGIONS

y

'L'.- Verta: where two
line. meet.

,
PEAK .- Formed
lines,
of the
higher
any of

*

by four Or more
when the YCOR
central vertex is
than the YCOR's of
its neighbors.

'X'.-

TliO of the vertices are
colinear with the center,
and the other two fall in
opposite Sides of such a
line.

'MULTI'.- Vertices formed by
four Or more lines,
and not falling in
any of the preceding
types.

The program

The program named SEE accepts a scene expressed
in the notation described above and produces outputs
lists identifying and describing the bodies present in the
scene.
In this section we describe the program, and how it
achieves its goals, by discussing the procedures,
heuristics etc., employed and the way they· work.
We begin with several examples.
Example 1. Scene 'STACK' This scene (see Figure 4
'STACK') is analyzed by SEE, with the following results:
(LOCAL ASSUMES (:5) (:13 :14) SAME BODY)
(BODY LIS :1 :3 :2 :18 :17)
(BODY 2. IS :4 :16 :15)
(BODY 3. IS :7 :6 :11 :12)
(BODY 4. IS :9 :8 :10)
(BODY 5. IS :13 :14 :5)
(BODY 6. IS :20 :19)
Results for scene STACK
Example 2. Scene 'BRIDGE.' With this example,

Decomposition of Usual Scene into Three-Dimensional Bodies 295

r
~

Finally, we evaluate

____~------lra

(SEE (QUOTE BRIDGE))
This calls SEE to work on
BRIDGE.
Results appear in Table II, 'RESULTS FOR BRIDGE.'

(LOCAL ASSUMES (:18) (:19) SAME BODY)
(LOCAL ASSUMES (:28) (:29) SAME BODY)
(LOCAL ASSUMES (:10) (:8:11:5 t6 :4) SAME BODY)
(LOCAL ASSUMES (:7) (:8:11 :5:6:4 :10) SAME BODY)
(SINGLEBODY ASSUMES (:19 :18) (:16) SAME BODY)

na
aa I -....-

....-~....----

RESULTS
(BODY 1. IS :24 :9 :21 :27 :12 :25)
(BODY 2. IS :22 :26 :23)
(BODY 3. IS :17 :3 :20)
(BODY 4. IS :1 :2)
(BODY 5. IS :14 :15 :13)
(BODY 6. IS :19 :18 :16)
(BODY 7. IS :29 :28)
(BODY 8. IS :8 :11 :5 :6 :4 :10 :7)

Results for scene 'BRIDGE'

TABLE II-RESULTS FOR BRIDGE
SEE finds eight bodies in scene 'BRIDGE' (See Figure 5
'BRIDGE'). Unnecessary detail has been removed from the
drawings; the reader must bear in mind that the complete scene
contains vertices (whose names do not appear in the drawings)
and their coordinates (which are also not shown), as well as edges
and regions.

FIGURE 4-'STACK.' This scene is analyzed by SEE, with
results detailed in Example 1. All bodies are correctly found.
Some of the vertices appear in the drawing with their names; in
other drawings we will omit the names; we are also omiting the
coordinate axes.

we will give details of the program's operation. We
start by loading into LISP the programs for SEE and
its auxiliary functions.
Then, we evaluate:
(UREAD BRIDGE SCEN3) l' Q
This causes scene BRIDGE (see
Figure 5 'BRIDGE'), to be read
(in the format described previously) and transformed to the
proper form which SEE expects
(also described before).

FIGURE 5-'BRIDGE.' The long body :25 :24 :27 :21 :9 :12 is
correctly identified. (See Table II)

296

Fall Joint Computer Conference, 1968

SEE and its parts

The operation of SEE is quite straightforward; the
program is not recursive and does not do any tree
search. Its main parts, which are executed one after
another, unless otherwise indicated, are:
FILLSCENE. The properties SLOP and TYPE
are generated for each vertex, if they were not already
present.
CLEAN. Old properties used internally by SEE are
removed from vertices and regions.
EVIDENCE. An analysis is made of vertices, regions
and associated information, in search of clues that indicate
that two regions form part of the same body. If evidence
exists that two regions in fact belong to the same body,
they are linked or marked with a "gensym" (both receive the same new label). There are two kinds of links,
called strong (global) or weak (local).
LOCALEVIDENCE. Some features of the scene will
weakly suggest that a group of regions should be considered together, as part of the same body. This part of
the program is that which produces the 'local' links or
evidence.
GLOBAL. The 'strong' links gathered so far are analyzed; regions are grouped into "nuclei" of bodies,
which grow until some conditions fail to be satisfied (a
detailed explanation follows later).
LOCAL. Weak evidence is taken into account for deciding which of the unsatisfactory global links should be
considered satisfactory, and the corresponding nuclei of
bodies are then joined to form a single and. bigger
nucleus. Assumptions made by LOCAL are printed
(see output of SEE). LOCAL may call GLOBAL again,
or go on.
SINGLEBODY. If a single region does not belong to
a larger nucleus, but is linked by one strong evidence to
another region, it is incorporated into the nucleus of
that other region. This part of the program may call
GLOBAL or LOCAL again, if necessary, or continue.
SINGLEBODY also prints its assumptions.
RESULTS. The regions belonging to the background
are screened out, and the results are printed.

Operation
Here is explained in considerable detail each of the
parts of SEE that have been sketched above. This will
help the reader understand the behavior of the program,
its strength and deficiencies.
Example. Scene 'TOWER.' First, we begin by showing a typical analysis of SEE with a somewhat complicated scene (see Figure 6 'TOWER'). Most of the scenes
contain several "nasty" coincidences: a vertex of an object lies precisely on the edge of another object; two
nearly parallel lines are merged into a single one, etc.

This has been done on purpose, since a non-sophisticated preprocessor will tend to make this kind of
error.
The output is given in Table III, 'RESULTS
FOR TOWER.'

FIGURE 6-'TOWER.' Neither LOCAL nor SINGLEBODY
are necessary to correctly parse this scene into the bodies which
form it. There are many 'strong' links in this scene .and SEE
makes good use of them. (See Table III)

(BODY 1. IS :3 :2 :1)
(BODY 2. IS :5 :15 :4)
(BODY 3. IS :23 :17)
(BODY 4. IS :6 :7 :8)
(BODY 5. IS :10 :11 :9)
(BODY 6. IS :13 :14 :12)
(BODY 7. IS :18 :22)
(BODY 8. IS :20 :19 :21)

Results for TOWER

TABLE III-Results for Figure 6 'TOWER'

FILLSCENE,· CLEAN. These two parts of SEE are
simple; if necessary, FILLSCENE calls SLOPGENERATOR and TYPEGENERATOR; CLEAN removes
some unwanted properties.
EVIDENCE. Strong or global links are placed by
this part of the program: Two functions are used:
EVERTICES and TJOINTS.

Decomposition of Usual Scene into Three-Dimensional Bodies 297
EVERTICES. This function considers each vertex of
the scene under the following rules:
L. Vertiees of the type 'L' are not ,considered.
FORK.

If three regions meet at a vertex of
the FORK type (Table IV (b)), and
none of them is the background, links
between them will be formed. For -instance
in Figure 6 'TOWER,' we establish the
links :19- :20, :19- :21, and :20- :21.
Nevertheless, some of these links may not
be produced: in Figure 7 'FORK,' the link
between :3 and :2 is not produced because
Qis a "passing T" ; the link between :1 and
:3 is not generated because R is an 'L.' The
link between :1 and :2 is generated.
This heuristic is pow~rful, and (see Figure
5 'BRIDGE') allows us, for instance,
while working on vertex jb, to omit the
link between regions :5 and :9 in scene
'BRIDGE.' Nevertheless, this same heurristic puts a link between regions :8 and :9
of the same scene. As we shall see later,
this situation is not too bad.

ARROW. This type of vertex (TableIV (c)) causes
two of its regions (the 'left' and the
'right' one) to be joined'; in Table IV (c),
we will put a link between :1 and :2, which
'counts as evidence that :1 and :2 belong to
the same body. Nothing is said about :3.
For instance, this type of vertex joints 1:
and :2 in Figure 5 'BRIDGE.'

X.

Two cases are distinguished:
(a) The X is formed by the intersection of
two lines. No evidence is formed.
(b) Otherwise (Table IV (f)), links :1- :2
and :3- :4 are formed. This type of X
occurs when we have piles of objects;
for instance, in Figure 6 'TOWER,'
:18 and :22 are considered as belongi~ to the same body, due to this type
of vertex.

PEAK.

All its regions (table IV (h)), except the one
containing the obtuse angle, are linked to
each other. See also Figure 14 'CORN.'

T. A search is made for another T to match the
vertex cUrrently analyzed; two T's match if
they are colinear and "facing each other;"
if there are several pairs, the closest is
chosen. For instance (Table IV (d)), A and

B are paired. An indicator 'NEXTE' is
placed in such vertices.
(a) Once the NEXTE is determined,
EVERTICES establishes a link between :1 and :2 (Table IV (d)), and
another between :3 and :4. These
links will not be produced if the results of them is to associate-the background with somethi_~g that is not
the background.
(b) The following test is done (Figure 8
'PARALLEL') : If neither :1 or :2 is
the background, but both have it as
neighbor, and in some part of the
boundary of :1 (and the same holds
for :2) with the background, the segment them (M - K in Figure 8
'PARALLEL') is parallel to the central segment (O-P) of the T, then
:1 and :2 are linked. For instance, in
Figure 4 'STACK,' this analysis applied to the vertex T will produce
evidence that :13 and :14 belong to
the same body (since ZA-AA, TMA and OA-NA are parallel). This
is a rather global heuristic although
only useful for bodies with parallel
faces. Also, EVERTICES classifies
T's according to the slope of their
central segments.
A summary of the strong links put by
EVERTICES is found in Table IV'GLOBAL EVIDENCE.'
T JOINTS. This function actuates on T's and established global evidence as described in part (a) of T
(Table IV (d)).
LOCALEVIDENCE. An arrow is a leg if one of its
left or right vertices is a corner (if necessary, through a
chain of matched T's) which has a side parallel to the
central segment of the arrow. The function LEGS finds
legs in the scene, and stores this information in a list of
'weak' links (see Figure 9 'LEGS').
GLOBAL. Strong evidence is analyzed in this part of
the program. When this section is entered, several links
(strong and weak) exist among the different. regions of
the scene. These links are shown pictorially in Eigure 10
'LINKS,' for the scene 'BRIDGE' (see both). All the
links to the background (:30) are deleted: the back-.
ground cannot be part of any body.
Definition: a nucleus (of a body) is either a region or a
set of nuclei which has been formed by. the following
rule.

298

Fall Joint Computer Conference, 1968

TABLE IV-'GLOBAL EVIDENCE' The strong links are
represented by dotted lines

y

>

,

:~

0_.

b

•

.;

.'" ... f>

(A)

(C)

(B)

:1

:j;

O"'~
:3 ~"""'"

.1IT" '0:2

"

·············.... ····~·~'···
..... 2
....

'ow

(0)

:3

:4

IS'

:3

.

·:4

(F)

(E)

*

(H)

(G)

'.

(I)

FIGURE 8-'PARALLEL.' A link is established between :1
and :2 because they do not belong to the background, but the
background is a neighbor of both of them, and the segment that
separates :1 from the bacgkround (and the same is true for :2)
is parallel to OP, the centrai segment of the T in question (:3 is
the background).

R

FIGURE 9-'LEGS.'
Three different types of legs.

5
FIGURE 7-'FORK.'

Rule: If two nuclei are connected by two or more
links, they are merged into a larger nucleus by concatenation.
(Two nuclei A and B are linked if regions a and bare
linked where a E A and b E B). For instance, regions :8
and :11 are put together, because there exists two links
among them, to form the nucleus :8-11. Now, we see
that region :4 (see Figure 10 'LINKS') has two links
with this nucleus :8-11, and therefore the new nucleus
:8-11 = 4 is formed.
We let the nuclei grow and merge under the forner
rule, until no new nuclei can be formed. When this is the
case, the scene has been partitioned into several "maximal" nuclei; between any two of these there are zero or,

at most, one. link. For example, figure 10 'LINKS' will
be transformed into Figure 11 'NUCLEI.'
LOCAL. If some strong link joining two "maxinuil"
nuclei is also reinforced by a weak link, these nuclei are
merged.
For example, in scene BRIDGE (see Figure 5
'BRIDGE') the following local links exist (among
others): :9 to :4, :10 to :4, :28 to :29, :18 to :19. Therefore, the corresponding nyclei are merged and now
figure· NUCLEI is transformed into figure 'NEW
NUCLEI.'
A weak link does not cause the regions which it links
to be merged or considered as belonging to the same
body unless there is, in addition, one strong evidence between such regions. LOCAL may call GLOBAL again,
if necessary.

.Decomposition of Usual Scene into Three-Dimensional Bodies 299

FIGURE ll-'NUCLEI.' Mter joining all nuclei having two
or more links in common, the representation for the scene
'BRIDGE' changes from that shown in figure 10 'LINKS' to the
one shown here.

FIGURE 10-'LINKS.' This figure
represents scene
'BRIDGE,' with the strong links between its regions (represented
here by circles) shown. The dotted links represent the evidence
generated by the vertex PB (see Figure 5 'BRIDGE'L The short
arrows show the links put by vertex JBj note that a link between
:5 and :9 is not put, because S (see Figure 5 'BRIDGE') is a passing t-joint. Zig-zag links are produced by the mechanism described in part (b) of T. (See Figure 8 'PARALLEL'). Curled
links are produced by vertex GBj even if this vertex were occluded, and the links were missing, there is still enough evidence
to identify regions :4 :5 and :6 as belonging to the same body.
Weak links are not shown.

SINGLEBODY. A strong link joining a nucleus and
another nucleus composed by a single region is considered enough evidence and the nuclei in question
merged, if there is no other link emanating from the
single region. For instance, in Figure 12 'NEW NUCLEI,' nucleus :16 is merged with nucleus :18--:19 (see
Figure 13 'FINAL'). Nucleus :28 - 29 is not joined with
:26-22-23 or with :24-25-27-12-21-9. Even if
nucleus :28-29 were composed by a single region, it
still will not be merged, since two links emerged from it:
two nuclei clajm its possession.
RESULTS. After having screened out the regions

FIGURE l2-'NEW NUCLEI.' The figure shows the scene
'BRIDGE,' after LOCAL transforms it from the representation
in Figure 11 'NUCLEI' to the one shown here.

that belong to the background, the nuclei are printed as
"bodies."
In this process, the links which may be joining some
of the nuclei are ignored: RESULTS considers the
links of Figure 13 'FINAL', for instance, as non-existent.
Summary

SEE uses a variety of kinds of evidence to "link" together regions of a scene. The links in SEE are supposed
to be general enough to make SEE an object-analysis
system. Each link is a piece of evidence that suggests
that two or more regions come from the same object, and
regions that get tied together by enough evidence are
considered as "nuclei" of possible objects.

300

Fall Joint Computer Conference, 1968

(BODY 9. IS :10 :16 :11 :12)
(BODY 10. IS :18 :9 :17)
(BODY 11 IS :7 :8)
(BODY 12. IS :38 :37 :39)

22
FIGURE 13-'FINAL.' SINGLEBODY joints the lonely region :16 with the nucleus :18-19.

5

&

Some ~nteresting examples
We present in this section several scenes with the results obtained by SEE.
Example. 'CORN.' The program analyzes the scene
CORN (see figure 14 'CORN') obtaining the following
identification of bodies:
21

(SINGLEBODY ASSUMES (:2 :3 :1) (:4) SAME
BODY)
(BODY 1. IS :2 :3 :1 :4)
(BODY 2. IS :7 :6 :5)
(BODY 3. IS :13 :11 :12)
(BODY 4. IS :15 :16 :14)
Results for 'CORN'
(BODY 5. IS :19 :18 :17)
(BODY 6. IS :21 :20)
(BODY 7. IS :8 :9 :10)

FIGURE 14-'CORN.' Since a link between :4 and :12 is not
established, the bodies found ill that part of the scene are
:1 :2 :3 :4 and :11 :12 :13.

The region :4 got a single link with :3, and SINGLEBODY had to join it with the nucleus :1 :2 :3. Note
that :4 and :12 did not get joined. The pyramid at the
top was easily identified because its peak produces
many links.
Example. 'MOMO'. (See Figure 15 'MOMO'). The results are as follows:
(LOCAL ASSUMES (:17) (:9) SAME BODY)
(LOCAL ASSUMES (:9 :17) (:18) SAME BODY)
(BODY 1. IS :3 :2 :1)
(BODY 2. IS :32 :33 :27 :26)
(BODY 3. IS :28 :31)
(BODY 4. IS :19 :20 :34 :30 :29)
(BODY 5. IS :36 :35)
(BODY 6. IS :24 :5 :21 :4)
(BODY 7. IS :25 :23 :22)
Results for 'MOMO'
(BODY 8. IS :14 :13 :15)

FIGURE 15-'MOMO.'

Decomposition of Usual Scene into Three-Dimensional Bodies 301

Comments on the solution for 'MaMa': The central
cubes are easily isolated. :21 gets a link with :5 and
another with :24, so there is no need to use LOCAL in it.
The same is true of :26 with :27 and :33.
There is enough strong evidence to joint :28 and :31.
The links for :29 :30 :34 :20 :19 and :9 :17 :18 are indicated in Figure 16 'M01VI9-LINKS.'
The dotted links between,regions :30 and :34, and between :20 and :19 (see Figure 15 'MOMO') are duetothe
heuristic of parallel lines (of Figure 8 'PARALLEL').
These links made it possible to join the otherwise disconnected nuclei :29- :30- :19 and :34- :20. In particular,
if :34 or :20 did not have parallel sides, SEE would have
failed to merge these nuclei, and would have reported
two bodies. The disposition of regions in MOMO is such
that no link is present between :29 and :34, since :28
and :31 fall "exactly" parallel to :29 and :30. In a less
extreme scene, some of these links would be present, allowing correct identification even if :29-:30-:34-:20-:19
were not a prism. Anyway, SEE did not make any mistakes.
The triangle of links formed by :9, :18 and :17 normally would have produced 3 separate bodies (since we
need at least one double link to merge two regions);
nevertheless, in this case, LOCAL makes some assumptions and saves the situation. Again, if :9 were not a
parallelogram, there would be no weak links between :9
and :18 or between :9 and :17, and 3 bodies would have
been reported instead of :9-:17..; :18. But we should notice that, in general, two links instead of one would be
between :17 and :18.
Links were extablished between :12 and :13, without
serious consequences, because we need. two mistakes,
two wrong strong links, to fool the program. But that
could happen.

Example. 'HOME'.-(see scene HOME). The results
are in Table V 'RESULTS FOR HOME.'

(SINGLEBODY ASSUMES (:38)
(SINGLEBODY ASSUMES (:34)
(SINGLEBODY ASSUMES (:25
(SINGLEBODY ASSUMES (:20)
RESULTS
(BODY 1. IS:3 :6:10 :2)
(BODY 2. IS :14 :13:11 :12)
(BODY 3. IS :9 :8)
(BODY 4. IS :18)
. (BODY 5. IS :15 :5)
(BODY 6. IS :38 :39)
(BODY 7. IS :7 :26 :27)
(BODY 8. IS :20 :21)
(BODY 9. IS :29:28)
(BODY 10. IS :34 :33)
(BODY 11. IS :31 :32 :30)
(BODY 12. IS :25 :24 :22 :23)
(BODY 13. IS :16)
(BODY 14. IS :19)
(BODY 15. IS :17)
(BODY 16. IS :36 :37 :35)

(:39) SAME BODY)
(:33) SAME BODY)
:24 :22) (:23) SAME BODY)
(:21) SAME BODY)

Results for HOME

TABLE V-Results for HOME

FIGURE 17-'HOME.' The hexagonal prisms did not create
difficulties; SINGLEBODY was needed to group :34 with :33.
The body :38-39 was identified as a single one, but :16-17 was
reported as two. Note that there does not exist local link between
:21 and :20; nevertheless, SINGLEBODY makes the correct
identification. (See Table V).

FIGURE

16-MOMO-LINKS'. Some
figure 15 'MOMO'

links

of

Comments on the solution to HOME: There is a certain
degree of ambiguity in this scene which human beings
tend to resolve by assuming parallelepipeds. :16 and :17

302

Fall Joint Computer Conference, 1968

are reported as two separate bodies, instead of one,
which is probably a more natural answer.
In the picture from which 'HOME' was drawn,
:19 and :18 were the two faces of a single parallelepiped
leaning on :38-:39; SEE reports :19 as one body and :18
as another.
Nevertheless, SEE reports :38 and :39 as forming
part of the same body (which was in fact the case in the
picture in question), due to the fact that :4 and :1 are
background.
Example. 'SPREAD.'-(see Figure 18 'SPREAD').
The results are in Table VI 'RESULTS FOR SPREAD' .

(LOCAL ASSUMES (:36) (:4) SAME BODY)
(LOCAL ASSUMES (:30) (:31 :32 :29) SAME BODY
(LOCAL ASSUMES (:16) (:17) SAME BODY)
(LOCAL ASSUMES (:5) (:20) SAME BODY)
(LOCAL ASSUMES (:3 :11 :9) (:12 :10) SAME BODY)
(SINGLE BODY ASSUMES (:23) (:22) SAME BODY)
(SINGLEBODY ASSUMES (:4 :36) (:37) SAME BODY)
(SINGLEBODY ASSUMES (28 :26 :27) (:25) SAME BODY)
RESULTS
. (BODY 1. IS :39 :40 :38)
(BODY 2. IS :23 :22)
(BODY 3. IS :42 :41)
(BODY 4. IS :4 :36 :37)
(BODY 5. IS :24)
(BODY 6. IS :28 :26 :27 :25)
Results for SPREAD
(BODY 7. IS :31 :32 :29 :30)
(BODY 8. IS :20 :5)
(BODY 9. IS :12 :10 :3 :11 :9)
(BODY 10. IS :13 :7 :1)
(BODY 11. IS :21 :6)
(BODY 12. IS :8 :18)
(BODY 13. IS :17 :16)
(BODY 14. IS :45 :43 :44)
(BODY 15. IS :19)
(BODY 16. IS :15 :14)

(BODY 2. IS :16 :15)
(BODY 3. IS :32 :31 :30)
(BODY 4. IS :9 :10 :8)
(BODY 5. IS :18 :19 :20)
(BODY 6. IS :13 :17 :14)
Results for 'HARD'
(BODY 7. IS :5 :4)
(BODY 8. IS :1 ;:2 :33)
(BODY 9. IS :24 :23 :22 :3 :21 :28 :29)
(BODY 10. IS :25 :26 f27)
(BODY 11. IS :7)
(BODY 12. IS :6)

1

TABLE VI-Results for SPREAD

Comments on the solution to SPREAD: The body
:22-23-24, due to insufficiency of links, was split in two:
:22-23 and :24.

Since there is only one link between :6 and :5, this
body gets split into two: :6-21 and :5-20. Note that :21
is not the same face as :20, and there is where SEE gets
confused and refuses to see evidence toward linking :21
with :20.
The long body :9-10-11-12-3 gets properly identified.
Example. 'HARD.'-,-This scene is analyzed with the
following results:
(LOCAL ASSUMES (:11) (:12) SAME BODY)
(LOCAL ASSUMES (:15) (:16) SAME BODY)
RESULTS
(BODY 1. IS :12 :11)

FIGURE 18-'SPREAD.' :41 and :42 are identified as a
single body. Nevertheless, :8-18-19 gests broken into :8-18 and
:19. :28-27-26-25 gets correctly identified, as well as the funny
looking :29-30-31-32. (See Table VI).

Comments on the solution to HARD: :15 and :16 have
to make use of weak evidence to get joined and recognized as forming part of the same body. Nevertheless,
tois is not necessary with :28 and :29, because, through
a chain of Ts, there is enough evidence in :3, :21 and :22
to join successfully all that long and twice occluded body.
There is one serious bug in this identification: regions
:7 and :6 get identified as two separate bodies,and not
as a single one, as one would normally do. This is caused
by the fact that neither :7 nor :6 have visible 'useful' vertices, and there are not enough parallel lines in them to
use the heuristic of Figure 8 'PARALLEL.'

.Decomposition of Usual Scene into Three-Dimensional Bodies 303

FIGURE 19-'HARD.' Body :21-22-3-23-24--28-29 is reported
as a single object, which is correct. Nevertheless, regions :7 and :6
get reported as two bodies.

:33 was recognized as part of :1-2, as it should be:
DISCUSSION
We have described a program that analyzes a three-dimensional scene (presented in the form ofa line drawing) and splits it i~to "objects" on the basis of pure
form. If we consider a scene as a set of regions (surfaces), then SEE partitions the set into approprirute subsets, each subset forming a three-dimensional body or
object.
The performance of SEE shows to us that it is possible
to separate a scene into the objects forming it, without needingto know in detail these objects; SEE does not need

to know the 'definitions' or descriptions of a pyramid, or
a pentagonal prism, in order to isolate these objects in a
scene containing them, even in the case where they are
partially occluded.
The basic idea behind SEE is to make global use of information collected locally at each vertex: this information is noisy and SEE has ways to combine many different kinds of unreliable evidence to make fairly reliable global judgments.
The essentials are:
(1) Representation as vertices (with coordinat,es),
lines and regions
(2) Types of vertices.
(3) Concepts of links (strong and weak), nuclei and
rules for forming them.
The current version of SEE is restricted to scenes pre-

sented in symbolic form. It does not have resources for
dealing with curves, shadows, noise, missing lines, etc.
So it represents a "geometric theory of object identity"
at present.
Since SEE requires two strong evidences to join two
nuclei, it appears that its judgments will lie in the
'safe' side, that is, SEE will almost never join two regions that belong to different bodies. From the analysis
of scenes shown above, its errors are almost always of
the same type: regions that should be joined are left
separated. We could say that SEE behaves "conservatively," especially in the presence of ambiguities.
Divisions of the evidence into two types, strong and
weak, results in a good compromise. The weak evidence
is considered to favor linking the regions, but this evidence is used only to reinforce evidence from more reliable clues. Indeed, the weak links that give extra
weight to nearly parallel lines are a concession to obj ect-recognition, in the sense of letting the analysis system exploit the fact that rectangular objects are common enough in the real world to warrant special attention.
Most of the ideas in SEE will work on curves too.
However, we do not yet have a good idea of how sensitive the system will be to "symbolic noise," i.e., missing
misplaced, and false region boundaries. As indicated in
the scenes above, the system seems to have good resistance to "accidents" in .which objects happen to
to "line up" unusually well. This feature may be necessary if the preprocessor that (eventually) will feed data
SEE decides to report two nearly colinear lines as one
alone, or if it lumps several vertices into one, because'
they lie close to each other.
Extensions. (None of this incorporated in the actual
program.) l\lore heuristics could be added to increase
the number of links; in part.icular, given a good number
of "link proposers," parameters set outside (by the
user) would tell SEE which set of heuristics to use; for
instance, if we knew that the scene is formed by prisms,
we could use the heuristics that ask for parallel lines
having a given CO,nfiguration, we could check the length
of certain edges, etc.
Different kinds of links could also be established; in
this way, 'contradictory' links (such as the three links of
Figure 13 'FINAL' which SEE just. igtiores) could be
studied further, in order to discover ambiguities. In
particular, a "conditional link" would be useful: regions
:2 and :3 belong to the same body if region :4 does not.
SINGLEBODY could be improved so as to analyze
in more detail the regions that by themselves form
bodies (that is, the bodies formed by only one region);
in this way, we could hope to joint regions :6 and :7 of
scene 'HARD.'

304

Fall Joint Computer Conference, 1968

ACKNOWLEDGMENTS
The author is grateful to Professors Marvin Minsky and
Seymour Papert for several helpful discussions, and to
the referees of this paper for their constructive recommendations.
Michael Speciner made valuable suggestions; Cornelia Sullivan helped to codify most of the scenes.
"The author was partially supported by a scholarship
from the Instituto N acional de la Investigaci6n
Cient1fica (Mexico)."
The work reported here could not have been produced
had the author not had access to the computational
facilities of Project MAC, an M.LT. research program
spbnsored by the Advanced Research Projects Agency,
Department of Defense, under Office of Naval Research
Contract Number Nonr-4102(01). This paper, having
had this support from MAC, may be reproduced in
whole or in part for any purpose of the United States
Government.
REFERENCES
1 R GREENBLATT J HOLLOWAY
Side821
Memorandum MAC-M-320 A I Memo 101 Project MAC
MIT August 1966 A program that finds lines using gradient
measurements
2 KKPINGLE
A program to find object8 in a picture
Memorandum No 39 Artificial Intelligence Project Stanford
University January 1966 It traces around objects in a picture
and fits curves to the edges
3 AGUZMAN
Scene analysi8 using the concept of model
Technical Report No AFCRL-67-0133 Computer Corpora-

tion of America Cambridge Massachusetts January 1967
4 AGUZMAN
A primitive recognizer of figure8 in a 8cene
Memorandum MAC-M-342 AI Memo 119 Project MAC
MIT January 1967
5 AGUZMAN
Some a8pect8 oj pattern recognition by computer
MS Thesis Electrical ~Engineering Department MIT February
1967 Also available as a Project MAC Technical Report
MAC-TR-37 This memorandum discusses many methods
of identifying 9bjects of known forms.
6 A GUZMAN H V McINTOSH
CONVERT
Communications of the ACM
9,8 August 1966 pp 604-615 Also available as Project MAC
Memorandum MAC-M-316 AI Memo 99 June 1966
7 AGUZMAN
Decomp08ition oj a vi8ualscene into bodie8
Memorandum MAC-M-357 AI Memo 139 Project MAC
MIT September 1967 unpublished This memorandum is a
more technical description of SEE
8 RHCANADAY
The description of overlapping figure8
MS Thesis Electrical Engineering Department MIT January
1962
9 LGROBERTS
Machine perception of three-dimensional80lids
Optical and electrooptical information processing
pp 159-197 J T Tippett et al eds MIT Press 1965
10 M LMINSKY SAPAPERT
Research on intelligent automata
Status report II
Project MAC MIT September 1967
11 J McCARTHY
Plan8 for the Stanford artificial intelligence project
Stanford University April 1965
12 C A ROSEN N J NILSSON eds
Application of intelligent automata to reconnai88ance
Third Interim Report Stanford Research Institute December
1967

A limited speech recognition system*
by DANIEL G. BOBROW and DENNIS H. KLATTt
Bolt Beranek and Newman Inc
Cambridge, Massachusetts

INTRODUCTION
A computer system which identifies words in continuous
speech of an unknown speaker is beyond the current
state of the art in speech recognition. LISPER, is a
successful limited speech recognition system based on a
set of assumptions which greatly simplify the recognition problem; within these restrictions it allows
experjmentation on the usefulness of a voice insertion
system on the computer.
LISPER operates within limitations along a number
of dimensions. Rather than use continuous speech in
which segmentation is a problem, we work with
messages with easily delimited beginning and termination points. The set of messages is limited in number; at
anyone time the· vocabulary to be distinguished can
contain up to about 100 items. However, an item need
not be a single word, but may be any short phrase.
A message list from a NASA mission context, shown in
Table 1, was one of three used in testing the system.
Note that LISPER recognizes each of these messages as
a unit, and does not segment a multi word utterance into
individual words for recognition. The system is not
designed to work well simultaneously for a number of
different speakers, or achieve good recognition scores
for an unknown speaker. The system is useable by any
male speaker, but must be first trained by him. The
training period consists of a period of closed loop
operation in which the speaker says an input message,
the system guesses what he says, and he responds with
the correct message. In this training phase, the system
will learn the idiosyncratic variations of the speaker's
set of input messages. In this closed loop system, it is
not unlikely that the speaker will also learn something.
*Thi.s research was supported principally by the National Aeronautics and Space Administration, and in part by the Advanced
Research Projects Agency.
tAIso at Massachusetts Institute of Technology, Cambridge
Mass.

305

The LISPER system was designed as a research
vehicle, as well as a pattern recognition system. For this

one
two
three
four
five
six
eight
nine
point
plus
stop
zero
seven
minus
pressure
negative
what is yaw
what is pitch
end repeat
affirma.tive
inclination
distance to earth

distance to dock
fuel tank content
time to sunrise
time to sunset
orbit apogee
orbit perigee
revolution time
closing rate to dock
midcourse correction time
micrometeoroid density
radiation count
what is attitude
remaining control pulses
alternate splashdown point
weather at splashdown point
sea and wind at splashdown point
visibility at splashdown point
temperature at splashdown point
skin temperature
power consumption
fuel cell capacity
repeat at intervals

TABLE I-Message list from NASA context

reason, flexibility for data access and program modification were important. For this reason, LISPER was
built in an extended LISP system. 1,2 This decision
allowed an easy transfer during the research from a
DEC PDP-1 to an SDS 940 computer.
Any pattern recognition system must have three basic
components: preprocessing hardware to extract a
representation of the input; programs utilizing this raw
data to compute properties of the unknown input (data
reduction); and a recognition or decision algorithm.
Figure 1 shows a block diagram of the organization of
the LISPER system. The input speech signal may be
obtajned from either a microphone or tape recorder. The

306

Fall Joint Computer Conference, 1968
r---------------------------

I

DISPLAY

FIGURE i-Block Diagram of the Lisper system

basic parameters of the input are extracted by a
spectrum analyzer which consists of a pre-emphasis
network followed by nineteen bandpass filters. Bandpass
filter outputs are rectified, low-pass filtered, sampled,
converted into logarithic units, and stored on digital
tape, or in the memory of the computer. The 19 filters
consist of 15 filter spaced uniformly up to 3000 HZ! the
range encompassed by the first three resonances of the
male voice; and 4 filters covering the range from
3000-6500 Hz in which there is information about the
noise component of speech. The four-pole Lerner
bandpass filters each have a bandwidth of 360 Hz. An
advantage of this filter system is that one does not see
spectral peaks due to individual harmonics of the
fundamental frequency of a male speaker; a spectral
maximum in the filter outputs indicates the presence of
one or more formants (resonances of the vocal tract
transfer function). The spacing. between filters makes
resolution of individual formants poor, and we do not
use formant tracking in our recognition system.
.The spectral representation of a word as derived from
our input system consists of 200 spectral samples,
corresponding to 2 seconds of speech material and
approximates the log of the short term power spectrum
of the speech signal. A spectral sample consists of the
outputs of the 19 bandpass filters, all sampled at a
particular instant of time. A filter output, in log units,
is an integer ranging from 0 to 63, covering a 45 decibel
range of intensity.
The use of the logarithm of the short-time spectrum
is well established as one approach to speech analysis
and has often been used as the basis for recognition
programs. 3 The principal contributions of this research
have been the development of a set of interesting
algorithms for extracting features which characterize
speech utterances, and coupling this set with a recognition algorithm capable of high quality message identification in the presence of redundant, inconsistent, or
incorrect information from these properties. The
recognition algorithm does not directly utilize the

spectral data, nor is an intermediate phonemic transcription of the word produced. However, we have made use
of the present day body of knowledge about acoustic
phonetics, and the distinctive feature approach to
phonological description. 4,5,6 We discuss below some
problems of these two approaches and indicate how a
number of these problems have been alleviated by
techniques used in LISPER.
Our system has been extensively tested, and recognition scores have been obtained on three vocabularies
with three different speakers. Typical of our results is
attainment of recognition scores that approach 97%
correct on a 54 word vocabulary after three rounds of
training for a single speaker. These results compare
favorably with the word recognition scores of other
investigators. 7,8,9,10
Property extraction system

An unknown word is represented in the computer by
a matrix of integers (filter number vs. sampled time vs.
log-amplitude). The purpose of a property or feature
extraction system is to reduce the information content
of the input signal to a level that makes it possible for
the decision or recognition algorithm to operate
reasonably. The critical thing is that the information
eliminated should be information which is irrelevant to
the decision that the recognition algorithm must make.
The techniques used in LISPER can best be appreciated by first exploring some problems involved in
identifying a speech utterance on the basis of the 19 X
200 array representing a 2 second sampling of its ene:r:gy
spectrum. Pattern recognition schemes operating on
data of this dimensionality are theoretically tenable
(Sebestyen, 11), but only if repetitions of words cluster
properly in the resultant vector space. It is by now
well-known that speech patterns as initially stored in a
computer do not cluster according to the word spoken.
Some of the reasons for this are:
1. The range of intensities encountered will vary
because the overall recording level is not fixed.
Recording level depends on vocal effort and the
distance of a speaker from the microphone.
2. An unknown word is difficult to register. at the
same place within 200 spectral samples because
word onset time is not a simple feature to detect
reliably. For example, initial voiceless fricatives
may be missed, prevoiced stops are hard to treat
consistently, etc. We insure that all of an utterance
is contained within· the two second interval by
sampling the input line continuously, storing
spectral samples in a computer-simulated digital
tape loop, and stopping 1.8 seconds after the data
first exceed a threshold.

A Limited Speech Recognition System
3. The total duration of a word is highly variable. In
addition an increase in speaking rate is not
manifested by a linear compression of the time
dimension. Final syllables are often prolonged.
Some transitions (for example, the release of a
stop consonant) are not as greatly affected by
changes in speaking rate as the steady-state
portions of vowels. If shortened enough, vowels
are likely to be reduced and consonants may not
be carefully articulated, with resultant losses in
spectral distinctiveness.
4. A speaker attempts to generate an utterance so
that it has a particular set of perceptual attributes
(or features). We do not know in detail what the
acoustic correlates of these attributes are. There
is a great deal of variation allowed in the acoustic
properties of the signal that will still give rise to
the same utterance. There is also sufficient redundancy in the message to permit a speaker to
leave out certain attributes entirely. For example,
the degree of stress placed on a syllable will
determine the extent to which the vowel may be
reduced (Lindblom, 12). Consonants in unstressed
syllables may contain less frication noise, a weak
stop burst release, or incomplete stop closure.
Vowels may be nasalized in nasal environments.
The substitution of one incomplete gesture for a
consonant cluster is also common in unstressed
. syllables of natural speech. None of these effects
would necessarily produce word recognition difficulties if they appeared consistently in the data.
Unfortunately, they do not.
5. If a speaker is instructed to speak distinctly and
not rapidly, some surprising and unfortunate
variability in speaking habits has been experi.
mentally detected. In an attempt to help the
system, our speakers released final stops, increased
the length of some syllables, and articulated
unstressed syllables more carefully then they
would normally. Unfortunately, our speakers
appear to have found these speaking habits
unnatural, and could not remember from repetition to repetition exactly what they had done to
"help." For example, final voiced stop releases
gave trouble by producing short vowel segments
that varied greatly in amplitude, and the words
four and core were sometimes pronounced as if
they had two syllables.
6. Individual speakers have vocal tracts of different
sizes and shapes. It is physically impossible for
two speakers to produce identical spectra for a
given phone or word. A speaker makes an
articulatory gesture that we, as listeners, interpret;
possibly with respect to our knowledge of the

307

spectra that he is capable of producing (Gerstman,13). The nature and importance of the normal
ization process of a listener are not well understood.
7. Different speakers have articulatory habits
(idiolects) that may be quite distinct. Habits
include the timing and dynamics of articulatory
movements and the features that a particular
speaker employs to manifest a phonemic distinction. Whether recognition djfficulties can be
attributed to individual speech habit structures is
not known. Very little quantitative data are
available on the characteristics that distinguish
speakers.
The variability of the spectrum of a word has led to
the search for data reduct jon techniques to eliminate
irrelevant information. An approach favored by several
investigators has been to develop rules for detecting
phonemes (Fry and Denes, 14; l\1artin et aI., 15 ;
Reddy, 16. We believe that phoneme recognition is a
much more difficult problem than word recognition
because it presupposes a good understanding of the cues
that distinguish phonemes in arbitrary phonetic
environments. For example, allophones of the phoneme
/p/ may be:
'1. normally aspirated, as in the word "peak" [phik]
2. weakly aspirated, as in the word "supper"
[s] 1\ 'pha A]
3. non-aspirated, as in the word "spin" [spin]
4. non-released, as in the word "top" [th ap 7]

There is no need for a word recognition program to
attempt to group this disparate set of physical signals
together into one phoneme. However, to the extent that
algorithms for deriving a detailed phonetic-feature
description of an utterance can be found, they can be of
considerable help to a practical· speech recognition
system. Examples of feature approaches that are
relevant include the work of Hughes, 17; Hemdal and
Hughes, 6; Gold, 7; and Marti net. aL 15.
The properties of speech which are used by the
recognition program are based on the energy measures
derived from the input system. The output of each
filter is an elementary function of the speech input
signal. We use the notation Fn(i) for the output of filter
n at sample interval i; that is FI(i), F2(i), ... , FI9(i)
are used for the output of filters 1 through 19 at sample
interval i. The filter number n ranges from 1 for the low
frequency filter to 19 for the high frequency filter; and
i = 1 for the first sample interval to i = 200 for the
last time sample of a two second utterance.
l\10re complicated functions of the speech input signal
can then be defined in terms of these elementary (base)
functions, FI, .. , FI9, in the LISP system. For

308

Fall Joint Computer Conference, 1968

example, the following function has been found to
correlate with perceived loudness, independent of vowel
quality.
Loud(i)

i

=

Fl(i) + F2(i) + F3(i)
FI2(i) - F7(i)

+ F4(i)

+

The output of the seventh filter is subtracted from the
sum of the first four filters .and filter 12 to compensate
for the fact that low vowels are inherently more intense
when produced with the same vocal effort. We will
indicate later how a modified version of this function
Loud (i) can be used to correct for differences in
recording level between repetitions of the same word.
Loud(i) is useful jn reducing the information that
must be processed by the decision algorithm, since it
helps to normalize the input with respect to a variable
which is not important to recognition, namely, the
recording level of the input sjgnal. We describe in this
section a number of techniques which are used to reduce
the information content of the incoming signal in ways
that preserve the invariance of message identity over
ranges of parameters which are irrelevant to the decision
about the identity of the message.
One important way we have found to reduce the
information content of a function is to reduce its range
of values. Thus, for example, we may define a reduced
information property Amp2(i) based only on the output
of filter F2.
Amp2(i)

=

+1 if F(2) > 40;
o if F(2) > 20;
-1 otherwise

Amp2(i) is thus a 3 valued function, where we ascribe
no significance to the names of the three values. As
described later, a set of non-linguistic threshold properties similar to Amp2 can be used as a basis for recognition. However, we note the following problem. If the
signal in F2 were varying around either of the thresholds, 20 or 40, then there would be little significance of
the change of state from -1 to 0 or 0 to 1 and back; it
would be much more likely due to noise than to a real
variation in the input signal
To make such properties less sensitive to noise, we
introduce a hysteresis region around the thresholds to
insure that a change of state js significant. A revised
definition of Amp2(i) is
Amp2(i)

= + 1 if [F2(i) >

40]' or [F2(i)
F2(i -1) = 1];
o if [F2(i.) > 20] or [F2(i)
F2(i -1) ¢ -1];
-1 otherwise

>

37 and

>

17 and

Most of the features we use are functions of sampled
time having a range limited to a small number of
distinguishable states. These functions are very sensitive
to slight changes in time scale and origin; these
variations in the data are irrelevant for recognition.
The time dimension is removed from a feature by
transforming the time function into a sequence of
transitions of states, as is illustrated in the following
example:
i
1 234 567 8 9
Voice (i) 0 0 1 1 1 1 1 1 0
Voice = 0 1 0
This transformation reduces the amount of data that
must be manipulated by the program. Due to the nature
of spoken language, the exact time when features
change value will vary from repetition to repetition -of
the same word, but the essence of the word remains in
the sequence of state transitions of an appropriate set
of features.
No information about the word onset time, speaking
rate, and speaklng rhythm can be recovered from the
sequence unless these parameters have an effect on the
actual states that are reached. To this extent, recognition will be unperturbed by variations in word onset
time, speaking rate, and speaking rhythm.
A problem that arises from' collapsing the time
dimension is an inability to tell whether two features
were in specific states at the same time. Time removal
assumes that features independently characterize a
word. This is obviously false. A clear example is
provided by the words "sue, zoo" which can only be
djstinguished by knowing whether the strident is
simultaneously voiced or not. It is .possible to retain
some timing information by the. inclusion of features
that count the number of time samples between
temporal landmarks in the data and change state if the
count exceeds a threshold, or to include states which are
entered only upon simultaneous satisfaction of two
conditions.
For example, the state" -1" corresponds to voiceless
segments in the definition of the spectral quality
[r]-like(i). In this way we indjcate in which voiced
segment an [r]-like phone occurred. The sequence
produced for the word "ratio" should be -1, 1,0, -1,
0, -1. A more detailed localization of the [r] is not
necessary for limited vocabulary word recognition, and
would certainly be more difficult. We find that very
gross timing information is satisfactory for recognition.
Two features are used to make a preliminary division
of a word or message into one or several segments. One
feature divides a word into voiced and voiceless
segments and the other divides it into syllables. Voice(i)

A Limited Speech Recognition System
and Syllable(i) are then used to introduce time markers
in the definitions of other features.
Features which classify the vowel quality of the
stressed syllable of an utterance into one of 10 categories have been found to be very useful in recognition.
The stressed syllable is identified with the aid of a
fllnction Loud(i) that computes an approximation to
the perceived loudness of a vowel. These features of a
stressed syllable are less likely to be affected by the
natural variability that characterizes the speech process (Stevens 18).
Recognition algorithm

The recognition algorithm is a program that learns to
identify words by associating the outputs of various
property extractors with them. During learning, the
vocabulary of words is presented a number of times, and
information is accumulated about the different ways
that the speaker may pronounce each word. For
example, the result of the training procedure applied to
the feature sequence Voice after 5 presentations of the
4-word vocabulary "one, two, subtract, multiply"
might be:

Word
one
two
subtract
multiply
multiply

Sequence

010
010
01010
0101010
01010

N umber of times
sequence occurred
5
5
5
3
2

The two versions of the word "multiply" exemplify a
common problem. No matter where we place threshold
boundaries, there are some words that are 'treated
inconsistently by ,the feature detectors.
However, our recognition algorithm is powerful
enough to deal with ambiguity in the voicing assignment of some vocabulary items, and thus we need not
develop a more sophisticated voicing algorithm. We
made no attempt to use rate. of voicing onset, offset,
time between burst and energy build-up for stops, etc.,
as additional cues to a better feature definition. In all
of the features used, the ambiguity remains at a level
tolerable to the recognition algorithm. The redundancy
inherent in the complete set of feature definitions allows
recognition of variations of the same message. Another
way of putting it is to say that there appear to be no
absolute boundaries along the property dimensions we
have chosen. The recognition algorithm takes this
fundamental limitation into account and makes a best
guess given the imperfect nature of the properties.
In. the training process the program reorganizes the
data for each property into a list of those sequences

309

which have occurred. The list for Voice for our example
is shown below:

Sequence

010
01010
0101010

(Word, frequency)
one 5, two 5
subtract 5, multiply 2
multiply 3

If a new utterance is presented to the program for
recognition, and the feature Voice(i) produces the
sequence 01010, then Voice will register one vote for the
word "subtract" and one vote for the word "multiply."
The unknown word is identified as the vocabulary word
eliciting votes from the most features. Typically, 'he
identified word receives a vote, signifying a perfect
match for that property, from only about 80 percent of
the features.
In case of ties, the program makes use of information
concerning the number of times a word appears at a
node. Thus, if "subtract" and "multiply" tie for first
place in the voting from all the features and Voice =
01010, then Voice will register 5 votes for "subtract"
and 2 votes for "multiply" in the run-off between these
two candidates.
The final decision procedure is an attempt to find the
message from the set of possible inputs which is most
similar to the current input message. Because there is a
wide variation in the way people say things, the
decision procedure does not insist that the current input
must be like one of the prototype input strings in all
ways that it was categorized; that is, it need not be
suggested by all properties. In this sense, the decision
procedure allows a generalization of the original training
and learning by looking for a best fit without putting a
bound on the goodness of this fit.
The property sequences have been considered as
independent characterizations of the input message. In
this case, by independent we do not mean that the
computations themselves are necessarily independent,
but that these descriptors of the input message are
treated independently in the decision process. With the
assumption of independence, the voting procedure is
similar to a maximum likelihood estimate. The a priori
probabilities of all messages are the same. Therefore,
the most likely message is the one for which the product
of the a posteriori probabilities (or the sum of their
logarithms) is a maximum. For each property, every
message, M" previously associated with the current
input sequences Si is given a (scaled) log probability of
100
N i, where N i > 1 is the frequency with which
Mi was seen for Si. Messages not associated with Si in
training are given log-probability 0 and can therefore
be ignored in the summation. These assignments of

+

310

Fall Joint Computer Conference, 1968

probabilities achieve in one step a score which allows a
single search to determine the most likely message.
It has been experimentally determined that the voting
scheme works as well or better than a number of other
measures that make use of the same information. For
example, we tried the adjusted weight used by Teitelman 19 in ARGUS, a hand printed character recognizer
(a similarly structured pattern recognition system) ; and
log (1 + N i) which is a good small sample probability
estimate of the a posteriori probability of message i.

vowel, [i], for which the vocal tract is more
closed (Lehiste and Peterson, 1959; Fant,
1960). The function is intended to compensate
for the reduced level associated· with· a low
first formant.
2. ah(i)

=

F9(i) + FI0(i)
2F6(i) - 2F7(i).

4. oo(i)

+

Fll(i)

+

FI2(i)

F3(i) + F4(i) + F5(i) - F8(i) - FI0(i)
- FI2(i) - FI4(i) - FI6(i).

=

The vowel [u] as in "boot" is produced by
positioning the tongue body as high and as far
back in the mouth as possible. An acoustic
correlate of this articulation is a low first and
second formant, resulting in a major energy
concentration below F7 and reduced energy
above F7. The function 000) will therefore be
a maximum for vowels similar to [u].

Fl(i) + F2(i) + F3(i) + MAX [F2(i) ,
F4(Ql + MAX [2(F3(i) - F4(i)), 0].

This function is intendeq to provide a measure
of the perceptual loudness of vowels. Perceptualloudness is related to vocal effort whereas
the acoustic energy in a vowel depends in part
on the voc~l tract configuration as well as
vocal effort. For example, the low vowel, [a],
for which the vocal tract is relatively open will
have a greater natural intensity than the high

- Fl(i) - F2(Q.

The vowel [i] as in "beet" is produced by
positioning the tongue body as high and as
forward in the mouth as possible. An acoustic
correlate of this articulation is a low first
formant and a high second and third formant,
resulting in an energy minimum in filters 6
and 7, and an energy concentration between
filters 9 and 12. The function ee(i) will
therefore be a maximum for vowels similar
to [i].

Functions
1. Loud(i)

+ F4(i)

=

3. ee(i)

Linguistic features.
We distinguish functions, such as Loud (i) , which
have a domain equal to the input spectral representation
of an unknown word; features, such as Voice (i) , which
are functions that are used in recognition and have a
range limited to a small number of states; and feature
sequences, such as Voice, which are the result of
removing the time dimension from a feature. The
following functions are used in the definitions of a set
of 15 features.

F3(i)

This function a~d the following two functions
are used to characterize the spectral quality of
the vowel nuclei of a word. The vowels
[i, a, u] represent limiting articulatory positions for the tongue body. The vowel [a], as
in "pot," is produced by placing the tongue as
far back and as low as possible without
producing a constricted vocal tract (and
therefore a consonant). An acoustic correlate
of this articulation is a high first formant,
resulting in a greater output.in filters 3 and 4
than in filters 1 and 2. The function ahO) will
therefore be a maximum for vowels with a
high first' formant.

Functions and properties used in recognition

The principal results of this research have been the
development of properties which characterize speech
input signals in a way to make recognition possible. Two
different sets of recognition properties are included here.
The first is a set of properties and functions which tend
to describe the speech signal in more linguistic terms.
Transitions of these properties describe features of the
input message which can be understood in terms of the
ordinary linguistic descriptions of such messages. In
this way, they tend to more speaker independent .than
the second, more abstract set of properties which are
described.
The second set of properties extract features of the
spectral shape of a message. Their extreme simplicity
makes them seem ideal for hardware implementation,
and their high accuracy in recognition suggests that
they capture most of the invariant qualities of our input
message set.

=

5. er(i)

=

F7(i)

+ F8(i)

- F4(i) - FI2(i).

This function is similar to the vowel functions
in form, but has the task of detecting spectra
characteristic of the consonantal and syllabic
allophones of [r]. The low third formant of [r]
and [~] (as the vowel in "Bert") produces a
distinct spectral shape with an energy concentration centered in filters 7 and 8, a dip in

A Limited Speech Recognition System
energy at filter 4 between the first and second
formants, and an absence of energy above FlO
due to the low third formant. The function
er(i) will therefore be a maximum when phones
similar to [r, e] are produced.

1. Voice(i) = 1 if [F2(i)

+ FI7(i) + FI8(i) + F19(i).

This function is a maximum when high
frequency frication energy is present. The
strident phones produce intense high frequency
energy, whereas a non-strident fricative produces a small energy peak in filter 19. The
function str(i) will therefore be a maximum for
many allophones of [s, z, s, z, c, j, t, k], which
are the first consonants in [sin, zen, shin,
azure, chin, gin, tin, kin] respectively.
7. dspect(i) = 1ah(i) - ah(i - 1)1
+ loo(i) - oo(i - 1)1

+

1ee(i) - ee (i) 1

This function is a computationally inexpensive
approximation to a spectral derivative. The
function will be a maximum when the
spectrum is changing rapidly, as for example
in a consonantal transition.· Dspect(i) is used
as an aid in delimiting syllable boundaries. It
is also used to distinguish ee-like· vowels from
some consonant-vowel transitions that produce
a momentary peak in the function ee(i).
8. cv(i) = sum of FI(i) through FI6(i).

This function tends to be greater for vowels
than for adjacent consonants. This is because a
constricted or closed vocal tract configuration
results in a reduced acoustic output in the
frequency range spanned by these filters. This
function is used to detect syllable boundaries.
9. damp(i) = sum of FI(i) through FI9(i) minus sum
of Fl(i - 1) through FI9(i - 1).
This function indicates a sudden increase in
energy in all filters. It will be a ~aximum for
stop releases and sudden voicing onsets. It is
used to detect stop bursts.
Features
The preceding functions are used in the computation of
the following features. The usual ,interpretation of the
three feature values (states) is: "-1" implies that the
property is irrelevant for this time interval; "0" means
that the property is relevant but not present; and "I"
means that the property is relevant and present.

tl] or [F2(i)

Voice(i -1)

=

>

tI-5 and

1]

o otherwise
tl

li. str(i) = F16(i)

>

311

=

34

A hysteresis region of 5 units is employed about the
threshold, tI, to ensure that a change of state is
significant and not due to random fluctuations in level.
The effect of the second conditional part of the definition
is to keep Voice(i) in its current state for values of
F2(i) between 30 and 34, the hysteresis region.
An unknown word may vary considerably in overall
recording level if the speaker moves with respect to the
microphone or changes his vocal effort. It is much
easier to compensate for recording level by modifying
the threshold, tI, than by attempting to modify the raw
data. The maximum value attained by the time function
Loud(i) is used for this normalization:
Maxloud = MaXi [Loud(i)]
Loud(i) attains its maximum value near the midpoint
of the stressed vowel nucleus. For a speaker positioned
correctly in front of a microphone and speaking at a
comfortable level, a typical value for Maxloud is 200.
Threshold normalization is accomplished by computing
a new threshold, tI', for each unknown word according
to the following formulae:
t'l

=

tl

* (200/Maxloud)

The method fails if the recording level increases to
saturation or decreases below background noise. The
effective range for recording level insensitivity is somewhat less than the full 45 decibel range of the input
system.
The fundamental voice frequency of a male speaker
will from about 90 to 180 Hz. The greatest energy due to
voicing will appear in the low frequency filters because
energy in the harmonics of the laryngeal source falls off
at about 12 db per octave. Voice(i) looks at the energy
in filter 2. If this energy exceeds a threshold, voicing is
present, otherwise not. This simple definition has
worked surprisingly well. The greatest difficulty has
been in treating final voiced stop releases consistently,
and in detecting voicing energy in some voiced fricatives.
2. Syllable(i) = 1 when the function cv(i) is significantly increasing
o when the function cv(i) is significantly decreasing
otherwise, set to same value as in
previous time sample.

312

Fall Joint Computer Conference, 1968

The precise computation that implements this definition
is too lengthy to be given here. The feature usually gives
an accurate count of the number of syllables in a word
and provides a rough segmentation. However, the times
at which the feature changes state do not delimit
. precise syllable boundaries. Examples of difficulties with
Syllable(i) include a frequently missed third syllable in
"binary" and the segmentation into two syllables of
some repetitions of the words "four" and "core."
3. Stress(i) =

1 if Loud(i) = Maxloud for the first
. time.

o if Syllable(i) =

1

-1 otherwise

Maxloud = Maxi [Loud(i)]
This feature is designed to indicate which syllable of a
word is the one which has the maximum loudness and is
therefore the stressed syllabl2. Stress assignment has
worked very well. The only word for which stress
assignment has not consistently agreed with the expected stress assignment is "overflow," and this may be
due to variations in the actual stress given the word by
our speakers.

6. ~u]-like(i) = -1 if [Voice(i) = 0]
1 if [oo(i)

> t2 or [[u]-like (i -1) =
and F2(i) >

>

1] or [ah(i)

t2 = 32
This feature indicates the presence of the vowels
[u, v, OU,) ] (the vowels in [boot, book, boat, bought]) in
many phonetic environments. The additional clause
involving Fl(i) and F2(i) is intended to eliminate
responses to consonants such as [m, n, 1, w]. It has been
found necessary to ignore any transitions to the "I"
state in the featur~s [i]-like(i) and [u]-like(i) if they last
less than 6 time samples. Even with this additional
constraint, a number of consonants are assigned one
of these vowel-like qualities. In addition, there appear
to be no natural threshold boundaries in the vowelquality space so that a certain percentage of the
vocabulary are treated inconsistently by each feature.

7. [r]-like(i) =

-1 if [Voice(i) = 0]
1 if [[er(i) > 18 and
F3(i) - F4(i)

>

5]

or [er(i) > 14
and [r]-like (i-l)= 1]]

o otherwise
>

-2 and

raj-like (i - 1) = 1]

o otherwise
This feature indicates the presence of the vowels
[a, ow, ), ae, A] in many phonetic environments (the
vowels in [pot, boat, bought, bat, but] respectively).
5. [i]-like(i) = -1 if Voice(i) = 0

This feature indicates the presence of [r, e] in many
phonetic environments. The clause involving F3(i) and
F4(i) is intended to ensure that the first formant
frequency is not high. The low third formant of these
phones produces a spectrum that is distinct and
relatively easily differentiated from all other speech
spectra. The feature works consistently except following
voiceless stops and in some unstressed intervocalic
positions.
8. Strident(i)

> 16 or [[il-like (i -1) =
and ee(i) > 8] and FI9(i) < 25
and Dspect(i) < 30

1 if [ee(i)

> t2-7]]

o otherwise

4. [a]-like(i) = -1 if Voice(i) = 0
1 if [ah(i)

1 and 000)
Fl(i)

1

o otherwise
This feature indicates the presence of the vowels
[i,l, ell , E] (the vowels in [beat, bit, bait, bet]) in many
phonetic environments. The two additional clauses
involving FI9(i) and Dspect(i) are utilized to eliminate
false responses to stridents and consonantal transitions
which are momentarily [i)-like.

=

1 when the function Str(i) is significantly increasing
.

o when the function

Str(i) is signifi-

cantly decreasing
- 1 otherwise set to same value as in
previous time sample
This feature indicates the presence of [s, z, s, z,] and alsy
[t, d, k, g] in certain phonetic environments (generalol
in stressed position and followed by a front vowel).
A floating threshold is employed to divide a. sequence
of two successive stridents (e.g., [st]) into two strident
segments separated by the state "-1."

A Limited Speech Recognition System
9. Strid-stop(i)

=

0 if Lstrident(i) = 1

stops by the sequence "1,0" and voiceless stops by the
sequence "1, -1, 0."

1 if Strident(i) = 1
-1 otherwise

12. Nasal(i) = -1 if Voice (i - 2) = 0

Where Lstrident(i) is the same as Strident(i) except that
the state "+ I" must occur for more than 6 time
samples or it is transformed to the state -1. This
property computes the length of a strident segment and
places it in one of two categories. In general, a long
strident is a continuant and a short strident is a stop.
However, in some phonetic environments, voiceless
stops may have an aspiration d,uration that is longer
than the frication duration of an intervocalic fricative.
1 if [[[FI9(i) > t4] or [[FI9(i) >
t4 - 4] and, [Fricative (i-I)
= 1]] and [Lotid(i) < 120]]

10. Fricative(i) =

o if Voice(i)

= -0

-1 otherwise
t4=6
This feature looks for the high frequency energy
characteristic of [f, v, 8, a], (the initial consonants of
[fin, vend, thin, then]). Strident phones generally exceed
the threshold and are also detected by FricativeO). The
upper bound on Loud(i) is used to prevent a response to
a loud vocalic sound in which energy is spread over the
entire spectrum. A feature like Fricative(i) or Strident (i)
sends a great deal of information about a word to the
recognition algorithm, but neither feature is as consistent in its analysis of an unknown word as a simple
feature such as Voice(i).
11. Stop-burst(i)

=

313

1 if [[damp(i)

>

Loud(i-l)

>

5

>

1]1

or [Nasal(i -1) = 1
and.Loud(i)-Loud (i -1)
and [ah(i) - ah (i -1)

>

5

or ah(i) - ah(i - 2) >] 8

o otherwise
This feature looks for a voiced segment followed by a
sudden increase in loudness and a rising first formant
frequency. A nasal followed by [i] does not satisfy this
criterion, but nasals in many other environments are
detected. Initial [t] is frequently also detected by the
feature. Features that look for dynamic properties of
the input spectra are not easy to define efficiently. This
relatively simple algorithm does not give a very
satisfactory definition of nasality.
13-15. There are three other features of a somewhat
different type. The~e features are intended to give a
fairly precise characterization of the stressed vowel in
the unknown word. The features, called raj-stress,
[i}-stress, and [u}-stress respectively, characterize the
spectrum at a single time sample, that point during the
stressed vowel when Loud(i) reaches a maximum for
the word.
The ranges of the functions ah(i), ee(i), and oo(i)
have been divided into 10 regions corresponding to the
10 possible states of the three special features:

75]

and [F19 (i -1)

<

30]

and [[F2(i)

<

20]

or [F2(i) -'- F2 (i - 1)

<

1]]]

o if Voice(i)

1 if [Loud (i) -

= 1

-1 otherwise
This feature detects the sudden onset of energy in all
filters that is characteristic of the release of a stop. The
stop burst is distinguished from a rapid voicing onset by
requiring the energy in F2(i) to either be low or not
increasing. The. "-1" state following a burst is removed
if it is less than 3 time samples long. This transformation
is an only partially successful attempt to signal voiced

tLPPER-BOOND ON REGION
State:
ah(i)
ee(i)
00 (i)

5
6
2 3 4
1
none 14 9 4 0 -3
0
none 80 60 40 20
0
none 80 60 40 20.

7
- 6
-20
-20

8
-11
-40
-40

9
-16
-60
-60

10
-27
-80
-80

A typical stressed [i] phone might be characterized by
the states raj-stress = 9, [i]-stress = 1, and [u]-stress= 6.
It has been found that this characterization is relatjvely
stable for a given word. Most words fall into two or at
most three states for each of the features.
Non-Linguistic Properties
A set of abstract properties was defined near the end
of the research project in order to provide a comparative
base for the performance of the linguistically motivated

314.

Fall Joint Computer Conference, 1968

features just described. These properties take advantage
of some of the constraints that apply to speech spectra,
but do not reflect the detailed phonetic content of the
utterances.
There are two distinct types of spectral shape
properties that were used in this set. The first nineteen
properties crudely categorize the shape over time of the
output of each of the nineteen filters, individually, with
no attention paid to correlation between filters. There
are three regions of "interest" in the output. The
spectral property is given the value" -I" if the output
is in the lowest region, "0" in the middle region, and "1"
in the highest region. A hysteresis region around the
transition threshold is used to prevent many "uninteresting" transitions when the filter output is near
the border of these regions.
Formally, we define a set of 19 spectral amplitude
properties, Sn(i), as follows, where the notation Fn(i)
denotes the output of filter n at the ith sample interval:
Sn(i)

=

1 if (Fn(i) > B) or ([FnO)
[Sn(i - 1) = 1]]

>B

- 8] and

o if (Fn(i) > A] or [(Fn(i) > A - 8; and
(Sn(i - 1)

~

-1]]

-1 otherwise
A and B, as a function of the filter number, are given in
the following table:
n

A
B

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
18152015 17W17 13
50 47 44 40 35 45 40 35 30 38 34 31 27 35 30 30 30 25 30
373430252030~2015~21

The threshold values in this table should be modified
if there is a change in recording level. This can be done
in the same way as previously described for thresholds
involving linguistic features.
Another ten properties are used which roughly describe the correlation between adjacent filters for the
lower ten filters. These properties catagorize the differences between energies in adjacent filters. The three
alternatives are: the next higher band has significantly
more energy, significantly less energy, or about the same
energy, as its lower neighbor. These properties are given
values "1," "-1," and "0" respectively in these cases.
Formally, we define a set of 10 spectral difference
properties, Dn(i), as follows, where n = 1,2, ... , 10 and
m= n + 1:
Dn(i)

=

1 if [(Fm(i) - Fn(i) > 4]
or [[Fm(i) - Fn(i) > -1]
and [Dn(i - 1) = 1]]]

if [[Fm(i) - Fn(i) < 4]
or [[Fm(i) - Fn(i) < 1]
and [Dn(i - 1 = -1]]]

~1

o otherwise
A change of state for one of these properties indicates
that the spectral shape of the current time sample differs
from the spectral shape of the previous time sample.
A change of state is not produced by a simple change in
level since it is the difference in energies which is
significant. The large hysteresis region around the
thresholds also prevents a property from changing state
when there is no energy present in either filter.
The thresholds for the two types of properties were
selected so that each state could be reached by at least
some of the vocabulary items. The 29 properties
produce sequences of states used in recognition. We can
compare directly these recognition scores with those
produced by state sequences from the 15 linguistic
features.
Results

As benchmark experimental data, we recorded a word
list, Table 2, used by Ben Gold in other speech recognition experiments. This list was recorded in a quiet room
(SIN ratio > 35 db) as spoken 10 times by two
speakers, KS and CW~ Both had been used as subjects
by Gold. KS and CW were also recorded 5 times each
on two other lists, an augmented International Word
Spelling alphabet, Table 3, and a message list typical
of one that might be used in a NASA mission context,
shown earlier in Table.l.
The messages were recorded on high quality magnetic
tape at 7Y2 ips, with approximately two seconds gap
between words. For almost all experiments we used a
digital tape containing the 6 bit logarithms of the filter
bank output sampled every 10 milliseconds. Only in the
noise degradation experiment was the analog input used
directly. No difficulty was encountered in finding the
beginning and end of each message.
A training round consists of one repetition of the
entire word list in which the computer makes an
identification attempt, is told the correct response, and
stores the characterization of this message for use in
future identification. With four rounds of training
utilizing the linguistic properties, the system recognized
correctly (gave as unambiguous first choice) 51 and 52
out of 54 words of the Ben Gold list for· KS and CW
respectively. Early experiments indicated that additional training would not increase the recognition scores
after reaching its asymptote, and these 95 % correct
scores were available after only 3 rounds of traini~g.
Further experiments gave speaker KS 38 out of 38

+

A Limited Speech Recognition System

insert
delete
replace
move
read
binary
save
core
directive
list
load
store
add
subtract
zero
one
two
three
four
five
six
seven
eight
nine
multiply.
divide
number

name
end
scale
cycle
skip
jump
address
overflow
point
control
register
word
exchange
input
output
make
intersect
compare
accumulate
memory
bite
quarter
half
whole
unite
decimal
octal

315

difficulty is that these later rounds were recorded at a
different time. This indicates that some degradation in
performance may be expected under less well controlled
conditions.
Some incorrect responses are listed in Table 6 (for
KS on the Gold list after 4 training rounds). These
confusions give an indication of the types of phonetic
information that is not well represented by the linguistic
features. For example, the "four-core" confusion
suggests that frication noise often falls below the lower
thresholds of the filters, and that formant transitions
are not sufficiently distinct to trigger different state
transitions for this word pair. It is expected that some
improvements could be made in the threshold settings
by studying the data of Table 6.

Previous Training 1 2 3 4 5 6 7 8 9
Ben Gold List
43 44 49 51 47 45 52 49 51
Alphabet
30 36 34 38
NASA List
35 37 43 43

Perfect
54
38
44

TABLE 5-Typical recognition scores (KS)

TABLE 2-Word list from Ben Gold

zero
one
two
three
four
five
six
seven
eight
niner
affirmative
negative
alpha
bravo
Charlie
delta
echo
foxtrot
golf

hotel
India
Juliet
kilo
Lima
Mike
November
Oscar
papa
Quebec
Romeo
Sierra
tango
uniform
Victor
whiskey
x-ray
yankee
zulu

TABLE 3-International word spelling alphabet and numbers

correct on the International Word Spelling Alphabet
and 43 out of 44 correct on the NASA message set,
indicating the usefulness of these linguistic properties on
other message sets. Recognition rates for the Gold list
as a function of training rounds are shown in Table 5.
Note the lack of improvement (and oscillation of scores)
with more than 4 rounds of training. Part of the

Correct Answer

Guess

Weather at Splashdown Point,
Four
Binary
Load

Alternate Splashdown Point
Core, or Whole
Memory
One

T ABLE 0-Typical mistakes

These asymptotic recognition scores also indicate the
separability of this 54 word vocabulary with these
linguistic properties. The three vocabularies were combined into a single vocabulary of 114 distinct messages
(duplications between vocabularies were considered only
one message). On this larger vocabulary, the recognition
score was a remarkable 110 out of 114 for KS. All those
messages identified correctly in the individual lists were
also identified in this larger context after the same four
training rounds. This indicates very little interference
between messages on these different lists; and implies
that fairly large noninterfering (phonetically balanced)
vocabularies might be constructed while maintaining
this high recognition rate. It should be emphasized that
while messages were repeated in training and testing,
the same speech utterance was never seen more than
once by the system.
To test the consistency of speakers uttering messages,
we devised the spectral threshold properties described
earlier. We tested these properties for recognition only

316

Fall Joint Computer Conference, 1968

on the Ben Gold word list. After four rounds of training,
the system was able to identify correctly 52 out of the
54 input messages presented to it for KS; and 51 out
of 54 for CWo This rate is as good as that discussed for
the linguistic features.
The spectral threshold properties appear to converge
more rapidly to a higher recognition score on early
training rounds. However, the linguistic properties may
be slightly less speaker dependent. Neither of these
tendencies is statistically significant so we are unable to
make a definitive comparison.
There are 29 spectral threshold properties and only 15
linguistic properties. In addition, the spectral threshold
properties tend to produce longer sequences. The
comparable recognition rates of the two property sets
suggests that the total information sent to the recognition algorithm by each set is roughly the same order of
magnitude. If this is true, then it can be concluded that
the linguistic sequences embody a more concise and
more consistent representation of the vocabulary.
DISCUSSION
We have outlined the reasons why word recognition
based on spectral input data is not a straightforward
problem in pattern recognition. The invariants in the
speech code appear to be relatively complex functions
of the spectral input. We have also outlined the reasons
why phoneme recognition is not an appropriate intermediate step in a word recognition algorithm. Unsolved
problems include the segmentation of speech spectra
into phoneme sized chunks and the derivation of rules
for recognizing all of the allophones of a given phoneme.
Our approach is intermediate between pattern recognition and phoneme recognition.
A set of acoustic feature detectors have been defined.
The time dimension is removed from each feature so
that the learning program deals only with the sequences
of states produced by the feature definitions. The
feature sequence characterization of an input message is
sufficiently redundant so that the recognition algorithm
is able to deal successfully with errors and inconsistencies in some fraction of the features.
The advantages of this approach are:
(1) No precise segmentation of the utterance is
required; features can change state in arbitrary
time segments because the time dimension is
removed from a feature in a way that js independent of the changes of state of other features.
(2) A word need not be registered at exactly the
same place in the 2 second speech sample; state
sequences are independent of time origin.
(3) Feature definitjons can be made insensitive to
the recording level by adjusting threshold

(4)

(5)

(6)

(7)

(8)

settings according to a measure of the loudness
of the unknown word.
Feature definitions can be made less sensitive to
noise by employing hysteresis regions about
thresholds.
State transition sequences weight changes in
spectra as the important cues to word recognition (simple pattern-matching schemes will give
undue weight to a sustained vowel).
Features may be defined to take advantage of
natural acoustic boundaries between phones
(Stevens, 1968b) and thereby minimize the
variability in state transition sequences produced
by a feature.
Features may be added to the system to provide
redundancy for those decisions that are difficult.
There is a direct control over the amount of
redundancy sent to the recognition algorithm.
The feature approach permits the introduction
and testing of linguistic hypotheses, such as
placing greater emphasis on the properties of the
stressed syllable.

The disadvantages of this approach are:
(1) Removal of the time dimension discards all
information concerning the simultaneous occurrence of specific states for two or more features.
We have used the voicing feature to reintroduce
some timing information. There exist pairs of
English words for which this "time with respect
to the voiced segments" is not enough to
disambiguate the pair. Special features can
always be defined to treat special cases, but our
approach is not easily generalized to yield
segmentation of an utterance into phone-sized
chunks.
(2) The features currently implemented are not
speaker independent. Each speaker will have to
train the system and this requires approximately
3 or 4 repetitions of the vocabulary.
(3) Our system will degrade in performance as the
length of the vocabulary is increased or as the
number of speakers that it can simultaneously
recognize is increased. This property is of course
true of any recognition program; however, it
should be noted that, with our current sjmpleminded set of features, there is a high error rate
in any feature characterization and we rely
heavily on redundancy to "select the most likely
input message.
(4) For our limited objectives, the current implementation is computationally fast and gives
satisfactory results. However, more sophisticated
and more reliable features would be desirable.

A Limited Speech Recognition System
The exponent in the function relating computation time and feature performance is not known
but may be restrictively large.
A set of simple sum-:-and-difference properties was
compared with the linguistically motivated features in
the later stages of research. The comparable performance
of this set of properties:has led to several conclusions
concerning the desirable attributes of features that
operate within this framework.
A good feature includes a maximum amount of information in the sequences that it produces. Factors that
influence information content are consistency of characterization and the number of vocabulary items that
can be differentiated on the basis of the feature.
A voicing feature that works perfectly does not contain
as much information about the unknown word as any
of the relatively jnconsistent spectral properties. In
other words, a moderate amount of inconsistency is
tolerable if accompanied by increased word separability (and additional features to provide redundancy).
The spectral properties compare favorably on the
basis of recognition scores because the linguistic features
are fewer in number and computationally similar in
form to the spectral properties. We believe that, even
for limited vocabulary word recognition, a set of
phonetically oriented features exist which are better in
some sense than simple pattern features. The reasons
for this faith consist of arguments that:
(1) there exist natural acoustic boundaries between
phones (Stevens, 20). Thresholds placed at these
boundaries will produce features with more
consistent sequence assignments. Features selected on this basis will be less sensitive to the
free variations that occur in speech spectra.
(2) there exist invariant attributes in acoustic
waveforms from different speakers. These invariants, when incorporated into feature definitions, will produce recognition scores that are
less sensitive to the individual speaker.
The arguments in favor of phonetically oriented
features are offset by the computational simplicity of
the spectral properties. Not enough is currently known
in acoustic phonetics to take advantage of these
theoretical benefits without additional basic research.
We argue that a carefully selected set of properties like
our spectral properties represent a practical word
recognition solution that may not be superseded for
.
some time to come.
The so-called spectral shape features were not
selected primarily on the basis of their pattern recognition potential. They were carefully selected on the basis
of what is known about the information bearing
parameters of speech. An arbitrary set of parameters

317

will not work (for the reasons outlined in the introduction). In that sense, the spectral shape features resemble
acoustic phonetic parameters and are distinct from a
number of other types of pattern characterizing functions that could have been chosen. Our results should
not be interpreted to mean that a fundamental knowledge of speech is not needed when working on restricted
problems such as limited vocabulary word recognition.
On the contrary, it was only after developing a set of
linguistic feature definitions within the context of our
chosen recognition algorithm that we were able to
devise a set of spectral shape functions possessing the
necessary atrributes.
ACKNOWLEDG MENTS
The authors wish to acknowledge the invaluable
assistance of Lucille Darley who did most of the
programming of LISPER, and Kenneth N. Stevens and
Gottfried von Bismark, 21 who designed and built the
filter bank spectrum analyzer.
REFERENCES
1 D G BOBROW D L MURPHY

W TEITELMAN

The BBN LISP system
BBN Report No 1677 April 1968

2 J MCCARTHY et al
The LISP 1:5 programmers manual
MIT Press 1964
3 JLFLANAGAN
Speech analysis synthesis and perception

New York Academic Press 1965
4 N CHOMSKY M HALLE
The sound pattern of English

New York Harper and Row 1968
5 R JAKOB SON G M FANT M HALLE
Preliminaries to speech analysis
The MIT Press Cambridge 1963

6 J HEMDAL G HUGHES
A feature based computer recognition program for the modeling
of vowel perception

In W Wath-enDunned Models for the Perception of Speech
and Visual Form pp 440-453 Cambridge The MIT Press 1964
7 BGOLD
Word recognition computer program

Technical Report 452 Research Laboratory of Electronics
Cambridge MIT Press 1966
8 P DENES M MATHEWS
Spoken digit recognition using time-frequency pattern matching

The Journal of the Acoustical Society of America 32 pp
1450-1455 1960
9 H DUDLEY S BALASHEK
A utomatic recognition of phoentic patterns in speech

The Journal of the Acoustical Society of America 30 pp
721-7321958
10 K H DAVIS H R BIDDOLPH S BALASHEK
A utomatic recognition of spoken digits

The Journal of the Acoustical Society of America 24 pp
637-642 1952

31~

Fall Joint Computer Conference, 1968

11 G S SEBESTYEN
Recognition oJ membership in classes

IRE Transactions on Information Theory IT-6 pp 44-501961
12 B LINDBLOM
Spectrographic study oj vowel reduction

The Journal of t.he Acoustical Society of America 35 pp
1773-17811963
13 L J GERSTMAN
Classification of self-normalized vowels

1967 Conference on Speech Communication and Processing
6-8 November Office of Aerospace Research United States
Air Force pp 97-100 1967
14 DBFRY PDENES
The solution of some fundamental problems in mechanical
speech recognition

Languages and Speech 1 pp 35-58 1958
15 TBMARTIN ANELSON HZADELL RCOX
Continuous speech by feature abstraction

DDC No AFAL-78-66-189 Camden N J RCA 1966
16 DRREDDY
An approach to computer speech recognition by direct analysis of
the speech wave

Technical Report C549 Palo Alto Cal Stanford University
Computer Science Department 1966
17 GWHUGHES
The recognition oj speech by machine

Technical Report 395 Research Laboratory of Electronics
Cambridge MIT Press 1961
18 K N STEVENS
Study oj acoustic properties of speech sounds

BBN Report 1669 AFCRL Report 68-0446 Bolt Beranek and
Newman Inc 1968
19 W TEITELMAN
Real time recognition of hand printed characters

Proc FJCC Spartan Press 1964
20 K N STEVENS
The quantal nature oj speech: evidence from articulatory-acoustic
data
In E E David and P B Denes eds Human communication A
Unified View New York McGraw-Hill in press

21 K N STEVENS G von BISMARCK
A nineteen-channel filter bank spectrum analyzer for a speech
recognition system

NASA Scientific Report No 21967 Contract NAS 12-138

Computer models for speech and music appreciation
by P. B. DENES and M. V. MATHEWS
Bell Telephone Laboratories, Incorporated

Murray Hill, New Jersey

INTRODUCTION
Computers have been used extensively in speech
research for over 10 years now; they ,have been
applied to the synthesis of musical sounds for a
slightly shorter period. The results have produced
models of sound production and perception which
are intimately related to the synthesis rules programmed in the computer and indeed the program is often the best available model of the
production or perception process.
The most difficult problem encountered in both
speech synthesis and music composition is the
introduction of the right kind of long range dependencies. In speech, excellent isolated sounds
can be easily generated. Transition rules which
synthesize high quality examples of two sequential sounds tax both the state of our acoustic
knowledge and our computer programs. Longer
range effects such as, sentence stress have barely
begun to be studied. In music, we cari produce
single notes which "are either excellent imitations
of existing instruments or interesting new tones,
we can closely imitate a complicated style for a
few notes with ,a composing algorithm, but we
cannot generate minutes of sound which approaches the cohesiveness of human compositions.
In order to understand the underlying problems of long range structure, the rest of this
paper will survey speech synthesis procedures
and composing algorithms with special emphasis
on this structure. As will become clear, although
there are some similarities between the speech
and music structures, the differences far outweigh the similarities.

Speech synthesis
Research on generating artificial speech has
been going on more or less continuously for sev-

e!al centuries. 1 More recently, a significant part
of this effort has been devoted to "speech synthesis by rule," the process which converts
sentences specified on a typewriter keyboard into
readily understandable speech. Synthesizers of
this kind are constructed to serve as models of
the speech mechanism and are used for the study
of the human speech process. They could also
have practical applications, for example, for auto'matic voice read-out from computer-based information retrieval systems and from teaching
machines, and for other ways of improving mancomputer interaction. Unfortunately, however,
nobody has yet been able to design a satisfactory
method of speech sYnthesis by rule. This is not
due to any lack of effort, but is more an indication .of some unexpected complexities of the
speech process.
The basic speech generating process is deceptively simple: natural speech is produced by the
vibration of our vocal cords and this buzzy sound
is transmitted through the tube formed by our
throat and mouth. This tube, the vocal tract, has
a number of resonances, called the "formants,"
and the frequency of the acoustic resonances
depends on the shape of the vocal tract. The
quality of the vocal cord buzz is modified by the
formants when the sound is transmitted through
the vocal tract. As speech sound after speech
sound is pronounced, the movements of tongue and
lips change the shape of the vocal tract; this will
alter the frequency of the formants, and thereby
the quality of the sounds produced. Intensive research in the 1940's and 1950's resulted in satisfactory explanations of what determines the
acoustic resonances of non-uniform tubes of
shapes like those of the vocal tract. The acoustics
of speech production is therefore fairly well understood and a variety of working models are avail-

319

32Q

Fall Joint Computer Conference, 1968

able. The understanding of the relevant acoustics,
however, is insufficient for explaining the speech
process as a whole. Experiments carried out at
Haskins Laboratories in New York,2,3 byOhman 4
and Lindblom, 5 and by others indicate that the
acoustic features typical for a phoneme when pronounced in "isolation are modified extensively when
this same phoneme is pronounced in a connected
sentence. The changes are complex and are a functjon of a variety of contextual circumstances. The
spectrogram of the sentence shown in Figure 1
gives a number of exampl~s of this. The syllable
"comp" occurs twice in this sentence, the first
time in 3r stressed position and the second time
unstressed. The difference in the corresponding
acoustic features is obviously very large. Again,
the phoneme III occurs in a word initial position
and again in a final position and shows significant acoustic differences. Similarly for the
phoneme Ip/· when followed by different vowels.
Broadly speaking there are two classes of contextual influences that are significant. One is a
result of linguistic factors such as stress, inflection, grammar and certain relations between
speech sounds that vary from language to language. The other ·class is the result of articulatory
context: our vocal organs are constituted in
specific physical ways, their muscular control for
continuous action is coordinated at some higher
physiological level, their musculature allows only
certain movements and the acceleration and
velocity of their masses obeys the usual laws of
dynamics.

For many years our principal method for investigating natural speech was by examination of
speech spectrograms. All effects, acoustic as well
as articulatory and linguistic, were therefore
evaluated mainly in terms of formant specifications.
Naturally enough, the models of speech production were also controlled in terms of formants.
Such models are called "formant synthesizers."
They simulate the vocal cords by pulses that repeat at the rate of the vocal cord vibrations: the
frequency of these pulses determines the pitch of
the synthesized speech sounds. The pulses are applied to a number of resonators, each representing
one of the formants of the vocal tract. The vocal
cord generator and the resonators can be simulated by computation or by conventional electronic
circuits. In either case it is relatively simple to
use computer programs for controlling the frequency and amplitude of the vocal cord pulses
and the frequencx and bandwidth of the resonators. Such computer programs would typically
reset each of the above parameter values every
10 msecs in order to produce the varying sound
qualities appropriate for a spoken sentence. The
schematic diagram of a computer-controlled electronic formant synthesizer can be seen in Figure
2 which shows the formant synthesis facilities of
the Honeywell DDP 24, at Bell Laboratories. 6 The
DDP 24 'controls the electronic formant synthesizer 6 a by outputting a set of 12 numbers
every 10 msecs which set the 12 control parameters of the formant synthesizer (pitch, ampli-

RAND TABLE I

FIGURE I-Sound spectrograms plot time along the horizontal axis and formant frequency along the vertical axis and
indicate sound intensity by the darkness of lines. This spectrogram of the sentence, "It's a compact little computer" illustrates
how phonemes vary according to context. Note the differences
between the two "I" sounds in "little" and between the "comp"
sounds in "compact" and "computer." These differences are
influenced by many factors, which include sentence stress and
inflee,tion.

r---------,.

FIGURE 2-Schematic diagram of computer controlled
formant speech synthesizer.

Computer Models for Speech and Music Appreciation
tudes, formant frequencies and bandwidths, etc).
The experimenter not only hears the synthesized
speech in real time but he can also see any or
all control parameters displayed as a function of
time on the screen of the computer controlled
cathode ray tube. Programs are available for controlling each of the 12 parameters in one of two
ways:

321

almost never take into account the influence of
m'Ore than three successive phonemes and are
therefore essentially concerned with short term
dependencies. Some 'Of the synthesis by rule pr'Ograms, however, also accept stress and punctuation marks as part of the typed input. 8 ,9,1o These
additi'Onal symbols are used by the program to
c'Ontrol the formant values and durati'On of individual
elements, and the pitch cont'Ours through1. The experimenter can specify parameters
out
the
sentence. These grammatical factors
as a function of time by drawing the appropriate
effect
successive
elements over entire sentences
curve using a Rand Tablet and he can listen to the
rather
than
just
two
or three phonemes. Furtherc'Orresponding change in the synthesized speech.
more,
as
will
be
seen
from the experiments de2. A sentence t'O be synthesized is typed int'O .
bel'Ow,
the
factors
to be considered greatly
scribed
the computer, phoneme by phoneme. A c'Omputer
influence
each
'Other:
'Only
by computer techniques
pr'Ogram then calculates the variations in time
can we hope to implement these complex long
'Of each parameter by using values st'Ored f'Or·each
term dependencies with reas'Onable ease.
ph'Oneme and by applying programmed alg'Orithms
The rest of this section will describe the
f'Or determining the phoneme-t'O-ph'Oneme transisynthesis
by rule program written for the Bell
ti'Ons of these parameters. The computed paramLaboratories'
DDP 24. 8 The program c'Omputes
eter curves are then 'Outputted t'O the synthesizer
short range dependencies by calculating paramand to the display scope. Again, changes can be
eter values as a function of adjacent phonemes;
made with the Rand Tablet in real time. This
it also c'Onsiders long range dependencies by comsecond method is a typical example 'Of synthesis
puting duration and pitch values for each phoby rule.
neme that are a function of where the stressed
Sentences synthesized by rule usually have
syllables are in the sentence and also takes into
less than acceptable quality. At first it was
account whether the sentence is a statement 'Or
th'Ought that this was caused by inadequacies 'Of
a question. The pr'Ogram also allows modification
f'Ormant synthesis. J'Ohn H'Olmes/ at the J'Oint
of the computed parameter values or durati'Ons
Speech Research Unit in England, tested this
either by using the Rand Tablet and the display
assumpti'On by a fundamental experiment. He
oscillosc'Ope or by typewritten instructions. This
synthesized the same sentence in tW'O ways.
latter feature of the program was used for preFirst he controlled a synthesizer by c'OPying, as
paring synthetic speech test material for psychocl'Osely as he could, the spectrogram of a human
ac'Oustic tests aimed at finding quantitative relations between sound durations and pitch on the
utterance 'Of the sentence. The quality of the
synthesized utterance was almost the same as
one hand and stress and inflection on the other
that of the original human utterance. He then
hand. l1
generated the same sentence by rule, using the
The input to the pr'Ogram was 'Obtained by
same formant synthesizer, and by applying the
typing the sentence t'O be synthesized in phonetic
most sophisticated rules available. The resulting
transcription. In addition t'O the phonetic symbols
speech quality left much to be desired. This ex(see Table 1) a special symbol has to be typed
periment established that the inadequacies of
to mark the stressed syllables and a period or
synthesis by rule are due not to defficiencies in
question mark is to be typed at the end of the
the synthesizing circuits but are caused by less
sentence to indicate if the sentence is to be a
than satisfactory understanding of the rules f'Or
statement or a question.
Typically, each phoneme consisted of a central
c'Ombining successive ph'Onemes into a continuous
sentence.
steady state segment, an initial transition and a
Many different sentence synthesis rules have
final transition.
Stored values were available for the steady
been tried during the last few years. Certain of
state segments of each of. the phonemes for each
these rules are concerned with transiti'Ons of pa.of the 12 parameter values and also durations
rameter values from one phoneme to the other:
8
for each of the three segments and a "weight"
s'Ome c'Ompute simple linear transitions, others
for the transiti'Ons. Phoneme to phoneme transicompute tw'O-part linear transitions," and 'Others
tions were computed as shown in the examples of
again use exponential transitions. 9 These rules

322

Fall Joint Computer Conference, 1968
TABLE 1
Phonetic
Symbol
Used

Key Word

Phonetic
Symbol
Used

Pan
Tan
Can
Ban
Dan
Gun
Fan
Thin
Sin
Shin
He

M
N
NG
L
R
y
W
DH
Z
ZH
V

p

T
K
B
D
.G
F
TH

S
SH
H

KeyWord
Moon
Noon
Sing
Limb
Rim
Yes
Win
Then
Zebra
Garage
Victor

Phonetic
Symbol
Used

Key Word

EE
I
E
AE
AH
AW
U

00
UH
ER

Heat
Hit
Head
Had
Hot
Ball
Put
Boot
But
Sir

Diphthongs were considered sequences of two vowels.
LIST OF PHONEMES ACCEPTED BY SYNTHESIS PROGRAM

Figure 3. The three examples show the influence
of the relative "weights" of adjacent phonemes.
The stress marks automatically doubled the
stored duration of the steady state segment of
the stressed vowels and halved the stored duration of the unstressed vowels.
The pitch was originally computed on a monotone. The pitch of each stressed syllable was

55
PHONEME I

55
PHONEME 2

55
PHONEME I

ET

ST

55
PHONEME 2

SS
PHONEME I

ET

ST

S5
PHONEME 2

SS'STEADY STATE
ET' END TRANSITION
ST· BEGINING TRANSITION

FIGURE 3-Examples of transitions between phonemes for
three different "weights."

made to decrease: the start of this pitch fall
could be above or at the monotone level and was
a variable, selectable by a Rand Tablet operated
light button .
.The pitch change of the final stressed syllable
in each sentence decreased or increased for statement or question respectively. The intelligibility
of the sentences generated by this program
varied greatly for different sentences.
The same program was used to prepare test
material for exploring quantitative relations between stress and the duration and the pitch of
vowels. 1t The sentence "They are flying planes"
was chosen for one of the tests. As is well-known,
this is a grammatically ambiguous sentence. In
one interpretation "are flying" is the verb and
"planes" the object; in another way "are" is the
verb and "flying planes" the noun phrase. The
first version's 2413 grammatical stress pattern
(1 is the greatest stres,s) becomes a 3521 if
semantic stress is added to "planes"; the second
interpretation's 2341, stress pattern becomes 3412
if semantic stress is added to "flying." The clear
difference in meaning due to the stress oppositions of the last two words of the sentences with
semantic stress was explained carefully to the
subjects. This ensured that their responses were
in terms of the differences in meaning caused by
the position of stress in the sentence and avoided
the need to explain the concept of "stress" to
the subjects.

Computer Models for Speech and Music Appreciation
The duration and pitch of the steady state elements of the leading vowels of the diphthongs
in "flying" and "planes" were varied systematically. The pitch of the sentence was kept constant at 130 Hz except as required in the test
vowels. The results are shown in Figures 4 and
5. They indicate that increased duration and increased pitch of a vowel increase the likelihood of
hearing the syllable that include that vowel as
stressed. However, stress perception was influenced not just by the duration and pitch of
the vowel concerned but also by the duration of
pitch of other vowels in the sentence. The results also show a trade-off between duration and
pitch: if stress is perceived on syllable A because
of its higher pitch level then stress can be

-_f-

•

lO-

y-

~

it.

341--

:~
~8

>l:l
:!i~
~t
j:

i

"I-!OI--

I

..

fa

•

t--

•- I--

.

I

I

'2 t-fO

•

•

(g)

x

DURATION OF 'iOWEL OF .. FLYING

FIGURE

4-St.res~

0-40%" >LYI •• "
40-10% "'CYI ••
60-100% ·FLYI ...-

H

judgments as a function of vowel duration.

-

.-

-

,0

•

I-

-QD

x-

1--'

· 1
-:-1
· .

1--.I

QD

-.
I
oz.

l

t---_ _ _

I

r-QD

-

QD

QD

I

i
i

I

I

'30

I

I

i

PITCH OF VOWEL 011 ~fl..TI'U.·
CpS

FIGURE 5-Trade-off between duration and pitch of vowels for
stress judgments. The symbols used in Figure 4 also apply to this
figure.

323

shifted to syllable B either by changing the
duration or the pitch of its vowel. Another important effect is that "flying" required considerably less pitch or duration increase to be heard
stressed than did '~planes." This means that different syllables have different requirements of
relative pitch or duration in order to be heard
stressed.
This may have a number of explanations. It
may simply be due to the different vowels in the
two syllables, or because of their different
phonetic environments. It could also have been
due to the sentence-final position of "planes," or
due to various semantic influences. Whatever the
reason, it shows an important effect that was also
observed in other synthesized sentences: equal
duration or equal pitch of all the vowels of a
sentence do not produce equal stress. Under these
conditions of equality the stress falls on the
syllable which for grammatical or semantic reasons should have the least stress. Yet another
factor is that by principle the definition of vowel
duration must be arbitrary: the particular ad hoc
definition adopted could lead to difficulties when
the same vowel is used in different phonetic environments.
In summary, the strong influence of vowel
duration and pitch on stress perception can be
easily demonstrated. The quantitative relationship, however, is variable and affected strongly
by a great variety of phonetic, grammatical and
semantic conditions.
The outlook for good quality computer generated speech is not quite as black as these results might imply. Phonetic, grammatical and
semantic constraints can be restricted by allowing only sentences made up from a small number
of words and with a restricted grammar. The resulting ensemble of sentences could still. be significant for such applications as voice read-out
of computer stored information and at the same
time exhibit more manageable long range effects
of stress on the duration, pitch and formants of
speech sounds throughout the sentence. Work
on such simpler schemes are in progress now
and computers are indispensible to handle the
exploration of the remaining complexities that are
still formidable. The lessons learned from such
simpler synthesis schemes may well give useful
cues for more ambitious schemes later.

Composing algorithms
Music composed by machines has intrigued

324

Fall Joint Computer Conference, 1968

musicians since Mozart's time, but until computers became available, only very simple processes could be attempted. Now, almost any conceivable composition algorithm can be instrumented. We will survey the methods that have
been tried by describing four approaches which
bracket most other efforts. In each description we
will point out the kind of long range structure
achieved by (or missing in) the procedure.
As a pedagogical standard of structurelessness,
with which to compare these processes, we will
postulate an algorithm which generates successive notes by a sequence of independent random
choices. The parameters of the notes (pitches,
durations, etc.) are chosen from uniform distributions. If two or more voices are involved, they
are completely independent. Such a process both
is and sounds structureless.
A number of the first programs12 ,13,14 were
based on imposing sequential dependencies on the
process we have just described. These algorithms
produce note sequences in which (1) the probabilities of individual notes fit a pre specified distribution, or (2) the probabilities of two successive notes fit a prespecified second order distribution, or (3) the probabilities of three successive
notes fit a prespecified third order distribution,
etc. The processes have the advantage that these
distributions can be estimated for existing compositions and the composing algorithm can be
set to imitate an existing style.
The overwhelming conclusion from these processes is: sequential dependencies are not a well
appreciated, long range musical structure. First
and second order control produced subjectively
significant changes from structureless sequences.
Olson and Belar were able to compose "another
Stephen FO}Jter tune" in this way. Control of
dependencies up to the 8th order were attempted
(though accurate estimates of the higher order
probabilities are not possible from the amount
of existing music). Little more was achieved by.
the higher order control. The highest dependencies sounded repetitious and redundant. No
intermediate length generated more interesting
sequences than those produced with 1st or 2nd
processes. Neither did the intermediate sequences
closely resemble the styles on which their distributions were estimated.
These results are hardly surprising; sequential
dependencies have proven to be poor describers
of almost all time functions associated with intelligent human activity.
Sequential dependencies are intuitive to mathe-

maticians but have little association with music
theory. A more inventive approach which incorporated some music theory was developed by
Hiller and Isaacson 15 and used to compose the
Illiac Suite, a very respectable experiment. We
shall denote the process as random generation
plus rejection by rule. Hiller tried a version of
the rules of first species counterpoint and obtained highly, if locally, structured results.
To describe the process in more detail, a trial
"next note" is produced by an entirely random
selection. The note is then checked by a set of
rejection rules. If it violates any of the rules, it
is rejected and another random choice is made.
The process is repeated until either an acceptable choice is found or the program gives up
and the entire composition is abandoned.
The great advantage of Hiller's method is that
it can use very complicated rules which have
strong and peculiar sequential dependencies.
Some examples of the counterpoint rules which
he used are:
"In proceeding from one chord to the next, at
least one of the four voices must move by
stepwise motion or remain stationary."
"Only consonant intervals between voices are
permitted (unisons, octaves, perfect fifths,
thirds, sixths."
"Any melodic skip (minor third or greater)
must be followed by a repeat or a stepwise
motion."
The complexity and number of the rules is
limited only by the probability of rejecting the
entire composition. Structures can be introduced
by this rej ection process which would be very
difficult to program by any constructive process.
Moreover, rejection rules are the essence of many
elementary composition courses.
The Illiac Suite powerfully demonstrates style
and local structure. A few bars exude the unmistakable hymn like style of the· counterpoint.
The style and short term structure is much
stronger than that produced by sequential dependencies. However, if one continues to listen,
in about 30 seconds he senses an aimless wandering. Hiller and Isaacson's rules did not include
long range dependencies~ The absence of structure is apparent.
In a specific effort to control long range structure, J. C. Tenney deveioped the third process
which we will describe. 16 It can be called controlled random selection. Each parameter of each
successive note is selected randomly and inde-

Computer Models for Speech and Music Appreciation
pendently from a uniform distribution. But the
mean and limits of this distribution are selected
by the composer and can change over the composition. These changes constitute a long range
structure.
The process can best be described with an example. The specification of two parameters, duration and loudness, for one voice is shown on Figure 6. The solid line is the mean of the range
and the dotted lines the extremes of the range.
The abscissa goes from 0 to 420 seconds, the
duration of the composition. At some times (0
to 120 seconds) the composer can allow the computer great latitude as in choice of durations;
at other times (300 seconds) he can allow no
range and hence fix the computer's choice, as at
300 seconds. Average values can be likewise
manipulated.
Tenney and Gerald Strang have used this
method to achieve very marked long range structures. The ranges and rates of change of the
distributions must be carefully selected to be
perceptible to the listener, but the composer can
become highly skilled at making these selections.
By contrast, the short range structure is not
nearly as elaborate or as perceptible as that of
Hiller and Isaacson. Short sections sound like
groups of random notes, which mayor may not
please the listener depending on his regard for
John Cage's style.
One further question may be asked-who is
doing the composing, the composer or the program? The answer is both, since the perceived
output depends on both of their activities. The
long range structure is introduced by the composer; the individual notes are selected by the
z
~-;;)
c(

0

~~
o

t:

~~

i

::l
~

g
9

1/12
1/6

325

computer. Whatever is implied about authorship,
it is a most effective process from the composer's
viewpoint. He can quickly and easily construct
the broad structure of the piece with sweeping
strokes of the pen (light pen). The computer
can then do the tedious tletails of filling in the
myriad of notes. We will comment more later on
the question of authorship and innovation.
The three processes we have described so far
have involved random number generators. An alternate method called algorithmic development
has been tried by Mathews. 17 In this approach,
the computer is given a theme plus an algorithm
which modifies or develops the theme. The method
is not well defined in the sense that many
algorithms are possible and the nature of the composition as well as its success depend on the particular algorithm.
As an illustration, one example which has generated interesting results is shown on Figure 7.
The theme is considered as not one sequence of
notes, but as a sequence of frequencies Fl. . . F
and a sequence of durations Tl ... Ttl. Additional
frequencies, F, and F~, are appended to the frequency sequence. The algorithm generates notes
by proceeding cyclically through both the frequency and duration sequences, thus producing
the notes Fl T 1, F 2 , T 2 , • • • , F6 T 6 , F7 Th Fs F 2 ,
FIT;.;, etc. Since the frequency sequence is longer
than th.e duration sequence, the phase between
frequencies and durations is continually changing.
The process is cyc~ic and will repeat itself after
48 notes.
The algorithm develops the theme in the sense
of changing it perceptually but in a way so the
developed theme can be associated with the original. The short repeated melodic and rhythmic
sequences provide the perceptual clues which
bridge the theme and the development. Achieving
6

1

1/3

2/3 I-----~
4/3
6/3

I~ J J fJ

ff
f

mf

mp 1 - - - - - - - 1

~

J

P

1'P
ppp
SECTION

o

eo

(F,

F2

F3 F4

Fs

Fe

tT1

T2

T3 T4

T5

T6

1
120

160
240
TIME (SECONDS)

420

FIGURE 6-Score for Random Composition Generated by the
Tenney Algorithm.

F7

Fa )

)

FIGURE 7-Example of Cyclic DevelopmE:'nt of a Theme

326

Fall Joint Computer Conference, 1968

perceptual but associable. changes appear to be
two criteria of a useful development algorithm.
Producing an interesting sequence of notes is
a third criterion.
A number of other techniques for modifying
themes such as constructing "a weighted average" between two existing themes have been
tried by RosIer and Mathews18 and have generally produced interesting results, particularly
in rhythm. We will not describe the processes
further here.
Long range structure is provided by the perceptual association between the theme and its
development. Short range structure is provided by'
the theme itself. Hence, it has been possible to
produce compositions with interesting structures
over periods of several minutes. One can again
ask how much is contributed by the algorithm
and how much by the composer.
In a specific sense the answer to the question
of authorship is clear for any algorithm. In a
philosophical sense, it is far from settled. The
first three composing processes involve random
number generators. However, computers do not
produce true random numbers but, rather, they
calculate long, periodic, deterministic sequences.
Given the initial number and the algorithm, the
sequence can be exactly anticipated and, hence,
the composer could conceivably incorporate its
details into his composition. As a practical matter, of course, he does not. John Cage proposed
that authorship is a subjective judgment on the
part of the human composer. The notes or aspects
of the composition which he has planned or anticipated are his contribution; the parts which he is
surprised by when he first hears the music are
the machine's contribution. A successful algorithm produces desired rather than unwanted
surprises.
CONCLUSIONS
The need for better long range structure is one
of the most important unsolved problems for both
speech synthesis and music composition by computer. In speech, the main question is how the individual sounds are modified by the environment
in which they occur, where environment means
not only the adj acent sounds but also the entire
sentence and the frame of mind or purposes. of
the speaker. In music, the main question is how to
relate the sounds in one part of a composition
to the .sounds in another part in a perceptually
meaningful and interesting way.

The differences between long range structure
in speech and music arise from the fundamental
ways in which we perceive and use these sounds.
Speech synthesis is usually judged by its articulation score (understandability) and preference;
where preference is measured by naturalness or
lack of accent. Articulation cannot be measured
for music since the nature of its information is so
different from speech. Perhaps the equivalent
question is whether the style of the composing
algorithm can be learned in the sense of distinguishing examples from examples of some other
algorithm. Preference can be measured, but here
one asks questions about the overall piece rather
than the naturalness of individual notes. Long
term structure in speech is measured in seconds;
in music it is measured in minutes.
Despite differences, speech and music research
have often been mutually reinforcing. Many
questions about voice quality and the timbre of
musical sounds appear to be different aspects of
the same psychoacoustic phenomena. Certainly
the same computers and similar programs are useful for speech and music research. Consequently,
we believe it is useful to compare the long range
structure of these processes.
REFERENCES
1 H DUDLEY T H TARNOCZY
Speaking machine of Wolfgang von Kempelen
JASA Vol 22 pp 151-166 1950
2 A M LIBERMAN et al
The role of selected stimulus variables in· the perception of the
unvoiced stop consonants
AmJ Psychol Vo165pp497-5161952
3 A M LIBERMAN et al
Perception oj the speech code
Psychological Review .
Vol 74 pp 431-461 Nov 1967
4 SEGOHMAN
Coarticulation of VCV utterances: spectrographic measurements
JASA Vol 39 pp 151-1681966
5 BLINDBLOM
Spectrographic study of vowel reduction
JASA Vol 35 pp 1773-17811963
6 P DENES 0 C JENSEN
Speech synthesis with the DDP 24 on-line computer
Unpublished
PBDENES
Real-time speech research
Proc Symposium on the Human Use of Computing Machines
Bell Telephone Laboratories 1966
6a C H COKER P CUMMISKEY
On-line computer control of a formant synthesizer
JASA 381965 p 940A
7 JNHOLMES IGMATTINGLY JNSHEARME
Speech synthesis by rule
Language and Speech Vol 7 pp 127-143 July Sept 1964

Computer Models for Speech and Music Appreciation
8 P DENES ROSTER
Speech synthesis by rule on the DDP 24 computer
Unpublished
9 LRRABINER
Speehc synthesis by rule: An acoustic domain approach
BST JVol47 No 1 pp 17-37
Jan i968
10 I G MATTINGLY
Synthesis by rule of prosodic features
Language and Speech Vol 9 pp 1-13 Jan March 1966
11 ROSTER
Two experiments using speech synthesized on the DDP 24To be published.
12 F P BROOKS JR A L HOPKINS JR P G NEUMANN
WVWRIGHT
An experiment in musical composition
IRE Trans on Electronic Computers
EC-6 175 1957 Brooks F P Jr Correction ibid EC-7 60 1968
13 R C PINKERTON

14

15

16

17

18

327

Information theory and melody
Sci American 194 2 77 Feb 1956
H FOLSON H BELAR
Aid to music composition employing a random probability
system
JASA 3311631961
LAHILLERJR L M ISAACSON
Experimental music
McGraw-Hill Book Co New York 1959
J R PIERCE M V MATHEWS J C RISSET
Further experiments on the use of the computer in connection
with music
Gravesaner Blatter No 27/28 Nov 1965 p 92-97
M V MATHEWS
The computer music record supplement
Gravesaner Blatter Vol 7 No 26 1965 P 117
M V MATHEWS L ROSLER
Graphical language for the scores of computer-generated sounds
Perspectives of New M usic Vol 6 No 2 1968

A computer with hands, eyes, and ears*
by J. McCARTHY, L ..n. EARNEST,
D. R. REDDY and P. J. VICENS
Stanford University
Stanford, California

INTRo.nUCTION
The anthropomorphic terms of the title may suggest an interest in machines that look or act like
men. To this extent it is misleading. Our interest
is in extending the range of tasks to which machines can be applied to include those that, when
performed by a human, require coordination between perceptual and motor processes. We attempt to suppress the egocentric idea that man
performs these tasks in the best of all possible
ways.
In place of "eyes, ears, and hands" we could
refer to "cameras, microphones; and manipulators," but find latter terms less suggestive of the
functions that we wish to emulate. We leave the'
term "robot" and the ideas that go with it to the
science fiction writers who have made them so
entertaining.
Shannon, Minsky, McCarthy, and others had
considered the possibility of a computer with
hands, eyes and ears at one period or another during the latter part of the last decade. The main
obstacles to the realization of the idea were the
unavailability of suitable computers and 1-0 devices, and, the prohibitive cost of such a system.
Ernst! and Roberts 2 were among the first few who
used a computer to realize these objectives. Glaser,
McCarthy, and Minsky8 proposed that the first
major attempt at the biological' exploration of
Mars should be made by a computer controlled automatic laboratory, containing a wide variety of
visual input devices and mechanical manipulators
which can under computer control perform many
of the tasks of bio-chemical laboratory, requiring
*This research was supported in part by the Advanced Research Projects Agency of the Department of Defense under Contract No. SD-l83.

only a limited supervision by the experimenter on
earth.
The work reported here and a related project
at M.I.T. were undertaken several years ago to
combine and improve techniques for machine perc:eption and manipulation. Progress has been slower than we hoped because there have been many
previously unrecognized problems and few simple
solutions. Nevertheless, we have a system that
does such things as recognize spoken messages
that are combinations of terms .previously
"learned," "see" blocks scattered on a table, and
manipulate them in accordance with ins~ructions.
The work is just beginning. Our existing system exhibits more problems than solutions, but
that was its purpose. The following sections discuss considerations leading to the choice of equipment, techniques used to convert the huge masses
of television camera and microphone data into
useful information, and the control of arms.

System configuration
Major considerations in the choice of system
components have been off-the-shelf availability
and ease of interfacing. This approach has both
advantages and disadvantages. The main advantage, of course, is a relatively quick start.
Figure 1 shows major components of the existing
system. Figure 2 is a photograph of 'the hand-eye
system.
At the center of the system is a time-shared
PDP-6 computer with 131K words of core memory of 36 bits each and an 11 million word fixedhead disk file. The PDP-6 was chosen for having
a working time,-sharing system, ease of adding
special 1-0 devices, and unrestricted data transfer
rates of up to 30 million bits per second between
memory and external devices The Librascope
0

329

330

Key:

Fall Joint Computer Conference, 1968

========

memory bus

--otherdatapaths

FIGURE 1-Stanford A.I. computer system

disk file has a 24 million bit per second transfer
rate and provides both swapping and permanent
file storage.
There are a number of local and remote teletypes, CRT displays, a line printer, plotter, and
tape units for general user services.
Our research objectives imposed several special
requirements on the time-sharing system. When
a person begins to speak, the system must ensure
that the audio system is listening to him and must
not swap out the program just because its time
is up. Similar considerations apply to arms that
are in motion. The system must also provide for
communication between programs. The DEC
time-sharing system was modified locally to meet
these requirements.
Visual input to the system is provided by a vidicon television camera operating in accordance
with EIA standards. The video signal is digitized
to four bits (16 levels of light intensity) and
sampled at an instantaneous rate of 6.5 million
samples per second. Making use of interleaving,
any rectangular portion of the image, up to 666 X
500 points for the full field of view, may be read
into memory under program control in two frame
times (1/15 second). For static scenes, finer
gray-scale resolution can be obtained by averaging measurements over multiple frames.
The laboratory also has an image dissector
camera which is capable of measuring the brightness of image points in arbitrary order. It is capable of directly resolving better than 1000 X 1000
points with a gray-scale resolution of 6 bits or
more. It is relatively slow if a large number of

FIGURE 2-A picture of the hand-eye equipment

points are to be read and suffers from settlingtime problems when large deflections are used.
A comparative study of optical sensors for computers, including the possibility of u laser eye
with direct depth determination, has been made by
Earnest. 4
Audio input to the system is provided through
an A-D converter connected to the PDP-6. Two
different audio devices are currently attached. In
'One, composed of a condenser micrQphone and a
high quality amplifier, the speech signal is
sampled at a rate of 20,000 samples per second and
digitized to 9 bits. In the other, shown on Figure
3, the output of a crystal microphone is amplified
and filtered into three frequency bands. In each
band, the maximum amplitude of the signal and
the number of zero crossings are measured by
analog circuitry. Every 10 milliseconds, each hold
circuit is read by the A-D converter to 16 bits and
then reset for the next 10 milliseconds.
Input of the raw speech waveform without any
preprocessing hardware, such as a filter bank, has
the disadvantage of requiring more processing
by the computer and more storage. But on the
other hand, it provides the user with a very flexible means of analysis and permits all kinds of
processes to be simulated. In fact, we believe that
no solution should be implemented in hardware
until it has been proven to be one of the best possible solutions by computer simulation. Reddy 5
states that prosodic parameters of speech, requiring the use of segmentation and pitch detection
are more easily determined from the direct speech
signal than from the output of a bank of filters.
The second audio-device- arises directly from the
preprocessing program of Reddy and Vicens. 6

A CQmputer with Hands, Eyes and Ears

~

Microphone

ings due t'O unstable mQuntings. Despite several
imprQvements, the arm is still rather sl'Ow, shakey,
and inaccurate. The P'Ositi'On 'Of' the hand may
differ fr'Om cQmputed values by as much as a centimeter.
A hydraulic arm, recently c'Ompleted, is faster,
sm'OQther, and mQre accurate in its m'OtiQns. It is
alsQ capable 'Of dealing a fatal blQW tQ the experimenter, exhibits 'Other antisQcial prQperties such
as leaking hydraulic fluid, and tends t'O destrQy
itself periQdically.

Scene analysis
FIGURE 3-A schematic of the speech preprocessing hardware

They use tWQ smQQthing functions which prQduce
apprQximatiQns 'Of the same parameters (maximum amplitude and zerQ-crQssings). This kind
'Of system is required when 'One wishes tQ analyze
IQng utterances, because a direct analysis 'Of the
speech wave W'Ould c'Onsume large am'Ounts 'Of c'Ore
stQrage and prepr'Ocessing time.
The example 'Of speech rec'Ogniti'On discussed
bel'Ow uses the preprQcessing hardware. The
sampling rate 'Of this device, being very sl'OW
(3600 bps), all'Ows the central pr'Ocess'Or t'O pr'Ocess the input as it c'Omes, which is an imp'Ortant
c'Onsiderati'On if real time speech rec'Ogniti'On is
desired.
The electric arm was 'Originally designed as a
device t'O be strapped t'O a paralyzed human arm.
It has six degrees 'Of freed'Om which permits it t'O
place the hand in arbitrary P'OsitiQns and Qrientati'Ons within reach, plus a finger-cl'Osing m'Oti'On.
It is PQwered by small permanent magnet gearhead m'Ot'Ors m'Ounted 'On the arm, giving j'Oint
vel'Ocities 'Of 4 tQ 6 r.p.m. with small I'Oads. P'Osition feedback is pr'Ovided by P'OtentiQmeters
m'Ounted at each 'Of the six j 'Oints. The hand is a
tW'O finger parallel grip device appr'Oximately the
size 'Of a human hand and has a maximum finger
'Opening 'Of 6.4 centimeters (3.5 inches). The maximum reach is ab'Out 68 centimeters (27 inches),
and its weight is ab'Out 7 kil'Ograms (15 p'Ounds).
P'Ower tQ the mQtQrs takes the f'Orm 'Of 16 VQlt
pulses wh'Ose width and repetiti'On rate are c'Ontr'Olled by the C'Omputer pr'Ogram.
In its 'Original fQrm, this arm had a number 'Of
maladies such as severe mechanical play in the
jQints and imprecisi'On in the P'Otenti'Ometer read-

331

lLnd

description

If we digitize the light intensity at every PQint
in the wh'Ole fiela 'Of view 'Of the televisiQn camera, .
the cQmputer will receive 666 X 500 'Or 333,000
samples, 'Or 1,332,000 bits 'Of data per frame. The
pr'Oblem of scene descripti'On i.s the f'Ormulati'On 'Of
a pr'Ogram which will abstract meaningful descripti'Ons 'Of 'Objects 'Of interest in the scene and
their P'OsitiQns.
The pr'Oblem 'Of scene descripti'On must be distinguished fr'Om the prQblem 'Of classifying pictures int'O categories with which much 'Of the published theQry deals. The first wQrking descripti'On
pr'Ogram was reported by RQberts.2 Narasimllan 7
suggests that richly structured pictures such as
bubble chamber pictures, line drawings, and 'Others
are best studied in the f'Orm 'Of picture analysis
and descripti'On and pr'OP'Oses the use 'Of a linguistic m'Odel. Recent w'Ork by Miller and Shaw,8 and
Shaw9 illustrates the P'Ower 'Of the linguistic m'Odels in the analysis and generati'On 'Of pictures.
The linguistic m'Odels have the advantage that
they can be used f'Or b'Oth analysis and generati'On
of pictures, and that many 'Of the P'O'werful t'OQls
devel'Oped f'Or syntax-directed analysis 'Of languages can be directly utilized f'Or the analysis 'Of
pictures. The weaknesses 'Of the present linguistic
m'Odels, at least as far as the analysis 'Of images
'Of 3-D scenes is cQncerned, are the f'Oll'Owing:
Attempts at describing the c'Onnectivity 'Of
3-dimensi'Onal obj ects, using a data structure
primarily develQped f'Or the descripti'On 'Of strings
'Often results in unwieldy and awkward descripti'Ons leading 'One t'O dQubt whether such descripti'Ons really facilitate analysis. Extensi'On 'Of the
m'Odels t'O use list structures instead 'Of strings
sh'Ould remedy this weakness.
• The present linguistic m'Odels als'O suffer
fr'Om many 'Of the pr'Oblems 'Of err'Or rec'Overy 'Of

332

Fall Joint Computer Conference, 1968

syntax directed compliers. This is especially critical when dealing with analysis of pictures; as a
result of noise and jitter in the input device
spurious lines and edges may appear all over the
picture, and often some of the expected edges
may be missing.
One of the main problems with images of 3-D
scenes is not so much how to describe what is
visible but rather how to describe what is only
partially visible. Heuristics for handling degenerate views of objects cannot be conveniently
incorporated into presently proposed linguistic
models.
In view of the above consideration it appears
that generalizations of linguistic models will be
needed bef'Ore they can be used effectively for the
analysis 'Of images of 3-D scenes.
Our existing scene analysis program- is related
to the one used by Roberts 2 and has recently been
described by Pingle, Singer, and Wichman.10 Instead of repeating that description, we shall note
some shortcomings of the existing system and
some possible soluti'Ons.
The existing eye pr'Ogram locates cubical bl'Ocks
'Of various sizes scattered at random on a contrasting background. Its "w'Orld model" has room for
just one block at a time and those that are partly
obscured by others may be perceived only after the
intervening blocks have been removed by the
hand. Depth determination depends on the ast-mmption that all objects rest on a known planar
surface.
The edge tracing program in~ use does not reliably detect subtle differences in brightness between adjacent surfaces of the same or similar
objects. The block stacking tasks ,that have been
undertaken to date do not require thIS information.
A more general' world model, in the form 'Of a
multiply-linked data structure, is being devised
that will accommodate at least multiple objects
bounded by combinations of planar surfaces in
arbitrary positions. More powerful edge tracing
procedures are being tested, and we plan to employ some of the contiguity recognition techniques
of Guzman l l together with three-dimensional
plausibility tests of postulated objects.
In related work, the problems of combining information frum sever~l views and viewpoints into
a single model is being attacked. We expect these
combined efforts to produce a much more complete
descripti'On of the work environment.

Speech analysis and description
If we plot the changes in air pressure produced
bya speech utterance as a function of time we
~ill see a waveform such as the one given in Figure 4. This signal, as reflected by the changes in
voltage generated by the microphone, is digitized
in our system to 9 bit accurace every 50 P.s, resulting in a data rate of about 180,000 -bits per
second of speech. In normal speech, ~very second
of speech contains about 5 to 10 different sounds
which usually require less than 50 bits to represent in the written form. The problem of speech
description, then, is the development of a set of
procedures which will reduce the 180,000 bits of
information to about 50 bits. Of course, human
speech carries other information such as speaker
identity, emotional state, his location, age, sex,
health and other such features. But what is of
primary interest to us here is the message uttered
by the speaker.
First attempts at speech recognition by a computer were restricted to the recognition of simple
sounds like vowels and digits, just as preliminary
attempts at picture recognition were restricted to
the recognition of characters. The approaches developed for the recognition 'Of simple sounds, such
as the use of a metric in a multidimensional space
partitioned by hyperplanes, are not easily extendable for the analysis of a complex sequence of
sounds which may be part of a spoken message.
The structure of the message and the interrelationships among the sounds of the message are
, the important factors.
Speech is, perhaps, the most extensively investigated of all the human perceptual and motor processes. And yet a large body of this research is not
directly relevant for machine recognition of
speech. Even the relevant literature on the
acoustic characteristics of speech is more qualitative than quantitative and is meant for' use by
men rather than by machines. Stevens12 has recently summarized much of' the known data on
acoustic properties of speech sounds in a form
amendable for machine processing. Recent attempts at computer speech recognition by Bobrow
and Klattt3 and Reddy 5 provide' models which can
be used for the recognition of phrases, sentences,
and connected speech. The latter forms the basis
'Of present work. The model currently being used
consists of four stages: segmentation, sound description, phrase boundary determination, and
phrase recognition.

A Computer with Hands, Eyes and Ears
Segmentation
If you consider the sound in Figure 4 you will
see that it is not clear where one word ends and
another begins or where a particular sound within
a word ends and the next begins. This is because
the shape of the vocal tract is continuously changing and there is no clear cut point in time where
we stop saying one sound and start another. To
be able to associate discrete symbols with the continuous speech wave, a machine must be able to
segment a connected speech utterance into discrete parts.
To be able to segment speech we need to answer
questions such as "What is a sound?" and "How
do you distinguish one sound from another?" One
can define a sound on purely acoustical basis: a
sound is a part of the speech wave in which the
acoustic characteristics are similar (a sustained
segment) or one in which the characteristics vary
with time (a transitional segment). To distinguish one sound from another according to the
above definition we need a measure of similarity
or closeness between two adjacent units of speech.
Conventional metrics such as the Euclidean distance fail to be satisfactory. To be usable the
doseness function should be based on the following heuristics:
• Since some parameters are more variable
than others the closeness function should provide
for appropriate weighting of parameters.
• Although most of the parameters may be
similar a drastic change in one parameter should
resul t in a 'not-similar' indication.
• If the difference between two corresponding
parameters is less than a minimum, then the two
parameters should be considered as identical.
• The greater the parameter value, the greater
should be the difference we are willing to accept,
suggesting the use of a relative error function
such as dy/y.
• When the parameters are close to zero the
relative error function dy/y can take abnormally
large values, suggesting the use of a function such
as k . oY/Vy
A cloeeness function which satisfies the above
heuristics and a detailed description of segmentation are given by Reddy and Vicens. 6 The segmentation process can be summarized as follows.
A preprocessing procedure divides the speech wave
into 10 ms minimal segments and calculates estimators of four characteristic parameters: the

333

amplitude and zero crossings of the dominant frequency under 1000 cps and the amplitude and
zero crossing of the dominant frequency under
1000 cps. An alternative for this preprocessing
task is to use special hardware;14 it divides the·
speech wave into 10 ms minimal segments and accumulates six parameters: amplitude and zero
crossings of the signal in three frequency bands:
150-900 Hz, 900-2200 Hz, 2200-5000 Hz.
A primary segmentation procedure calculates
closeness values and groups together adjacent
minimal segments that may be regarded as similar. A secondary segmentation procedure divides
these primary segments into smaller segments if
the within-the-segment variation of parameters
is too high. The closeness values are recomputed
between the secondary segments, giving greater
weight to the frequency components than the
amplitude components. If two secondary segments
are sufficiently close and are not local maxima or
minima, they are combined to form larger segments.
Sound description
The purpose of generating a sound description
is to abstract, from the wide range of possible
values of parameters, a label which would adequately describe the nature of a sound segment.
The higher the level at which a sound is described,
the easier it is for the pattern matching and
recognition routines to determine what was said.
At one extreme the description might consist of
the average parameters of the segments and- the
other a single label for the whole utterance. In
between, descriptions can be attempted at· the
level of phoneme groups, phonemes, diphones, or
syllables. The nature of our segmentation is such
that it is more appropriate for us to attempt description in terms of phoneraes or phoneme
groups.
Phoneticians have classified the sounds we 'produce according to the shape of our vocal tract.
There are about 40 such different sounds (phonemes) in English. One natural description of a
speech utterance is in terms of its phonemic transcription. For example the word picks could be
described as consisting of four sounds, P, I, K, and
S in that sequence. However, various allophones
of the same phoneme exhibit widely varying
acoustic characteristics depending on the context
in which they occur. This ofte-n results in a substantial overlap of characteristics among similar

334

TR

Fall Joint Computer Conference, 1968

SUSl

L.'

SUST

;XXfL..., ,",

!

!

,

,

!

!

M

!

a ,

~T
!!

~L!

10

~A

'\" ••

I I I !

I

I '

,

1

!

J0

One obvious solution to this problem is to require the speaker to pause for a few milliseconds
between words or phrases. But this gets to be
annoying after a while. At present we are considering connected speech utterances of the form

t

~JST

~L,!!

!!
!

I

!!

I

I ! ' ! ! ! !

~

40

SUST

_1:.TCfP, ,

!

20

~T

STOP
....l..-...1...'

the sound description of the whole utterance can
be stored in the lexicon for future matching with
a similar descriptive. However, as the lexicon gets
larger and larger it becomes necessary to consider
breaking up a connected speech utterance into
words and phrases which can then be recognized
by a phrase recognition program.

SlISl

SUST

I ! !

~a!!!,,!!

~

I!

N



.... --

< argument list>

.... --

SUST
!

80

!

,

I

,

!

~.L!

!

,

90

!,

!!

I

!

1

I

1

,

100

,

I

I

!

!

I

!

I '

,

!

!

!

"0

FIGURE 4-Analysis of the waveform of "How now brown cow"

phonemes. Thus it is not uncommon f'Or the word
bits to have similar acoustic parameters to picks.
This possibility of error prel:udes the use of simple
pattern matching routines. At present, we generate descriptions in terms of phoneme groups:
vowel, nasal, fricative, stop, burst and so 'On. We
will see later how such a description is useful in
reducing the search space.
The procedure used for the classification of
segments into phoneme groups is an extension of
the one given by Reddy.5 If a segment is noiselike,
then it is labelled FRICS. Otherwise if the segment-amplitude is a local maximum, then the
segment is labeled VOWEL. Otherwise the segment is labeled STOP, NASAL, CONSONANT depending on segment parameters. For example, the
description generated for the word picks might
be as follows: "The sound consists of a stop, followed by a transition,. followed by a vowel, followed by a stop, followed by a fricative each with
the following parameters...."
Word and phrase boundary determination
Like many other aspects of English, the problem of determination of word boundaries in connected speech is ambiguous. For example the
sound description / AISCREEM/ could have resulted from the words "I scream" or "ice cream."
The problem of word or phrase boundary determination can be completely by-passed if the
problem at hand requires only the recognition of
a limited set of words, phrases 'Or sentences. Then

 ::



=

< function name> < argument list>
< argument> I < argument
list> < preposition>

PICK UP I STACK I
ASSIGN I ADD I
SUBTRACT I···

:: = THE LARGE BLOCK I
FAR LEFT I ALPHA
BRAVO I .. ·

< preposition>

:: =

I

AT IOF I TO I FROM I .. ·

By carefully choosing the function names, the possible arguments, and the ass'Ociated prepositions
it is possible to determine the word or phrase
boundaries. Certain keywords play an important
part in this determination. A good example of
such a word is BLOCK, starting with a silence
(B) and ending with a silence (K). As a result
~uch heuristics as 'scan until you find BLOCK'
may be done with a low percentage of error. Use
of restricted special purpose command languages
for communication to the computer such as the one
above, is not unreasonable in view of the fact that
we have had to make a similar compromise for
programming languages. How interesting the
spoken languages can get will depend on how reliably and precisely we can generate sound descriptions.
Word and phrase recognition
Given a sound description of a word or phrase,
we need a description matching algorithm to determine what was said. If we can guarantee that
the description is an error-free phonemic tran-

A Computer with Hands, Eyes and Ears
scription then all that is needed is a simple classi.
fication net which grows as new sounds are uttered. Since such a guarantee will not be forthsible errors in the sound description. Two uttercoming in the near future, if ever, we need a
recognition procedure which will cater to the posances of the same phrase by a single speaker can
exhibit different descriptions even under the same
environmental conditions. .Due t'O minor changes
in the emotional state he may say it faster, slower
or with slightly different stress and intonation resulting in a loss of segment, insertion of a segment, or assignment of a wrong label, e.g., NASAL
instead of STOP. This possibility of error in the
description poses the well known lack of synchronization problem, i.e., if two descriptions of
the same phrase differ by one or more segments,
the problem of determining which one it is that
is missing.
Given two descriptions which are to be compared, a mapping procedure determines the possible c'Orrespondences between segmental descriptions. It uses the heuristic that VOWEL and
FRICS segments can be reliably detected and first
maps VOWEL for VOWEL and FRICS for
FRICS. The remaining unmapped segments are
then mapped on the basis of similarity of
parameters.
Given the correspondences between segment descriptions, an evaluation procedure compares the
parameters of the mapped segments to determine
if they could p'Ossibly be two different utterances
of the same phrase. Similarity of the parameters
is given based on the heuristics given for the closeness function in the section 'On segmentati'On. Of
course, any unmapped segments have a detrimental effect on the similarity measure. If the
similarity value is over a certain threshold then
the two descripti'Ons are considered the same.
If no candidate was f'Ound during the first try,
the program, assuming that it knows what was
said, supP'Oses that the FRICS were not well determined and were classified as a high frequency
st'OP (burst) or vice versa. If this is the case, a
second search is attempted mapping 'Only VOWEL
f'Or VOWEL. All the remaining unmapped segments are then mapped on the basis 'Of similarity
'Of parameters as in the first try (but with FRICS
included) .
If after this second try no satisfact'Ory candidate
was found, two different actions may take place:
in learning mode, the new descripti'On is entered

335

int'O the lexicon along with the print name; in
recognition m'Ode, it is rej ected.
Unless the candidates for pattern matching with
an incoming description are chosen carefully from
the lexic'On, it could take a long time t'O determine
what was said. To minimize the search space,
the lexicon is ordered 'On the basis 'Of the number
'Of v'Owel segments and the number 'Of FRICS segments, furtherm'Ore the v'Owels are classified in
nine subclasses acc'Ording t'O the values of their
zero crossing parameters. The direct matching
'Of these subclasses easily eliminates s'Ome entries
in the initial list 'Of the possible candidates. Each
entry in the lexic'On consists 'Of a packed versi'On
'Of the description and parameters generated by
the sound descripti'On procedure. A detailed descripti'On and evaluation of the phrase recognition procedure is given by Reddy and Vicens.~5
Remarks
The preceding subsections attempt to give an
overview of the state 'Of acc'Omplishment in speech
recognition at 'Our project. Segmentation and
phrase recognition pr'Ocedures give correct results
ab'Out 95 percent of the time. This can be impr'Oved slightly by using m'Ore s'Ophisticated preprocessing routines. Work has barely begun 'On
the determination of classes 'Of words and/'Or
phrases f'Or which boundaries can be determined
unambigu'Ously in c'Onnected speech. A great deal
'Of w'Ork remains t'O be d'One in the generation 'Of
reliable s'Ound descripti'On.
If a reliable descripti'On can be 'Obtained in the
form 'Of a ph'Onemic transcription ('Or s'Ome such
unit) we can reduce the search space 'Of the w'Ord
and phrase recogniti'On routines c'Onsiderably, and
we will be able t'O unambigu'Ously determine w'Ord
b'Oundaries f'Or a larger class 'Of w'Ords. Only then
can we hope t'O recognize words fr'Om a lexic'On 'Of,
say, 20,000 w'Ords in cl'Ose t'O real time. We have
already menti'Oned that the main difficulty in 'Obtaining a reliable ph'Onemic transcripti'On is the
wide variability 'Of acoustic characteristics 'Of a
phoneme depending on c'Ontext. The'Oretically
every phoneme can 'Occur in 1600 'Or S'O different
c'Ontexts. Many of them d'O n'Ot occur in natural
speech and the remaining can perhaps be gr'Ouped
together int'O 10-20 contextual t!ategories f'Or each
ph'Oneme. The huge task that remains to be d'One
is the investigation and methodical cataloguing 'Of
the m'Odificati'Ons t'O the features 'Of a ph'Oneme,
and the development 'Of rules for transf'Ormati'Ons

336

Fall Joint Computer Conference, 1968

on phonemic features based on context. It will
perhaps be many years before such a study is
complete but a great deal can be done in computer
speech recognition even with incomplete results
using the model proposed here.

There is much to be done in the area of planning
assembly tasks. Many of the things that we do
instinctively, such as building things from the
bottom up or from the inside out, need to be
formalized and translated into programs.

Control of a mechanical arm

An example

In order to carry out complex manipulation
tasks, it is necessary to do planning for and control of the arm at several levels. At the top level
there is a goal-seeking process which integrates
the activities of the various sensory, perceptual,
model-building, and manipulation processes. Next
there must be planning of subtasks. For example,
if we are given a description of an 'Object to be
assembled and a description of available components, we must plan which components will go
in which locations and the order in which they are
to be placed.
Each subtask generates a sequence of motions
(e.g., move hand H to point P and open fingers).
At this point, the model of the environment should
be checked for space occupancy conflicts (i.e., the
arm shouldn't bump into things accidentally). In
case of conflicts, we must replan the arm motions
and, possibly, the order in which components are
put in place.
Given that the hand is to reach a certain position, we must calculate how each of the arm joints
is to be positioned. For arms with certain geometric properties, this can be a very quick and
reliable calculation. For others, it may involve a
slow and uncertain iterative process.
Finally, there is a process that servos the arm
from place to place, possibly with constraints on
the velocity or force to be employed.
Our existing system exhibits each of these levels
of planning and control in some form, but without
much generality. In most cases, an ad hoc sequence of subroutine calls takes the place of a
flexible planning function. As one consequence,
the arm readily runs into objects in its vicinity.
The calculation of joint positions required to reach
a given point is relatively straightforward for the
arms we have and has been described by Pingle,
Singer and Wichman.~o
An obstacle avoidance technique has been devised by Pieper. 16 It attempts to make the point
of closest approach greater than a specified value
between all parts of the arm, modelled as a series
of cylinders, and an environment containing
planes, spheres, and cylinders.

As an illustration of existing capabilities, we
describe a system that obeys the experimenter's
voice commands to find blocks visually and stack
them as ordered. The grammar chosen for this
example is as follows.
Syntax


:: =  I




:: =  I 
EMPTY



:: = RESCAN I STOP
:: = PICK UP 



::

< size indicator>

:: =



:: = SMALL



=

 EMPTY

EMPTY
LARGE


< position! >


:: =

.." -.... --

 ::

=



:: =

< position' >

:: =



:: =

I  BLOCK
I MEDIUM I
I EMPTY

EMPTY I 
< position2 >
 SIDE
< position' > < position" >
< position word> I
< position" > < position' >
< position word>

I CORNER
< position' > I < position" >
EMPTY I LEFT I RIGHT
EMPTY I UPPER I LOW~R
ANGLE

Semantics
The meaning of some of the terminal symbols
is obvious, but some others, like RESCAN and
EMPTY need explanation.
The command "rescan" is used to indicate that
the scene might be disturbed and that the vision
program should generate a new scene description.

A C'Omputer with Hands,
The terminal symb'OI EMPTY means no speech
utterance at all 'Or s'Ounds n'Ot rec'Ognized by the
w'Ord rec'Ognizer. If any 'Of the n'On-terminal symb'Ols is finally reduced t'O EMPTY the middle value
is assumed. F'Or example if < size indicat'Or > =
EMPTY, a bl'Ock 'Of medium size will be assumed.
Sentences like "pick up the small bl'Ock standing
'On the upper right c'Orner," "rescan the scene,'"
"pick up any bl'Ock" are c'Orrect acc'Ording t'O the
grammar.
After the preliminaries such as training the
phrase rec'Ogniti'On system and calibrati'On 'Of the
arm and eye c'O'Ordinate systems, the picture recogniti'On pr'Ogram I'O'Oks at the image and generates a scene descripti'On 'Of all the cubes present
in the field 'Of view. The descripti'On f'Or each bl'Ock
c'Onsists 'Of the I'Ocati'On, size, and 'Orientati'On 'Of the
bl'Ock.
Given a c'Ommand, the speech analysis pr'Ogram
segments the speech and generates a s'Ound descripti'On. This description is then used by the
scanner-rec'Ognizer which dec'Odes it and passes
the result 'Of its analysis t'O the main program.
The scanner-rec'Ognizer requires a g'O'Od w'Ord
rec'Ognizer utility pr'Ogram. The rec'Ogniti'On is
d'One by scanning the speech utterance description f'Orward and backward using feedback fr'Om
the grammar. The dec'Oding 'Of a sentence like
"pick up the small bl'Ock standing 'On the right
side" will be d'One as f'OII'Ows:
Rec'Ognize PICK UP.
Then scan until BLOCK.
If BLOCK backtrace t'O find size attribute.
Backtrace fr'Om the end t'O find SIDE.
Backtrace t'O find RIGHT.
At any step, feedback is used S'O that the 'Only
candidates c'Onsidered are those that are syntactically c'Orrect. F'Or example, when the pr'Ogram is trying t'O reduce the n'On terminal symb'OI
< size> the 'Only available candidates f'Or the
matching pr'Ocess are the descripti'Ons 'Of LARGE,
SMALL and MEDIUM,
Based 'On the c'Ommand, the arm is directed t'O
pick up or stack a bl'Ock. If it is t'O pick up, the
I'Ocati'On and 'Orientati'On 'Of the bl'Ock are given. If
it is t'O stack, the I'Ocati'On 'Of the stack is given.
The m'Ovie, t'O be sh'Own, illustrates the reSP'Onse
'Of the arm t'O vari'Ous c'Ommands, and presents the
details 'Of vari'Ous analysis and descripti'On generati'On pr'Ocesses displayed 'On a CRT.

E~s

and Ears

337

CONCLUSIONS
Many 'Of the pr'Oblems discussed at the end 'Of the
preceding secti'Ons can and will be s'Olved in the
next few years. H'Owever, it will pr'Obably be a
I'Ong time before a c'Omputer can equal the percepti'On and dexterity 'Of a human being.· This will
require n'Ot 'Only advances in the areas 'Of c'Omputer
architecture and the quality 'Of the external devices, but als'O a better understanding 'Of perceptual and m'Ot'Or pr'Ocesses.
Even the limited pr'Ogress achieved S'O far can
result in c'Omputer hand-eye-ear systems that are
better suited f'Or s'Ome purp'Oses than human beings. F'Or example, they may see things and hear
s'Ounds that a pers'On cann'Ot, and they may be
faster, str'Onger, m'Ore ec'On'Omical, 'Or m'Ore expendable.
The fact that a c'Omputer may n'Ot be able t'O see
all the things we can see 'Or carry 'On fluent c'Onversati'On sh'Ould n'Ot be a cause f'Or extra c'Oncern.
C'Onsider the case 'Of pr'Ogramming languages.
Alth'Ough we have n'Ot been able to c'Ommunicate
with c'Omputers in 'Our natural language, we have
managed t'O achieve a great deal using c'Ontrived
and ad h'OC languages like F'Ortran. There is n'O
reas'On t'O suspect that the same will n'Ot be the
case with visual and v'Oice input t'O the c'Omputers
or with c'Omputer c'Ontr'OI 'Of manipulat'Ors.
We foresee several practical applicati'Ons that
can pr'Ofitably use the techniques described in this
paper. One that is m'Ost 'Often menti'Oned is the
P'Ossible bandwidth reduction in picture and speech
transmissi'On systems. We believe that c'Omputer
c'Ontr'Olled carts which can navigate themselves,
and aut'Omated fact'Ories, where c'Omputer contr'Olled manipulat'Ors with visual feedback can
handle many situati'Ons which cann'Ot be presently
handled by fixed sequence manipulat'Ors, are als'O
within the range 'Of the present state 'Of the art.
ACKNOWLEDGMENTS
The success 'Of any system 'Of this magnitude depends 'On the team eff'Ort of many pe'Ople. It is a
pleasure t'O ackn'Owledge the c'Ontributi'Ons 'Of Karl
Pingle, wh'O did m'Ost 'Of the eye pr'Ogramming, and
Jeff Singer, wh'O devel'Oped m'Ost 'Of the arm and
hand pr'Ograms. Excellent hardware and s'Oftware
system support were pr'Ovided by Stephen Russell,
Gerald Gleas'On, D;avid P'O'Ole, J'Ohn Sauter and
William Weiher.

338

Fall Joint Computer Conference, 1968

REFERENCES
1 HAERNST
MH-1 a computer operated mechanical hand
Doctoral Thesis MIT Cambridge Massachusetts 1961
2 LGROBERTS
Machine perception of three-dimensional solids
Optiool and Electro-Optical Processing of Information MIT
Press Cambridge Massachusetts 1963
3 D GLASER J McCARTHY M MINSKY
The automated biological laboratory
Report of the subgroup on ABL summer study in exobiology
sponsored by the Space Science Board of the National
Academy of Sciences 1964
4 LDEARNEST
On choosing an eye for a computer
AI memo No 51 Computer Science Deparlment Stanford
University 1967
5 DRREDDY
Computer recognition of connected speech
J Acoust Soc Am 42 329-3471967
6 DR REDDY P J VICENS
A procedure for segmentation of connected speech
To be published in J Audio Engr Soc 1641968
7 R NARASIMHAN
Syntax-directed interpretation of classes oj pictures
CACM 9 3166-1731966
8 W MILLER A SHAW

9

10

11

12
13

14
15

16

A picture calculus
GSG Memo 40 Computation Group Stanford Linear
Accelerator Center Stanford' California 1967
A.SHAW
The formal description and parsing oj pictures
PhD Thesis CS Report No 94 Computer Science Department
Stanford University Stanford 1968
K K PINGLE J A SINGER W M WICHMAN
Computer control of a mechanical arm through visual input
To be published in the proceedings of the IFIP 68 1968
AGUZMAN
Some aspects oj pattern recognition by computer
MAC-TR-37 Project MAC MIT Cambridge Massachusetts
1967
K N STEVENS
Unpublished paper 1968
D G BOBROW D KLATT
A limited speech recognition system
To be published in the proceedings of FJCC 681968
PJVICENS
A speech preprocessing device
Stanford Artificial Intelligence Memo to be published 1968
DR REDDY P J VICENS
Spoken message recognition by a computer
To be published 1968
DPIPER
Kinematics of manipulators under computer control
PhD Thesis Stanford University to be published 1968

Digital si~ulation of continuous dynamic systems:
An overVIew
.
by JON C. STRAUSS
Carnegie-Mellon University
Pittsburgh, Pennsylvania

INTRODUCTION
There has been a growing interes~ over the last decade
both in this country and abroad,,:in the us~/of the digital
computer to model continuous !fiynamic ~ystems. Prior
to 1960, and still true in la~ge measure today this
application area had been thei~xclusive province of the
analog computer. The initial motivation for integrating
the ordinary differential equations characteristic of
continuous system simulation models on the digital
computer was one of accuracy; given enough time,
solutions of essentially unlimited accuracy could be obtained from the digital computer. These accurate but
costly, solutions were then used as consistency checks
on the many hundreds of solutions characteristic of a
simulation study on a high speed electronic analog
computer.
This emphasis has changed somewhat over the years
but not strictly on'a speed ratio alteratiori basis. While
digital computers have become appreciably faster,
analog computers have more than kept pace. In addition, hybrid computers (combined systems of analog
and digital computers) have been developed and are
being employed in an attempt to exploit the best features of both analog and digital computation. It is still
true that for many applications on a per solution basis
all other things equal, the analog and/or hybrid com~
puter is several orders of magnitude faster than a digital
computer of equivalent cost.
Among the main items which have increased the relative usage of digital computers in continuous system
simulation are:
1) guaranteed accur~cy of solution,
2) accessibility, and
3) the existence of problem oriented simulation languages that smooth the interface between the analyst and the computer.

New developments in graphical hardware and conversational software promise to increase the usage of
digital computers in this application area even moreThus while analog and hybrid computers continue to
retain a marked speed and cost advantage over digital
in certain problem areas, notably optimization and real
time simulation, it appears that usage of digital computers in general continuous dynamic system simulation
will continue to increase.
The first attempts at digital computer simulation
were characterized by the extremely long set up and
checkout time associated with the coding and debugging
of individual programs in machine language. With the
advent of effective problem oriented algebraic compiler
languages (e.g., Fortran, Algol, etc.) in the late '50s
and early '60s, this delay time was somewhat reduced.
Efficient numerical integration programs were, however,
still very complicated and hence costly and time consuming to write and debug on a single problem justification basis. Even the "packaged" numerical integration
programs t~nded to require programming sophistication
for their efficient utilization. lVloreover at this level of
programming complication, it was still difficult to get
the engineer who was, and is, concerned with the difficulties inherent in his problem. representation to become c;oncerned with the difficulties inherent in the
problem solution. He would obviously have· been more
willing to become involved if simulation programming
involved mainly model representation, a~ on the analog
computer, and he was somehow buffered from the solution difficulties.
It was this concern combined with the growing
realization that a digital computer was more than just
a large "number cruncher" that led to the design of the
first problem oriented simulation languages. In format,
the early languages resembled a combination of a three
address absolute machine code and an operational block
339

340

Fall Joint Computer Conference, 1968

description of an analog computer wiring diagram. In
solution techniques, they generally weren't much better; most offered rectangUlar or some other low accuracy
integration scheme. They did, however, make an important contribution; i.e., they introduced the engineer
interested in dynamics to the digital computer.
More recently, simulation languages have be~n developed that permit model description in an equation
based representation that is independent of analog
computer notation. Through provision of a varied set of
functional operators, equation based notation can in':'
clude block diagram based notation as a subset.
A review of the literature gives the impression that
there has been almost too much work reported on digital
simulation languages (in the sense of lots of work and
too little thought). In addition, much of this work has
ignored the intimate relationship between the design
and use of simulation languages, the structure of the
simulation process, and the natural environment
of numerical integration. A history of simulation language development is presented in several survevarticles. 1 •2 There is, therefore, little need for rep~tition
here.
The riot of invention (and duplicated effort in all too
many cases) together with the apparent neglect of the
numerical integration process indicated the need for
control and synthesis. In response, the Simulation Software Committee was organized under the auspices of
SCI to develop standardization guidelines for continuous dynamic system simulation languages. In an
effort to dispel the vague generalities associated with
many standardization efforts, it was decided to present
the recommendations in the form of a communication
language for dynamic system simulation. This language,
the Continuous System Simulation Language (CSSL),
was specified in a recent report.3 The CSSL report does
not address the problem of optimal numerical integration system design, but it does attempt to relate the
structuring capabilities of CSSL to the inherent structure of numerical integration and to a general structure
for the simulation activity. It is these interrelationships
that form the basis for the current discussion.
Details of numerical integration system design are
presented in Reference 4. Reference 5 describes a simulation language system that augments the recommended
CSSL solution options by providing for steady state
and frequency response in addition to the standard
transient response calculation. Reference 6 introduces
an area of dynamic system simulation that to date has
received very little attention in terms of problem oriented simulation languages, namely, the simulation of
spatially continuous systems.

The character of simulation

In a recent book, 7 Evans, Wallace and Sutherland
present an interesting discussion on the "nature of
simulation." Their definitions are paraphrased and
particularized here for the restricted environment of
continuous dynamic system simulation.
Continuous Dynamic System: System in which the
response phenomena occur continuously in one or
more independent variables; i.e., the response can be
modeled by systems of algebraic, ordinary differential, partial differential, and difference equations.

Of primary concern here are difference equation
models and/or ordinary differential equation models
(which ultimately are reduced to iterated difference
equation models as part of the numerical integration
process). Reference 6 introduces the topic of simulation
language design for partial differential equation models.
Mathematical Model: A set of equations, the solutions
of which represent some corresponding response
phenomena in the system. The question of adequacy
of the representation,. while certainly important, is
not an issue here; suffice it to say that the solution
of the model represents the behavior of the system
against some criteria.

For example, the solution, x(t), of the differential
equation: .
m x(t)

+

d x(t)

+

k~x(t) =

gm

(1)

represents the position of the mass (parameter m) in a
simple linear spring, mass, and dashpot mechanical
system. The model of Equation 1 'assumes an ideal
linear spr.ing (spring parameter k), an ideal linear dashpot (parameter d), negligible air resistance (unless
accounted for in d and k), and a known acceleration of
gr-avity (g).
Simulation: The process of solving the mathematical
model for a particular set of parameters and conditions. The solution is said to represent the behavior
of the system for the same set of conditions; i.e.,
it represents the true system behavior subject to the
adequacy of the model.
For example, the solution of the mathmatical model
of Equation lover the interval 0 < t < tj with parameters:
d

=

1, k

=

=

0, x(O)

=

1

0, tj

=

1, m

and conditions:'
x(O)

=

10

Digital Simulation of Continuous Dynamic Systems
constitutes a simulation.
Simulation Study: One or more applications of simulation to a system.
For example, the process of repeating the simulation
of the last example five times increasing m by +.1 each
time would be a simulation study of the effects of increasing mass on the dynamic response of the system.
The mathematical model is the representation of the
system. The simulation involves a command over the
mathematical model (e.g., FOR "d = 1, k = 1, ... etc."
SOLVE "Math Model" OVER "Range.") The simulation study involves an ordered sequence of simulations
(or a procedural sequence of commands).
These definitions provide a framework within which'
the relationship of simulation languages and the numeri- '
cal integration process is easily presented.
As mentioned in the introduction, a simulation
language must obviously be concerned with the representation of the system being simulated; i.e., with the
description of the mathematical model. It must also
provide for the presentation of the parameters and
conditions that specify a single simulation. To meet
the requirements of the simulation study, it must, in
addition, provide for the specification and monitoring
of the experimental procedure that is a simulation
study.
It is of some interest to note the disparity of these
requirements. The model of a continuous dynamic
system is parallel in character; i.e., to solve the first
order vector differential equation in Equation 2,

341

It is the function of the numerical integration system
to solve the 'Ordinary differential equations of the model
and in so doing perform a single simulation in the
fashion dictated by the conditions and parameters of
the simulation. The numerical integration system has
the task of operating on the differential equations that
describe the parallel model so as to give a reasonable
approximation to the solution on the serial (sequential)
digital computer.
It thus becomes clear from the definitions that the
simulation language must be concerned with the model
representation and the simulation study activity while
the numerical integration system has responsibility
for the actual mechanics of the simulation (i.e., the
solution of the model).
Structure of a simulation

A discussion of the general structure of a simulation
of a dynamic system is best approached through a
specific example of a numerical integration scheme. The
scheme chosen for presentation here is the Euler
IVlethod. This scheme has the virtue of illustrating the
idea without requiring burdensome detail. The working
hypothesis is that since a simulation is, by definition, a
solution procedure, the general structure of the continuous system simulation process should be intimately
related to the general structure of numerical integration.

Euler integration method
z(t) = f(z(t), t)

(2)

it is necessary to know z(t) to compute f(z(t), t) to
employ in the process of computing z(t), etc. Description of the mathematical model involves the specification in a problem oriented notation of f(z(t), t) in
Equation 1. Because this is a parallel model, it is
clear that this description should be, in general,
nonprocedural; i.e., it should be independent of the
order of description. Moreover, the description should
be in a notation convenient to the discipline in which
the model originates; i.e., the operators of the language,
whether blocks or general functions, should be appropriate for the original level of description of the model.
The specification of the simulation study procedure is,
on the other hand, a standard procedural task. For the
most part it is entirely satisfactory to describe such a
task with a standard procedural language such as
Fortran or Algol. In fact, as is discussed in Reference 3,
one of the major design criteria for the CSSL effort was
that it resolve these conflicting requirements of nonprocedural model representation and procedural task
specification.

The object is to integrate Equation 2 from point tn
to point tn+!' Certainly the simplest, non-trivial result
is to expand Z(tn+!) in a Taylor Series about z(t~), as in
Equation 3, and save only the first two terms, as in
Equation 4.

z (tn+l ) = Z(t )
11

+ Z. (t n)(tn+1 - . t ) +,z"(t7/0)(t
11

n

n )2 + ...
+!-t
2
(3)

or
Zn+l = Zn

where:

Zn

= z(t n )

+ kfn
h = t n+1 - tn

(4)

Equation 4 is a satisfactory, but not very ,accurate,
integration formula known as the Euler Method. Note
that Equation 4 is an approximation for z(t n+!) which is
represented exactly in Equation 3, but the terms involving the second and higher derivatives are, in.
general, too unwieldy to calculate. The Euler IVIethod is
of the prediction (extrapolation) type since it does not
need any information concerning the derivative function (f) at tn+l to integrate (extrapolate) to tn+!'
A flow chart of a digital computer program to in-

342

Fall Joint Computer Conference, 1968
where (5) is the state equation,
(8) is the measurement equation,
z(t) is the state vector,
ps(t) is the vector of parameters in the state
variable model,
x(t) is the vector of system inputs,
yet) is the vector of measurable system outputs.
Pm(t) is the vector of parameters in the measurements model,
Zo is the initial condition vector for z(t).

n+- 0

t n

Z

-n

!.

~

n·

t

4-

t

initialHe

0
Z

!. (~ , t .)
n

~t
n+l
n

n

calculate derivatives

+h

The flow chart for the Euler Method in Figure lean,
with only slight modification, be presented in the more
general outline of Figure 2. There are several other
salient features to this organization:

update t

test for termination

terminate

1. The operations peculiar to the model are isolated
in a routine that calculates the state variable derivatives, f, and in the calculations for the
measured variables in the system, y.
2. The initialization operations are isolated from the
integration operations.
3. The inputloutput operations are assumed to take
place at a fixed frequency (II A in simulated time).
This is reasonable in light of the interpretation
demands of digital simulation; i.e., printouts and

update Ii

•

FIGURE I-Flow chart of Euler method use

tegrate Equation 2 employing Equation 4 from to to t,
in steps h is presented in Figure 1.
Integration
Initialization

General structure
Inspection of the flow chart for the use of the Euler
Method in Figure 1 reveals that certain of the. operations are strictly a function of the particular prediction
formula employed while others are strictly dependent
on the model (namely the derivative calculation) and
still others are strictly a function of the numerical integration task. These latter operations (i.e., updating
of the independent variable t, testing for completion,
and routing of control between tasks) are referred to as
the numerical integration environment.
Figure 2 presents a general flow chart for a simulation
of a system with the general mathematical model of
Equations 5 and 6.
z(t) = f(z(t), ps (t), x(t»

(5)

yet) = h(z(t), pm (t), x(t»
z(t o) = Zo

(8)

termination
logic
Simulation

Termination

FIGURE 2-General simulation flow chart

Digital Simulation 'Of Continuous Dynamic Systems
pl'Ots are m'Ore easily read and und~rst'O'Od if inf'Ormati'On is presented at a fixed interval in the
independent variable. This interval, d, is kn'Own
as the communication ~nterval.
4. The c'Ommunicati'On interval is n'Ot necessarily the
interval empl'Oyed in the numerical integrati'On
being perf'Ormed under c'Ontr'Ol 'Of the integrati'On
system. This 'Other interval, 8, is termed the
calculation interval; it is n'Ot necessarily c'Onstant,
but generally is an integral fact'Or 'Of d. The detailed design 'Of numerical integrati'On systems is
n'Ot at issue here. (Reference 6 relates s'Ome 'Of the
design c'Onsiderati'Ons t'O the general structure
presented here.)
5. The terminati'On I'Ogic terminates the simulati'On.
The c'Ontr'Ol is then passed t'O a c'Ontr'Ol pr'Ogram
c'Oncerned with attaining the 'Objectives 'Of the
simulati'On study. This pr'Ogram might d'O n'Othing
m'Ore than return e'Ontr'Ol t'O the simulati'On entry
t'O read in new data (zo, pm, P8, x) f'Or an'Other
simulati'On 'Of the m'Odel, 'Or it might m'Odify parameters in the m'Odel based 'On the results and
return c'Ontr'Ol f'Or an'Other simulati'On as part 'Of an
'Optimizati'On alg'Orithm.
Simulation study structure

Figure 3 presents a general c'Ontr'Ol fl'OW structure f'Or a
simulati'On study pr'Ogram. As might be expected fr'Om
the definiti'On 'Of simulati'On study, this structure c'Onsists'Of a c'Ontr'Olled iterati'On 'Of the fl'OW chart 'Of a
single simulati'On presented in Figure 2. It is interesting
t'O n'Ote that the general structure 'Of Figure 3 is n'Ot
peculiar t'O the digital simulati'On activity; rather any
c'Ontinu'Ous system simulati'On study (digital, anal'Og,
andl 'Or hybrid) can be c'Ouched in this structure.
The'similarity between' Figures 2 and 3 clearly
emphasizes the relati'Onship between the general structure 'Of a simulati'On study and that 'Of the numerical
integrati'On pr'Ocess. The relati'Onship 'Of the general
structure t'O a c'Ontinu'Ous system simulati'On language
is pr'Ovided by the regi'Ons den'Oted 'On Figure 3 as Initial, Dynamic and Terminal. As is discussed in Reference 3, CSSL pr'Ovides a pr'Ogrammable structure
capability that enc'Ourages, at the s'Ource pr'Ogram level,
the descripti'On 'Of acti'Ons t'O be taken by the simulati'On
study pr'Ogram at the appr'Opriate P'Oint in the c'Ontr'OI
fl'OW 'Of Figure 3.
CONCLUSIONS
The structure 'Of the numerical integrati'On pr'Ocess
determines the structure 'Of a run time digital c'Omputer
pr'Ogram f'Or the simulati'On 'Of c'Ontinu'Ous dynamic
systems. If simulati'On languages are t'O facilitate the

!l43

Simulation Study
Setup',
Initial

Simulation Setup

Synchronous
Action
Dynamic

Integration

Simulation
Termination
Terminal
Study
Termination,

FIGURE 3-Simulation study control structure

c'Omplete simulati'On study activity 'On the digital c'Omputer, they must pr'Ovide appr'Opriate interfaces t'O the
structure determined by numerical integrati'On and the
simulati'On study requirements.
REFERENCES
R D BRENNAN

R N LINEBARGER

1 A survey of digital simulation; digital analog simu,lator programs

Simulation Vol 3 No 6 Dec 1964
2 J J CLANCEY M F FINEBERG
Digital simulation languages, a critique and a guide
AFIPS Conference Proceedings Vol 27 1965 FJCC December
1965
3 The SCI continuous system simulation language (CSSL)
Report of the SCI Simulation Software Committee J C Strauss,
Editor
Simulation Vol 9 No 6 December 1967
4 DHBRANDIN
The mathematics of continuous system simulation
AFIPS Conference Proceedings

344

Fall Joint Computer Conference, 1968

Vo1331968 FJCC December 1968
5 TESPRINGER OAFARMER
T AF-a steady state, frequency response, and time response
simulation program
AFIPS Conference Proceedings
Vo1331968 FJCC December 1968
6 S M MORRIS W E SCHIESSER

SALEM-a programming system for the sim1-tlation of systems
described by partial differential equations
AFIPS Conference Proceedings Vol :33 1968 FJCC December
1968
7 G W EVANS G F WALLACE G L SUTHERLAND
Simulation using digital computer8
Prentice Hall Inc N J 1967

Mathematics of continuous system simulations
by DAVID H. BRANDIN
Informatics Inc.
Sherman Oaks, California

efficient and accurate solutions-computationally
efficient because digital computers are expensive and·
thousands of runs may have to be made to validate a
solution or perform a parameter variation study;
accurate because refined models may be very sensitive
to small variations in parameter values. Accuracy may
also be needed to verify an analog computer solution
or maintain a stable solution.
Needle,ss to say, these two constraints have the
unfortunate property that they are mutually contradictory. To improve speed (and reduce cost), practitioners suggest a minimum of extended precision
arithmetic, low order integration algorithms, large
integration step sizes, and "tight" programming. To
improve accuracy practitioners suggest maximum use
of extended precision arithmetic, stable, high order
integration algorithms, and small integration step
sizes. Numerical techniques for computer simulatiqn
of continuous sys-aems are therefore bound to compromise either economy, accuracy, or both.
The problem, then is not trivial. Intelligent tradeoffs
must be made when selecting the mathematical techniques. The programmer (or simulation analyst) must
understand the physical systenl,' the mathematical
model, and the numerical techniques and their constraints.

INTRODUCTION
The purpose of this paper is to summarize briefly the
state-of-the-art in numerical methods applied to simulation of continuous dynamic systems. * The principal
concern is with numerical techniques encountered in
general simulation problems. Because special purpose
integration techniques and approximation methods
which reduce systems of differential equations to systems of algebraic equations are not commonly employed, they are discussed only briefly.2.3.4
This paper views the state-of-the-art in simulation
mathematics from the engineer's point of view: What
are the commonly used methods? Why are they used?
How do they relate to accuracy, speed, and stability?
What is their relation to digital simulation languages?
The problem

The purpose of a digital computer simulation of
continuous dynamic systems is to generate the pointby-point solution along'the time axis to a set of simultaneous differential equations which represent the
mathematical model. The differential equations may be
linear, nonlinear, partial, of any order, and mtve
initial conditions, boundary values, and other constraints and complexities. However, simple algebraic
techniques and approximations reduce virtually all
systems of this type to "a set of simultaneous ordinary
differential equations of the first order. 5.6 The numerical
methods employed in the simulation generate the solution of these first order systems.
The numerical procedures to generate the solutions
are well known-Runge-Kutta and predictor-corrector
algorithms.
The application of these procedures on a digital
computer presents practical difficulties. The constraints
of the problem usually necessitate, computationally

Mathematical techniques

Numerical integration
The numerical. integration techniques commOinly
encountered are extracted from the Runge-Kutta and
predictor-corrector families. Most generalized simulation programs for a specific range of applications will
have only one algorithm or one combination (e.g.,
predictor-corrector with a Runge-Kutta starter and
variable step size) while many simulation languages
will incorporate a variety of methods. 7 .8.9.10
The Runge-Kutta family is characterized as follows:

·The definition of a Continuous Dynamic System is presented
in an earlier paper in this session-Reference 1.

345

346

Fall Joint Computer Conference, 1968

a) The methods are'self starting and do not require
previous information,
b) They require N evaluations of the derivative for
an Nth order method,
c) The trl1npation error at each step is proportional
to h N +1 where h is the integration step size and
N is the order.

GIVEN

dY
dt = f (t, Y)

.

h
N+l = YN + '2 (3 YN

• (p)

a) The methods are not self starting; they do
require previous information,
b) They may iterate the "corrector" until desired
convergence is reached, **
c) They provide an excellent approximation to trun-,
cation error if the predictor and corrector equations are of the same order,
d) Previous information must be retained.

UNumerical integration subroutines are rarely programmed to
perform repeated iterations of the corrector. See later section.

=

yep)

In contrast, the predictor-corrector family is characterized as follows:

An argument can be made justifying the use of either
of the families of integration algorithms. The choice is
dependent on the nature of the systems of equations,
required accuracy, costs, programming competence,
etc. Defending the choice of any particular family for
the general case is questionable since, for any given
selection, a system of equations can be defined which
are unsuitable for that method. The selection of a given
algorithm within a given family is more controversial.
Frequent selections are fourth order Runge-Kutta or
Adams (Moulton) predictor-corrector. The Adams
Family (a 2nd order method is displayed in Figure 1)
has soine desirable characteristics 'Yith respect to
efficiency. 11
If one assumes fourth order algorithms and a fixed
step size, then predictor-correctors (without repeated
corrector iterations) require half the derivative evaluations as the Runge-Kutta method. In this case,
predictor-correctors are presumed to be two times
faster than Runge-Kutta methods. Unfortunately,
nothing in simulation is this simple, as the next section
illustrates.
It should be noted that the predictor-corrector algorithms require starting values which are usually provided by Runge-'Kutta formulae. The incorporation of
a variable step size and Runge-Kutta equations inevitably compounds the programming problems and makes
it more difficult to demonstrate explicitly the superiority of one technique over the other.
It is interesting to note that a large class of second
order differential equations commonly encountered
in physical problems can be solved explicitly with

Y

YN+1

=

y(c)

=

N+l

YN- I )

y (p»

f(t N + h,

N+l

(c)

Re-iterate Corrector or Y
N+I = YN+1
FIGURE 1-8econd order Adams predictor-corrector formulae

Jtunge-Kutta formulae. These equations are of the
form:

y

=

f(t, y).

Curiously, the techniques are described in the
common literature12 however they are rarely used. A
third order method is displayed in Figure 2.

Variable step size
The predictor-corrector algorithms provide an estimate of truncation error which is superior to estimates
of the error in Runge-Kutta algorithms. If Y i (p)
denotes a predicted point in the solution of the i-th
equation and Y i (c) denotes the corrected point in the
i-th solution, the truncation error Ei is given by

where K depends on the specific predictor-corrector
algorithm. With information of this type, it is common
to vary the integration step size to take advantage of
small truncation errors. One usually computes
E

=

max
IY·(p) _ Y·(c)1
i
~
.,
{

y.(P)
\

i

_
.

y,oo

y.(c) }
i

I

where either the absolute or relative error for each
equation is computed based upon certain criteria, e.g.,
the magnitude IYi(CJI. Variable weight factors may be
assigned to each error in order to vary its influence
on the step size. Unfortunately, knowledge concerning
th6 selection of the weight factors is usually limited and

Mathematics of Continuous System Simulations

Given

f (t, y)

=f

(t , Y )

n

n

FIGURE 2-Runge-Kutta formulae for a class of
second order equations

they are frequently all set to the same value. The
step size is commonly varied as follows:
If
If

E

< E s , double the step size;
> E z, halve the step size and

restart the integrations;
If Es :::; E :::; El the step size remains unchanged. *
E

The problems encountered with this technique are
due to the substantial variation in E from step to step,
resulting in subsequent halving and doubling of the
interval. This generates a large number of integration
restarts, many iterations (frequently Runge-Kutta
passes or backwards interpolations) to generate the
required starting conditions, and a consequential loss
in speed which the variable step size was intended to
improve. Meaningful values of Es and El are therefore
necessary if the benefits of a variable step predictorcorrector algorithm are to be reaped. Although it is
not possible to define general values for El and E s , it
is generally agreed that they should satisfy the relationship:
20 :::;

~:

:::; 100

The reader can conclude, therefore, that predictor*Some programs always halve or double the step size at each
step.7

347

corrector algorithms with variable steps are not unconditionally faster than Runge-Kutta techniques of the
same order. Based upon this conclusion, many people
select a Runge-Kutta algorithm with fixed step size
(usually fourth order) and assume that no improvements in running time can be obtained.
Runge-Kutta algorithms are also used with variable
steps. These techniques may employ two methods of
different order and compare results at the comp letion of
the full integration step. Another method is to integrate
with the same algorithm but employing two different
step sizes. Intermediate points in the solution common
to both methods can be used by both algorithms to
conserve running time. 7 Other methods integrate in
blocks of N steps utilizing information within each
block. Ah:;o, by analyzing the behavior of the solution
over N steps, estimates of the accuracy can be derived
which compare in reliability with those for predictorcorrector methods. L3
A commonly made suggestion encountered is to
integrate different differential equations in the mathematical model with different integration step sizes.
This technique is most commonly employed in hybrid
calculations. Multirate integration techniques require
good knowledge of the frequencies present in the mathematical model. If such a technique is implemented, the
integration routines do become quite complirl,ted.
Canned simulation programs and simulation languages
rarely incorporate multirate integration algorithms
although their use is becoming more popular .14

Truncation and roundoff error
We all realize that it is theoretically possible to reduce the integration truncation error to zero at each
step by driving the integration step size to zero. On a
digital computer, however, this is impractical since the
roundoff error will grow rapidly as the step size is decreased. The general relationship between roulldoff and
truncation error is illustrated in Figure 3. More exact
curves can be drawn for specific algorithms. The error
graphed in Figure 3 represents the error at each step.
Clearly, the most desirable step size isone which will
reduce the total error; that step size is somewhere in
the vicinity of h M. The exact value of hM will depend
on the specific shapes of the curves. 1S
Most analyses are directed at studies of truncation
errors since these. are far easier to investigate than
roundoff errors. However, for problems with wide
dynamic ranges of the independent and depe,n,dent
variable, roundoff error may actually dominate the
solution. In this event, arbitrarily decreasing the step
size only compounds the error. In addition, the roundoff error may confuse the step size variation criteria and
results may then become meaningless.

348

Fall Joint Computer Conferenc~. 1968

t
S(t)

= so

+ It

0

Sdt

S Represents State Variables

ERROR
Accumulated in Double Precision

MODIFICATION

----------------~-------------h

t

.

It

STEP SIZE

ER - Roundoff Error

If

Sdt

.

o

>K

then

st,t

FIGURE 4-Half-double precision integration and modification

ET - Truncation Error
FIGURE 3-Roundoff and truncation error

A decrease in roundoff error can always be achieved
by implementing extended precision arithmetic operations (e.g., double precision floating point arithmetic).
If a variable step size is implemented it is not necessarily
true that double precis~on computations will be slower.
If the step size does not increase in a double precision
solution when compared to single precision it may
indicate that previous results were incorrect. 16 Double
precision arithmetic does utilize twice as much storage
for data as single precision, and "half double precision"
techniques are frequently implemented to conserve
storage.
"Half double precision" techniques accumulate the
integral asa double precision sum but convert the
results to single precision before transmitting them to
the simulation equations. This eliminates much of the
roundoff error in the integration algorithms; however,
roundoff error in the equations of the mathematical
model may be severe. An interesting modification to
this technique is illustrated in Figure 4. This technique restarts the integrator, along with a suitable
readjustment of the initial conditions, whenever the
increment added to the integral b,ecomes small enough
to border on the arithmetic limitations of the machine.
Sampling considerations
The selection of the integration step size, error

limits, and other integration parameters is an art
bordering on black magic. Great care must be taken to
account properly for high frequency effects in the
mathematical model. The Shannon17 sampling theorem
does not automatically apply to digital simulations·
Shannon's theorem states that a function can be accurately reproduced if it is sampled from negative
infinity to positive infinity with a frequency twice the
highest frequency present in the function. The infinite
range of the independent variable is impractical on a
digital computer and rates of ten to one hundred times
the highest frequency present are often' necessary in
closed loop simulations. Sampling rat~s of one hundred
times the highest frequency may not seem severe in
many applications, but this can be misleading.
Consider a digital simulation of a space vehicle in
which the entire control system is simulated at the
transfer function level. The highest frequency present
in the vehicle may only be 5 cycles per second, however
time constants in the control system components may
be very small.9 This is illustrated in Figure 5. In this
event, the step size must conform to the requirements
for the smallest time constant present in the modeleven though its effect on the vehicle may be negligible.
This is one example in which weight factors applied to
the integration error control are invaluable.
Stability
The stability of the integration algorithm must also
be considered when selecting the algorithm and parameters. Generally speaking, an integration method is

.349

Mathematics of Continuous System Simulations
INPUT

. K2 (1+'"2 S +'"3 82 )

.0002 SECS.

(1+'"· S+'" S2)
4
5

OUTPUT
ELEVATION CHANNEL OF TRACKER SERVO· LOOP
WITH SMALL TIME CONSTANT

ized programs are frequently demonstrated with real
time speeds.
The speed of the simulation cannot be estimated
until the natural frequency of the models are determined, integration algorithms selected, stability properties are studied, and intelligent decisions concerning
the step size are made.
The detail of the mathematical model is also significant. Detailed models are certainly more difficult
to simulate in real time than less detailed configurations .
The trap that many people fall into is characterized
by "The Real Time Syndrome." Briefly, the Syndrome
states: "It can be shown that any system can be simulated in real time with a suitable number of significant.
simplifications." The truth of this statement is selfevident .and should be considered when·making requests
for, or claims of, real time speeds in a simulation.
M athematic8 in simulation languages

ROLL RATE = 5 CPS ABOUT INTERCEPTOR ROLL AXIS

FIGURE 5-Relation of Gross system behavior to high frequency
components in mathE'matical model

said to be stable if the error introduced at each step
decreases with increasing number of steps. It is said to
be relatively stable if the error introduced at each step
grows more slowly than the solution. I8 The stability of
the solution is a function of the integration step size,
the algorithms, and the time constants of the mathematical model.
In general, relative stability is the significant criteria
in the numerical solution of differential equations. 19
Although predictor equations may often be unstable,
one usually chooses correctors which are stable. In
this event, the instability of the predictor has little
effect, and, if the corrector is iterated, the predictor's
instability is irrelevant. Curiously it is generally more
desirable to decrease the step size tnan to perform
repeated iterations of the corrector.19

Real time?
The speed of the simulation is a critical factor. One
often hears demands for (or claims of) "real time"
speeds or "faster than real time" speeds. These speeds
are certainly feasible in many applications, and, in
fact, many hybrid computer simulations actually depend upon these speeds. However, it appears that many
people assume categorically that they can obtain real
time speeds in virtually every digital simulation they
perform. Examples are given, results cited, and general-

Numerical techniques embedded in most simulation
languages generally conform to the techniques described
in earlier sections, i.e., algorithms drawn from the
Runge-Kutta and predictor-corrector families. Earlier
languages used simple algorithms ;20 ,21 ,22 however the
current languages generally use algorithms of at least
fourth order.7 ,8,14 See, for example, Figure 6.
Simulation languages are usually enhanced by the
inclusion of "canned" mathematical functions in addition to the integration routines. They include such
things as transfer function blocks representing a variety
of circuits, blocks representing nonlinearities such as
dead zones, transport delays, etc. 14 ,23 See Figure 7.
Implicit algebraic.loops present in the model equations
are not allowed in the use of simulation languages and
the languages usually incorporate iterative and binary
search techniques which enable the user to obtain the
necessary algebraic solutions.
LANGUAGE

ALGORITHM

VARIABLE STEP

DAS

RECTANGULAR

NO

MIDAS

5TH ORDER MILNE PREDICTOR CORRECTOR

YES

MIMIC

FOURTH ORDER RUNGE
KUTTA

YES

HSL

VARIETY AVAILABLE ADAMS
AND 4TH ORDER RUNGE
KUTTA RECOMMENDED

YES

CSMP

7 AVAILABLE

YES

CSSL
(RECOMMENDED)

VARIETY RECOMMENDED

YES

FIGURE 6-8oine numerical integration algorithms

350

Fall Joint .Computer Conference, 1968

LANGUAGE

FUNCTION

EQUATION

yet + At) = yet) +

j

t+dt

yet) dt

t

...

DAB

BANG-BANG

0 = 1121s1gn 11

z(t) = g(t,z(t), yet))

MIMIC

DERIVATIVE

d1
0 = d1 2 ' 0(0)=1 3
1

z(t + At) = z(t) +

DSL/90

DELAY

e-:- 1 ,s

HSL

FIRST ORDER
TRANSFER FTN.

11 + 1 2S
13 + 14S

CSMP/360

2ND-ORDER
LAG-COMPLEX

CSSL

IMPLICIT

1
S 2.+21 1 1 28+1.2S 2
BREAKS SORT LOOPS
= IMPL"(1 ,1 )
1 2

o

FIGURE 7-.-Some mathematical functions of
simulation languages

The simultaneous nature of the differential equations describing continuous dynamic systems creates a
burden on the integration systems design in simulation
languages. Because the digital computer is a sedal
processor, it is necessary to construct an integration
package to integrate all of the differential equations in
a parallel manner. This is accomplished by using a
centralized routine which integrates each derivative
serially but holds the value of each integral until all
integrals at a given time step are ev.aluated. Once all
the integrals are evaluated, they are "simultaneously"
updated, the independent variable is advanced, and
the solution continues.
The problem of parallel integration can best be
explained by an example. Consider the system of two
simultaneous differential equations:
y = f(t,y,z)

I

t+dt

z(t) dt.

t

The problem appears in the evaluation of
z(t) = g(t,z(t), yet))
If yet) is a specific storage location (usually the first

location of an array) the value used in the calculation
of the derivative z(t) cannot be the result of the integral
since this represents the value y(t+At), not y(t\ The
centralized integration subroutine, referenced in the
DERIVATIVE section of a simulation language source
program, will update all of the solutions in paralle1. 24
See Figure 8.
An alternative method employed in some programs23
is to start each computational pass by evaluating all
of the integrals. This advances the solution of the
state variables to the next point in time. It is then
necessary to compute the derivatives of the state variables for the given point in time.
Using either technique, the parallel nature of the
problem creates programming complications. Arrays

r==~=1--~---I EVALUATE DERIVATIVES

AND INTEGRALS

~

- COMMUNICATIONS INTERVAL

b -

CALCULATION INTERVAL

Z= g(t,z,y)
The numerical solution at t + At is obtained by using
some integration algorithm to evaluate
yet) = f(t,y(t), z(t))

FIGURE 8-Integration systems design

Mathematics of Continuous System· Simulations

Yi - l
THESE VALUES SHIFT
ONE POSITIO~

Yi - 2

DOWN

Yi - 3
Yi - 4

-""

Yi - N
MOST RECENT INTEGRAL

Yi

U

DISCARDED

TO TOP OF TABLE

351

cussed in the introduction, and others, for example
discretization of continuous systems into sampled data
systems using z transforms, adaptive filters, etc~,26 are
not commonly employed in simulation applications
and almost never in simulation languages.
Selection of languages, integration algorithms, single
or double precision, sampling rates and integration
parameters are all perplexing problems at present,
but these are the questions the engineer must address
prior to simulation of a continuous dynamic system on
a digital computer. Although a substantial amount of
work is being done to attack these problems, it is the
author's prediction that effective elimination of these
numerical problems will come about sooner by the development of improved hardware than by the development of improved analytical and computational
techniques.
REFERENCES

Y indicates value of the solution calculated on the
i
i-th pass. The integration routine places Yi at the
bottom of the table until time is advanced.
the

UPDA~

During

phase the value is moved to the top of the

table.

FIGURE 9-Update table

used to store current and past solutions are in a constant
state of fluctuation. The buffers used to store the
integrals temporarily also are used for retaining previous information describing the solution for the
predictor-corrector algorithms, and for storing intermediate points in the Runge-Kutta techniques. The
number of locations occupied by each of the arrays is
a function of the order of the integration algorithm.
Buffers are required for both the derivative and solution values.
Figure 9 illustrates a typical "UPDATE TABLE."25
The table is originally filled with Runge-Kutta values
and then maintained by a predictor-corrector algorithm.
Sufficient points are usually maintained to continue
integrating if the step size is increased without requiring
a Runge-Kutta restart.
SUMMARY
Mathematical techniques embedded in simulation
applications cover virtually the entire mathematical
spectrum from numerical analysis through classical
analysis to algebra and the theory of numbers. It is
clearly impossible to address all of these topics in a
single paper, however this paper summarizes the common
mathematical questions encountered in most general
simulations. Special techniques, such as those dis-

1 JCSTRAUSS
Digitial simulation oj continuous dynamic systems: An overview
AFIPS Conference Proceedings Vol 33 1968 FJCC 1968
2 H H TRAUBOTH
Digitialsimulation of general control systems
SIMULATION 9 5 1987
:) 'V H ANDERSON R B BALL
A mtmerical method for solving control di,ffereni1"aZ equations on
digital computers
JACM 711960
4 L A NICHOLLS
Some aspects of the digital simulation of a surface-to-air guided
missile
Technical Note SAD 126 Weapons Research Establishment
Salisbury So Australia 1963
5 JCSTRAUSS
Simulation lang'uages and H SL
EAI Research and Advanced Development Report 67-2
1967
6 D D McCRACKEN W S DaRN
Num~rical methods and Fortran programming
John Wiley and Sons Inc New York 1964 chapter 11 p 365
7 F J SANSOM H E PETERSEN
MIMIC Programming Manual
USAF AFSC SEG-TR-67-311967
8 HYTRAN simulation language programming manual
EAI Publication No 0780000060 1967
9 DHBRANDIN KJAKSTAS PSTRAMESE
Digitial simulation of guidance and control for exoatmospheric
intercept
Supplemnet to the IEEE Transactions on Aerospace and
Electronic Systems AES-2 41966
10 R C BROWN R V BRULLE G D GRIFFEN
Six-degree-of-freedom flight-path study generalized comput~r
program
USAF AFSC WADD-TR 60-7811961
11 T E HULL A L CREEMER
Efficiency of predictor-corrector procedures
JACM 1031963
12 Handbook oj mathematical functions
U.S. Department of Commerce NBS Applied Mathematics
Series 55 1964 p 896

352

Fall Joint Computer Conference, 1968

13 JBROSSER
A Runge-Kuttajor all seasons
SIAM Review 93 1967
14 J C STRAUSS
The SCi continuous systems simulation language
SIMULATION 9 61967
15 RBAGNEW
Differential equations
McGraw-Hill Book Co Inc New York 1960 2nd Edition
16 D H BRANDIN
Numerical integration and digital simulation of continuous
systems
SIMULATION 9 41967 Technical Note
17 C E SHANNON
Proc IRE Vol371949 pp 10-21
18 A RALSTON H S WILF
Mathematical methods for digital computers
John Wilpy and Sons Inc New York 1967 Volume 2
19 R WHAMMING
Numerical methods for scientists and engineers
McGraw-Hill Book Company Inc New York 1962
20 R A GASKILL J W HARRIS A L McKNIGHT
D A S-a digital analog simulator

AFIPS Conference Proceedings Vol231963 SJCC p 69
21 JRHURLEY
Digital simulation I: DYSAC A digitally simulated analog
computer
AlEE Summer General Meeting Denver Colorado 1962
22 R D BRENNAN R N LINEBARGER
.4 survey of digital simulation: digital analog simulator programs
SIMULATION 7 12 1964
23 R D BRENNAN MY SILBERG
Two continuous system modeling programs
J IBM Systems 6 4 1967
24 FJSANSOM
Continuous system simulation languages
AFIPS Conference Proceedings Vol 33 1968 FJCC 1968
25 D H BRANDIN
Simulation of interceptor missiles on an IBM 360/50 digital
computer
N00123-67-C-0547 Naval Ordnance Laboratory Corona Calif
1967
26 J S ROSKO
Improved techniques for digital modelling and simulation of
nonlinear systems
AFIPS Conference Proceedings Volume 32 1968 SJCC 1968

SALEM-A programming system for the simulation of
systems described by partial differential equations
bySTANLEYM. MORRIS a.nd WILLIAME. SCHIESSER
Lehigh U niver8ity

Bethlehem, Pennsylvania

INTRODUCTION
Digital simulation has attained a broad and enthusiastic
usage in recent years, due largely to the increased speed
and flexibility of digital computer hardware and the
notable efforts of the authors of simulation programs
such as MIMIC,! DSL-90,2 PACTOLUS,3 and many
others. All of these programs perform basically a single
task: they solve a system of ordinary differential equations of the initial value type. Indeed, the expression
"digital simulation of continUOll.8 systems" has become
synonymous with this definition.
Users of these programs can study complex physical
processes with little knowledge of computer programming or numerical analysis. Logically, they are never
far removed from the differential equations, but they
have all of the capability of the digital computer at their
disposal.
SALEM extends these concepts to partial differential
equations, which always arise in the mathematical
modeling of distributed parameter systems. Most
physical systems are of the distributed type; that is, the
dependent variables are functions of more than one
independent variable. The ordinary differential equations commonly encountered in mathematical models
are usually simplifications of the partial differential
equations whjch actually describe the system.
A partial differential equation (PDE) simulator
would enable a user to investigate distributed systems
with the ease that he may presently investigate a discrete or ordinary differential equation (ODE) system.
The problems involved in actually writing a PDE simulator, however, are far more complex and varied than
those involved in an ODE simulator. There is no one
universal method for numerically solving all the PDE's
commonly found in engineering problems. Each
different problem may require a unique method, a possibility commonly attested to by authors of standard
texts in the field.

Therefore, SALE~VI is organized into two parts: an
executive program capable of translating user-generated
descriptions of partial differential equations into data
usuable by a computer, and a library of calculation routines which produce the solution.

SALEM input format
Every attempt has been made to allow a free-form
algebraic input format. If we are interested in the solution to the equation:

2a2c/ax2

-

ac/at + 1/2C = 1

we would program it as:
(2.0)*D2(C, X) - Dl(C, T)

+

(0.5)*C = 1.0

Note that D2(C,X) refers to the second derivative of C
with respect to X. The coefficients may also be algebraic
expressions or functions, expressed in Fortran notation.

a2c/aR2
D2(C, R)

+

+ (2.0/R)aC/aR

- ac/at

=

0

(2.0/R)*Dl(C, R) - D1(C, T)

=

0

Initial and/or boundary conditions are expressed in an
analogous fashion.

ac / ax + C = 1,

x

= 0

B0UNDARY C0NDITI0N, Dl(C, X)
1.0, X = 0.0

+ c

C = 1.5, t = 0 (t is time)
INITIAL C0NDITI0N, C = 1.5, T = 0.0
There are other statements which define (1) the
353

354

Fall Joint Computer Conference, 1968

values of the independent variables for which the solution is calculated and pr:nted out, (2) the desired
stopping point for open-ended equations, and (3) special statements which allow the calculation of complex
equation coefficients.
Table 1 lists the type~ of equations which can presently be solved by SALEM, along with allowable
boundary and initial conditions;

1.2 Ft.

Sample problem

A simple sample problem will serve to illustrate the
procedure involved in obtaining a solution to a PDE.
Figure 1 illustrates a steel sheet which is initially at a
uniform temperature of 100°. Two opposite sides are
insulated, and the other two sides are suddenly raised to
2000K. The following data can be used:
k = 25.6 Btu/hr ft°F (thermal conductivity)

r ~1:4

__x _ _ 2000
1 Ft.

D == 450 Ib/ft 3 (density)
The dimensions of the sheet are 1 ft X 1.2 ft, with the
short sides being maintained at 200°. We will consider
two cases:
Cp = 5.145 Btu/lboF (average heat capacity)
Cp = 3.37 + 0.0071(T) (temperature-dependent
heat capacity)
k/DCp(a2T/ax2 + a2Tjc1y2) - aT/at = 0
aT / ax = 0., x = 0
aT/ax = 0., x =1.0
T = 200., y = 0
T = 200., y = 01.2
T = 100., t = 0
The equation would· be linear for case 1 and nonlinear for case 2.
The SALEM input listing for case 1 is shown in
. Figure 2. Card # 1 is the partial differential eGuation,
where.T is temperature and TM is time. Cards 2-6
specify the boundary and initial conditions. Card # 7
sp.ecifies the print interval for each independent variable; X=.2 means that temperatures are to be calculated at X = 0, .2, .4, .6, .8, and 1.0; Y = .. 2 means that
temperatures are to be calculated at y = 0, .2, .4, .6, .8,
1.0, and 1.2 for each value of x. This specifies a grid of
6 X 7 = 42 points. TM = .1 specifies a complete solution
for each time unit of 0.1. Card # 8 indicates that the
PDE is parabolic. Card # 9 specifies the final value of
time for which a solution is to be produced. Card # 10
indicates the calculation program which is to be used to
solve this PDE; the number is obtained from a standard library list.
Figure 3 shows the SALEM-produced solution at

FIGURE I-Steel sheet
SALEM input list
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.

(.62)*D2(T,X) + (.62)*D2(T,Y) - Dl(T,TM) =0
BOUNDARY CONDITION, Dl(T,X) = 0., X = O.
BOUNDARY CONDITION, Dl(T,X) = 0., X = 1.
BOUNDARY CONDITION,T = 200., Y = O.
BOUNDARY CONDITION, T = 200., Y = 1.2
INITIAL CONDITION, T = 100., TM = O.
PRINT INTERVAL, X = .2, Y = .2, TM = .1
TYPE PARABOLIC
SOLUTION END, TM = .2
USE SUBROUTINE NUMBER 20
END
FIGURE 2-SALEM input list-case 1
SALEM solution for TM =
. ... X ....
.2
.6
.4
150.0 150.0 150.0
100.0
100.0 100.0
100.0
100.0
100.0
100.0 100.0
100.0
100.0
100.0 100.0
100.0
100.0
100.0
150.0
150.0
150.0

Y = 0
Y =.2
Y=.4
Y =.6
Y =.8
Y = 1.0
Y = 1.2

0
150.0
100.0
100.0
100.0
100.0
100.0
150.0

Y = 0
Y =.2
Y=.4
Y =.6
Y = .8
Y = 1.0
Y = 1.2

SALEM SOLUTION FOR TM
.... X ....
0
.2
.4
.6
200.0
200.0
200.0 200.0
173.0 173.0 173.0 173.0
152.7
152.7
152.7 152.7
145.8
145.8 145.8 145.8
152.7
152.7
152.7 152.7
173.0 173.0
173.0 173.0
200.0
200.0
200.0 200.0

O.

.8
150.0
100.0
100.0
100.0
100.0
100.0
150.0

1.0
150.0
100.0
100.0
100.0
100.0
100.0
150.0

= .2
.8
200.0
173.0
152.7
145.8
152.7
173;0
200.0

FIGURE 3-SALEM solution-case 1

1.0
200.0
173.0·
152.7
145.8
152.7
173.0
200.0

SALEM

time t = 0 and .2. The solution at t = 0 provides a
check on the initial conditions. Note that the temperature gradient is zero in the y-direction; this is expected
because of the perfect insulation at x = 0 and x = 1. .
Figure 4 shows the SALEM input listing for case 2.
Note that the constant 0.62 has been replaced by the
variable A in the equation coefficients. A is defined in
card 11, a special ARITH statement. The remainder of
the listing is identical to case 1, with the exception of
the subroutine (card 10). 20N refers to the nonlinear
version of subroutine # 20. Figure 5' shows the SALEl\;'(produced solution for case 2.

Table I -Glasses of equations presently'solved by SALEM
One dimensional parabolic
a la 2C/aX2 + a2 a C/ax - asaC/at + a 4C = a6
One dimensional hyperbolic:
a la 2C/ax2 - a2 a2 C/at2 = as
Two dimensional parabolic
a 2a 2C/ax2 + a2a2C/ay + asaC/ax
- a4 a C/at + a6 C = a6
elliptic:
ala~C/ax2

1.0
200.0
176.7
159.7
153.6
159.7
176.7
200.0

FIGURE 5--SALEM solution-case 2

SALEM also possesses a full complement of error
diagnostics to facilitate usage. Errors in problem formulation and programming, and problems encountered
in the numerical solution (i.e., instability and convergence failure) automatically terminate the execution. An explanatory comment is provided for the
user.
Methods used in calculation programs

A brief description of calculation techniques will be
given. Every effort was made to use simple, general
methods in developing the library ·of subroutines, both
to gurantee convergence and for programming simplicity. As a first example, we will consider the method
used to solve the equation:

+ a 2a 2C/ay2 + asaC/ax + a 4C = a6

The coefficients can be zero, constant, or functions
of any dependent or independent variable. This means
that nonlinearities of the form f(C)aC/ay are allowed.
Arowable boundary and initial condit ons:
alaC/ax + a 2C = as, x = a4
ai, a2, and as can ·be zero, constant, or functions of the
independent variable. a4 must be zero or constant.
Rectangular, cylindrical} and spher "al coordinate
systems may be used.

1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.

SALEM solution for TM = .2
.... X ....
0
.2
.8
.4
.6
200.0
200.0 200.0
Y = O. 200.0 200.0
176.7
Y =.2 176.7 176.7 176.7 176.7
159.7 159.7
159.7
Y=.4 159.7 159.7
153.6
153.6
153.6
153.6
Y =.6 153.6
159.7 159.7
159.7
Y =.8 159.7 159.7
176.7 176.7
176.7
176.7
Y = 1.0 176.7
200.0 200.0
200.0
Y = 1.2 200.0 200.0

355

SALEM input
(A)*D2(T,X) + (A)*D2(T,Y) - D1(T,TM) = o.
BOUNDARY CONDITION, D1(T,X) = 0., X = O.
BOUNDARY CONDITION, D1(T,X) = 0., X = 1.
BOUNDARY CONDITION, T = 200., Y = O.
BOUNDARY CONDITION, T = 200., Y = 1.2
INITIAL CONDITION, T = 100., TM = O.
PRINT INTERVAL, X = .2, Y = .2, TM = .1
TYPE PARABOLIC
SOLUTION END, TM = .2
USE SUBROUTINE NUMBER 20N
ARITH, A = 3.19/(3.37 + .0071 *T)
END
FIGURE 4-SALEM input list-case 2

(1)

a2c/ax2 is replaced with a second order central
difference representation, and ac/ax is replaced with a
first order backward difference representation.

a2c/ax2 = (Cr+l,8+1-2Cr,8+1+Cr-I,8+1)/h2 + 0(h2)
ac/at = (C r,8+1-C r,s)/k + O(k)
r refers to x, s refers to t
Substituting these representations into equation (1),
we obtain the following implicit finite difference
equation:
B Cr+1,s+1- (2B + l)C r ,s+l+ B C r- 1,B+1=Cr,8+F'
B = a1k/a 2h2
F' = Fk/a2
(2)
If we had nonderivative boundary conditions:

C = as, x = 0
C = a4, x = 1
C = a6, t = 0
we could write equation (2) for each internal mesh point

Cr ,s+1 0< r < 1. If there are N internal mesh points,

356

Fall Joint Computer Conference, 1968

this will result in N equations in N unknowns. The set of
equations is tridiagonal and can be solved explicitly by
the method of Thomas. 4 This procedure is repeated for
each time step.
If we have the general boundary condition:

calculated answer (k = 1)
truncation error (k = 1)
= calculated answer (k = 2)
+ truncation error (k = 2)

+

truncation error (k = 1)
1 a2C(1/)jat2
truncation error (k = 2) = 2 a2C(1/')jat 2
we can replace the derivative'term with a second-order
difference representation:
(3)

In this case, we do not directly know the boundary
value, so we must write equation (2) for each mesh
point, including boundary points. But this requires
knowledge of the value of points outside the boundary.
These can be calculated from equation (3):

Therefore, for each time increment, we will have
N +2 tridiagonal equation in N +2 unknowns, which
can be solved by the method of Thomas.
Finally, to increase the speed and accuracy of the
calculated solution, we use truncation error correction
(often referred to as the "deferred approach to the
limit"). Examining the error due to replacing the time
derivative with a finite difference representation, we
can write:
calculated answer

+

truncation error
= actual answer

(4)

We can estimate the truncation error in the time
direction from Taylor series:
truncation error =

k

a2c (1/)

'2 at2

to:::; 1/ ~ to

+

k

1 a2c
truncation error (k = 1) = - - 2 (1/)
2 at

(5)

For k = 2:
truncation error (k = 2) --

2 a2C
'2 at2

('11')
.,

(6)

From (4), (5), and (6) we can develop two more
equations:

(8)

If the calculated answers for k = 1 and k = 2 are
sufficiently close, then a2C(1/)jat2 = a2C(1/')/at2 , and
combining (6) and (7):

calculated answer (k = 1)
- calculated answer (k = 2)
= truncation error (k = 1)
This leads to a powerful solution technique:
1. Calculate the solution using the time and distance
intervals specified by the user.
2. Halve the time interval, and recalculate the solution using two time steps.
3. If the solution from step 1 and step 2 differ by at
most a specified error, proceed to step 4; otherwise, halve the time step again and repeat.
4. Calculate the truncation error and add this to the
most recently calculated solution to obtain the
final answer.
By an analogous procedure, we can estimate the truncation introduced by replacing the x-derivative with
the second-order finite difference representation
truncation error (h = 1)
= [calculated answer (h = 1)
- calculated answer (h = 2)1/3.
A study has been made to determine the efficiency of
this procedure relative to the same procedure without
truncation error correction. The following problem was
used:
2a~v jax 2 -

Arbitrarily let k, the step size in the time direction,
equal one.

(7)

av jat = 0

V = 0, t = 0
V = t, x = -2
V = t, x = 2
We desire a solution for five time steps of ~t = .1.
Several runs were made with ~x = 0.8, one with truncation error correction, and several with no truncation
error correction, at decreasing values of ~t. The calculated answers at t = ..5 are tabulated for x = - 1.2 and
-.4 in Table 2.
After expending three times as much computation
time as the version with truncation error, the answer is
still in error by 5%, compared to 0.3% for the corrected

SALEM
Table II-Truncation error correction rtudy
Results
x= -1.2 x= -.4
Exact solution
Salem with
truncation error
correction
Salem without
truncation error
correction
At = .1
At = '.05
At = .025
At = .0125
At == .003125

.1875

IBM 360/30
Calculation
time, sec.

357

University. Emphasis is being placed on the following
areas, which currently limit the applicability of
SALEM:
• Irregular geometries.
• First order flow equations, where convection
terms are more important than diffusion terms.
• Coupled partial differential equations.
Nonlinear boundary conditions.

.0696

It-

.1876

.0698

• Nonlinear terms of the

11

form~(D(C)oC/ox)
and
ox

!x(D(C)C)
.2016
.1955
.1924
.1908
.1896

.0904
.0816
.0770
.0746
.0728

2
3
5
9
36

solution. Even if At were much smaller, a 3% error
would exist, due to the truncation error in the x direction. Reducing the mesh size to Ax = .4 and retaining
At = .003125 reduced the error to less than 1%, but the
solution time was 144 seconds, or 13 times as long as the
method with truncation error correction. For long, complex problems this advantage could be enormous.
All one-dimensional parabolic and hyperbolic PDE's
are solved using variations of the above techniques.
Two-dimensional parabolic and elliptic equations are
solved using the Peaceman-Rachford method, which is
documented elsewhere. In general, the method is an
alternating-direction technique which results in sets of
tridiagonal equations. The truncation error correction
technique has been adapted to the Peaceman-Rachford
equations, and has resulted in increased speed of solution while maintaining a given accuracy.
SUMMARY
SALEM is more than Just a programming system for,
the automated solution of PDE~s. It is a flexible simulation language with many user-oriented programming
features. It is also modular in con.struction so that once
a numerical technique is sucessfully developed for a
particular type of PDE, a subroutine implementing the
numerical algorithm can easily be added to the system.
Hopefully the library of subroutines will be expanded
and shared by the users, thereby reducing the duplication of effort in the development of numerical methods
for the solution of PDE's.

Future research
Development of SALEM is continuing at Lehigh

As of this writing, these additional features are being
incorporated; and the program will be withheld until
the changes are complete. The authors will publish
papers relating to applications of SALEM in the near
future, and these will demonstrate how simply a novice
can use the system.
More information concerning SALEM is. available in
reference 6, or by contacting:
S.M. Morris
Esso Research and Engineering Co.
P.O. Box 101
Florham Park, New Jersey 07932
Phone: 201-474-6379
or:
W. E. Schiesser
pepartment of Chemical Engineering
Lehigh University
Bethlehem, Pennsylvania 18015
Phone: 215-867-5071, ext. 229
BIBLIOGRAPHY
1 H E PETERSON F J SANSOM L M WARSHAWSKY
MIMIC-A digital simulator program
SESCA Internal Memo 64-12 Wright-Patterson Air Force
Base Ohio 1964
2 R L LINEBARGER
DSL/90
Simulation September 1966
3 RDBRENNAN HSANO
Pactolus-A digital simulation program for the IBM 1620
1964 Fall Joint Computer Conference AFIPS Conference
Proceedings 26 1964
4 LLAPIDUS
Digital computation for chemical engineers
McGraw-Hill Book Company New York 1962
5 D W PEACEMAN H H RACHFORD JR
The numerical solution of parabolic and elliptic differential
equations
JSIAM 31955
6 SMMORRIS
SALEM-A programming system for the simulation of systems
described by partial differential equations
PhD Dissertation Department Chemical Engineering Lehigh
University available from University Microfilms Inc 300 North
Zeed Road Ann Arbor Michigan 48103

ot

TAF-A steady state, frequency response, and
time response simulation program t
by THOMAS E. SPRINGER and OTIS A. FARMER
University oj California
Los Alamos, New Mexico

INTRODUCTION
For over a decade, engineers have used the analog computer to simulate systems, models of which could be
repres'ented by groups of nonlinear simultaneous firstorder differential equations. As the digital computer
became more prominent, it was often used to cross
check, to set up, and to solve problems run on the analog computer. Many- digital codes were developed to
complement, check out, and even replace the analog
computer. Codes such as DAS, MIDAS, PARTNER,
DYSAC, MIMIC, DSL/90 i and others came into wide
use, and some of the reasons for their development have
been ably reviewed by Brennan and Linebarger* and
later by Clancy and Fineberg. **
Nuclear rocket engine development at the Los
Alamos Scientific Laboratory led to use of digital computer programs in conjunction with analog computer
programs. The equations solved were those representing
the propellant system, the heat exchanger, the reactor
kinetics, and the controls of nuclear rocket engines
tested at the Nuclear Rocket Development Station in
Nevada. The analog computer simulation was checked
by means of a digital' computer. Originally this was
done by programming and solving digitally, first, the
steady-state equations representing the system and,
second, the linearized, La Place transformed differential equations representing the system. The steadystate results from the first code and the transfer func*Work perlormed under the auspices of the U.S. Atomic Energy
Commission.
*R. D. Brennan and R. N. Linebarger, "A Survey of Digital
Simulation: Digital Analog Simulation Programs," Simulation,
Vol. 3, No.6, (December, 1964).
**J. J. Clancy and M. S. Fineberg, "Digital Simulation Languages: A Critique and Guide," Fall 1965 Joint Computer Conference, Vol. 27, Part I, Spartan Books, Inc. (1965)

tions from the second code were checked with results
from the analog computer, and corrections were made
until both computer results agreed. The first code required solving a set of non-linear algebraic equations
usually by iteration. The second code required solving ~
complex matrix at each frequency for which the transfer
functions were to be evaluated. It soon became desirable
to obtain time solutions on the digital computer. To do
this, the derivatives of the system were defined the
initial conditions were obtained by solving the 'nonlinear steady-stat~ equations, and the equations were
integrated by using a fourth-order Runge-Kutta digital
integration method. Most of the various subsystem
studies involved programming three separate codes as
well as linearizing and LaPlace' transforming by hand
the equations.
Of the three classes of digital solutions--steady state,
frequency response, and time response- the last was the
easiest to' program. It was only necessary to define the
derivatives of the system in any order, and to integrate
the derivatives with the Runge-Kutta subroutine.
However, the programming of FORTRAN formats and
of read-and-write statements for defining input-output
data remained a necessary chore for all three classes of
solutions.
As the number of problems increased, so did the need
for a flexible digital code that would quickly solve for
steady state, frequency response,and time response.
The only information needed to obtain these three
classes of digital solutions are the derivatives of the system and their inputs. This led to the development of
the TAF (Time and Frequency) code in which the
derivatives of the system are defined in one FORTRAN
subroutine called DER; the variables are identified, and
certain preliminary calculations are performed in a
second user-written subroutine called INPUT. The
TAF code reads input data; finds steady state, transfer
359

360

Fall Joint Computer Conference, 1968

functions, and time response; and lists or plots on microfilm the outputs.
The digital codes mentioned earlier (DAS, MIDAS,
etc.) that simulate the analog computer do not compute
transfer functions (unless a sine wave is fed into the system) and must integrate to find a steady-state solution.
However, many of these codes do not require an understanding of digital computation. The user, as a rule,
only defines the analog computer elements and all the
inputs to these elements. For an engineer unacquainted
with digital coding but familiar with analog computing,
this offers an immediate advantage over the TAF code,
which requires some knowledge of FORTRAN. However, in defining a problem, the user must first describe
the system in differential equations. If these are partial
differential equations and if techniques are to be used
that only allow ordinary differential equations, the
original equations must be reduced into a set of firstorder, non-linear differential equations. For us it
appeared simpler to enter these equations directly into
the computer instead of to enter an analog flow chart
from which the computer extracts the original equations.
Admittedly, the construction of flow charts may point
out many mistakes; however, needless effort may be
expended in their preparation if the equations themselves can be entered directly into the computer.
The TAF code is not a new simulation language.
It is written in FORTRAN and requires that the user
define the derivatives of the system in a FORTRAN subroutine called DER. The programmer may use the
integration variables and may define the derivatives in
any order in programming the DER subroutines. However, any other variables the programmer choses to use
in algebraic equations must be defined before they are
used. It would be possible, of course, to define the system model to be simulated by defining the equivalent
analog computer wiring diagram using, for example, the
Continuous System Simulation Language. * A user only
familiar with analog computers could then easily obtain
fast digital steady-state solutiorts and frequency response solutions as well as the time response solutions
that other codes presently give" him. For the reason
mentioned in the previous paragraph, however, we
chose not to provide a new simulation language.
DISCUSSION

sponse and time response from one group of non-linear
simultaneous first-order diffierential equations. The code
is intended for initial value problems only. The equations can be described by

where y i is a set of integration or state variables, and Xk
is a set of system inputs defined as functions of time.
The system-defining equations themselves are assumed
to be already contained in Equation 1.
Integration codes for steady-state and time-response
calculations from differential equations are in common
use, but do not include frequency response. We had to
develop, therefore, a method of calculating frequency
response from the same set of equations. This method
uses a complex matrix whose elements are automatically
defined.
Assume a set of steady-state variables, yO i, for which
dy·
all dt ~ = O. To compute transfer functions, we
linearize the equations for a given set of inputs,xk'

where 0Yi is the variation in Yi from steady-state when
the input is varied by OXk. By deleting the steady-state
terms and by forming the La Place transform of oy i
and OXk, we obtain the matrix equation, shown below
for three variables and two inputs. Capital letters
denote the LaPlace t.ransform.

l

afl
ays

afl

af l

aYI

aY2

af2

aYI

af 2
-- - s
aY2

ays

Of,
aYI

afs
aY2

afs
-s
ays

--8

af2

af l
-oXI
aXI

afl
-oX2
aX2

The basic criterion in developing the T AF code was
the ability to compute steady-state, frequency re-

af 2
-oXI
aXI

af2
-,oX 2
aX2

*J. C. Strauss, et aI, "The SCI Continuous System Simulation
Language (CSSL)," SIMULATION, Vol. 9, No.6, December,

afs
-oX I
aXI

afs
-oX 2
aX2

Approach

1967.

oY I

OY2

oYs

(3)

TAF
If BX k = 1, then BY i will be the transfer function
BY
oX i

k

·
d for s, the complex
s. "V·
. It h·.JW su bstitute

()

matrix may be solved for various specified values of WI
Equation 3 represents the linearized LaPlace transformed system equations. The unique feature of the
TAF code is the ability to evaluate the elements of this
matdx equation automatically. The derivatives of the
system, f i, may be "reasonably" non-linear. By "reasonably" we imply the same conditions that are generally used when one applies linear control theory to nonlinear systems. If the system has abrupt discontinuities
such as stops on the controllers or a branch of equations
at certain points, the frequency response should not be
'evaluated in the immediate vicinity of these points.
This is reasonable since the La Place transform is only
defined for linear systems.
The computer evaluates the partial derivatives with
respect to Yj by the numerical formula
af i
ay j

f.o(yOl,· .. , 1.003yOj, ... yOn, Xk)
b,.yj

- f(yOl, ... ,

J!l j,

... yOn, Xk)

D.yj

(4)

. eva1uIS
aXk
ated similarly with D.Xk = .003Xko The choice of .003 is
arbitrary. For most of the engineering problems we have
programmed, it has proved to be a good compromise
between derivative non-linear effects and digital computer round-off error. The former occurs if D.y i is too
large; the latter if D.y i is too small. In the previous
paragraph, we mentioned avoiding the "immediate
vicinity" of abrupt discontinuities. By "immediate
vicinity" we, therefore, mean that no state variable
shall be within 0.3 percent of the discontinuity.
If y/ = 0, then D.yj = .003 and similarly for xl
Because these. partial derivatives are evaluated at
steady state, one might assume that the second term in
the numerator of Equation 4 could be eliminated since
it equals zero. However, in general, the term is not
exactly zero, and its omission can lead to large errors.
The transfer functions just described were computed
about a steady-state that is consistent with the inputs
to the system. The TAF code offers two possibilities
for computing steady-state: (1) by integrating until
the system achieves equilibrium, and (2) by a modified
Newton-Raphson method. In general, the first possibility requires a much longer computing time.
The second method was developed from Equation 2.
Here, y/ implies an initial guess as to the steady-state

. w h·IC h t..l.yj
A
In

·
.
=.003Y0j. The deflvatlve
-af i

361

condition, and oYj implies an error correction to Yj to
set the time derivatives to zero. In Equation 2, both
the left-hand side and OXk are zero in steady-state. The
error, OYh is then found by solving the matrix equation.
af l

afl

aY1

aY2

af 2 af2
ay! aY2

afs
ay!

afs
aY2

af1
ays
af 2

ays
af3
ays

°Y1

- f1(y/)

°Y2

- f 2(y jO)

OY3

- f3(Y jO)

(5)

Since the equations of the system are not necessarily
linear, the steady-state solution may not be found in one
iteration of the matrix equation only. Various techniques have been used to converge on steady state with
the least number of iterations.
The user of the T AF code may wish to ignore certain
parts of his problem: he may shut off a bypass flow
valve or turn off part of an electric network. In such
cases, some of the derivatives of the system will be
identically zero. This will lead to a row of zeroes in the
coefficient matrix. There may also be a free integrator in
the system with a zero input, which would lead to a
column of zeroes in the coefficient matrix because no
derivative is a function of the variable representing the
integrator output. In the steady-state solution, the error
being solved in the variable whose derivative is zero
must also be zero. Thus, the row of zeroes and the corresponding column may be deleted from the matrix,
whose order would then be reduced by one. Likewise, a
column of zeroes implies a free integrator whose output
is arbitrary. The initial quess of the value for that variable is as good as any. The error correction can be considered known to be zero, and all the columns of zeros
and their corresponding rows can, therefore, be deleted:
In the matrix solution for transfer functions, this
same reasoning can be applied to delete a row of zeroes
but can no longer be applied to a column of zeroes, since
physically, a free integrator should have infinite gain at
zero frequency. After deleting these rows of zeroes, the
matrix will no longer be singular.
Refinements
The TAF code has been used successfully in solving
various types of systems fo1' as many as 80 integration
variables (y i) and three different inputs (Xk). The code
has been refined over the years to include several
secondary features such as the handling of implicit
equations. These equations correspond to a high-gain

362

Fall Joint Computer Conference, 1968

algebraic loop on the analog computer. For example,
assume that g (Yl Y2, h) = 0, and that dYi/dt = fi
(Yl, Y'J, h) where g is a function that cannot be solved
explicitly for h. The digital-analog simulator codes use
different methods for handling such implicit functions.
The simplest method is to use values of h from the previous time step. For codes not computing partial derivatives and for time increments much smaller than
the time responses one wishes to observe, this method
will prove satisfactory. One cannot compute the matrix
elements for steady-state or frequency response with
such an equation defining the derivatives, since the
variables are changed by the factor of 0.003 one at a
time (see Equation 4). In a time solution, such treat
ment only introduces a time lag in the implicit variable.
Obviously, it cannot be applied when computing partial
derivatives.
Another method of handling implicit functions is by
interation.A Newton-Raphson, .Regula Falsi, or other
method may be used to determine that value of h for
which g(y;, h) = O. Since the value of h changes only a
small amount when the y:'s change by a small amount
following an integration step, a third method of handling implicit functions is possible and has been implemented in T AF. If h is treated as an integration variable, then the derivative dhjat may be computed auto"
matically by the equation

~
bad Parameters
Set Initial Conditione
Initial Calculations

FIGURE I-Mass on a"spring schematic

dh
dt
If several implicit functions are coupled together, a
more -complex solution results.
All the integration variables Yi are incremented together by their respective time derivatives multiplied

by the time step in the evaluation of g (Yi

+ ~~i At,h).

The above equations are programmed automatically
in a closed subroutine called EMDER, which defines
the derivative of an implicit variable.

Coding
Figure I shows a basic block diagram of the TAF
code. Since the entire code is written in FORTRAN IV,
a user must understand the basic FORTRAN language.
There are only two subroutines that require coding:
INPUT and DER. Their coding has been greatly simplified by using specially designed subroutines that only
require input data in addition to COl\1l\10N statements. Other parts of the program require only CO l\1MON statements and the allocation of permanent

blocks of storage for all integration variables parameters, integers, etc.
If input parameters are identified by FORTRAN
names, they must be added to the DER and INPUT
COMMON lists. This permits the use of assigned names
in programming DER and in reading the data c.ards.
The actual coding of the DER and INPUT subroutines can best be explained on a sample problem. However, let us explain first some of the specially designed
subroutines that are available.
BCDCON. This subroutine is used for data input and
data output. FORTRAN names can be associated with
storage locations and used with input and output data,
as shown in the Appendix.
The program is used by
CALL BCDCON (R1, R2, - - -, C1, - - -,
Z(l), Z(2), - - -, Zen))
where R1, R2, C1, etc. are FORTRAN names assigned
to variables, and Z(l), Z(2), Zen) is a block of allocated
storage. Variables may be a multisubscripted array, and
any number may be defined.

TAF
Defined data can be read into the program by using
only the FORTRAN names followed by assigned data
in any format.
Consecutive runs only require a redefinition of the
input data to be changed.
To print data with FORTRAN names, one only
needs to specify the i-th location of the first and of the
last Zi to be printed.
Many other options to print data (e.g., specified
transfer functions, specified integration variables, etc.)
have been built into the program. A sample printout is
given in the Appendix.
ENTER. This FORTRAN function is a table look-up
routine for implementing non-linear algebraic functions.
(The tabulated data had been stored when reading-in
the input.) Coding requires only the following statement.

v=

363

The example presented in the Appendix has been
chosen to show the typical coding involved in defining
a system that can be represented by differential equations.
ACKNOWLEDGMENTS
Special acknowledgement is given to P. Blake and P. A.
Secker of Westinghouse Astronuclear Laboratory,
Pittsburgh, Pennsylvania; and to J. Hafer, Los Alamos
Scientific Laboratory, for their contribution of ideas and
presentation of the sample problems.

APPENDIX
T AF sample problem
Problem: Mass on a spring, as shown below

ENTER (J,U)

where J is the index number of the table, and U and V
are the independent and the dependent variables, respectively.
TCNSET and TCNTRL. A system being studied for
TAF coding frequently contains controllers in the form
of the following transfer function.

D

~--r---J

1. _____ _

-

referuee poillt at laltlal colMllt1oa.

FIGURE 1

Previously, this required the development of subroutines for transforming the transfer functions into
first-order differential equations and then for solving
the resultant set of controller equations as a subset to
the equations in DER.
In TCNSET and TCNTRL, controllers are defined
by input data, and the transformation to first-order
differential equations occurs automatically as part of
the program. TAF can handle up to 15 different controllers.
The only coding in DER is
CALL TCNTRL (I, U, V)
where I . refers to the number of the controller being
used, and U and'Varethe input and the output of the
controller.
Several other closed subroutines are being used in
addition to those previously described: A complete
description of all TAF programs can be found in the
User's Manual, to be published around December, 1968.

The system of Figurf' 1 can be reprf'sented by the
equation of motion for a linear damped spring mass
system.
m d 2 (D)
dt 2

+

d(D)
C~

+

KD = f

where m = mass, Ibm
C = damping constant, lb,/sec
K = spring constant~ Ib,/sec2
f = forcing function, Ib t-in./sec2
D = displacement, in.
The problem is set up for three solutions represented
by Equations (1), (2), and (3).
d(D)
=v
dt
(1)
dv
dt

-2rwv - w2 (D - x)

364

Fall Joint Computer Conference, 1968

1)(s)
XeS)

W2

= S2

+ 2tws + w

2

(2)

(3)

dv
dt - - 2twv Iv; -w2 (2 - x)
where

CI.

C

t

= 2YKm

x

=-

f
K

These examples have been chosen to demonstrate
specific features of TAF. Equation (1) represents the
linear, damped, spring-mass system as a coupled set, of
2 first order ordinary differential equations. Equation
(2) represents the same problem in LaPlace transform
notation to exemplify the TCNTRL (I, U, V) feature in
TAF. Equation (3) represents a non-linear spring-mass
system with velocity squared damping to illustrate the
ability of TAF to obtain a steady state and a frequency
response of non-linear systems.
In each set, the integration variables are displacement (1)) and velocity (v), and the system input is displacement (x)
In the TAF program, we can find all three solutions
simultaneously since three inputs and 80 integration
variables are available. However, before coding, the
variables must be identified with FORTRAN names;
The FORTRAN names for the derivative and integration variables are listed below for all three solutions.

FORTRAN NAMES
Variable Name
D
v

D
V

DISPL
VEL

Solution 3

Solution 2

Solution 1

Y(~)

DNL
VNL

Y(5)
Y(6)

Y(l)

TCNDIS

Y(4)

d(O)
dt

DDT

YP(l)

DNLDT

YP(5)

dey)
dt

VDT

' YP(2

VNLDT

YP(6)

x

X(2)

X(l)

The equivalence and BC1)CON statements in
INPUT allow the use of different names and, at the
same time, allow the main code to use specified values
for Y i, YP i, Zj. For instance D, Y(l) and 1)ISPL are all
the same variable. Y(l) is used by the main program~
1) may be used in coding equations and 1)ISPL will be
printed with the correct data value. The INPUT subroutine listing shows the use of different names for the
same variable. Any of the three names may be used for
input data or in coding, and the first name given in the
BCDCON list will be printed to identify the output
data.
In addition to those listed above, other variables with
their assigned FORTRAN names and storage assignmentsare:

FORTRAN NAMES

Variable
(.oJ

r
m
K
C

X(3)

WO

ZETA
XM
XK
XC

NTFRQ
ZETA
MASS
SPGCI
DAMPF

Z(l)
Z(2) Storage
Z(3)
.
Z(4) AssIgnment
Z(5)

INPUT Subroutine. The FORTRAN listing includes all
the coding needed in this subroutine for solving all three
sets of equations simultaneously. The input data
are read by SYMBOL, and wand t are computed from,
m,K,andC.

TAF

365

E(,)UIVALt::Nr.E{V( 1) ,U). (Y(2) ,V), (YPC1) ,nUT). tYPe?) .VDT), (Z(I) 'WO)
• CZ (3) • XM) , Cl (4) • XK) , (Z (C;) ,.XC)
E(~UIVALE"'CE (Y(S) ,ONL), (Y(6) ,Vt'4L). (VP(S) ,L)NLnT), (YfJ(6) .YNLDT)

1, (l (2) ,ZE T A)

CALL

1
1
·1

~COCnN(4RHOISPL.VEL,ODT,ACCEl
,D,~,OOT.VOT)

CALL RCDCON(36HNTFRQ,ZETA
,WC.Z(2»
CALL HCDCON(]6HMASS,SPGCT.DAMPF

~

~

~

,XtJ,)(K.x.C)

CALL"BCOCON(24HTCNINP.TCNOIS
$
CALL HCUCON(~l~O~L,VNL,D~lDT,VNLnT $
1.
,Dt\L, VNL, ONLOT • VNl.nr)

.

,Y(3),V(4»

CALL .SYMAOL ( 1,5)

IF(IRU~.GE.l)kET~HN

=

wO
SGRl(XK/XM)
ZETA ~ XC/(?.*XM*WO)

CR(l,)=w()

CR(2,1):lETA
The BCD CON statements and EQUIVAtENCE
statements could be left out if all coding included only
Y(I), YP(I), Z(J), andX(K) as variables.
DER Subroutine The FORTRAN listing includes all
the coding needed in this subroutine for solving all three
sets of equations, simultaneously. The first four equations are coded from (1) and (3). The solution of (1)

shows an example of solving first-order differential
equations, and the solution of (3) shows an example
using second-order non-linear equations. The solution
of Eq. (2), which should be identical to the solution of
Eq. (l),is given to show how controller problems may be
solved by using TCNTRL. The input data name,
INFO, defines the number of terms in the numerator
and denominator and DR and CR define their value.

E (~u I V ALE NeE (V ( 1 ) ,D) , (Y ( 2) ,V) • (Y ~ ( 1 ) ,0 I) T) • (Y P ( ?) ,v 0 T)
1 • (' (2) ,Zf:. T A) • ( 1 (,3) ,XM) , (Z (4) • XK) , (z (C;) ,XC)

c - -

- - -- - - - - - - - - - - - - - EQUIVALENCE

t

(Z ( 1 ) ,w 0 )

(V(~)'ONl)'(Y(6),YNL).(YP(S)tUNLnT),(yp(6)'VNLOT)

- -

-- ----

VNLOT=-2.*wn*7ETA·VNL*A~S(VNl)-WO**2*(ONL-X(1»

DNLOT = VNL
Vf)l
-2 .... ZETA*V1C*V -wCo*2*(O- X(l»
Dr) T = V
.~
CALL TCNTRL (1.X(2),nUT)

=

Input Data. The input data consist of indices to define
options and the number of variables Y(I), "Z(J), and
X(K); of controller data; input variables; initial con'ditions "Of integration variables; frequencies (w) at

which frequency response data are to be calculated; and
the time response variables af starting (TS), stopping
(TSTOP), and interval (DT) times. Data cards are read
until 1 is encountered in Column 1 of a data card.

NV 6
NZ 5
N I .s
N e l l V 1 (1) 3
N YT (1) 1
2
3
4
N SK I P 2 00
NPAS5 25 155 2
rfREQ 1
IT IME 0
lCSS 1
leO 1
!YP 1
NfREQ 19
NYTPR 4
NYfPR 6
NfPLOl 6
NYF 1 2 3 4 5 6
CV[RR.5
INFO(!) 00001
ORCl.l) 1.
CRti.l) 1.414214
CRf2.'I) .035360678
X 16.1
16.1
lb.l
Y(4.1b.l
M AS S 1.
S P GC T 2.
DAMP r .2 82 8428
VEla.
0 I SP 1 5 •
W • 01 ." 04 • 06 3 • 1 • 15 • 25 • 4 • 63 1. 1.4 14.21 " 1. 5 2. 5 4. 6. j 10.

15. 25.

40. 63.

Fall Joint Computer Conference, 1968

366

Output Data The first set of printed data lists the indiceEI, defines the problem conditions, and the input

SAMPLE PROBLEM
TAF RUN NO.
1

Y(I), Z(J), and X(K). A typical printout of input data
follows.

A SPRING
CASE NC.
0

1

MASS ,ON

TTME

1.23A

01 01 0

ISS

IFREQ

2

ITe

leSS

IYP

1

0

0

0

0

0

1

1

"IV
6

NZ
5

NI

~c

NYFPR

NZFPR

NYTPR'

NZTPR

3

1

6

0

4

0

ITIME ISPNCH IFPNCH ITPNCH

t8KFQ

10"
0

0

NnATA NTPLOT

NPASS

0

25

0

IYI

II

3

0

0

(l

0

0

0

0

0

0

0

0

INFO

a

1

0

0

0

0

0

0

0

0

0

0

0

NYF

•

1

2

3

It

5

6

0

0

0

0

0

0

0

0

0

0

0

0

NZF

II

(\

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

NYT

•

1

2

3

It

0

0

0

0

0

0

0

0

0

0

0

0

0

0

A typical printout of variables after the steady-state solution is calculated follows.

STEADY STATE VARIABLES AFTEH

1 PASSES
THESE A~E DIFFERENTIAL EQUATION V-S
1 DISPL
.1~lE+02
? Vfl
O.
b

VNL

o.

1

0

T~ES~ AHE X~S. INPUT VA~IARLES
Xl
.161£+02
X2
.161£+02

THESE ARE-ALGEBRAIC E'UATION l~S
1 NTFRQ
.1 4 1E+Ol
2 ZfTA

3 TCNtNP

•

.100~+OO

8

X3

.161(.02

o•

.161E+O?
3 MAS5

TAF

367

Typical printouts of the transfer function solution and the time response solution are shown below.

TRANSFER FUNCTIONS OISPL
MAGNITUDE
(RAO./SEC.)
.100E·Ol
.100E-Ol
,400E';Ol
.100£+01
.100£+01
.630E-Ol
.100£+01
.100E-+00
.150E+00
.101E·Ol
.250E.00'
.103£+01
.108E+Ol
.400E+00
.124£+01
.630E·00
-.'192E+Ol
.100E+Ol
.500E·Ol
.141E+Ol
.406E+Ol
.150E.Ol
.464E+00
.250E.Ol
.142E+00
,400E+Ol
,630E+Ol
.530E-Ol
.100E.02
.204E-Ol
.897E-02
.150E·02
.321E-02
.250E+02
.400E+02
.125E-02
.504E-03
.630E.02

TIME
O.
.1000E+00
.2000£+00
.3000E·OO
.4000E·OO
.5000E·00
.6000E·00
.7000£+00
.8000E·OO
,9000E+OO
.1000E·Ol

DISPL
.1610E·02
• 1594t+02
.1541E+02
.1471E+02
.1.368E·02
.1241E+02
.1094E·02
.9284E+ol
.7495E+Ol
.5608E+01
.3663E·Ol

VEL
O•
-.3164E+Ol
-.6178£+01
-.8986E+ol
-.1154E+02
-.1379£+02
-.1571£+02
-.1727E+02
-.1844E·02
-.1922E+02
-.1960E·02

A complete set of, Bode plots to show t~e frequency
response of all three solutions is included III ~he foll~w­
ing computer plots. The time response of the IntegratlOn

IX(})

DECIBELS
.000
.007

.017

.043

.096
.270
.708

1.868
5.686

13.979
12.173
-6.666
-16.930

-25.S13
--33.807
-40.947
-49.869
-58.050
-65.948

TeNOlS
• 1610E·02
.1594E+02
.1547E.02
.1471£·02.1368E+02
.1241E·02
;1094£+02
.9284E·Ol
.7495E+Ol
.5608E·Ol
.3663£·01

PHASE
-.081
-.324
-,511
-.@14
-1.229
-2.090
~3.S19

-6.343
-15.793
-90.000
-120.509
-lTO.S54
-175.380
-177.293
-178.347
-178.910
-179.350
-179.594
-179.743

ONL

,1610E+02
.1594E+02
,1550E+02
.1483£+02
.1403£+02
.1315E+02
.1223E+02
.1131E+02
.1040E.02
.9513E+Ol
.8651E·Ol

VNL
O•
·.3115£·01
-.5685[.01
-.7465E+Ol
-.8519E+Ol
-.9039£+01
-'.9210E+Ol
.,.9169E·Ol
-.9001E+Ol
-.8759E+Ol
•• 8414E+Ol

variables has also been included to show the typical
plots available to users of the program.

Fall Joint Computer Conference, 1968

368

IUt
CASE

CASE

..

0

0

..

..

1/\
~
.- ~V

1\

V
~
z:

i

-

~~

~.. jJJjlLL

"D
10-'

FREQUEttCY

10-1

1\

-'.

~ I

'r--. 1\

f
II

t-r-

I

-,

~

j

-,.

-.
I

--

I>I-

I

..
ji!

10

100

0

'0 '

to '

CRROI'SEC)

IUt
CASE

CASE

0

.
.

1\
i\

~1I

~

V

~
I"

--

1

10·'

~

10·"

i
\ I

;

J_

I

0

FREQUetCY

(

_..

'/

ID

CRRO....SEC)

I

I!

Ii

I; :' :~:'!'

~~'-~
10

.,.

I-

1/

I!

z:

1'1\

If

l>-

1

-,.

.

-

1\

(

II

V

..

A
V\

1\

,r. . .

/ll

....

"

iA
1I

0

ID

IDD
•

-'.,. -,

10

I

10

0

\

,,--\

~

I-

r\
10

'

-Ie

I: \'
10

,

TAF

0

....

fa

1

..

..

.

.

-..

II

.,

z:

I

,. t

I
to'""

~

,\
T

-

~

I

"

I

I

.

i:!i!
'0

-

r

\

,

1
T

\

\
\
\
\

----rL-.'
- -.. -_.-

•

"\

"\

I
I

~-;:t

r---

.

~

f

f\..... I

\
\ I

·so

•

\

~

I

'0

\

.

~

'0 0

\
\
\

,. I

-

8

.

ca••

"

IU
CASE

369

..

.'"

_-- .__

:

..

...... -----

-

.

. . . . _--., .-.--

_

"._.-

,

__ 1 .

'0

ITIII'TIIC·sO.O

CASE

..,

...... ,...............,.

,

IU

ca ••

0
·s

fa

-\

.

I \

0

I

7

II

I
I

·sso

z:

8

10

1\
0

\~

0

to

II

-I

to-'

'0 0

--

........

.

\

r

m.
~

II
~

-~

l

,[ : ' \ \ ~
I L" 'i;

o

'0

•

I

r

~

r,

T \

\

\

\

I

I
J

\
\
\

I

T

\

\
\

\.

....j

~-f-r
-w-..~. -.:- f~-+

;,-- -. _.

I

I

~

__1 ... ~...J_L
[LA'KO TIlE (IECOIID$1

,

..

I

_--.i __ ... __J. __

'0

.

.

370

Fall Joint Computer Conference, 1968

..

,

r\
\
\
\.
\

• ,0

..,.,• .

_Ll'IIOILI. . . . . OIl . . . . . .

0

\

T
I
1

~

I
I

I

\
\
\
\
\

J

"\\

I
~

V

.III

7

\

\
\ .... I

I

'-,

\

r

I

I

1

_. I

r

-r-

...

II

\

-f----J
-..

- --- .-.

.

-

--- ..

.

.

'0

",.,.n
IT.. , Tue

lUI 011 • . . . .

\

\

-

"I'U: 'Il0l\.':'

\

=_·c.· j--"

---

I

I_CCIIIOIl

TIll[

[u.KO

0.0

IfUT fUt(

...

.
•

II

0.0

....LI.IIOIL1. . . . . 011 . . . . . .

ca • •

I ,~

I
II

0

,

'\

~

......

/

r

~

I
/

I

-

I

V
--Vc--

---.

I

-.-

-

~.
"aU TI"f • 0.0

1

---_.

!

I j .. 1---

-

j

I

-I---t-

-----+ ...

l
I . .4-.I __1i . _J_.

i

HAP_O

TIll(

i
-'-

IKCMSI

_.....1..--_-._"-.

.

-

--

TIll[

I_CMI'

The automated medical history
by WILLIAM WEKSEL
Cytek Information Systems Corporation
New York, New York

and
PAUL N. SHOLTZ
IBM Corporation
Rochester, Minnesota

and
JOHN G. MAYNE
Mayo Clinic
Rochester, Minnesota

INTRODUCTION
It has often been suggested that computer tech-

nology could help solve problems in medicine. The
Automated Medical History (AMH) system is designed to help the physician collect data from the
patient. The system's objective is to lessen physician involvement in routine activities, thereby
increasing his availability to provide patient care.
The AMH should help alleviate the chronic shortage of medical personnel even as it extends the
physician's capabilities to collect patient information.
Collecting data from patients involves many
related activities that can be roughly categorized
as history taking, physical examination, and laboratory tests. It is difficult to determine precisely
the relative importance of these activities. However, physicians generally believe that the patient's medical history has basic importance in
interpreting medical findings. For this reason, the
medical history is a logical starting point for developing techniques to aid the physician in his
data collection activities.
We propose that information technology be used
as an adjunct to the traditional physician-patient
relationship, specifically for collecting medical his-

tory data. The feasibility of using computer technology has been demonstrated and discussed in another paper. 1 This paper describes the AMH system and briefly reviews the system's data collection capabilities. It also discusses the possibility
of using the AMH to evaluate the medical data
collected.
The Automated Medical History (AMH)
The AMH is a medical questionnaire that is presented to a patient on a display terminal. An IBM
1050 Data Communication System is used to enter
patient identification information and to print the
summary of each patient's responses. This standardized, legible, condensed summary is sent to the
physician before the physician-patient interview.
The display terminal projects photographic images that are stored on 16 mm color film (Figure
1). This terminal is a prototype of the recently
announced IBM 2760 Optical Image Unit. Images
can be selected in any order by the computer. Patient responses are entered on the display terminal
with an electronic light pen. An array of response
areas is arranged in a 10 by 12 matrix, making
possible 120 unique responses on each frame.
Colors emphasize the three functional areas of
371

372

Fall Joint Computer Conference, 1968

Figure I-Experimental graphic display terminal

Are you taking any medicines
within the past month?

nl1N

each frame, which are the question, the response
alternatives, and the instructions (Figure 2).
Color photographs and pictorial techniques are
also used to supplement written explanations of
medical terminology. For example, if a patient
does not understand a question about "skin cancer" or some 'Other skin condition, a picture of the
condition can be shown (Figure 3). Pictorial
techniques also allow the patient more freedom of
expression. For example, this illustration permits
him to specify the location of abdominal pain
(Figure 4).
Computer-administered questioning permits the
effective use of question branching. This means
a questionnaire can he tailored to the individual
patient, so that factors such as sex, age, education,
and ability to understand· questions can be accounted for. Moreover, the patient answers only
those questions which pertain to his own medical
problems.
Question branching is based on responses given
by the patient. Specific uses of hranching in the
AMH will be considered later in this paper.
Computer administration permits control over

or have you taken any

DYes

ONo
This is an example of a skin cancer.
Do you understand?
DYes

D

D

-Go back

-- Go back

Figure 2-Frame

Figu~e

3-Skin condition

The Automated Medical History

373

lation of light pen coordinates, and the control of
branching operations. Also included were extensive text composition facilities, for use in construction of the summary statement.
The experimental graphic display terminal
seems ideally suited to this particular application.
It has been 'Operated successfully by completely untrained users (patients) who had very brief instructions. There are two reasons for the suitability of this terminal: first, very high quality colored
images are 'Obtained by photographic projection,
and second, a very simple and direct method of
response is made possible by the use of the light
pen.

T he questionnaire
The questionnaire consists of broad, inclusive,
screening questions organized according to c'Onventional body systems. These questions attempt
to detect the presence of actual or potential disease
states. The questions are all of the fixed choice
type. Response alternatives vary from a simple
"yes," "no" to multiple choice check lists describ-

Figure 4-Body

the patient while he is answering the questions.
That is, the patient must answer all questions because the system can be designed so that the questioning process will not proceed until an answer
is given. The computer can also monitor patient
performance by rec'Ording such things as undue
delays and excessive erasures.

AMH system description
The graphic display terminal and the IBM 1050
Data Communication System are controlled by an
IBM 7040 Data Processing System. To permit efficient use of the computer, the operating system
was m'Odified to permit concurrent operation of
terminal service programs· and background programs. Experience indicates only 1 % to 2 % of
available computer time is required for terminal
activities.
A special purpose language was developed to
permit c'Omputer control of the graphic display
terminal activity at each step of the questionnaire.
'This language was specifically designed to simplify
the display of particular film frames, the manipu-

Figure 5-Question types

374

Fall Joint Computer Conference, 1968

ing symptoms and conditions. The format usually
is dictated by the objectives of a specific question
(for example, see Figures 5, 6, 7). The number
of questions asked varies from patient to patient
because of question branching. It ranges from
226 to 302 questions for females, and from 212 to
283 for males.
Currently, there are four uses for branching in
the AMH:
1)
2)

3)

Which of the following bring you to see the doctor now?

To ask the patient questions that pertain
only to his specific problems.
To explain questions and medical terminology that the patient does not understand
F'Or example, if a patient does not understand a question about "yellow jaundice"
(Figure 8), he is shown this explanation
(Figure 9). If he indicates that he understands, he is shown the original question
again. If not, he goes on to further questions. The fact that he did not understand
the "yellow jaundice" questi'On is recorded
in the summary.
To give the patient greater latitude when

Figure 7-Question types

4)

Figure 6-Question types

describing his medical problem. For example, if a patient indicates he has abdominal discomfort (Figure 10) , question
branching provides· various descriptions of
such discomf'Ort (Figure 11). Although
many of these terms are redundant and
have no differential diagnostic value, the
patient can give his answer in words familiar and meaningful to him.
To evaluate the significance of a positive
response, using branching questions to distinguish between common occurrences and
significant medical symptoms. For example, if a patient complains of a headache, he is questioned on aspects of the
headache such as severity, frequency, duration, and his concern about it. These questions permit assessment of whether or not
the headache is a significant symptom that
requires medical follow-up 'Or whether it is
an' unimportant occurrence that requires
no further investigation. This is an important use' of question branching that

The Automated .Medical History

375

Have you ever had yellow jaundice?

o

-Go back

Figure 8-Yellow jaundice question

takes the AMH beyond the task of data
collection to that of data evaluati'On.
A condensed summary of the patient's responses
is provided for the physician. Negative responses
(unless pertinent to other positive responses) are
not provided in this summary. This summary is
a prototype of a standardized, legible medical rec~
ord (Figure 12) .
Evaluation of the AMH

One hundred fifty~nine Mayo Clinic patients
were randomly selected for AMH administration.
The highlights of this experiment were:
1)

2)

Patient reaction was extremely favorable.
Of the 159 patients sampled, 154 partici~
pated; only two reacted ulJ.favorably.
All patients were able to answer the questionnaire and operate the terminal. Mean
patient age was 50.1 years (95% confidence
limits were 48.5 < p. < 51.7) and mean education level was 11.8 years (95% :11.4 < p.
< 12~2). This suggests that a high educa-

Figure 9-Yellow jaundice explanation

tion level is not necessary for successful·
participation.
3) Physician reaction was favorable. The tone
and extent of the criticisms received indicate physician acceptance of the AMH in
its role as collector of medical histories.
4) Mean questionnaire completion time for
patients
, (95 % :62.2 < p. < 69.2) was 65.7
minutes.
5) The AMH obtained 95 % of the symptom
information recorded by the physician in
the traditional patient record. This study
compared patient symptoms obtained by
the AMH to those recorded by the examining physician in the patient's Mayo Clinic
Medical Record.
6) Comparisons between the traditional ,patient record and the AMH summary with
respect to "past surgery" and "past illness"
information .suggest that, given the total
set of patient responses, the AMH data collection performance was significantly better
than that 'Of th,e physician (Table I).

376

Fall Joint Computer Conference, 1968
Table I
Two-Way Comparison: AMH Data vs Physician-Recorded Data
Proportion of
physician-recorded
data also obtained
by AMH (%)

Item

Proportion of
AMH-obtained data
also physician-recorded
(%)

Past surgery*

86

62

Past illness *

59

39

Past family illness
and cause of death

57

62

*Difference statistically significant. P > P,05

These results indicate that reliable medical histvry gathering techniques can be developed to aid
the physician.

Use of the AMH for the evaluation of medical
symp'toms
We have already indicated that branching can
be used to evaluate the significance of positive

Figure II-Abdominal pain descriptions
Do you NOW (that is. within the past 3 months) have any type
of abdominal discomfort?

DYes

D

-Go back

Figure lO-Abdominal pain question

symptoms. Such an evaluation has two aspects.
Given a positive response to a question, should it
be followed up? If it is followed up, what is the
best way-more questions, laboratory tests, or
physical exam? We will consider the first aspect
of the problem.
We attempt to obtain additional information (on
a positive symptom) that will help us decide
whether or not the symptom is significant enough
at the system review level to require more questioning. For example, if a patient indicates that
he has headaches, we need information regarding
headache severity, frequency, and duration, as
well as the degree of the patient's concern about
his headaches. Some combination of these items
should form the basis for deciding whether or not
the patient's positive response to the headache
question requires follow-up.
We need to find which patient responses, singly
or in combination, are the most important determinants of whether or not a physician follows up
on his patient's complaint. This knowledge would
allow us to assign relative weights to various pa-

The Automated Medical History

Summa ry . S ta temen t
1·lal e
S.S.8: 000-00-0001
Educ: Ii igh schoo I

~Iarried

I"Ihi te
Brown Ha i r
Brown Eyes

U5/31/67
Born: 9/22/19
B i r thp I ace: Canada
R i gh t handed

Ivants general checkup.
Referred by r·m. Health concerns: stomach and
swallo",ing. Self evaluation: not in good health.
Previous
illnesses: ulcer, mumps.
SYSTEI'lI C REV I Ell
Defective vision correctable with glasses. I'fears glasses.
~: Freq. dYsphap;ia I.ith solids.
Dec. dysphagia with liquids.
Cilrdiov"sc : l~otes cold-induced acral blanching.
CilJ Appet i te decrease past 3 mos. Dyspeps i a I.i th many foods, greasy or
rich foods, spicy foods.
now troubled by abd. discomfort described'
as sour stomach, bloated feeling, cramps, nausea, boring pain, hear't
burn, belly pain, sore belly, acid indigestion, knife-like pain,
twisted knotted sensation.
Location: umbill-cal. Thinks he has
ulcer.
Complains of belching.
Dovlel movement less frequent past 6
mos;
In past yr. had occas. constipation. Has noted blood in bo",el
mover,lents.
In past year stool occ. characterized by excessively
putrid odor, smaller diameter. l-/i thin past 6 mos. bothered by
Q.Q.h.th...:

itch i ng and/or bu r n i ng rec tum.

r·:ore than 3 mos. ago had abd. discomfort described as sour stomach,
bloated feel ing, cramps, nausea, boring pain, sore belly, acfd
.
indigestion.
Location: umbilical.
Past I;D Dx: duodenal ulcer. Has had x-ray of stomach, gallbladder,
complete Gl tract.
~: Troubled vlith headache past 6 mos.; onset over 5 yrs. ago.
NOt
usually relieved by ASA or equiv. Has constant pain.
Had same type headache in pas t.
~: Occas. trouble sleeping in past few I.ks.
Skel -l·'usc : Troubled I.ith upper back pain past 6 mos.
Concerned re
backache.
Backache ove r 6 ",os. ago.
F~: Blood relatives have died of high blood pressure.
Has living
blood relatives Hith high blood pressure.
O~: tradesman.
~: Smokes ci garettes (less than a pack/day).
Has smoked more than 20
years, inhales, increased cigarette smoking in past year.
In' past
year was on ulcer diet(s).
Diet(s) follo",ed regularly; advised by
1·10.
In the past mont·h has taken unidentified medicine.
Pt. didn'.t understand questions about nasal polyps.
End of session.

Figure 12-Summary statement

tient responses when evaluating positive symptoms. This knowledge would also give us a statistical basis for determining the discriminative
power of each individual question. Using this
statistical basis, items with low discriminative
power could be discarded.
In our investigation, patients with positive responses to questions regarding the incidence of
"headache" were grouped. Then, on the basis of
the inf'Ormation extracted from the patient record,
this group of patients was subdivided into those
who had a follow-up exam on headaches (hereafter referred t'O as the f'Oll'Ow-up gr'Oup) and
th'Ose wh'O did n'Ot have a f'OIl'Ow-up exam 'On headaches (hereafter referred t'O as the non-f'Ollow-up
group). "F'OIl'Ow-ups," then, had further investigati'On by the physician regarding their headache
pr'Oblem. In some cases, this was in the form of
a head x-ray; in 'Other instances it was a c'Onsultati'On with a neurol'Ogist regarding the headache
pr'Oblem, or a final diagnosis was made which suggester that the headache pr'Oblem had been f'Ollowed up.
Tw'O statistical techniques were used t'O investigate the relative imp'Ortance of the items used t'O
evaluate the r'Outine headache reSP'Onse. The first

377

'Of these was the "likelih'O'Od ratio" which is represented by the relative frequency with which a
symptom 'Or set 'Of sympt'Oms occurred in the f'OlI'Ow-up gr'Oups (P8!) as c'Ompared t'O the relative
frequency with which the same sympt'Om or c'Ombinati'On 'Of symptoms occurred in the non-f'Ollowup gr'Oups (pan!)' That is, the rati'O was

The assumpti'Ons underlying the use 'Of 8 and its
use for item analysis has been dealt with by
Neyman 2 and C'Ollen s and will not be discussed
here. These auth'Ors indicate that the resulting 8
can be used as the basis for establishing sets 'Of
values f'Or which a diagn'Osis will be P'Ositive and
sets 'Of values f'Or~ which a diagnosis will be negative. We have S'Ought t'O examine 'Only the discriminative value of the items in the question branches.
Table II repeats these values f'Or the branch 'Of
questi'Ons used to evaluate a P'Ositive headache re~ponse. In this table, we sh'OW the relative frequencies 'Of occurrence of different categ'Ories f'Or
headache. d.urati'On, frequency, severity, incidence
of relief with simple medications, and the patient's
concern ab'Out his headache. Clearly, durati'OnTable II
Discriminative Value of Features Which Describe Headaches (n = 77)

Feature

ps
f

2
x < chi sq. n.

Duration

ps
9=_f_
s
P
nf

a= 0.05
statistical
Significance

ps
nf

S.

< 1 year

0.33

0.41

0.81

Between 1-5 yr

0.30

0.20

1.5

More than 5 yr

0.36

0.39

0.92

x

Frequency

2

> chi sq.

Increasing

0.52

0.25

2.1

Same

0.39

0.34

1.1

Decreasing

0.09

0.41

0.2
2

x > chi sq.

Perceived Severitt
Increasing

0.36

0.20

1.8

Same

0.61

0.43

1.4

Decreasing

0.03

0.36

0.08
2

x > chi sq.

Relief with siml!le
medicine
Yes

0.39

0.71

0.55

No

0.61

0.29

2.1

Patient concern

x

2

> chi sq.

Yes

0.70

0.25

2.8

No

0.30

0.75

0.4

378

Fall Joint Computer Conference, 1968

that is, whether a headache has laster less than a
year, between 1 and 5 years, or more than 5 years
-seems to have no bearing on whether or not the
physician follows up on a patient. There is no
significant difference between the groups in this
case. Whether or not the groups are significantly
different is the basis for deciding whether or not
the O's ar'e of any value.
The other categories in the headache branch are
more important, as significant differences were
found between the patient groups. Notice that the
ratio of the q'S to one another is high from the
positive to the negative response. Someone who
has anyone (or all) of the following: headaches
that are increasing in· frequency, headaches that
are increasing in severity, 'Or concern for his headaches without being able ta obtain relief with
simple medications, is likely to receive a follow-up
examination.
How do these features relate ta follow-up when
they are combined? And, in combination, which
of these items is the most important? To determine this, a multiple correlatian analysis was done
in which the criterian variable was membership
in the follow-up group and the predictors were the
items listed in Table II. The results of this analysis are listed in Table III. The multiple correlation is .54, which is statistically significant. The
third column 'Of this table, which lists the regression coefficients, shows the relative importance of
each of the independent variables in influencing
the criterian or dependent variable. We can see
that the most important variable is the patient's
concern, which has the largest regressian coefficient. Note that this variable had the largest ratio
between O's, as seen in Table II.

Using this information, it is pas sible ta assign
relative weights to respanses of future patients.
The cambination 'Of these r,elative weights would
be the decisian pracedure used to determine
whether or nat physician follow-up is required.
A similar analysis was perfarmed with respect to
"neck pain." In this analysis, 'Only twa items were
in the branch: assaciation of the pain with nervousness, and past 'Occurrences 'Of neck pain. The
theary was that neck pain cansistently assaciated
with nervausness was not significant. Similarly,
if the patient had previous neck· pain, it was not
as impartant as if the neck pain was a new phenamenon. Table IV bears this out. Patients with
neck pain not cansistently assaciated with nervousness were faund in the follow-up graup more
often than in the nan-fallow-up group. The item
regarding past 'Occurrences was less impartant.
Table IV

.

Discriminative Value of Features Which Describe Neck Pain (n = 56)
a= 0.05

pS

Feature

f

pS

nf

Statistical
Significance

x

Association with
nervousness

2

pS
9=_f_

P

> chi sq.

Occurs when nervous
and at other times

0.70

0.22

3.1

Can't really say when
it occurs

0.25

0.44

0.5

Occurs mainly when
nervous or upset

0.05

0.33

0.1

x

Pastoccu~

Trouble with neck
pain in past
No trouble with neck
pain in past

2

s
nf

> chi sq.

0.45

0.28

1.6

0.55

0.72

0.7

I

Table III
Prediction of Membership in Headache "Follow-Up" Group (criterion
variable) Using Features Which Describe Headaches as Predictors.
Predictor
Variables

Zero Order
Correlation
(with criterion)

Regression
Coefficients

0.03

0.06

Frequency

-0.36

-0.07

Perceived severity

-0.34

-0.06

Duration

Relief w/simple medicine
Patient concern

Multiple R = 0.54
F value = 4. 77, F > F. 05

0.31

0.18

-0.44

-0.30

These findings are consistent with the mUltiple
carrelation analysis presented in Table V. The
assaciatian of neck pain with nervousness seems
to be the mast impartant variable.
It should be noted in bath the headache and neck
pain cases that al~hough the multiple correlatians
are significant, they are law enough in magnitude
ta indicate that there are many other reasons
which relate to being assigned to the follow-up
group. Same of these reasons may be neuralogical
complaints given in' respanse ta other questians.

The Automated Medical History
Table V
. Prediction of Membership in Neck Pain "Follow-Up Group" (criterion
variable) Using Features Which Describe Neck Pain as Predictors.
Zero
Correlation
(with criterion)

Predictor
Variables

Regression
Coefficfents

Association w/nervousness

-0.47

-0.28

Past occurrences

-0.17

-0.15

Multiple R
F value

= . 50

= 8.6,

F >F.05

To establish these relationships with other questions is a much larger p~oblem than the one we
.have considered in this paper. At present, however, it seems apparent that the techniques we
have discussed will enable us to find criteria for
deciding whether or not particular positive instances require further investigation or whether
they can be considered unimportant occurrences.
SUMMARY
The Automated Medical History is a system to
collect medical history information from patients

379

by using a computer-controlled display terminal.
Computer administration permits effective use of
branching techniques, thus making possible an individualized questionnaire for each patient. Patient responses are condensed into a concise summary statement for the examining physician.
The system was tested with 159 patients. Patients and physician·s reacted favorably to the system. The AMH obtained approximately 95 % of
the information recorded by the physician in the
patient's medical record.
The possibility of using the AMH to evaluate
the significance of the data collected was also explored.
REFERENCES
1 J G MAYNE W WEKSEL P N SHOLTZ
Toward automating the medical history*
Mayo Clinic Proceedings 43:1-25 January 1968
2 JNEYMAN
First course in probability and statistics
Henry Holt New York 1950 Chapter V
3 MFCOLLEN
Machine diagnosis from a multiphasic screening program
Proceedings of the Fifth IBM Medical Symposium October
7-11 1963 Endicott NY

*Additional references (12) are cited in this paper.

The key to a nationwide capability for computer
analysis of medical signals:
The dedicated medical signal processor*
by CESAR A. CACERES, GABRIEL KUSHNER ,**

DAVID E. WINER and ANNA LEA WEIHRER
U.S. Department, of Health, Education and Welfare
. Washington, D.C.

INTRODUCTION
The Medical Systems Development Laboratory
has demonstrated a system of computer analysis
that encourages wider use of medical signals,
reduces unit costs, and alleviates the shortage of
physician manpower while c'Oncurrently improving the quality of interpretations. It is' adaptable
to hospital wards, outpatient departments, routine
physical examinations, and health screening programs. Its development anticipates the worsening shortage of professionals able to analyze
medical data.
A . large number 'Of those concerned with the
practice of medicine recognize that automated
analysis is the only feasible answer. At the same
time, most medical-service groups are reluctant
to install systems in their own institutions because existing computer hardware has not been
adapted to meet their needs. Existing systems are
expensive, bulky, and because of the flexibility
for which they were designed require scarce computer technicians to 'Operate and maintain. The'
need of most potential medical users is for quite
the opposite: a small computer system that requires minimal maintenance and that can be operated by the personnel usually available to medical
groups.
The aim of this paper, after a brief review of
the background, is to describe a model for a com*From the Medical Systems Development Laboratory
(MSDL) Heart Services Research and Development, National
Center for U.S. Department of Health, Education, and Welfare,
Washington. D.C.
**Also Associate Professor of Medicine, George Washington
University, Washington, D.C.

381

pact computer system designed for the needs of
medical-service groups. The model is based on
an existing "breadboard" system.
Background of need

The electrocardiogram was chosen as the m'Odel
signal for automated pattern recognition and interpretation by computer because physicians are
familiar with it and have 50 years of experience
in relating its waveforms to specific meanings.
But almost any other physiological signal-brain
waves, vital capacity, heart s'Ounds, and otherscould have been selected. In fact, we have since
demonstrated that each of these signals is subject to automated measurement and interpretation. The computer measurements are accurate,
and clinicians can accept the interpretations as
readily as they accept those of other clinicians.
Approximately 50 million electrocardiograms
are interpreted annually in the United States by
medical personnel. It is probable that changes in
population age-groups and the impact of health
legislation will double the volume of electrocardiograms long before it is p'Ossible to train the rerequired specialists. Conventi'Onal techniques of
electrocardiography would make the cost of the
projected increase prohibitive for disease control
and prevention purposes in terms of physiciantechnician man-years.
From a manpower viewpoint the most important factor is total reading time, including measurement and interpretation time by interns, residents, technicians, and finally that of the physician who signs the electrocardiogram report.
Although some tracings can be read by cardi-

382

Fall Joint Computer Conference, 1968

ographers in a few minutes, tot"al reading timefor problem as well as routine cardiogramsaverages close to 15 minutes. Thus the reading
of 50 million electrocardiograms, in terms of a
2,OOO-hour man-year, takes up an estimated 6,250
ECG reader man-years. In conventional systems,
reading time accounts for 75 % of the cost. Use
of a computer system can reduce reading time
5- to- 7 fold and facilitates the reduction of secretarial (bookkeeping, filing) ,and technician (recording) time.
The current computer system prints out all the
significant measurements with a verbal diagnostic
statement based on the criteria of a consensus of
cardiologists. Electrocardiograms and spirograms
are now being taken from patients in hospitals
and clinics evaluating benefits of immediate online analysis by a computer system.
More than 300 groups on their own initiative
have asked the Medical Systems Development
Laboratory to make available to them the use of
the computer program currently available f'Or
electrocardiogram analysis. Consultation has been
given, but serious hardware limitations have restricted utilization within the medical setting.
Duplication of laboratory type facilities such as
our existing "breadboard" system is not generally
practical in medical care units. Nevertheless, one
group with a large staff (the Missouri Regional
Medical Program), for lack of any other "off the
shelf" alternative, has replicated the basic essentials of the breadboard processing configuration
used at the Medical Systems Development Laboratory.
Alternative routes
It is possible to construct, from products now
on the market, large regional centralized multipurpose, multi-signal computer facilities. However, these would be impractical for routine clinical medical-signal analysis at this time because
of their defects: staffing difficulties, the continuing high expense 'Of non-local analog telemetry,
high acquisition and maintenance costs, the absence of a workable time-sharing system for medical-care purposes, and the changing character of
medical systems due to computer use itself. Although the technological problems can be solved,
largely because of the last reason it may not be
economic to expend great effort for an overall
solution until 10 years hence.
This does not mean that we oppose large, re-

gionally centralized computer centers n'ow. On
the contrary they are to be encouraged, but as
central storage and retrieval centers serving networks of small, dedicated computer systems.
Translation of patient-care computer programs
to the assembly, compiler, or machine languages
'Of small computers for service-oriented hospitals
of average size is thus a pressing vital step.
This concept implies a need for development
of small single-purpose computers for processing
medical signals. Our experience with prototype
systems adapted for general-purpose computers
has proved that a specially designed dedicated
computer can best meet the anticipated needs 'Of
regional medical programs, mUltiphasic screening programs, medium-to-Iarge hospitals, and
local health departments.1.
Our experience with commercial groups suggests that the systems dedicated to medical-data
processing can be commercially available in 2
years. A prototype, the Control Data C'Orporation
"MESA" system, was developed from our specifications within a 6-m'Onth period about 1965
a nd served to clarify our concepts of the systems
required for the '70s. The proposed systems
should be of office-desk size, completely modular
self-contained units.
A system with a processing capacity of 60,000
or more medical signals annually could be marketed by industry for a cost under $100,000 (or
rented for about $36,000 per year). With support for the development of prototypes, a network of such computers could be established
within 5 years to make routine computer analysis
of electrocardi'Ograms, spirograms, or other medical signals available anywhere in the United
States. These could aid in increasing the quality
of medical care and in controlling the rising cost
of medical tests.
These single-purpose medical computers would
facilitate the creation of storage and retrie~al
centers at strategic locations for much-needed
medical data pools. This storage and retrieval is
of course of secondary importance to immediate
display for action. With data extracted by the
dedicated clinical terminal from the human source
and analyzed with defined accuracy, the analysis
can be displayed, prepared f'Or insertion in the
patient's record, and put to immediate use. This
is the basic reason for considering storage and
retrieval centers as secondary in any serviceoriented medical computer project.

The Dedicated Medical Signal Processor
Preliminary estimates of the basic cost of an
electrocardiogram with a dedicated system, assuming a 10-year equipment amortization and
60,000 patients a year, show a unit processing
cost of a few cents contrasted to dollars today.
With mass volume, costs of the equipment are
small when contrasted with costs of manpower
training and utilizati'On.
The breadboard 8Y8tem

At the Medical Systems Development Laboratory we have, as part of our work in automation
of medical signals analysis, experimented with
several different preprocessing and processing
systems. We have kept in mind that in medicine,
users or even combinations of users often do not
generate sufficient quantities of data to warrant
processing on large, fast computer systems. Costs
for processing equipment are low as long as the
system is kept busy, but are apt to be exorbitant
if input rates are slower than throughput capabilities. Therefore we have chosen to work initially with dedicated, single-input systems.
Because computer personnel are not readily
available at most hospitals or clinics, the system
should not require skills beyond those of hospital technicians and nurses. Our experience indicates that processing can become medically reliable in nearly any properly equipped computer
room, but even there only if the system is exceedingly simple to operate. Accordingly, our
system specifications require no more of the technician than to load and start an analog tape playback and then check that a monitor light goes on.
Before we could begin to specify requirements
for routine service equipment, it was necessary
to determine many system requirements, for example, the sampling rate, the filter settings, etc.
An experimental processing system was constructed having variable settings for nearly every
component. After the first approximations were
determined and necessary corrections made, there
still remained the tasks 'Of statistical validation,
reliability and maintainability studies, human factors engineering, and analysis of operational
problems encountered. To complicate matters,
the original signal (the ECG) became only one of
many undergoing automation at our lab. The
system grew and changed, .all the while becoming
m'Ore versatile, but also more complex and difficult to operate and maintain. We recognized that
this system would allow almost limitless varia-

383

tions in experimental and research teclmiques but
was not applicable to clinical processing.
In routine operation the most difficult problem
was with trouble shooting and maintenance. Basically the engineering solution hinges on the use
of replaceable modules which can easily be exchanged in the event of fail1;lre. No wiring or
special effort to connect the modules should be
required. Repairs of components should be made
at remote sites with well-equipped maintenance
facilities while the user enjoys uninterrupted
service. Basically the hospital or clinic shoul<;l
be unconcerned about maintenance except for
acceptance of a preventive maintenance c'Ontract.
The system must be no more complex to operate
than a home television set. It should be operable
with the same amount of instruction, since hospital personnel do n'Ot have the specialized skills
of electronic technicians or computer operators.
The signal from the data acquisition devices is
given to the first section of the system (the input
unit), which contains an analog tape playback
deck and monitor indicator. The tape deck uses
lA-inch-wide tape on .7-inch reels and operates at
3 3A inches per second. After set-up, start/
stop is initiated by computer control. The monitor indicator automatically glows if the tape being
played was not recorded on a pr'Operly aligned
data acquisition system. If the recorder head was
not aligned to specifications, a 6750-Hertz flutter
compensation signal used in our data acquisition
systems will not be. played back with sufficient
amplitude. If the head is unaligned, the tape deck
should stop automatically. Filter bandwidth f'Or
processing clinically used medical signals is DC to
45 Hz. 'The 3-db point should be at 45Hz. Rolloff
above 45 Hz should be 24 db/octave.
To enable heart sound processing, a bandwidth
of 40 to 1000 Hz (± 1 db) is usually suggested.
A filter with the 3 db points at 20 and 2000 Hz
with rolloff of 6 db/octave is recommended .. Parenthetically we can state that the envelope resulting from the rectified signals may be adequate for analysis and brings all medical signals
to the same range.
Amplifiers should be provided to compensate
for losses incurred during transit of the signals
through the filter networks and other media such
as telephone lines, and to condition the signal
. strength and circuit impedance to the optimum
values required by the analog-to-digital converter.
One, a high input impedance amplifier (minimum

384

Fall Joint Computer Conference, 1968

10 rpegaohms), can be provided at the input to
the filter networks. The second can be a signal
level compensating amplifier at the output of the
filter network. A calibrated gain control should
be available with the compensating amplifier to
enable adjustment of signal voltages to proper
levels.
The experience gained from our experiments
suggests commercial incorporation of some of the
above listed functions either as the terminal end
of· a digital data-acquisition device (instead
'Of an analog one) or the initial part of the dedicated computer as described here. The tape
playback demodulator, amplifiers, filters, and/or
telephone jacks are also in the input unit. An
automatic answering feature can enable acceptance and rec'Ording of the telephone data without
operator intervention. Automated control circuits
must be provided to coordinate the various
functions.
The second section is the medical-signal processor. Its stored programs should have the capability of modification by a procedure not normally
available to the usual medical user. The system
must utilize a minimum of external switches and
human decisions. The hardware in this section
consists of an analog-to-digital conversion unit, a
central processing unit, data and program storage unit, printer, and the control panel. Our oscillator drives the· analog-to-digital converter at a
fixed sampling rate of 500 cycles per second per
channel used. This sampling rate is adequate. f'Or
most medical signals. An unsigned 10-bit output
is adequate for accuracy purposes over the range
of ± 2.5 volts. A c'Ontrol circuit causes the analogto-digital converter to· send a·10-bit word through
the computer input register upon computer request. Initial input requests .start and computer
commands stop the analog tape deck.
The sub-modules must be packaged in a single
housing that need occupy a space of not more than
20 square feet. The cabinet should resemble a
desk and have a top usable as such .. Weight of
the unit, excluding the optional attachments,
sh'Ould not exceed 1,000 pounds, to be suitable
for n'Ormal hospital and clinical building floor
load.
.The minimal functions that need be included
are: input/output, arithmetic operations, peripheral control, logical and/or, shift, c'Onditional

and unc'Onditional transfers, and interrupts or
timing devices.
A typewriter or other low-cost printing device,
capable of a printout speed of at least 720 characters per minute, is all that is necessary for conventional work. The unit should operate under
program control, with buffering a desirable
feature.
An incremental plotter also under computer
control could be utilized to produce a graphic
output.
A capability should be provided for attachment
of a telephone for transmission of digital data
(Le., the medical results obtained by the processor) to central storage and retrieval computers.
The internal memory can contain as little as
a 16,000 1S-bit word memory core. This would
suffice for the operational program.
Provision for program entry or modification
must be preplanned. Dedicated analysis systems
must therefore be· compatible with an existing
commercially and readily available computer, to
enable manufacturers to make program modifications to incorp'Orate medical advances.
A random access storage unit can replace part
of the core memory specified. Economy for the
individual manufacturer should dictate the storage medium. The storage capacity will be dependent on the peripheral equipment and the computer's instructi'On repertoire. Approximately
16,000 1S-bit word or 32,000 12-bit word capacity or equivalent would be· ample.
The system should incorporate executive programs to control program selection and the flow of
inf'Ormation between input and ouput devices,
patient code recognition, and data formatting.
Checkout programs for the on-line equipment and
the data acquisition system should also be part
of the software.
Utility programs to facilitate fault detection,
modification of programs, and the addition of new
programs are needed only by the manufacturer's
checkout or maintenance crew.
The MSDL electrocardiogram program for the
160A consists of two parts. The first (pattern
recognition) is approximately 6,000 lines in the
OSAS assembly language. The second (diagnostic) is· 8,000 assembly statements. The MSD·L
spirogram program consists of approximately
5,000 assembly statements. The generality and
numerous logic paths incorporated, in these pro-

The Dedicated Medical Signal Processor
grams indicate why translation and validation are
time consuming.
SUMMARY AND CONCLUSIONS
Several factors should be considered to evaluate
the system's 'adequacy f'Or medical operations.
The medical signal pr'Ocessor must permit easy
installation and keep maintenance requirements
to a minimum. The unit must be capable of
being maintained by replacement of easily removed components and modules. Reliability of
operation must be considered to be of prime importance in the design and manufacture of any
medical signal process'Or. Commercial sales cannot be expected to be great without due emphasis
on this aspect. The validation must demonstrate
the ability of the system to handle approximately
60,000 medical signals over a l-year period when
operated on a c'Ontinuous basis (exclusive of preventive maintenance time).
Large-scale screening or research proj ects both
require utilization of more than one signal. In

385

lieu of "simultaneous" processing with one device or a serial system, small dedicated systems
used in parallel can achieve the high throughput
rates required to keep up with voluminous data.
Currently we believe these will offer the most
economic courses to follow to solve existing volume problems. A central storage and retrieval
system can then collate the data.
The medical community can be provided with a
standardized processing system for medical signals to meet volume requirements of J:1ealth care
needs. .Diagn'Ostic printouts can be made in the
standard format and terminology familiar to
every physician. This alone will provide invaluable quality contr'Ol 'Of medical service delivery.
Combinations 'Of small machines can be effective
in producing the required volume and quality on
a sound economic basis.
REFERENCES
1 MVMATHEWS
Choosing a scientific computer for service

Science 161:23 1968

A legal structure for a
national medical data center*
byROYN.FREED
H arbridge House, Inc.
Boston, Massachusetts

INTRODUCTION

The national medical data center

Increasingly, medical professionals are concluding
that a computerized national center to contain medical
records of all persons has significant medical advantages. Moreover, such a project seems to be becoming
technically feasible. However, uncertainty about the
adequacy of physical and legal protections of the privacy of the stored data (and the related compatibility
of the system with the Fifth Amendment bar to involuntary self-incrimination) appears to be the major
stumbling block at this time. Study of that aspect reveals that it is possible to achieve a level of privacy and
an observance of Constitutional requirements that are
entirely satisfactory on an absolute basis and especially
in light of both the great social benefits in store and the
degree of protection customary for the particular information involved. This article provides a blueprint of
the types of legal inhibitions that should be sufficient
for the purpose in view of technical measures available.
To facilitate evaluation of the proposals being made,
a fairly broad description of the operation of a national
medical data center is set forth. Next, the types of
potential jeopardies to privacy and Constitutional protections are indicated. Then, suggested technical protective measures are detailed. Finally, recommended
legal steps and associated compliance audits are treated.
It is hoped that this discussion will stimulate an exchange of views on the important factor of privacy of
the proposed recorded data so that a consensus can be
reached fairly promptly on an acceptable approach.
The potential medical benefits of the suggested central·
file are so great, both for the persons whose records
would be available through the system and for society as
a whole, that the project should be initiated at the
earliest possible moment.
*The opinions expressed in this paper are entirely those of the
author and are not to be attributed to Harbridge House, Inc.

Many responsible and respected professionals coneerned with health care believe strongly that a national
center should be established to contain the medical records of as many persons in this country as possible.
This section describes the type of system presently envisioned in sufficient detail to provide a basis for the
legal proposals made later. Of course, if a system is set
up, its actual features well might differ from the following description of the writer's concept in many respects.
Medical records would be kept in a very large central
file for all persons who decide voluntarily, either personally or through their legal representatives (in the
case of minors or incompetents), to take advantage of
the opportunity. Such a decision would be manifested
by signing a request form after at least reading a statement of the medical benefits and privacy risks involved
in participation.1 Participants** would be free to discontinue adding to their records at any time, simply
by directing their doctors not to submit information.
(The fact of discontinuance should be noted in the record.) They also could ask, at any time, for the purging
of their part of the file. Since the patient's medical recordhas been considered to be the property of the doctor keeping it (subject to use for the benefit of the patient), the removed material probably would be sent to
a healing arts practitioner designated by the withdrawing participant rather than to the participant himself.
Based upon voluntary participation, largely for their
own benefit, of persons whose own records would be
stored, the medical data center is different, in that respect, from practically aU other proposed data centers.2
However, the fact should have no significance in determining the extent to which privacy and Constitutional
protections should be provided. It should not be neces**800 end of paper for footnotes numbered 1-11.

387

. 388

Fall Joint Computer.Conference, 1968

sary to sacrifice those protections in order to enjoy better medical care.
Incidentally, patient consent might not be legally essential for practitioners to file medical information with
the center. Practitioners may do so, in their own discretion (which essentially could represent a decision to
use the center as their own file), subject only to their
general legal obligation to protect the privacy of their
patients. Lawyers, who have similar professional duties
to persons they serve, may disclose client identity to outside data processors. 3 The practitioners' obligation requires that they avoid disclosing medical information
associated with the patient's identity to others without
legal authorization. Such authorization covers disclosures of various types of identified sensitive information
to the patient's family or prospective spouse (mental
illness or venereal disease), government agencies (contagious diseases), and the police (apparent foul play).
Practitioners who breach that obligation are subject to
lawsuits for the penalty of money damages, which might
not be provable. Despite the likelihood that they might
be free to act on their own decision, most practitioners
undoubtedly would prefer the validation of express patient consent.
It would have to be decided whether participants
may pick and choose information to be included in their
records while they are participating. There is much
merit in deciding that only a practitioner may make the
determination of what will be entered, especially if the
data are to be used also by researchers and the Food
and Drug Administration. This would tend to protect
the reliability of the information. Moreover, that approach is similar to current practice with respect-to
records kept by doctors themselves.
Since this article is intended to treat only the privacy
aspects of the system, rather than its technical or economic feasibility, no consideration will be given here to
those two important facets. They undoubtedly will be
discussed in detail elsewhere, after it has been shown
how adequate privacy can be achieved. Actually, technical measures necessary for protection of privacy must
be selected before accurate costs can be calculated.
The data would be stored in the center's records in
binary code in a large computer system so that they can
be located rapidly and accurately and transmitted directly to inquiring practitioners and can be supplemented easily as further data become available. Information would be sent in in binary code in some convenient manner and would be secured from the file by
means of display-printer terminals (like TV screens)
readily accessible to practitioners over the country.
Very likely, data communication techniques would be
used in both directions.
Each participant would be identified by his Social

Security number probably supplemented by the first
four letters of his last name.4 Similarly, all practitioners
in the country who would want to inquire about or add
to the stored data would register themselves by filing
their own Social Security numbers and information on
their licenses to practice a healing art. 6 The licensing
authorities so identified would be notified of such registrations and would be requested to inform the center
when the registrants cease to be practitioners as a result
of death, disqualification, or other circumstances.
Likewise, vital statistics bureaus would be requested to
report deaths to the center for entry in participants'
records and for correction of the list of practitioners.
Because, as indicated below, practitioners might have
.to be issued replacement identification means from time
to time, their codes might include their Social Security
numbers plus supplementary numbers or symbols that
might be varied occasionally.
Medic9l information entered in the system would be
alphanumeric only (although it might produce graphical and tabular data as well as narrative statements).
The precise formal nature of entries would be determined by a study of the feasibility of using standard abstracts, formats, and nomenclatures. 6 The information
undoubtedly would include vital statistics, physical
conditions with medical significance, diseases, treatments, allergies, immunizations, doctors' and hospitals'
names, and like details. It probably also would have
descriptions and locations of important physical items
containing information, such as X-ray films and tissue
slides.
The stored data would make it possible to provide
full medical histories to the participants' practitioners
at all times, regardless of how much the particular person has moved or of the fact that he is being seen, in an
emergency, by a practitioner unacquainted with him.
(It would be advisable for persons participating in the
system to carry their identification numbers or wafers
at all times.) Under the system, it would be unnecessary for practitioners to keep records on their patients
except for data in addition to that f:;tored in the system.
Hospitals also might be able to reduce the size of their
files in the same manner, at least between confinements.
The ready availability of the data should make it possible to provide improved medical care in many cases
based on more information. It also might furnish the
means for learning of experiences with specific medications, for locating persons who have received treatments
subsequently discovered to be harmfuI,1 and for performing similar functions.
Direct access, through the terminals, to the stored
data of specific, identified participants would be permitted only to practitioners currently licensed, subject
to the legal safeguards suggested below. To identify

Legal Structure for National Medical Data Center
themselves, practitioners would use embossed plastic
wafers (like credit cards) or similar devices that can be
read by machine. If additional precautions to control
access are desired, it might be arranged for each participant to have an identification wafer that would have to
be inserted into the terminals, along with the practitioner's wafer, to release his information. However,
that measure might prove to be too ~umbersome to be
useful and might not be essential.
I t would have to be decided whether participants
would be permitted to receive print-outs of their data
routinely, directly by mail, upon written request,
rather than through their practitioners. It might be
determined that, for medical reasons, at least some
types of particularly sensitive medical information, if
not the entire record, would not be released directly to
participants. It appears to be current practice for medical file information to be made available to patients
through practitioners (except for hospital records subject to inspection under statutory or other legal authority).
As indicated, it must be recognized that the center
file· would represent a medical information resource
much too valuable to, be reserved solely for clinical
practitioners. It would be a veritable gold mine for researchers, the Food and Drug Administration, the Public
Health Service, and others, since it could disclose data,
probably unavailable elsewhere either at all or to a similar extent, on experience with particular treatments, on
incidence of medical difficulties,8 and on other very
pertinent matters. To protect privacy, such data could
be made available directly by the center only to qualified reseachers and Government regulatory officers and
then without an indication of the participants' names.
The computer can omit those names very easily. If
some identification is required for follow-up, special
code numbers, whose deciphering can be-controlled by
the center, could be used.
To satisfy Constitutional inhibitions against compulsory self-incrimination, direct access to the identified
stored data furnished by participants would be denied
specifically to all government agencies. In this manner,
those agencies would be prevented from using the data
in criminal proceedings against a participant without
his voluntary action.
So much for the general nature of the system. It now
is in order to identify and -evaluate the types of jeopardies to privacy and Constitutional protections of the
stored data that seem to be involved.
Jeopardies to privacy and constitutional protections

Privacy and Constitutional protection of data stored
by the center ostensibly could be in jeopardy in a number of different ways. Probably the major concern

389

would be over possible intentional, direct access to personal data by government personnel or by many types
of persons in the private sector, such as employers, credit agencies, insurance companies, and private investigators. Also important is the hazard of accidental disclosure of information to unauthorized persons. Finally,
there is the danger of unauthorized access through the
tapping of co:mmunications lines. It is helpful to assess
the likelihood of those types of intrusions and to compare the potential jeopardies they represent with the
present degree of privacy of the same kinds of medical
data.
Since neither the kinds of data to be stored nor the
jeopardies are novel, it is interesting to note why a
unique problem seems to arise from the establishment of
the proposed data center. To many, the sheer assembling
of the information in one place converts a matter of degree into a matter of real difference. Solely by maintaining the current fragmentation of medical files, it appears as if the information is less readily reachable by
persons not entitled to it. This probably is true if there
is a real danger that the central file will be used improperly to locate specific persons for wrongful purposes by
categories of information (such as type of disease, income, or location of residence).
Actually, the present repositories" which are doctors'
offices and hospital record rooms, are no more physically
secure than the proposed data center and they even
might be less so in many specific situations. Furthermore, they are vulnerable not only to physical intrusions and ruses but also to use of gover'nment influence,
especially of police agencies. It is important to determine if there is any actual difference and hence any
greater danger to privacy and other legal rights from
operation of a national center.
Properly, the vulnerabilities of privacy through present and proposed recordkeeping systems cannot be
compared in general. The comparison can be made only
in terms of specific recorded information sought to be
protected. Information so assessed has two aspects pertinent to this inquiry, its variety {or comprehensiveness) and its location.
In many situations, only one particular medical item
would be sought by an unauthorized person, and it
would be in only a single file. That file might be more or
less secure than the proposed central repository, depending upon the circumstances. It well could be much
less secure in view of traditional handling of files by doctors and hospitals. If the person seeking the information knows where the file is located, then it might be
more vulnerable than a central file. However, if he does
not know, then it is uncertain whether locating and securing the individual file is more difficult than pene-

390

Fall Joint Computer Conference, 1968

trating the central record. That generally is one type of
circumstance.
On the other hand, where the improperly desired data
are stored among fragmented files of the present type,
then the relative difficulties of entering many files and
the proposed central file should be weighed. If it is difficult to identify which small files contain the data, then
use of a central file at least indicates most readily the
one that must be attacked.
The other risks indicated inelude inadvertent disclosure (unassociated with ruses) and tapping of communications lines. These risks probably are minimal in present methods of medical recordkeeping because information is transmitted by wire relatively infrequently
and entirely sporadically and randomly and inquiries
usually are made directly to people. When computers
are used eventually, apart from the national center, to
keep medical records for hospitals and quite likely for
doctors in private practice as well, the danger of inadvertent disclosure will become greater unless, as is to be
expected, special precautIOns are taken.9 Then, wire
communication would be used much more than presently. In view of these likely developments, the dangers
of a central file should be compared more properly with
those of non-centralized computerized medicai recordkeeping, rather than with present methods. And even in
the ultimate situation, it is difficult to envision that wire
tapping for selective information would be practical in
view of the vast volume of communciation that would
be involved. Furthermore, in many situations tapping
of data communications will be substantially more difficult than of voice messages.
The existence of legal inhibitions and of means for
auditing compliance with them also is pertinent to a
comparison of present and potential privacy jeopardies
to medical records. Presently, legal bars to improper
disclosure exist almost exclusively in the common law
rulings of the courts, and penalties, which are civil
rather than criminal, are uncertain because of the difficulties of valuing the damages suffered in terms of dollars. Also, few, if any, means are provided now for undertaking to detect privacy breaches. Hence, proposed
legal measures well might be much more effective in
discouraging intrusions and in setting up ways to discover violations.
In point of fact, then, the absence of factual data on
actual experience in the areas of risk identified makes it
impossible to state with any conviction whether the present or the proposed method of storing medical data presents a greater danger to the privacy and Constitutional
rights of the persons involved.
Nevertheless, despite the impossibility of concluding,
at this time, that a central medical file introduces a new
or greater risk in that respect, it is very much in order to

consider the numerous technical protective measures
available in the operation of such a file.

Technical protective measures
The effectiveness of technical measures to protect
privacy and Constitutional rights when a data center of
any sort is operated is influenced by developments in
electronic digital computer and communications technologies. As the technologies evolve, protective means
that are more effective and economical become available. Of course, it is unreasonable to recommend the
adoption of a weak system in the expectation that
necessary features will come into existence, and that is
not being done here. Actually, substantial protective
measures exist already, and they can be expected to be
improved. It appears that those present measures, in
conjunction with legal steps recommended below, will
achieve the full level of protection realistically required
for a medical data system.
There are numerous physical protections against intentional and inadvertent file intrusions. lO They can be
evaluated most effectively in light of the risks they are
intended to cover. Some of those risks can be suggested by the types of precautions that are required.
I t would be necessary, for example, to restrict direct
access to licensed practitioners, to bar i:mpersonation of
authorized practitioners, to prevent intentional physical intrusion into the area where the records are
stored, and to avoid accidental delivery of information
different from that requested. The specific measures
that are feasible for those purposes can be examined.
Access to the file would be secured only by the use' of
an identification wafer issued to a licensed practitioner.
When the center learns that a practitioner ceases to be
authorized or.that his wafer is out of his possession, the
acceptability of that wafer could be terminated and inquiries with which it is used would be rejected,u The
assignment of code identifications and the creation- of
wafers should be restricted to a small group of center
personnel who are subject to rigid controls.
It probably would be desirable to restrict the terminals from which inquiries may be made so that access
could not be gained from outside terminals. To exclude
intrusion into the wire network by means of other terminals, authorized input-output devices might create
unique signals that can be recognized by the centralsystem. It even might be possible to arrange that individual practitioner's wafers would be acceptable only
through particular terminals. This probably would be
entirely satisfactory except in the rare cases in which a
practitioner .undertakes emergency care away from
home.
I t should be possible to establish strict security con-

Legal Structure for National Medical Data Center
trol over the premises in which the center's records are
stored so that physical intrusions would be difficult.
If participants' wafers are required, along with those
of practitioners, in making inquiries, programming measures would insure that only the proper 'files would be
interrogated. In order to provide for emergencies in
which the participant's wafer is unavailable, a special
override should be provided for. If that approach is
taken, uses of that privilege could be monitored to
detect abuse.
All inquiries should be recorded in each r.>articipant's
record, without exception, and the opportunity to make
programming changes should be controlled strictly. In
this way, unauthorized inquiries originating at the center itself would be revealed.
It also might be advisable to treat particularly sensitive data (such as that on -mental illness or venereal
disease) specia:Ily, so that it· would be available only
under very limited circumstances, rather than routinely.
Although communications lines normally are the
weakest link because of the possibility of tapping, automatic encrypting of messages during transmission is
possible. However, unless there is great danger of intrusion in that area, which seems to be very unlikely, the
substantial cost of that measure probably could not be
justified.
The array of technical steps to protect privacy just
described indicates that computer technology provides
means of considerable effectiveness in view of the particular risks involved. It also appears that the risks entailed in the proposed center are not clearly greater than
those presently experienced or that will be encountered
with increased computerization of fragmented records.
In fact, the study of the feasibility of the center, which
hopefully will take place soon, probably will reveal; as
frequent1y is the case, that current arrangements for
keeping medical records warrant greater attention to
privacy, if the center is not set up soon.

Legal protective measures
Clearly, physical protections alone would not be
sufficient. People involved in the operation of the system, including practitioners and center personnel, still
would have considerable opportunities and incentives to
breach the privacy of participants. Those people undoubtedly are the weakest elements in the system.
Hence, the physical steps must be accompanied by
legal measures to control the conduct of those people. A
number of those measures are suggested at this point.
As in the case of the technical steps, it probably will
be helpful first to identify the risks those legal restrictions are intended to cover. They include primarily the
dangers that persons enjoying access to the stored data
(including both practitioners and center personnel)

391

might misuse their status to pass information on to
unauthorized persons and that unauthorized persons
might try to force their way into the system. To minimize those risks, it is advisable to establish a series of
penalties that will have very substantial deterrent
values.
Since the center would function nationwide and since
its sponsorship is not yet identified, it is difficult to suggest the precise controlling legal structure that should
be sought. There are a. number of possible ro~tes to
arrive at the most reasonable set of legal rules and
means for enforcing compliance compatible with practical limitations. These routes include legislation, contract (including regulations adopted by the center), reliance upon the common law (as created by the courts),
and various combinations of those approaches. As
usual, each o{the routes has its deficiencies.
Although Federal legislation might be attractive because it ostensibly would promulgate all the required
rules in one fell swoop for the entire country, there are
a number of drawbacks to that panacea. Resort to
Federal help is resisted in some influential quarters.
Furthermore, many measures might be considered inappropriate for Federal action, particularly as they
would add to the business of the Federal courts. Where
legislation is deemed essential, the alternative is state
enactment. But persuading all states to adopt laws
individually could involve an extended, if not futile,
effort. Support of the National Conference of Conunissioners on Uniform State Laws might be enlisted in such
an effort.
Since involvement in the center's program would be
attractive to practitioners and center employees, much
reliance could be placed on contracts with them. However, contractual commitments would bind only their
parties, thus leaving many types of troublesome persons unrestrained by that means. Furthermore, penalties for contract breach might be less effective than
criminal sanctions and valuable injunctive relief might
be unavailable.
By their rulings in individual cases not covered by
statute law, courts customarily have provided substantial protections of legal rights through the common law.
For example, they have molded most of the various
rights of privacy and some of the related privileges
against disclosure of information. Thus, much assistance
to the center's operations could be expected from the
courts in the absence of legislation. However, the nature of the legal rules that will arise in that manner
cannot be anticipated in advance and cannot be expected to be uniform among the states, at least for some
time to come.
While the strategy is being planned for achieving the
necessary legal rules that would make the contemplated

392

Fall Joint Computer Conference, 1968

center viable, it should be helpful to note the specific
undesirable conduct vis-a.-vis the center's operations
that should be discouraged. The acts appropriate for
criminal or civil condemnation are set out below, and
possible sanctions are considered.
Ideally, the following conduct should be made criminal, but much protection would be achieved if such
action of center personnel and practitioners were barred
merely by contract:
1. Delivery by a practitioner or center personnel of

2.

3.
4.
5.
6.

any information secured from the center to a
person who is not authorized to receive it under
then existing law.
Improper intrusion into the system in any way,
either directly or through practitioners or center
personnel.
Counterfeiting of an identification wafer of a
participant or practitioner.
Use by a practitioner of his identification wafer
while he is not authorized to do so.
Use of someone else's identification wafer under
any circumstances.
Receipt or use of specifically identified information secured from the center for any purpose other
than (a) to provide medical care to the person
from whose record it came or (b) to transmit it
under circumstances to which a legal privilege
applies under then existing law .

Similarly, it should be made the tort of invasion of
privacy against a participant (or at least a breach of
contract, as suggested above) for a practitioner or center
employee to deliver his medical information to any
person not specifically authorized to receive it either
by the participa~t or by the laws on privilege. It likewise should be made such a tort for a person to receive
medical information under those circumstances. Depending upon the circumstances, such a person might be
guilty of inducing breach of the contract of the center.
To make the foregoing criminal, civil, and contract
prohibitions effective, the following penalties probably
should be imposed by statute and remedies provided by
contract:
1. Substantial fines and imprisonment should be
established as punishment for violations.
2. Civil suits for money damages and for injunctions
should be authorized to be brought by the injured
participants or by the center on their behalf.
Otherwise, the center would have to sue for breach
of its contract and liquidated damages should be
provided for to assure that the penality will be
significant.
3. Practitioners who misuse information they secured

from the center ehould be barred from uee of the
system.
4. The writing of malpractice insurance to cover civil
or criminal losses suffered by practitioners due to
illegal conduct specified above might be forbidden.
5. Data secured from the center that were supplied
by a participant to his practitioner should be unavailable to police and inadmissible in criminal
proceedings against a participant without his
consent.
6. All discovery measures (including ordere for the
production of documents, subpoenas duces tecum,
interrogatories, and depositions) directed to the
national center and relating to stored data should
be forbidden.
Brief explanation probably is in order concerning the
recommendation that specified conduct be made criminal. On the one hand, some acts are made criminal that
are only civil wrongs presently, such as the improper
delivery by a practitioner of medical information about
a patient. The more stringent approach seems to be
warranted in view of the notion that greater harm can be
perpetrated by using the assembled data. On the other
hand, the securing of information from center personnel
or employees of practitioners or hospitals improperly by
paying money or giving other valuable consideration
probably is covered by state statutes forbidding commercial and government bribing. However, penalties
for that conduct usually are relatively small and hence
probably are ineffectual. Reference was made to the possibility that delivery of center data by a practitioner to
an outsider might be privileged. Statutes and case law
authorize a doctor to tell persons standing in the position of the family and even a prospective spouse that his
patient has a venereal disease, a mental illness, or
another unusual medical condition.
The precedent of the collection of census information
should indicate that operation of a national data file is
not ipso facto a danger to privacy. The Census Bureau
apparently has adhered scrupulously to legal bars to its
disclosure of specific information to anyone. With all of
the Congressional oversight of Government agencies
and the many incentives to engage in muckraking, no
departure from the rules has been revealed. However,
that experience probably is relevant only as the reliability of center personnel is concerned.
The penalties and civil remedies also warrant a few
words. Criminal penalties should be severe enough
to discourage violations. Substantially all violations
would be inspired by hope of personal gain and hence
might be deterred by making the risk sufficiently great.
Although many privacy breaches are remedial by
money damages today, injunctive relief normally is not

Legal Structure for National Medical Data Center
thought of. That remedy should be provided specifically. It would be useful in preventing further harm
through the misuse of purloined medical data, for example, by requiring the taking of action on an insurance
o! credit application without regard to the information
secured improperly or the purging of the recipient's
files of such information.
IVlore novel is the recommendation that guilty practitioners be barred from using the center's system. That
could be a severe and very effective penalty since use of
the system would be an essential element of medical
practice. Participants would want current medical data
entered in the file and hence would shun a practitioner
who could not accomplish that, especially if he were
.
barred for data misuse.
The denial of malpractice insurance coverage for
criminal privacy breaches involving center data is a
severe penalty that might harm the injured participant
more than it helps to prevent his injury. It might be assumed that lack of such insural\ce protection will deter
practitioners from flirting with privacy breaches by exposing their personal resources to legal judgments.
Many practitioners who would engage in violations
probably would not be influenced by such a prospect
and might be so marginal financially, as well as ethically
that they could not compensate participants they injured.
Respect for the spirit of Fifth Amendment protection
would seem to require that data in the center's records
furnished directly by a participant to a practitioner not
be reachable by government prm~ecutors. That being
so, prosecutors should not be able 10 use such data in
evidence against participants.
Finally, it might be advisable to authorize the center
to bring civil suits on behalf of participants whose privacy has been breached, especially if the intrusion were
perpetrated by its own personnel. This remedy would
be similar to that provided under the Wage and Hour
Law for recovery of back pay through Government
suits. Since many injured persons might lack resources
to finance a suit, the assistance of the center could be
very appropriate. Very similar results could be achieved
if the center were to pay the legal expense of participants who seek such relief directly, but the center's cost
might be much greater. Of course, if the center would
want to sue because of breach of its contracts, it would
need no special authorization.
Because injured participants frequently would not
know of the privacy breaches (as usually they do not
know presently of harm suffered at the hands of credit
agencies using incorrect information), provision should
be made for audits of compliance with the legal rules.
Even if participants were able to secure copies of their
own data, many could not analyze the entries that

393

reveal inquiries and identify any SUSpICIOUS patterns.
Moreover, they could not see the records of others,
which might be necessary to uncover the abuse. Hence,
only the center itself or an outside responsible agency,
in the nature of an ombudsman, could conduct effective audits to apprehend guilty practitioners or staff
personnel.
The audits would include such action as analyses of
inquiries of practitioners to look for suspicious access,
checks on internal activities involving program changes
that might be used for improper inquiries, and periodic
direct conununication with participants and practitioners to verify the genuineness of inquiries. A correctly designed and efficiently executed audit program
should be able to detect most of the relatively few privacy breaches that will occur. Awareness of the effectiveness of such a program should deter attempts to perpetrate breaches.
Also pertinent to privacy of center data is the availability of that data in legal proceedings, to which brief
reference already has been made. Presently, in many
states, the physician-patient privilege bars disclosure by
the doctor, without the patient's consent, of information given by the patient to the doctor in a medicalrelationship. In civil actions, the patient himself usually
may refuse to reveal the information he so gave to his
doctor. In criminal cases, however, it wou1d be protected from involuntary disclosure by the patient by
the right against self-incrimination.
There is good reason to apply to the records kept in
the proposed center the present privilege rule and related protections against disclosure even by the patient
himself involuntarily. For that purpose, discovery measures, such as orders for the production of documents,
subpoenas duces tecum, and interrogatories, would not
be authorized to be directed to the center for any data.
They would be available against the participant himself
and his practitioners, within the framework of existing
protective rules. Since doctors can be compelled,
through legal process~ to testify about medical items
other than information revealed by the patient, which
would not exclude the fact that a consultation occurred,
discovery measures should be permitted to be directed
to the practitioner.
When patients are confronted with discovery related
to center data, they could rely upon their privilege and
Constitutional protections, just as they do now. Similarly, at present, it frequently is left to the doctor to
raise the barrier of the privilege in the first instance,
although that patient's lawyer very often does so. The
same procedure well could apply with respect to center
data. Hence, discovery measures would be usable with
respect to information in the proposed system with
litt1e, it any, need to adopt special protective rules.

394

Fall Joint Computer Conference, 1968

Both these results can be achieved largely by regarding the center records legally to be the files of
practitioners rather than separate files with independent legal status.

CONCLUSION
This review indicates that it is in order to pursue investigations of the feasibility of a national medical data
center without concern that privacy and Constitutional
considerations constitute an insuperable barrier. Available technical protective means bolstered by acceptable legal measures assure at least as much respect for
individual rights in medical data as is enjoyed at present, if not actually more. The great health care benefits foreseen by proponents of the project warrant early
attention to it and would seem to provide whatever
justification is needed for the legislative action recommended.

FOOTNOTES
1. This approach resembles the requirement that persons investing in securities subject to a registration st~tement filed with
the Securities and Exchange Commission receive a copy of the
prospectus.
2. It thus is distinguished from employment and credit clearing
houses.
3. Informal Opinion 1002, Committee on Professional Ethics,

American Bar Assn., 54 A. B. A. J. 474 (May 1968).
4. This is the system used by the Internal Revenue Service in
its ADP system for processing tax returns.
5. Realistically, such participation would be open to many
types of practitioners in addition to medical doctors. Hence, not
only the name of the person submitting data but also the nature
of his treatment approach should be recorded to guide subsequent
inquirers in f'valuating the record.
6. Such a study is in progress under Burgess L. Gordon, M.D.,
on the staff of the American Medical Association. See Gordon,
B. L., Biomedical Language and Format, 39 Medical Record News,
No.2, (April 1968), p. 34.
7. In Schwartz v. United States, 230 F. Supp. 536 (E. D. Pa.
1964), it was held that doctors have a duty to review prior records
readily available and to warn patients of earlier treatment discovered to be harmful.
8. At its Atlanta office, the National Communicable Disease
Center of the Public Health Service collects data pertinent to .
its surveillance of epidemics.
9. For a discussion of some such precautions, see Freed, R. N.,
"Written signatures block the computer revolution," Modern
Hospital (July 1968), p. 103.
10. Ware, W., "Security and privacy in computer systems,"
Peters, B., "Security considerations in a multi-programmed computer system," Ware, W., "Security and privacy: similarities and
differences," and Peterson, H. and R. Turn, "System implications
of privacy." Proceedings AFIPS 1967 Spring Joint Computer
Conf., pp. 279-300.
.
11. Such attempted misuse should trigger an investigation into
an apparent effort to violate the system, especially if identification wafers are used with the result that innocent errors in the
handling of identification codes are avoided.

A research center for augmenting human intellect*
by DOUGLAS C. ENGELBART
and WILLIAM K. ENGLISH
Stanford Research Institute
Menlo Park, California

1

actions and computer feedback involved in
controlling the application 'Of these service
functions) .

SUMMARY

laThis paper describes a multisponsor research center at Stanford Research Institute in
man-computer interaction.

User files are organized as hierarchical
structures of data entities, each composed of
arbitrary combinations of text and figures. A
repertoire of coordinated service features enables a skilled user to c'Ompose, study, and modify these files with great speed and flexibility,
and to have searches, analyses data manipulation, etc. exec~ted. In particular, special sets of
conventions, functions, and working metho~s
have been developed to air programming, lOgIcal design, documentation, retrieval, project
management, team interaction, and hard-c'opy
production.

1b

lal For its laboratory facility, the Center
has a time-sharing computer (65K, 24-bit
core) with a 4.5 megabyte swapping drum
and a 96 megabyte file-storage disk. This
serves twelve CRT work stations simultaneously.
1 al a Special hardware completely removes

from the CPU the burden 'Of display refreshing and input sampling, even though
these are done directly out of and into core.
lalb The display in a user's office appears

on a high-resolution (875-line) commercial
television monitor, and provides both character and vector portrayals. A relatively
standard typewriter keyboard is supplemented by a five-key handset used (optionally) for entry of control codes and brief
literals. An SRI cursor device called the
"mouse" is used for screen pointing and
selection.

2 INTRODUCTION
2a In the Augmented Human Intellect (AHI)

Research Center at Stanford Research Institute
a group of researchers is developing an experimental'laboratory around an interactive, multiconsole computer-display system, and is working to learn the principles by which interactive
computer aids can augment their intellectual
capability.

lalbl The "mouse" is a hand-held X-Y
transducer usable on any flat surface; it
is described in greater detail further on.

2b The research objective is to develop principles and techniques for designing an "augmentation system."

la2 Special-purpose. high-level languages and
associated .compilers provide rapid, flexible
development and modification of the repertoire of service functions and of their control
proced ures (the latter being the detailed user

2bl This includes conc.ern not only for the
technology of providing interactive computer
service, but also for changes both in ways of
conceptualizing, visualizing, and 'OrganIzIng
working material/ and in procedures ane!
methods for working individually and cooperatively.

..

*Principal sponsors are: Advanced Research Projects Agency
and National Aeronautics and Space Agency (NASl-7897), and
Rome Air Devebpment Center F30602-68-C-0286.

395

396

Fall Joint Computer Conference, 1968

2c The research approach is strongly empirical.
At the workplace of each member of the subject
group we aim to provide nearly full-time availability of a CR T wor~ station, and then to work
continuously to improve both the service available at the stations and the aggregate value derived therefrom by the group over the entire
range of its roles and activities.

raphy and reference notes, etc., and doing all
of our scratch work, planning, designing,- debugging, etc., and a good deal of our intercommunication, via the consoles.
2/1 We are trying to maximize the coverage
of our documentation, using it as a dynamic
and· plastic structure that we continually develop and alter to represent the current state
of our evolving goals, plans, progress, knowledge, designs, procedures, and data.

2d Thus the research group is also the subject
group in the experiment.
2.dl Among the special activities of the group
are the evolutionary development of a complex hardware.:.softwal'e system, the design of
new task procedures for the system's users,
and careful documentation of the evolving
system designs and user procedures.
2d2 The group also has the usual activities
of managing its activities, keeping up with
outside developments, publishing reports, etc.
2d-3 Hence, the particulars of the augmentation system evolving here will reflect the nature of these tasks-Le., the system is aimed
at augmenting a system-development proj ect
team. Though the primary research -goal is
to develop principles of analysis and design
so as to understand how to augment human
capability, choosing the researchers themselves as subjects yields as valuable secondary
benefit a system tailored to help dpvelop complex computer-based systems.

2g The display-computer system to support this

experiment is just (at this writing) becoming
operational. Its functional features serve a
basic display-oriented user system that we have
evolved over five years and through three other
computers. Below are described the principal
features of these systems.
3

THE USER S.YSTEM
3a

$al As "seen" by the user, the basic facility
has the following characteristics:
3ala 12 CRT consoles, of which 10 are

normally located in offices of AHI research
staff.
3al b The consoles are served by an SDS
940 time-sharing computer dedicated to
full-time service for this staff, and each
console may 'Operate entirely independently
of the others.

"bootstrap~' group has the interesting
(recursive) assignment of developing tools and
techniques to make it more effective at carrying
out its assignment.

2e This

3al c Each individual has private file space,

and the group has community space, on a
high-speed disc with a capacity of 96 million characters.

2el Its tangible product is a developing augmentation system to provide· increased capability for developing and studying augmentation systems.
2e2 This system can. hopefully be transferred,
as a whole or by pieces of c'Oncept, principle
and technique, to help others develop augmentation systems for aiding many other disciplines and activities.

2/ In other words we are concentrating fully
upon reaching the point where we can do all
of our work. on line-placing in computer store
all of our specifications, plans, designs, programs, documentation, reports, memos, bibliog-

Basic Facility

3a2 The system is not intended to serve a

general community of time-sharing users, but
is being shaped in its entire design toward
the special needs of the "bootstrapping" experiment.
3b

Work Stations
3bl As n'Oted above, each work station is
equipped with a display, an alphanumeric
keyboard, a mouse, and a five-key handset.

3b2 The display at each of the work

s~ations

(see Figure 1) is provided on a high-resolution, cl'Osed-circuit television monitor.

Research Center f'Or Augmenting Human Intellect

397

FIGURE 2-Underside of mouse

relative speed and accuracy 'Obtained with
this and 'bther selecti'On devices sh'Owed the
m'Ouse t'O be better than a light pen 'Or a j'Oystick (see Refs. English 1 and English 2).
3b4cl C'Ompared t'O a light pen, it is gen-

erally less awkward and fatiguing t'O use,
and it has a decided advantage for use
with raster-scan, write-thr'Ough st'Orage
tube, pr'Ojecti'On, 'Or multiviewer display
systems.
FIGURE I-Typical work station, with TV display, typewriter
keyboard, mouse, and chord handset

3b3 The alphanumeric keyb'Oard is similar t'O
a Teletype keyb'Oard. It has 96 n'Ormal char-

acters in two cases. A third-case shift key
pr'Ovides f'Or future expansi'On, and tW'O special keys are used f'Or system c'Ontr'Ol.
3b4 )I1iemQ~seproduces tW'O anal'Og v'Oltages

asthet W'O wheels (see Figure 2) r'Otate, each
changing in pr'OP'Orti'On t'O the X 'Or Y m'Ovement 'Over the table t'OP.
3b4a These v'Oltages c'Ontr'Ol-via an AID

c'Onverter, the c'Omputer's mem'Ory, and the
display generat'Or-the c'O'Ordinates 'Of a
tracking SP'Ot with which the user may
"point" to P'Ositi'Ons 'On the screen.
3b4b Three butt'Ons 'On t'OP 'Of the m'Ouse

are used f'Or special c'Ontr'Ol.
3b4c A set 'Of experiments, c'Omparing

(within 'Our techniques 'Of interacti'On) the

3b5 The five-key handset has 31 ch'Ords 'Or
unique key-str'Oke c'Ombinati'Ons, in five
"cases."
3b5a The first f'Our cases c'Ontain I'Owerand upper-case letters and punctuati'On,
digits, and special characters. (The ch'Ords
f'Or the letters c'OrresP'Ond t'O the binary
numbers fr'Om 1 t'O 26.)
3b5b The fifth case is "c'Ontr'OI case." A

particular ch'Ord (the same ch'Ord in each
case) will always transfer subsequent input-ch'Ord interpretati'Ons t'O c'Ontr'OI case.
3 b5 c In c'Ontr'Ol case, 'One can "backspace"
thr'Ough recent input, specify underlining
f'Or subsequent input, transfer t'O an'Other
case, visit an'Other case f'Or 'One character
'Or 'One w'Ord, etc,
3b5d One-handed typing with the handset

is sl'Ower than tw'O-handed typing with the
standard . keyboard. H'Owever, when the
user w'Orks with 'One hand 'On the handset
and 'One 'On the m'Ouse, -the c'O'Ordinated in-

398

Fall Joint Computer Conference, 1968

. terspersion of control characters and short
literal strings from one hand with mousecontrol actions from the other yields considerable advantage in speed and' smoothness of operation.
3b5dt For literal strings longer than

about ten characters, one tends to transfer from the handset to the normal keyboard.
.3b5d2 Both from general experience and

from specific experiment, it seems that
enough handset skill to make its use
worthwhile can generally be achieved
with about five hours of practice. Beyond this,' skill grows with usage.
3c

Structure of Files
3ct Our working information is organized

into files, with flexible means for users to set
up indices and directories, and to h'Op from
file to file by display-selection or by typed-in
file-name designations. Each file is highly
structured in its internal organization.
3cta The specific structure of a given file

is determined by the user, and is an important part of his conceptual and "studymanipulate" treatment of the file.
3c2 The introduction of explicit "structur-

ing" to 'Our working information stems from
a very basic feature of our conceptual framework (see Refs. Engelbart1 and Engelbart2)
regarding means for augmenting human intellect.
3c2a With the view that the symbols one

works with are supposed to represent a
mapping of one's associated concepts, and
further that one's concepts exist in a "network" of relationships as opposed to the
essentially linear form of actual printed
records, it was decided that the conceptmanipulation aids derivable from real-time
computer support could be appreciably enhanced by structuring conventions that
would make explicit (for both the user and
the computer) the various types of network
relationships among concepts.
3c2b As an experiment with this concept,

we adopted some years ago the convention
of organizing all information into explicit

hierarchical structures, with provisions for
arbitrary cross-referencing among the elements of a hierarchy.
3c2bt The

principal manifestation of
this hierarchical structure is the breaking up of text into arbitrary segments
called "statements," each of which bears
a number showing its serial location in
the text and its "level" in an "outline" of
the text. This paper is' an example of
hierarchical text structure.
3c2c To set up a reference link from State-

ment A -to Statement B, 'One may refer in
Statement A either to the location number
of B or to the "name" of B. The difference
is that the number is vulnerable to subsequent structural change, whereas the name
stays with the statement through changes
in the structure around it.
3c2ct By convention, the first word of

a statement is treated as the name of the
statement, if it is enclosed in parentheses. F'Or instance, Statement 0 on the
screen of Figure 1 is named "FJCC."
3c2c2 References to these names may be

embedded anywhere in other statements,
for instance as "see (AFI) ," where special format informs the viewer explicitly
that this refers to a statement named
"AFI," or merely as a string of characters in a context such that the viewer
can infer the referencing.
3c2c3 This naminga nd linking, when

added to the basic hierarchical form,
yields a highly flexible general -structuring capability. These structuring conventions are expected to evolve relatively
rapidly as our research progresses.
For some material, the structuredstatement form may be undesirable. In
these cases, there are means for suppressing the special formatting in the final printout of the structured text.
3c3

3c4 The basic validity of the structured-

text approach has been well established by
our subsequent experience.
3c4a We have found that in both off-line

and on-line computer aids, the concep-

Research Center for Augmenting Human Intellect
ti'On, stipulation, and executi'On 'Of significant manipulati'Ons are made much
easier by the structuring c'Onventions.
3c4b Als'O, in w'Orking 'On line at a CRT

c'Ons'Ole, n'Ot 'Only is manipulati'On made
much easier and m'Ore P'Owerful by the
structure, but a user's ability t'O get
ab'Out very quickly within his data, and
t'O have special "views" 'Of it generated
t'O suit his need, are significantly aided
by the structure.
3c4c We have c'Ome t'O write all 'Of 'Our

d'Ocumentati'On, notes, rep'Orts, and pr'OP'Osals according t'O these c'Onventi'Ons,
because 'Of the resulting increase in 'Our
ability to. study and manipulate them
during c'Omp'Ositi'On, m'Odificati'On, and
usage. Our pr'Ogramming systems als'O
inc'Orp'Orate the c'Onventi'Ons. We have
f'Ound it t'O be fairly universal that after
an initial peri'Od 'Of negative reacti'On in
reading explicitly structured material,
'One c'Omes t'O prefer it t'O material printed
in the n'Ormal f'Orm.
3·d

File Studying

3dl The c'Omputer aids are used f'Or tW'O prin-

cipal "studying" 'Operati'Ons, b'Oth c'Oncerned
with c'Onstructi'On 'Of the user's "views," i.e.,
the P'Orti'On 'Of his w'Orking text that he sees
'On the screen at a given m'Oment.
3dl a

Display Start

3dlal The first 'Operati'On is finding a

particular statement in the file (called
the "display start") ; the view will then
begin with that statement. This is equivalent t'O finding the beginning 'Of a particular passage in a hard-c'OPY d'Ocument.
3dl b

F'Orm 'Of View

3dl bl The sec'Ond 'Operati'On is the speci-

ficati'On 'Of a "f'Orm" 'Of view-it may
simply c'Onsist 'Of a screenful 'Of text
which sequentially f'Oll'Ows the P'Oint specified as the display start, 'Or it may be
c'Onstructed in 'Other ways, frequently S'O
as t'O give the effect 'Of an 'Outline.
In n'Ormal, 'Off-line d'Ocument stUdying, 'One 'Often d'Oes the first type 'Of 'Operati'On, but the sec'Ond is like a siss'Ors-and3dlc

399

staple j'Ob and is rarely d'One just t'O aid
'One's studying.
(A third type 'Of service 'Operati'On
that will und'Oubtedly be 'Of significant aid
t'O stUdying is, questi'On answering. We do
n'Ot have this type 'Of service.)

3dld

3d2

Specificati'On 'Of Display Start

3d2a The display start may be specified in
several ways:
3d2al By direct selecti'On 'Of a statement

which is 'On the display-the user simply
P'Oints t'O any character in the statement,
using the m'Ouse.
3d2a2 If the desired display start is n'Ot
'On the display, it may be selected indirectly if it bears a "marker."
3d2a2a Markers are normally inVISI-

ble. A marker has a name 'Of up t'O five
characters, and is attached t'O a character 'Of the text. Referring t'O the
marker by name (while h'Olding d'Own
a special butt'On) is exactly equivalent
t'O P'Ointing t'O the character with the
mouse.
3d2a2b The c'Ontr'OI pr'Ocedures make it
extremely quick and easy t'O fix and
call markers.
3d2a3 By furnishing either the name 'Or
the I'Ocati'On number 'Of the statement,
which can be d'One in either 'Of tW'O basic
ways:
3d2a3a Typing fr'Om the keyb'Oard
3d2a3b Selecting an 'Occurrence 'Of the'

name 'Or number in the text. This may
be d'One either directly 'Or via an indirect marker selecti'On.
3d2b After identifying a statement by 'One

'Of the ab'Ove means, the user may request
t'O be taken directly there f'Or his next view.
Alternately, he may request instead that
he be taken t'O s'Ome statement bearing a
specified structure relati'Onship t'O the 'One
specifically identified. F'Or instance, when
the user identifies Statement 3E4 by 'One
'Of the ab'Ove means (assume it t'O be a
member 'Of the list 3El thr'Ough 3E7), he
may ask t'O be taken to

400

Fall Joint Computer Conference, 1968
to display only those statements that
have the specified content.

3d2b1 Its successor, i.e., Statement 3E5
3d2b2 Its predecessor, i.e., Statement

3.d3b3a One can specify simple strings,

3E3

or logical combinations thereof, or such
things as having the word "memory"
within four words of the word "allocation."

3d2b3 Its list tail, i.e., Statement 3E7
3.(i)2b4 Its list head, i.e., Statement 3El
3d2b5 Its list source, i.e., Statement 3E

3d3b3b Content specifications are writ-

3d2b6 Its subhead, i.e., Statement 3E4A

ten as text, anywhere in the file. Thus
the full power of the system may be
used for composing and modifying them.

3d2e Besides being taken to an explicitly

identified statement, a user may ask to go
to the first statement in the file (or the
next after the current location) that c~n­
tains a specified word or string of characters.

3d3b3e Anyone content specification can
then be chosen for application (by selecting it directly or indirectly). It is compiled immediately to produce a machinecode content-analysis routine, which is
then ready to "filter" statements for the
view generator.

3d2e1 He may specify the search string
by typing it in, by direct (mouse) selection, or by indirect (marker) selection.
3d3

Specification of Form of Vie'w

3.d3a The "normal" view beginning at a
given location is like a frame cut out from
a long scroll upon which the hierarchical
set of statements is printed in sequential
order. Such a view is displayed in Figure 1.
3d3b Otherwise, three independently vari-

able view-specification conditions may be
applied to the construction of the displayed
view: level clipping, line truncation, and
content filtering. The view is simultaneously affected by all three of these.
Given a specified level
parameter, L (L = 1, 2, ... , ALL), the
view generator will .display only those
statements whose "depth" is less than
or equal to L. (For example, Statement
3E4 is third level, 3E second, 4B2Cl fifth,
etc.) Thus it is possible to see only firstlevel statements, or only first-, second-,
and third level statements, for example.

3d3e In addition, the following format features of the display may be independently
varied: indentation of statements according to level, suppression of location numbers and/or names of statements, and separation of statements by blank lines.
3d3d. The user controls these view specifications by means of brief, mnemonic charactercodes. A skilled user will readjust
his view to suit immediate needs very
quickly and frequently; for example, he
may change level and truncation settings
several times in as many seconds.

3d3b1 Level:

3d3b2 Truncation:

Given a specified
truncation parameter, T (T = 1, 2, ... ,
ALL), the view generator will show only
the first T lines of each statement being
displayed.
3d3b3 Content: Given a specification for
desired content ( written in a special
high-level content-analysis language) the
view generator optionally can be directed

3d4

"Freezing" Statements

3d4a One may also pre-empt an arbitrary
amount of the upper portion of the screen
for holding a collection of "frozen" statements. The remaining lower portion is
treated as a reduced-size scanning frame,
and the view generator follows the same
rules for filling it as described above.
3d4b The frozen statements may be inde-

pendently chosen or dismissed, each may
have line truncation independent of the
rest, and the order in which they are displayed is arbitrary and readily changed.
Any screen-select operand for any command may be selected from any portion of
the display (including the. frozen statements).

Research Center f'Or Augmenting Human Intellect
3d5

Examples

~

. . :>.,:>r:::.;:;:':'~~:'"

3d5a Figures 3 and 4 sh'Ow views generated

fr'Om the same starting p'Oint with different
level-clipping parameters. This example happens t'O be 'Of a pr'Ogram written in 'Our Machine-Oriented language (MOL, see bel'Ow).
3d5b Figure 5, dem'Onstrates the freezing
feature with a view 'Of a pr'Ogram (the same
'One sh'Own in Figure 8) written in 'Our C'Ontr'Ol Metalanguage (CML, see bel'Ow). Statements 3C, 3C2, 2B, 2Bl, 2B2, 2B3, and 2B4
are fr'Ozen, and statements fr'Om 2J 'On are
sh'Own n'Ormally with L = 3, T == 1.
3d5b1 The freezing here was used t'O h'Old

,..:",.":: .; · ' t . ! .

"

... . "

r

'",,"u, H. ",.,

JCl nt)

<>'j;A

~~

.
"ilil,,) t"'/i.'>'flR1,

211

FIGURE 5-View of CML program, showing six frozen statements and illustrating use of reference hopping

f'Or simultane'Ous view f'Our different functi'Onally related pr'Ocess descripti'Ons.
The subr'Outines (+ BUGISPEC) and

(+ WAIT

were l'Ocated by use 'Of the
h'Op-t'O-name feature described ab'Ove.
3e

f;\lltllM!l~MllJlel

It,

JL~T

401

File Modification
3e1 Here we use a standard set 'Of editing
'Operati'Ons, specifying with each 'Operati'On a
particular type 'Of text entity.

,m;&

Navigation menu