Virtual Memory

PETER J. DENNING
Princeton University,* Princeton,
\
New Jersey

The need for automatic storage allocation arises from desires for program
modularity, machine independence, and resource sharing. Virtual memory is an
elegant way of achieving these objectives. In a virtual memory, the addresses a
program may use to identify information are distinguished from the addresses the
memory system uses to identify physical storage sites, and program-generated
addresses are translated automatically to the corresponding machine addresses.
Two principal methods for implementing virtual memory, segmentation and
paging, are compared and contrasted. Many contemporary implementations have
experienced one or more of these problems: poor utilization of storage, thrashing,
and high costs associated with loading information into memory. These and
subsidiary problems are studied from a theoretic view, and are shown to be
controllable by a proper combination of hardware and memory management
policies.
Key words and phrases: virtual memory, one-level store, memory allocation,
storage allocation, dynamic storage allocation, segmentation, paging, replacement
algorithms, storage fragmentation, thrashing, working set
CR categories: 4.3, 6.2

INTRODUCTION allocation procedures into his program

whenever the totality of its information was
F r o m the earliest days of electronic com- expected to exceed the size of main memory.
puting it has been recognized that, because These procedures were relatively straight-
fast-access storage is so expensive, computer forward, amounting to dividing the program
memories of very large overall capacity must into a sequence of " s e g m e n t s " which would
be organized hierarchically, comprising at " o v e r l a y " (i.e. replace) one another in main
least two levels, " m a i n m e m o r y " and "auxil- memory. Since the p r o g r a m m e r was inti-
iary m e m o r y . " A program's information mately familiar with the details of b o t h the
(i.e. instruction code and data) can be machine and his algorithm, it was possible
referenced only when it resides in main for him to devise efficient "overlay se-
m e m o r y ; thus, information having immedi- quences" with relative ease.
ate likelihood of being referenced must The picture began to c h a n g e m a r k e d l y
reside in main memory, and all other infor- after the introduction of higher level pro-
mation in auxiliary memory. The storage gramming languages in the mid-1950s. Pro-
allocation problem is t h a t of determining, at grammers were encouraged to be more
each m o m e n t of time, how information shall concerned with problem-solving and less
be distributed among the levels of memory. concerned with machine details. As the
During the early years of computing, complexity of their programs grew, so grew
each p r o g r a m m e r had to incorporate storage the magnitude of the storage overlay prob-
lem. Indeed, b y the late 1950s it was clear
* Department of Electrical Engineering. This work t h a t program operating efficiency could
was supported in part by National Aeronautics
and Space Administration Grant NGR-31-001-170. suffer greatly under poor overlay strategies,

Computing Surveys, Vol. 2, No. 3, September 1970

154 * Peter J. Denning

CONTENTS and it was generally agreed that storage

allocation had become a problem of central
importance. But, since programmers were
shielded from machine details by .program-
ming languages, it was increasingly diffi-
cult to persuade them to expend the now
relatively large effort required to devise good
Introduction 153-157
overlay sequences. This situation led to the
appeal of computers havillg very large main
Basic System Hardware 157
memories [M5].
Definition of Virtual Memory 157-159
Two divergent schools of thought about
Manual Versus Automatic Memory Management 159-
160 solutions emerged. These have come to be
Implementation of Virtual Memory 16O-165
known as the static (preplanned) and dy-
namic approaches to storage allocation.
Segmentation
Paging These two approaches differ on their assump-
Segmentation and Paging tions about the most fundamental aspect of
Storage Utilization 165-172 the storage allocation problem, prediction,
Placement Policies both (1) of the availability of memory
Overflow and Compaction
Fragmentation resources, and (2) of certain properties of a
Page Size program's "reference string," i.e. its se-
Compression Factor
quence of references to information.
Comparison of Paged and Nonpaged Memories 172
The static approach assumes that. (1) is
Demand Paging 173-177
Paging Drum
either given or can be prespecified, and that
Cost (2) can be determined either by preprocess-
Program Behaviorand Memory Management 177-183 ing the program and recording its reference
Replacement Algorithms string, or by examining the structure of its
Optimal Paging Algorithms
The Principle of Locality and the Working Set Model
text during compilation [C5, K1, O1, R1, R4].
Multiprogramming and Thrashing The dynamic approach assumes that (1)
Program Structure 183-184 cannot (or ought not) be prespecified, and
Hardware Support 184-186 that (2) is determinable only by observing
Conclusions 186-187
the program during execution; the memory
space in use by a program should grow and
References 187-189
shrink in accordance with the program's
needs [$1]. Computer and programming
systems during the 1960s have so evolved
that, in a great many cases, neither memory
availability nor program behavior are suffi-
ciently predictable that the static approach
can provide a reasonable solution. The
reasons for this can be classed as program-
ming reasons and system reasons.
To understand the programming reasons,
it is useful to distinguish two concepts:
address space, the set of identifiers that may
be used by a program to reference informa-
tion, and memory space, the set of physical
main memory locations in which information
items may be stored. In early computer sys-
tems the address and memory spaces were
taken to be identical, but in many con-
temporary systems these spaces are dis-

Computing Surveys, Vol. 2, No. 3, September 1970

 Virtual Memory • 155

tinguished. This distinction has been made which, by their very nature, demand dy-
to facilitate the eventual achievement of namic storage allocation.
three objectives. The major system reasons compelling
1. Machine independence. There is no a dynamic storage allocation result from cer-
priori correspondence between address tain objectives arising principally in multi-
space and memory space. programming and time-sharing systems: (1)
The philosophy behind machine inde- the ability to load a program into a space of
pendence is: It relieves the programmer arbitrary size; (2) the ability to run a
of the burden of resource management, partially loaded program; (3) the ability to
allowing him to devote his efforts fully to the vary the amount of space in use by a given
solution of his problem; it permits equip- program; (4) the ability to "relocate" a
ment changes in the computer system with- program, i.e. to place it in any available
out forcing reprogramming; and it permits part of memory or to move it around during
the same program to be run at different execution; (5) the ability to begin running a
installations. program within certain deadlines; and (6)
2. Program modularity. Programs may the ability to change system equipment
be constructed as collections of sepa- without having to reprogram or recompile.
rately compilable modules which are Program texts prepared under the static
not linked together to form a complete approach require that the (rather inflexible)
program until execution time. assumptions about memory availability, On
which they are predicated, be satisfied be-
The philosophy behind program modularity fore they can be run. Such texts are generally
is: It enables independent compilation, test- incompatible with these six objectives.
ing, and documentation of the components
of a program; it makes it easier for several Even within the dynamic storage alloca-
programmers to work independently on tion camp there was disagreement. One
parts of the same job; and it enables the group held that the-programmer, being best
modules constructed for one job to be used informed about his own algorithm's opera-
in another, i.e. building on the work of tion, should be in complete control of storage
others [D4, D5, D10, D l l , D12, D13, allocation. He would exercise this control
P2, R3, W4]. by calling on system routines which would
"allocate" and "deallocate" memory regions
3. List processing. Languages (e.g. LisP) on his behalf. This thinking is at least
having capability for handling problems partially responsible for the block struc-
involving structured data are in- ture and stack implementation of the
creasingly important. ALGOL programming language (1958) and
As we suggested earlier, these three pro- subsequently the ALgoL-oriented Burroughs
gramming objectives invalidate reliable pre- computers. It has also influenced the imple-
dictability, upon which static storage allo- mentation of list-processing languages [B8,
cation is predicated. The mechanisms that C4, K4].
implement machine independence cannot The other group in the dynamic storage
(by definition) establish a correspondence allocation camp advocated a very different
between addresses and locations until exe- approach: automatic storage allocation. Their
cution time, much too late for a programmer thinking was influenced by their belief
or a compiler to preplan memory use. Pro- that complicated programs beget storage
gram modularity makes it impossible for the allocation problems so complicated that
compiler of a module to know either what most programmers could not afford the time
modules will constitute the remainder of a to manage memory well, and most particu-
program or (even if it could know) what larly by their belief that multiprogram-
their resource requirements might be. List ming would soon be a concept of great
processing languages employ data struc- importance. Because the availability in
tures whose sizes vary during execution and main memory of particular parts of address

Computing Surveys, Vol. 2, No. 3, September 1970

156 • Peter J. Denning

space may be unpredictable under multi- The foregoing discussion has summarized
programming, a programmer's ability to the ideas leading to the virtual memory
allocate and deallocate storage regions may concept. By distinguishing between ad-
be seriously impaired. Realizing that the dresses and locations, and automating stor-
principal source of difficulty was the small age allocation, virtual memory facilitates
size of programmable main memory, this certain programming and system design
group advanced the concept of a o~e-level objectives especially important in multipro-
store. In 1961 a group at M I T [M5] pro- gramming and time-sharing computers. The
posed the construction of a computer having discussion in the remainder of this paper
several million words of main memory (an divides into two general areas: the mecha-
amount then considered vast) so that the riisms for effecting virtual memory, and the
storage allocation problem would vanish. policies for using the mechanisms. The prin-
Economic reasons prevented this from ac- cipal mechanisms are: segmentation, under
tually being realized. which the address space is organized into
In 1961 the group at Manchester, Eng- variable size "segments" of contiguous
land, published a proposal for a one-level addresses; and paging, under which the
store on the Atlas computer [F3, K3], a address space is organized into fixed size
proposal that has had profound influence "pages" of contiguous addresses. We shall
on computer System architecture. Their compare and contrast these two mecha-
idea, known now as virtual memory, gives nisms and show why systems using some
the programmer the illusion that he has a form of paging are predominant.
very large main memory at his disposal, Although it has some very important
even though the computer actually has a advantages, virtual memory has not been
relatively small main memory. At the heart without its problems. There are four of
of their idea is the notion that "address" particular interest. (1) Many programmers,
is a concept distinct from "physical loca- in their illusion that memory is unlimited,
tion." It becomes the responsibility of the are unduly addicted to the old idea that time
computer hardware and software auto- and space may be traded, in the sense
matically and propitiously to move infor- that a program's running time may be re-
mation into main memory when and only duced if there is more programmable
when it is required for processing, and to memory space available. But space in a
arrange that program-generated addresses virtual memory may be an illusion; un-
be directed to the memory locations that necessarily large and carelessly organized
happen to contain the information addressed. programs may generate excessive overhead
The problem of storage allocation (for ob- in the automatic storage allocation mecha-
jects represented in virtual memory) thus nism, inevitably detracting from tile effi-
vanishes completely from the programmer's ciency of program operation. Nonetheless,
purview and appears in that of the com- as programmers and language designers
puter system. By basing memory use on gain experience with virtual memory, this
system-observed actual use of space, rather problem should disappear. (2) Many paged
than (poor) programmer estimates of space, systems suffer severe loss of usable storage--
virtual memory is potentially more efficient "fragmentation"--because storage requests
that preplanned memory allocation, for it must be rounded up to the nearest integral
is a form of adaptive system. number of pages. (3) Many time-sharing
By the mid-1960s the ideas of virtual systems using "pure demand paging" (a
memory had gained widespread acceptance, policy under which a page is loaded into
and had been applied to the internal design main memory only after an attempted
of many large processors--IBM 360/85 and reference to it finds it missing) experience
195, CDC 7600, Burroughs B6500 and later severe costs as a program's working pages
series, and GE 645, to name a few. The are loaded singly on demand at the start
fact of its acceptance testifies to its general- of each time quantum of execution. (4)
ity and elegance. Many systems have shown extreme sensi-

Computing Surveys, Vol. 2, No. 3, September 1970

 Virtual Memory • 157
PROCESSORS
tivity to "thrashing," a phenomenon of
complete performance collapse that m a y
occur under multiprogramming when mem-
ory is overcommitted. We shall demonstrate
that these problems m a y be controlled if AUXILIARY
virtual memory mechanisms are governed MEMORY

by sound strategies.
The reader should note that these four
observed inadequacies of many contem-
porary systems result not from ill-conceived Fie,. 1. Basic system hardware
mechanisms, but from ill-conceived policies.
These difficulties have been so publicized
that an unsuspecting newcomer may be also from waiting for rotating or movable
led erroneously to the conclusion that vir- devices to be positioned ("latency time").
tual memory is folly. Quite the contrary; We take the average transport time to be T.
virtual memory is destined to occupy a Since main memories are ordinarily elec-
place of importance in computing for many tronically accessed and auxiliary memories
years to come. mechanically accessed, ,5 is typically 1
~sec and T is typically at least 10 msec.
Thus speed ratios (T/h) in the order of 104
or more are not uncommon.
BASIC SYSTEM HARDWARE
Main memory m a y be regarded as a
As our basic computer system, we take that linear array of "locations," each serving
shown in Figure 1. The memory system as a storage site for an information item.
consists of two levels, main memory and Each location is identified by a unique
auxiliary memory. One or more processors "memory address." If the memory contains
have direct access to main memory, but not m locations, the addresses are the integers
to auxiliary memory; therefore information 0, 1, . - . , m - 1. If a i s an address, the
may be processed only when in main mem- item stored in location a is called the "con-
ory, and information not being processed tents of a,'; and is denoted c(a). Under
may reside in auxiliary memory. From now program control, a processor generates a
on, the term " m e m o r y " specifically means sequence of "references" to memory loca-
"main memory." tions, each consisting of an address and a
There are two time parameters of interest command to " f e t c h " from or " s t o r e " into
here. The first, known as "memory reference the designated location.
time," is measured between the moments
at which references to items in memory are
DEFINITION OF VIRTUAL MEMORY
initiated b y a processor; it is composed of
delays resulting from memory cycle time, As mentioned earlier, virtual memory may
from instruction execution time, from "in- be used to give the programmer the illu-
terference" b y other processors attempting sion that memory is much larger t h a n in
to reference the same memory module reality. To do this, it is necessary to allow
simultaneously, and possibly also from the programmer t~ use a set-of addresses
switching processors among programs. We different from that provided by the memory
take the average memory reference time to be and to provide a mechanism for translating
,5. The second time parameter, known as program-generated addresses into the cor-
"transport time," is the time required to rect memory location addresses. An address
complete a transaction that moves infor- used by the programmer is called a " n a m e "
mation between the two levels of memory; or a "virtual address," and the set of such
it consists of delays resulting from waiting names is called the address space, or name
in queues, from waiting for the requested space. An address used b~,: the memory is
information transfer to finish, and possibly called a "location" or " m e m o r y address,"

Computing Surveys, Vol. 2, No. 3, September 1970

158 • Peter J. Denning

f could be interposed between the processor

!
and the memory to handle the mapping
2 automatically. Note that, b y virtue of the

iI
mapping f, the programmer may be given
the illusion t h a t items consecutive in N are
4 stored consecutively in M, even though the
items m a y in fact be stored in arbitrary
order. This property of address maps is
known as "artificial contiguity" [R3].
m-!
The mapping device, when presented with
M0f~Y SPACE
7 name a, will generate a p = f(a) if item a is
ADDRESS SPACE present in M, and a missing-item fault
FiG. 2. Mapping from name to memory space otherwise. The fault will interrupt the
processing of the program until the missing
item can be secured from auxiliary memory
and the set of such locations is called the and placed in M at some location a' (which
memory space. F o r future reference we takes one transport time); the address map
denote the address space by N -- {0, 1, f is then redefined so that f(a) = a', and
• .., n- 1} and the memory space b y the reference may be completed. If M is full,
M = {0, 1, . - . , m - 1} and we assume some item will have to be removed to make
n > m unless we say otherwise. way for the item entering, the particular
Since the address space is regarded as a item being chosen at the discretion of the
collection of potentially usable names for replacement rule (if item b is entering and the
information items, there is no requirement replacement rule chooses the replace item a,
that every virtual address "represent" or where a p -- f(a), then the address map is
" c o n t a i n " any information. redefined so t h a t f(b) becomes a' and
The price to be paid for there being no a f(a) becomes ¢). Contrasted with the re-
priori correspondence between virtual ad- placement rule, which decides which items
dresses and memory locations is increa,sed to remove, are the fetch rule, which decides
complexity in the addressing mechanism. when an item is to be loaded, and the
We must incorporate a way of associating placement rule, w h i c h decides where to
names with locations during execution. place an item. If no action is taken to load
T o this end we define, for each moment of an item into M until a fault for it occurs,
time, a function f : N - + M U {4~} such t h a t the fetch rule is known as a demand rule;
otherwise, if action is taken to load an item
' if item a is in M at location a', before it is referenced, the fetch rule is
f(a) = if item a is missing from M.
known as a nondemand or anticipatory rule.
This function f is known as the address map,
or the address-translation function. ADDRESS TRANSLATION MECHANISM
-r 1
For reasons given earlier, it is to our I MAP TABLE f I
advantage to make n much larger than m,
'
but this is not necessary. Even if n _~ m, O'
virtual storage could help with the relocation
problem [Dll], i.e. t h a t of moving informa- P t AOORESS } MEMORY
tion around in memory. I
Figure 2 gives an example of a mapping
f, where a line (a, a') for a in N and a' OPERATION:
in M indicates that item a is stored in loca- a loaded into VA
tion a', and the absence of a line indicates if ath entry of j blank, missing-item fault
t h a t item a is not present in M. Figure 3 a' loaded into MA
shows how a hardware device implementing FIG. 3. Implementation of address map

CompuLing Surveys, Vol. 2, No. 3, September 1970

 Virtual Memory • 159

Consider briefly the implementation of experiments addressed the question " H o w

the address map f. The simplest implemen- do programs behave under given automatic
tation to visualize, called direct mapping, storage allocation policies?" but not the
is a table containing n entries; the ath question at hand, "How does automatic
entry contains a' whenever f(a) = a r, and storage allocation compare with manual?"
is blank (i.e. contains the symbol ~) other- Experiments for the former question are
wise. If, as would normally be the case, n clearly of a different nature than those for the
is much greater than m, this table would latter. Therefore, attempts to make in-
contain a great many (i.e. n - m) blank ferences about the latter from data gathered
entries. A much more efficient way to repre- about the former are bound to result in
sent f is to create a table containing only conflicting conclusions. The following dis-
the mapped addresses; the table contains cussion is based on a paper by Sayre [$2],
exactly the pairs (a, a ~) for which f(a) = a' who has summarized and interpreted the
and no pair (a, ~), and thus contains at work of Brawn and Gustavson [B9], for
most m entries. Such a table is more com- these appear to be the only published works
plicated to use; when presented with name addressing the latter question.
a, we must search until we find (a, a') for If the name space N is larger than the
some a', or until we have exhausted the memory space M, it is necessary to "fold"
table. Hardware associative memories are N so that, when folded, N will "fit" into M.
normally employed for storage of these Let g(b, t) denote the inverse of the address
mapping tables, thereby making the search map f:
operation quite efficient. (An associative, or
"content-addressable," memory is a memory g(b, t) = I a if f(a) = b at time t,
device which stores in each cell information undefined otherwise.
of the form (k, e),where k is a " k e y " and e
an " e n t r y . " The memory is accessed by The address space N is said to be folded if,
presenting it with a key k; if some cell con- for some b and tl < t2, g(b, tl) # g(b, t2).
tains (k, e) for some e, the memory returns That is, there is some memory location
e, otherwise it signals "not found." The w h i c h has been assigned to more than
search of all the memory cells is done si- one address during the course of a program's
multaneously so that access is rapid.) execution. Between the instants tl and t~,
a sequence of commands, m o v e o u t and
m o v e in, must have been issued, which
MANUAL VERSUS AUTOMATIC MEMORY caused g(b, tl) to be replaced by g(b, t2).
MANAGEMENT The name space N is manually folded if the
programmer has preplanned storage alloca-
The discussion in the Introduction reviewed tion, and has inserted the m o v e o u t and
the motivation for automatic storage allo- m o v e in commands into the program text
cation from a qualitative view. Before open- where needed. The name space is auto-
ing the discussion of methods for imple- matically folded if the m o v e o u t and m o v e
menting and regulating virtual memory, we in commands are not in the program text,
should like to motivate automatic storage but instead are generated by the replace-
allocation from a more quantitative view. ment and fetch rules, respectively, of the
The question before us is: How well does virtual memory mechanism. Note that
automatic storage allocation compete with manually folded text is intended to fit into
manual? some specific memory space of size So,
Although the literature contains sub- whereas the automatically folded text may
stantial amounts of experimental informa- fit into any nonempty memory space.
tion about program behavior under auto- The question before us now is: Can auto-
matic storage management [B3, B9, C3, matic folding compete with manual folding?
F2, F3, F4, K5, O2, $2], authors have reached It is reasonably clear that automatic folding
conflicting conclusions. M a n y of these should be competitive when the speed ratio

Computing Surveys, Vol. 2, No. 3, September 1970

160 • Peter J. Denning

T/a between main and auxiliary memory is for a wide range of s, including s much less
small; but is it competitive when T/h is than So. In other words, a given program is
large (say, 104 or greater)? Sayre reports compatible with many memory sizes under
affirmatively. automatic folding, but only one under
Brawn and Gusta~vson, Sayre tells us, manual.
considered a number of programs represent- As we shall see in the section on Program
ing a wide range of possible behaviors, and Behavior and Memory Management, virtual
the following experiment in a memory sys- memory management mechanisms perform
tem with T/& in excess o f 104. For a given most efficiently when programs exhibit good
program, let Ta(so) denote the total running locality, i.e. they tend to concentrate their
time (execution and transport time) when references in small regions of address space.
N is folded automatically into a memory We shall define a measure of locality, the
of size So, when a demand fetch rule and a working set of information, which will be
good replacement rule are in effect. Let the smallest set of virtual addresses that
Tm(so) denote the total running time when must be assigned to memory locations so
N is folded manually for a memory of size that the program may operate efficiently.
so. For the programs considered, Sayre reports that the running time under
automatic folding, Ta(s0), can be very
0.8 < T~(so)/T~(so) < 1.7, sensitive to programmers' having paid at-
(i)
W[Ta(so)/Tm(so)] = 1.21, tention to endowing the programs with
small working sets, and relation (i) depends
where E[ ] denotes expected value. In on this having been done. Should program-
other words, automatic folding was (on the mers not pay attention to this, very large
average) no more than 21 percent less Ta(so)/Tm(so) can occur. Sayre reports that
efficient than manual folding. the costs of producing good manually :folded
Now, let Ks(so) denote the number of text appear to exceed by 25 to 45 percent
transports issued while the program ran the costs for producing nonfolded text with
under the automatic folding conditions, and good locality. Thus, one can tolerate as
Kin(so) denote the number of transports much as 25 percent inefficiency in the auto-
under the manual folding conditions. For matic folding mechanism before virtual
the programs considered, memory begins to be less efficient than
0.6 < K~(so)/K,,(So) < 1.05, manual folding. Relations (i) indicates this
generally is the case.
E[K~(so)/Km(so)] = 0.94. On the basis of the experimental evidence,
Thus the automatic folder (i.e. the virtual therefore, we may conclude that the best
memory) generally produced fewer moves automatic folding mechanisms compete very
than the manuM folder (i.e. the program- well (and may indeed outperform) the best
mer). A similar result was observed by the manually folded texts. Virtual memory is
Atlas designers for a more restricted class of thus empirically justifiable.
programs [K3]. The advantage of manual
folding is that, unlike virtual memory with a
demand fetch rule, processing may be over- IMPLEMENTATION OF VIRTUAL MEMORY
lapped with transports This suggests that The table implementation for the address
anticipatory fetch rules might result in mapping f described in the section on Defi-
ratios Ta(so)/T,~(so) consistently less than nition of Virtual Memory is impractical,
one [P1]. because it would require a second memory
The experiments show also that the auto- of size m to store the mapping table. In the
matic folder is robust, i.e. it continues to following sections we shall examine t h r e e
give good performance for memory sizes methods that result in a considerable re-
well below the intended So. Specifically, duction in the amount of mapping informa-
T~(s)/Tm(so) was found essentially constant tion that must be stored. Each method

Computing Surveys, Vol, 2, No. 3, September 1970

 Virtual Memory • 161

groups information into blocks, a block machine independence and list processing,
being a set of contiguous addresses in ad- are not peculiar to virtual memory systems.
dress space. The entries in the mapping They were fought for in physical storage
table will refer now to blocks, which are far during the late 1950s [W5]. 'Dynamic storage
less numerous than individual addresses in allocation, linking and relocatable loaders
address space. The first method--segmenta- [M3], relocation and base registers [Dll],
tion-organizes address space into blocks and now virtual memory, ~ll result from the
("segments") of arbitrary size. The second fight's having been won.
method--paging--organizes memory space The segmented address space achieves these
into blocks ("pages") of fixed size. The third objectives. Address space is regarded as a
method combines both segmentation and collection of named segments, each being a
paging. linear array of addresses. In a segmented
Both segments and pages have names, address space, the programmer references
which can be used to loeate entries in the an information item by a two-component
map tables. Segment names are usually (but address (s, w), in which s is a segment name
not always) assigned by the programmer and and w a word name within s. (For example,
are interpreted by the software, and page the address (3, 5) refers to the 5th word in
names are usually assigned by the system in the 3rd segment.) We shall discuss shortly
and interpreted by the hardware. Segmenta- how the address map must be constructed
tion and paging, when combined, form an to implement this.
addressing system incorporating both levels
By allocating each program module to its
of names. Otherwise, the only essential
own segment, a module's name and internal
difference between the two schemes is
addresses are unaffected by changes in other
paging's fixed block size.
modules; thus the first two objectives may
Segmentation be satisfied. By associating with each seg-
Programmers normally require the ability ment certain access privileges (e.g. read,
to group their information into content- write, or instruction-fetch), protection may
related or function-related blocks, and the be enforced. By enabling the same segment
ability to refer to these blocks by name. to be known in different address spaces under
Modern computer systems have four objec- different names, the fourth objective may be
tives, each of which forces the system to satisfied.
provide the programmer with means of Figure 4 shows the essentials of an ad-
handling the named blocks of his address dress translation mechanism that imple-
space: ments segmentation. The memory is a
• Program modularity. Each program linear array of locations, and each segment
module constitutes a named block which is is loaded in entirety into a contiguous
subject to recompilation and change at any region of memory. The address a at which
time. segment s begins is its base address, and the
number b of locations occupied by s is its
• Varying data structures. The size of
limit, or bound. Each entry in the segment
certain data structures (e.g. stacks) may
table is called a descriptor; the sth descriptor
vary during use, and it may be necessary to
contains the base-limit information (a, b)
assign each such structure to its own, varia-
for segment s if s is present in memory, and
ble size block.
is blank otherwise. The steps performed in
• Protection. Program modules must be forming a location address a' from a name
protected against unauthorized access. space address (s, w) are shown in Figure 4.
• Sharing. Programmer A may wish to Note that a missing-segment fault occurs
borrow module S from programmer B, even if s it not present in memory, interrupting
though S occupies addresses which A has program execution until s is placed in
already reserved for other purposes. memory; and an overflow fault occurs if w
These four objectives, together with falls outside the allowable limit of s. Pro-

Computing Surveys, Vol. 2, No. 3, September 1970

162 • Peter J. Denning

SI~31WF~T TABLE ST is known sometimes as the descriptor base

register.

"1
In this case, each program-generated
access would incur two memory-references,

tl.'
one to the segment table, and the other to
the segment being referenced; segmentation
SEGMENT llA7 LIMIT
would thus cause the program to run as slow
MEMORY
AOORESS as half speed, a high price to pay. A common
WORD solution to this problem incorporates a
small high speed associative memory into
the address translation hardware. Each
associative register contains an entry (8, a, b)
OPERATION: and only the most recently used such entries
(s, w) loaded into segment and word registers are retained there. If the associative memory
if sth entry of ST blank, missing-segment fault contains (s, a, b) at the moment (s, w) is to
if w > b, overflow fault be referenced, the information (a, b) is
(a + w) loaded into MA immediately available for generating the
Fro. 4. Address translation for segmentation location address a'; otherwise the additional
reference to the segment table is required.
I t has been found that 8 to 16 associative
teetion bits (the darkened region in the registers are sufficient to cause programs
table entry of Figure 4) can be checked to run at very nearly full speed [$4]. (The
against the type of access being attempted exact number depends of course on which
(i.e. read, write, or instruction-fetch) and a machine is under consideration.)
protection fault generated if a violation is Historically, the four objectives discussed
detected. at the beginning of this section haw~ been
The segment table can be stored in main provided by "file systems," which permit
memory instead of being a component of programmers to manipulate named "files"
the address translation mechanism. Figure 5 and to control decisions that move them
shows the operation of the mapping mecha- between main and auxiliary memory. In
nism when the segment table is in memory principle, there is no need for the pro-
starting at location A. The segment table grammer to use a file system in a virtual
is itself a segment, known as the descriptor memory computer, since auxiliary memory
segment, and the segment table base register is presumably hidden from him and all his
information m a y be permanently represented
in his address space. In practice, most
SEGMENT MEMORY contemporary "virtual memory systems"
--~ AOORESS
provide both a virtual memory and a file
SEGMENT
system, together with "file processing primi-
WORD BASE IdI~MOI~Y tives" that operate outside the virtual
REGISTER.
memory. In these systems, a "segment" is a
OPERATION : "file" that has been moved from auxiliary
(s, w) loaded into segment and word registers memory into address space. Multics is the
(A + s) loaded into M A only documented exception to this [B7].
c(A + s) fetched into MR Among the earliest proposals for segmen-
if MR blank, missing-segment fault
a := base field of MR • tation, though without the use of an address
b := limit field of MR space, was Holt's [H2]. Addressing schemes
if w > b, overflow fault very similar to that given in Figure 4 were
(a + w) loaded into MA first implemented on the Rice University
Fro. 5. Segmentation with mapping table in mem- Computer [I1, I2] and on the Burroughs
ory B5000 computer [B10, M1]. This idea was

Computing Surveys, VoL 2, No. 3, September 1970

 Virtual Memory • 163

expanded, its implications explored, and a P~ T~.E PT

strong case made in its favor by Dennis
[DIO-D12]. Details of implementing seg- I
mentation and of combining segments into
programs during execution are given by P
Arden et al. [AS], and again by Daley and
Dennis [D1]. Dennis and Van Horn [D13],
Johnston [J1], and also Wilkes [W4], place VtRTUAL MEMORY
ADDRESS 2 p' ~ ADDRESS
segmentation in proper perspective among
all aspects of multiprocess computer systems.
Randell and Kuehner [R3] place segmenta-
tion in perspective among dynamic storage
allocation techniques, and provide details OPERATION:
for its implementation on various machines. a loaded into VA
p := [a/z]
Paging w := R,(a)
Paging is another method for reducing if pth entry of PT blank, missing-page fault
the amount of mapping information and (p' + w) loaded into MA
making virtual memory practical. Main Fi~. 6. Address translation for paging
memory is organized into equal size blocks
of locations, known as page frames, which
serve as sites of residence for matching size from virtual address a are shown in Figure 6.
blocks of virtual addresses, known as pages. Note that a missing-page fault occurs if p is
The page serves as the unit both of informa- not present in memory, interrupting program
tion storage and of transfer between main execution until p has been placed in an
and auxiliary memory. Each page frame will available frame of memory. Protection bits
be identified by its frame address, which is (the darkened area in the page table entry)
the location address of the first word in the may be compared against the type of refer-
page frame. ence being attempted, and a protection
fault generated if a violation is detected.
We suppose that each page consists of z
words contiguous in address space, and that As in the implementation of segmentation,
the address space N consists of n pages the page table can be stored in memory.
{0, 1, 2, . . . , n - 1} (i.e. nz virtual ad- The modification of the address translation
dresses), and the memory space M consists mechanism follows the Lsame lines as Figure
of m page frames {0, z, 2z, . . . , (m -- 1)z} 5, and is not shown here. As before, program
(i.e. mz locations). A virtual address a is operation may be speeded up by incorporat-
equivalent to a pair (p, w), in which p is a ing an associative memory into the address
page number and w a word number within translation mechanism to retain the most
page p, according to the relation a = pz + recently used page table entries.
w, 0 <_ w < z, where p = [a/z], the Paging was first used in the Atlas compu-
integer part of a/z, and w = R,(a), the ter IF3, K3], and is presently used by almost
remainder obtained in dividing a by z. In every manufacturer in at least one of his
machines using binary arithmetic, the products [R3]. As with any virtual memory
computation that generates (p, w) from a is system, it shields, the programmer from
trivial if z is a power of 2 [A5, Dll]. storage allocation problems, and is therefore
Figure 6 shows the essentials of the address susceptible to misuse; its performance has
translation mechanism that implements generally been encouraging [A4, 02, P1, $2],
paging. The pth entry of the page table con- but occasionally discouraging [K6]. Because
tains frame address p' if page p is loaded in paging has received a great deal of attention
frame p', and is blank otherwise. The steps in the literature, and its behavior nonetheless
performed in forming location address a' tends not to be widely understood, we shall

Computing Surveys, ¥ol. 2, No. 3, September 1920

k • .> ,•2 '~ : ~ : : ~ ' ~ , ~

164 • Peter J. Denning

SEGMENT PAGE linear name space in its own right, may be

TABLE ST TABL~E
PT
described by its own page table. The sth
entry of the segment table contains :~ pair
(A, b) where A designates which page table

I " MEMORY
ADORE:S$
describes segment s and b is the limit for
segment s. The word address w is converted
WORD to a pair (p, wt) as in paging, and p is used
to index page table A to find the frame
OPERATION : address pl containing page p. As before,
(s, w) loaded into segment and word registers protection bits may be included in the seg-
if sth entry of ST blank, missing-segmentfault ment table entry. As before, the segment and
if w > b, overflowfault page tables may be stored in memory, the
p := [w/z] addressing mechanism being appropriately
w' := R~(w)
if pth entry of PTA blank, missing-page fault modified. As before, associative memory may
(p " + w') loaded into MA be used to speed up address formation;
indeed, the associative memory is essential
FIo. 7. Address translation for segmentation and here, since each program-generated mem-
paging
ory reference address incurs two table
references, and the program could run at one-
devote most of the later sections of this paper third speed without the associative memory.
to it. (If the processor has a sufficiently rich
repertoire of register*to-register operations,
Segmentation and Paging speed degradation would not be as bad as
Because paging by itself does not alter the one-third.)
linearity of address space, it does not achieve We mentioned earlier that segmentation
the objectives that motivate segmentation. and paging combined serve to achieve the
Because segmentation by itself requires that objective of sharing or borrowing programs
contiguous regions of various sizes be found (see the section on Segmentation .above).
in m e m o r y to store segments, it does not Programmer X, who owns segment s, may
result in the simple uniform treatment of allow programmer Y to borrow s, and Y may
main memory afforded by paging. To under- choose to call s by another name s'. Then
stand what is meant by "uniform treatment" programmer X's segment table will contain
of memory, compare the problem of loading (A, b) at entry s, and programmer Y's
new segment into memory with that of segment table will contain (A, b) at e,ntry s',
loading a new page into memory. Loading a where A designates a single (shared) page
segment requires finding an unallocated table describing the segment in question.
region large enough to contain the new The details of implementation, as well as a
segment, whereas loading a page requires description of advantages and difficulties of
finding an unallocated page frame. The sharing segments, are adequately described
latter problem is much less difficult than in [A5, B7].
the former: whereas every unallocated page
frame is exactly the right size, not every Most addressing mechanisms use a single
unallocated region may be large enough, register to implement the segment and word
even though the sum of several such regions registers shown separately in Figure 7. Typi-
may well be enough. (The question of find- cally the leftmost q bits of this register con-
ing or creating unallocated regions will be tMn the segment name, and the rightmost r
considered later.) bits contain the word name; thus there may
It is possible to combine segmentation be as many as 2q segments and 2 ~ words
and paging into one implementation, thereby per segment. In these implementations the
accruing the advantages of both. Figure 7 r word-bits serve as the program counter
shows the essentials of such an addressing (PC). Now suppose the program attempts to
mechanism. Each segment, being a small increment the program counter (i.e. PC : =

Computing Surveys, Vol. 2, No. 3, September 1970

 Virtual Memory * 165

PC + 1) when its contents are c(PC) = m°l

2 * - 1; the result will be c(PC) = 0 and a

carry from the leftmost program counter
position. Some implementations require
that a segment's size limit b satisfy 0 _<
b < 2 r, whereupon this carry would trigger
an overflow fault. Other implementations Fio. 8. Checkerboarding of memory
allow the carry to propagate into the seg-
ment field; thus if c(PC) = 2 ~ - 1 in segment
s and the operation PC : = PC + 1 is figuration of the memory. A transaction is
performed, the result is c(PC) = 0 in seg- either a request to insert a new segment of
ment s + 1 [R3]. given size, or to delete some segment already
present. We assume t h a t the system is in
STORAGE UTILIZATION equilibrium; i.e. that, over a long period of
time, the number of insertions is the same as
Our previous discussion has directed atten- the number of deletions for segments of each
tion to the mechanisms of implementing size. (For our purposes, the fetch policy is
segmentation, paging, or both. A virtual the source of insertion requests and the
memory system, however, is more than mere replacement policy the source of deletion
mechanism; it necessarily includes the requests.) After a long time, the memory will
policies whereby the mechanisms are used. consist of segments interspaced with holes
We mentioned earlier that policies fall into (unallocated regions); as suggested b y Figure
three classes: 8, the memory has the appearance of being
1. Replacement policies. Determine which "checkerboarded."
information is to be removed from memory; The placement algorithm, which imple-
i.e. create unallocated regions of memory. rnents the placement policy, makes use of
2. Fetch policies. Determine when in- two tables: the "hole table," which lists all
formation is to be loaded; i.e. on demand or the holes, and the "segment table," which
in advance thereof. already exists for use b y the addressing
3. Placement policies. Determine where mechanism. An insertion request for seg-
information is to be placed; i.e. choose a ment s, which always adds entry s to the
subset of some unallocated region. segment table, may increase, leave un-
Replacement and fetch policies use es- changed, or decrease the number of holes
sentially the same principles in both paged depending respectively on whether s is
and nonpaged systems, and present the inserted so as to be surrounded b y two boles,
same degree of difficulty in either case; we a hole and a segment, or two segments.
therefore defer discussion of these topics The last possibility occurs with very low
until later. The placement policy for placing probability and may be ignored; and the
k pages in a paging system is in principle first possibility is usually precluded because
quite elementary; use the replacement policy placement policies make insertions beginning
to free k pages. Placement policies for non- at a boundary of the hole. A deletion request
paging systems are, however, considerably for segment s, which always removes entry s
more involved. To investigate why this is from the segment table, may decrease, leave
so, we consider a very elementary model for unchanged, or increase the number of holes,
th~ behavior of a nonpaged memory system. depending respectively on whether s is
surrounded by two holes, b y a hole and a
Placement Policies segment, or by two segments. Both the hole
We suppose that a linear m-word memory table and the segment table must be modified
is to be used to store each segment con- appropriately at each transaction.
tiguously (in the manner of the section on We shall derive now two simple but im-
Segmentation). At certain moments in time portant relationships for placement policies
transactions occur, which change the con- having the properties described above. The

Computing Surveys, Vol. 2, No. 3. September 1970

166 • Peter J. Denmng

first is the "fifty percent rule" (due to Knuth might seem, for simulation experiments
[K4]), which states that the average number [K4] show that there is a large variance in
of holes is half the average number of seg- hole sizes, and it is often possible to make f
ments. The other is the "unused memory as small as 10 percent (i.e. k approximately
rule," which establishes a relation between ¼). Even so, it is not possible to reduce f to
the difficulty of placing a segment and the zero.
amount of unused memory. Of the many placement algorithms having
FIFTY PERCENT RVL~ [K4]. Suppose the the properties described above, there are two
memory system described above is in equilib- of special interest. The first is appealing
rium, having an average of n segments and h because it makes best use of holes, and the
holes, where n and h are large. Then h is second is appealing because it is simple to
approximately n /2. implement. Assume there are h holes of sizes
To establish this, we find the probability p xl, x2, • •., xh, and an insertion request of
that an arbitrarily chosen segment has a hole size s arrives.
as right neighbor ("right" has meaning 1. Best fit. The hole table lists holes in
according to Figure 8). Over a segment's order of increasing size (i.e. xl ~_ x2 _< . . .
lifetime in memory, half the transactions _< xh). Find the smallest i such that s _< xi.
applying to the memory region on its im- 2. First fit. The hole table lists holes in
mediate right are insertions, half are dele- order of increasing initial address. Find the
tions; thus p = ½. Therefore, the number of smallest i such that s < xl. (After a long
segments with holes as right neighbors is time, small holes would tend to accumulate
np = n/2, i.e. the number of holes is ap- at the head of the hole list, thereby increas-
proximately n/2. ing the search time. To prevent this, the
UNUSED MEMORY RULE. Suppose the hole table is implemented as a circular list
memory system described above is in equilib- with a "start pointer"; each search advances
rium, and let f be the fraction of memory the pointer and begins searching with the
occupied by holes. Suppose further that the designated hole.)
average segment size is So and that the average Knuth [K4] reports detailed simulation
hole size is at least kSo for some k > O. Then experiments on these and other placement
f >_ k / ( k + 2). policies. He finds that the first-fit algorithm
To establish this result for an m-word is the most efficient of a large class of al-
memory we note that, by the fifty percent gorithms, including the best-fit. He finds also
rule, there are n / 2 holes in memory; since that the memory size must be at least ten
each segment occupies an average space of times the average segment size for efficient
size so, the amount of space occupied by operation. Similar conclusions are also
holes is m -- nso, and the average space per reported by Collins [C6].
hole (hole size) is x = (m -- nso)/h = Knuth reports also on another algorithm
2(m - nso)/n. But we assume x ~ ks0, which he found slightly better than first-fit
which implies but which, being not in the class of placement
(him)so < 2/(k + 2). policies described above, does not follow the
fifty percent rule and the unused memory
Then rule. This policy is called the "buddy sys-
f = ( m - - n s o ) / m = 1 - (n/m)so tem." Its dynamic properties have not yet
been completely deduced [K4].
_> ~ - 2 / ( k + 2) = k / ( k + 2).
3. Buddy system. Assume that the re-
In other words, if we wish to limit place- quest size is s = 2 ~ for some i ~ ,~. This
ment algorithm overhead by maintaining policy maintains k hole-lists, one for each
large holes, we must be prepared to " p a y " size hole, 21, 2~, . . . , 2k. A hole may be re-
for this limitation by "wasting" a fraction f moved from the (i + 1)-list by splitting it in
of memory. This is not quite as serious as it half, thereby creating a pair of "buddies" of

Computing Surveys, Vol. 2, No. 3, September 1970

 Virtual Memory • 167

sizes 2 i, which are entered in the /-list;

/
conversely, a pair of buddies m a y be removed
I~ wm(#-#) ..L mf .~
from the/-list, coalesced, and the new hole V T
entered in the (i + 1)-list. To find a hole of
size 2 ~, we apply this procedure recursively:
procedure gethole(i) HOL£
begin if i ~ k + 1 then report failure;
if/-list empty then
begin hole := gethole(i + 1);
split hole into buddies;
place buddies in/-list; Fio. 9. Configuration of memory after compaction
end
gethole := first hole in/-list;
end gested in Figure 9. At certain moments in
t i m e - - " c o m p a c t i o n initiations"--computer
Overflow and Compaction operation is suspended and all segments are
The unused-memory rule tells us that, in moved together at the low end of memory,
equilibrium, we must tolerate a significant creating one large hole at the high end of
loss of memory. In terms of Figure 8, the memory. Each insertion request is placed at
memory has become so checkerboarded that the low end of the hole, thereby moving the
there are many small holes, collectively boundary rightward; when the boundary
representing a substantial space. Indeed, it reaches the high end of memory, the next
is possible that, when we scan the hole sizes compaction initiation occurs.
x~, x~, • •., xh for a request of size s, we find COMPACTION RESULT. Suppose the mem-
s > x~, 1 < i < h (i.e. the request can- ory system described above is in equilibrium,
not be satisfied) even though s < ~]~=1 x~ a fraction f of the memory being unused;
(i.e. there is enough space distributed among suppose that each segment is referenced an
the holes). What can be done about this? average r times before being deleted, and that
The solution usually proposed calls for the average segment size is So. Then the fraction
"compacting memory," i.e. moving seg- F of the time system expends on compaction
ments around until several holes have been satisfies F ~ (1 -- f)/[1 -- f + (f/2)(r/so)].
coalesced into a single hole large enough to T o establish this result, observe t h a t a refer-
accommodate the given request. K n u t h [K4] ence occurs to some segment in memory each
reports that simulation experiments showed time unit, and that one segment is deleted
that, when the first-fit algorithm began to every r references. Because the system is in
encounter overflow, memory was nearly full equilibrium, a new segment must be inserted
anyway; thus compacting it would provide every r references; therefore the rate of the
at best marginal benefit. In other words, a boundary's movement is so/r words per unit
good placement policy tends to obviate the time. The system's operation time to is then
need for a compacting policy. the time required for the boundary to cross
A somewhat different point of view can be the hole, i.e. to = fmr/so. The compaction
adopted regarding the role of memory com- operation re~luires two memory references--
paction. Instead of using a sophisticated hole a fetch and a store--plus overhead for each
selection policy and no compaction, we may of the (1 - f ) m words to be moved, i.e. the
use a sophisticated compaction policy and compaction time t~ is at least 2(1 -- f)m.
n o hole selection. Just as overhead in main- The fraction F of the time spent compacting
taining the hole list previously limited our is F = 1 - to/(to + t~), which reduces to the
ability to use memory fully, so the overhead expression given.
in running a compaction policy limits our Figure 10 shows a plot of F versus f, from
ability to use memory fully. To show this, which it is evident that, if we are to avoid
we consider the compaction scheme sug- expending significant amounts of time com-

C o m p u t i n g Surveys, Vol. 2, No. 3, S e p t e m b e r 1970

; Z!
168 • Peter J. Denning

F Fragmentation
Our discussion in the previous section
unveiled a problem of some importance in
virtual memory systems; storage fragmenta-
o.e .-~,-, I tion, the inability to assign physical locations
to virtual addresses that contain informa-
tion.
(14
There are three major types of storage
fragmentation. The first is external frag-
O.4 mentation [R2], which occurs in nonpaged
memories when checkerboarding becomes so
pronounced that every hole is too small to
0.2 be used. (More precisely, external frag-
mentation occurs for segments of size s with
0 f
probability E(s), the probability that
o e.z 0.4 0.6 o.e Lo s > max{xl}, where {xi} are the hole sizes.
Fro. 10. Inefficiencyof compaction E(s) follows the curve suggested in :Figure
11.) The second is internal fragmentation
pacting, we must tolerate a significant waste [R2], which results in paged memories be-
of memory. Because of the relative slowness cause storage requests must be rounded up
of compaction compared to searching a well- to an integral number of pages, the last part
organized hole list, the former tends to be of the last page being wasted (Figure 12).
less efficient than the latter, and compaction (More precisely, if z is the page size and s a
is not often used. segment size, then s is assigned to k pages,
In summary, nonpaged memory requires where (k -- 1)z < s < kz; then kz - s
an "investment," i.e. a certain amount of words are wasted inside the last page.) The
unused memory and overhead in placement third is table fragmentation, which occurs in
policies, for efficient operation. Some sys- both paged and nonpaged memories because
tems, notably the Burroughs B5000 series physical locations are occupied by mapping
[R3] and certain CDC 6600 installations tables and are therefore unavailable for
[B1], have chosen to make this investment; assignment to virtual addresses.
but most have elected to use paged memory, Randell [R2] reports simulation experi-
which can be fully utilized by pages at all ments showing that fragmentation raay be
times. Many of the techniques discussed in serious, and that internal fragmentation is
this section have been used with great suc- more troublesome than external. His experi-
cess in applications of a less general purpose ments rely on three assumptions: (1) each
nature, particularly in list-processing sys- segment is entirely present or entirely
tems [BS, C4, K4]. missing from memory, (2) each segment
begins at a new page boundary, and (3)
£¢,)
segments are inserted or deleted one at a
time. Many systems violate (1), there being
some nonzero probability that a segment's
final page is missing. Many systems violate
(2) and (3) by providing facilities theft allow

I ~ I 2 k

L I-l ao
v!

Fro. 11. Probability of external fragmentation F~a. 12. Internal fragmentation

Computing Surveys, Vol. 2, No. 3, September 1970

 Virtual M e m o r y • 169

m a n y small segments to be combined into space, in which the internal fragmentation

one large contiguous region of address space will occur only in the last page of the last
(e.g. a "relocatable loader" for virtual segment in a such collection. If there are k
memory, or a file system separate from segments in such a collection on the average,
virtual memory). Thus fragmentation is not then the foregoing results are modified by
as serious in practice as it could be, but then replacing so by ks0, whence zo = (2ckso) ~.
again it cannot be ignored. These results are by no means new. In
fact, the problem of choosing page size to
Page Size
Two factors primarily influence the choice minimize fragmentation is identical to that
of choosing block size in variable length
of page size: fragmentation, and efficiency
buffers to minimize space lost to internal
of page-transport operations.
fragmentation and to chaining information.
There is a page size optimal in the sense Wolman [W7] has studied this issue in some
that storage losses are minimized. As the detail; he gives a detailed account of the
page size increases, so increases the likeli- accuracy of the approximation z0 ~= (2s0) ½.
hood of waste within a segment's last page.
What might be a typical value for z0?
As the page size decreases, so increases the
The available data on segment size [B2]
size of a segment's page table. Somewhere
suggests t h a t so g 1000 words in most cases;
between the extremes of too large and too
taking this and c = 1, we find z0 _~ 45 words.
small is a page size that minimizes the total
This is rather startling when we consider
space lost both to internal fragmentation
that pages of 500-1000 words are commonly
and to table fragmentation.
used.
OPTIMAL PAGE SIZE RESULT. Let z be
the page size and so the average segment size; When we consider the other f a c t o r - -
suppose el is the cost of losing a memory word efficiency of page-transport operations--we
to table fragmentation and c2 the cost of losing discover the motivation for using a large
a memory word to internal fragmentation, page size. Each page-transport operation
and let c = c~/c~ . I f z << so, the optimal page takes one transport time T (see the section
size Zo is approximately (2cs0)t. on Basic System Hardware above) to be
completed. The following expressions for T
To establish this result, suppose segment
on typical devices are lower bounds because
size s is a random variable with expectation
in deriving them, we have ignored queueing
E[s] = so. A segment may be expected to
delays and processor overhead expended on
occupy approximately so/z pages, each being
name conversion and auxiliary memory
described by one page table word; the page
control.
table cost for this segment is therefore ap-
proximately ClSo/Z. If z << so, the expected 1. Drums. To obtain a page from a
loss inside the last page is approximately drum, one must wait an average of half a
z/2; the internal fragmentation cost for this drum revolution time t~ for the initial word
segment is therefore approximately c~z/2. of the desired page to rotate into position.
The total expected cost for fragmentation is If there are w words on the circumference
then of the drum, the page transfer time tt is
t rz/w. Therefore
E i C I z] = (So/Z)C~ + (z/2)c~ .
T = tr/2 + tt = t,(1/2 + z/w).
If we set d E [ C ] z ] / d z = 0 and solve for z,
we obtain the expression given for z0. Typically, t~ = 16 msec and w = 4000
These results presume that each segment words.
begins on a page boundary (as suggested by 2. D i s k s (moving arm). A disk access is
Figure 12), and t h a t both the segment and just like a drum access except there is an
its page table are entirely present in memory. additional "seek time" t~ required to move
M a n y virtual memory computers provide the arms into position. Therefore
mechanisms for loading or relocating a col-
lection of segments contiguously in address T = t~ + tr/2 + tt = t, + t~(1/2 + z / w ) .

Computing Surveys, Vo|. 2, No. 3, September 1970

170 • Peter J. Denning

T (pIJ ta, it delivers v words per main memory

cycle. Therefore
,o'
T = t~, + t , . = ta + (Z/v)tc.
Typically, t~ = 3 psec, tc = 1 psec, and v =
10 words.
Figure 13 shows these four lower bound
,o' transport time expressions plotted for various
values of z. Note the several orders of magni-
tude differences at small page sizes. Figure
14 shows the corresponding upper bound
efficiencies e = t t / T plotted for various
IO
values of z. I t is immediately apparent from
these figures t h a t moving-arm disks should
£c
never be used, neither for paging applications
nor for any other heavy-traffic auxiliary
z
memory applications [D3]. It is also apparent
i I0 I00 0 t h a t drums should be used with care [C2,
Fzo. 13. L o w e r b o u n d t r a n s p o r t t i m e s D3]; and that if drums are used, a page size
of at least 500 words is desirable. ']?his is
why most paging systems use drums instead
of moving-arm disks for auxiliary storage,
1.0 LCS
0.8 ~ ECS
why page sizes of 500-1000 words are com-
mon in these systems, and why some systems
have been experimenting with LCS [F1],
ECS [F5], and other [L2] auxiliary stores.
It is equally apparent t h a t there is a great
0.6. / / DRUM discrepancy between the page size for maxi-
mizing storage utilization and the page size
for maximizing page-transport efficiency--
0.4. about two orders of magnitude discrepancy.
It is easy to see that the poor performance of
some of these systems [K6] is at least par-
tially attributable to this factor.
It is sometimes argued that another factor
0 z inhibiting small page sizes is the additional
I I0 I00 I000 hardware cost to accommodate the larger
FIG. 14. Upper bound transport efficieneies number of pages. Whereas this hardware cost
is an initial one-shot investment, the in-
creased storage utilization provides a con-
Typically, t8 = 100 msec, t~ = 30 msec,
tinuing long-term payoff, and the extra
and w = 4000 words.
hardware is probably worthwhile. The
3. Large capacity storage (LCS). This is cache store on the I B M 360/85 is an ex-
nothing more than a slow-speed core mem- ample of a system where this investment
ory. If its cycle time is tc, then has been made, with apparently good effect.
T = t~ = ttz. One approach to constructing a system in
which a page size z0 is feasible would be to
Typically, t~ = 10 psec. use a much faster device, such as LCS or
4. Extended core storage (ECS). This is a ECS, to handle the traffic of pages in and
form of core memory with special transmis- qut of main memory. Some systems have
sion facilities; after an initial "access time" adopted this approach IF1, F5, L2].

Computing Surveys, Vol. 2, No. 3, September 1970

 Virtual M e n w r y • 171

Another approach--"partitioned segmen- SEGMENT PAGE

TABLE ST TABLE p'ra
t a t i o n " - - h a s been suggested by Randell
[R2]. It effects a compromise between the
large page size required for transport effi-
ciency from rotating auxiliary devices and
the small page size required for good storage
utilization. We shall describe a slight variant
to Randell's scheme. The memory system
OPERATION :
uses two page sizes: a "major page" whose
size is chosen to make transports efficient, (s, w) Loaded into segment and word registers
if sth entry of ST blank, missing-segment fault
and a "minor page" whose size is chosen if w > b, overflow fault
close to z0. Suppose the major page size is p := [w/Z]
Z and the minor page size z, where Z is a p" :-=O
multiple of z. A segment of size s is assigned if pth entry of FT, marked by *,
a " h e a d " consisting of K major pages such p" := [(w - ZK)/z.]
that Z K < s < Z ( K + 1), and a "tail" if (p ÷ p")-th entry of PT~ blank, missing-page
fault
consisting of k minor pages such that vo' := R,(w -- ZK)
zk < s - Z K < z(k-4- 1 ) , a n d K q - k _ > 1. (p' ÷ w') loaded into MA
Internal fragmentation thus occurs only
within the last minor page. An address Fro. 15. Partitioned segmentation
translation mechanism that implements
partitioned segmentation is shown in Figure referenced pages to the total number of
15. A major drawback to this scheme is pages. T h a t c(z) -- x implies that at least a
that, to operate effectively, segments must fraction 1 - x of a program's words are
be large enough so that they consist mostly superfluous, or conversely that x is the
of major pages. Available data [B2] suggests maximum relative amount of memory space
that this need not be the case. a program needs on a given run. Note that
c(n) = 1 and c(1) = n ' / n . According to the
Compression Factor data presented by Belady [B3] and O'Neill
During any given run, certain sections of [02], the compression factor is approximated
a program's code will never be referenced by the expression
because conditional branch instructions will
have unfavorable outcomes. In other words, c(z) = a -~ b log2z, 25 < z _< 2",
an n-word program will, on a given run,
where a .~ 0 and b > 0. The data suggests
have occasion to reference only n' < n of
the following properties of c(z):
its words, and n' - n addresses will have
been unreferenced. These n' - n unrefer- 1. Halving the page size tends to decrease
eneed words are said to be superfluous [K5]. the compression factor b y 10 to 15 percent;
Storage losses due to loading superfluous thus 0.10 ~ b ~ 0.15 [B3].
words into main memory are less serious in 2. For small z, 1 < z < 25, the expression
paged memories using small page sizes a + b log2 z is a lower bound on c(z), and in
because, for small page size, unreferenced particular c(1) = n ' / n _> a. Extrapolating
blocks of code will tend to be isolated on the data, a in the range 0.1 ~ a < 0.4
their own pages, which need never be appear typical.
brought into memory. Belady's simulations 3. For page sizes z ~ 29, c(z) > 0.8
[B3] and O'Neill's data [02] confirm this. appear typical.
The more are superfluous words isolated These results are significant. T h e y reveal
on their own pages, the less space will a a frequently overlooked potential advantage
program require, and the more "compres- of virtual memory: small page sizes permit a
sible" will it be. For page size z and a given great deal of compression without loss of
run of the program, define the compression efficiency. Small page sizes will yield signifi-
factor c(z) to be the ratio of the number of cant improvements in storage utilization,

Colnputing Surveys, Vol. 2, No. 3, September 1970

]
172 • Peter J. Denning

TABLE I. COMPARISON OF PAGED AND NONPAGED MEMORY

Factor .Paged Nonpaged

Segmented name space Feasible Feasible

Number of memory accesses per pro-

gram reference:
1. With paging 2
2. With segmentation 2
3. With both 3
4. With associative memory mapping

Replacement policy Required Required

Fetch policy Usually demand Usually demand

Placement policy Required, but simple Required, but complicated

Memory compaction Not required Optional; of marginal value

External fragmentation None Yes; controlled by placement

policy and memory size at
least ten times average
segment size

Internal fragmentation Yes, but can be controlled by None

proper choice of page size

Table fragmentation Yes Yes

Compression factor Can be much less than 1 with Usually 1

small page sizes

over and above those gained by minimizing is an aspect of paged memory that makes
fragmentation. Nonpaged memory systems its implementation more elegant and much
(or paged systems with large page sizes) "cleaner" than implementations of non-
cannot enjoy this benefit. paged memory: its "uniform" treatment of
fnemory. Whereas paging regards main
COMPARISON OF PAGED AND NONPAGED memory simply as a pool of anonymous
MEMORIES blocks of storage, segmentation regards it
as a patchwork of segments and holes of
As we have discussed, the various imple- various sizes. The same statement holds
mentations of virtual memory fall into two for auxiliary memory. Therefore (fixed
classes: paged and nonpaged. We have length) page transports are much simpler
discussed a great number of facts pertaining to manage than (variable length) segment
to each. Table I summarizes these facts and transports. The difficulty of transporting
compares the two methods. variable length segments is compounded
According to Table I, paging is superior b y overhead in watching out for the specific
to nonpaging in all respects save suscepti- segment length in order not to overrun
bility to internal fragmentation; hut internal buffers. I t is no surprise that some form
fragmentation can be controlled by proper of paging is used in almost all virtual mem-
choice of page size. Not listed in the table ories.

Computing Surveys, "~ol. 2, No. 3, September 1970

 Virtual Memory • 173

DEMAND PAGING at the beginning (end) of a time quantum,

and demand paging were used within a time
Because paging is so commonly used and so quantum. We shall show that swapping is
frequently discussed in the literature, the at best of marginal value in systems using
remainder of our discussions center around either a nonmoving auxiliary store or a
this topic. Demand paging, the simplest specially organized drum, the paging drum.
form, is the most widely used. Demand Prepaging, however, may have some value
paging has--unfairly--been subjected t o when properly managed from a paging drum.
widely publicized criticism [F2, F4, K6, R3],
before anyone has had enough experience Paging Drum
to evaluate it properly. We pointed out in the section on Page
In order to avoid maintaining a large Size above that among all rotating or moving
number of lightly used resources, time- auxiliary stores, only drums (or drumlike
sharing and multiprogramming systems stores [A1]) may be suitable for handling
attempt to increase the load factors on page traffic through main memory. Even
resources by sharing them. To do this, time then, a particular drum organization is
is partitioned into disjoint intervals, each required for efficient operation. A paging
program being allocated resources during drum [A1, C2, D3, W1] consists of a drum
certain intervals but not during others. memory together with hardware (or soft-
(This is sometimes called resource multi- ware) implementing an optimal scheduling
plexing.) These intervals are defined either policy. As shown in Figure 16, the drum
naturally, by the alternation between surface is laid out into equal areas, each
running states and input-output waiting capable of storing one page ;each such "drum
states of processing, or artificially, by time page" is identified by its "sector address"
quanta and preemption. The latter method is i and its "field address" j. Each field is
used primarily in time-sharing systems, equipped with a set of read-write heads. As
where response-time deadlines must be shown in Figure 17, the scheduler sorts
satisfied. We restrict attention to this case incoming requests into s separate "sector
throughout this section. queues" according as which sectors are
At the beginning of its allotted time requested. Within a given sector queue,
quanta, a program's working information service is in order of arrival (i.e. "first-come-
must be loaded into main memory. Older first-served"). The rotary switch arm re-
time-sharing systems employed swapping volves synchronously with the drum, point-
to do this, i.e. they would transport'a pro- ing to queue i whenever sector i is under
gram's working information as a contiguous the read-write heads. Suppose a read (write)
unit into memory just before each time request for drum page (i, j) is at the head
quantum began, and o u t of memory just of sector queue i. Just as the switch arm
after each time quantum ended. Demand
paging systems transport just one page (that SECTOR | FIEiD j DROM.PAGE O,j)
containing the next instruction to be exe-
cuted) into memory just before a program's
time quantum begins, and "page in" addi-
tional pages as the program demands them;
at time quantum end, no immediate action
will be taken to remove a program's pages
from memory, that being left up to the
replacement policy.
One occasionally hears proposals to the
effect that paging systems could be improved READ-WRITE
markedly if swapping were used to load HEADS
(unload) a program's working information FiG. 16. Layout of paging drum

Computing Surveys, Vol, 2, No. 3, September 1970

174 Peter J. Denning

am~nHo n t ~ $ r $ and ep(L) that of System F, when the drum

load is held fixed at L. Then
ep(L) = (L + 1)/(s --k L -k 1),
L>i.
• eF(i) = 2/(s -b 2),
Consider System P. The expression for
ee(L) is an approximation derived as follows.
Let to, h , ' " , t k , . . , be a sequence of
time instants at which requests csmplete
service and depart from the drum system.
/ • (Since L is assumed fixed, a new request is
added to the drum system at each time
tk .) Then xk = tk - tk-1 denotes the service
• x /
time of the kth request, Since the requested

'N sector positions are statistically independent

and L is fixed, the service times x, have a
common distribution with expectation E[x].
SECTOR QUEUE Now, E[x] can be written E[x] = t -~- E[r],
Fio. 17. Paging drum queue organization where t = t~/s is'a transmission time and
E[r] an expected rotational delay. To ap-
proximate E[r], we imagine a circle with
reaches sector queue i, the heads for field j circumference tr having L -b 1 points dis-
are set to read (write) status and connected tributed randomly about its perimeter; one
to the drum channel. Then transmission of these points represents the drum position
begins. at the moment a request departs, and the
Paging drums are sometimes known as remaining L points represent the positions
"slotted drums" or "shortest-access-time- of the requested sectors. The expected
first" drums. Some manufacturers market distance between two of these points is
drumlike "paging disks," which are fixed- tr/(L q- 1) = E[r]. The efficiency is ep(L) =
head disks with one head per track• These t/E[x] = t/(t + E[r]), which reduces to the
are equivalent to paging drums. expression given. In System F, each request
in the queue must complete its service
The paging drum stands in contrast to its
before the next may begin, and each selects
historical predecessor, the "first-come-first- its sector randomly. Therefore eF(L) is
serve" (FCFS) drum, which collects all independent of L, and indeed el(L) =
incoming requests into a single, order-of- e , 0 ) = e~(1) = 2 / ( s + 2).
arrival queue. To compare these, we imagine
Several facts follow from this result. (1)
two systems: System P is a paging drum, For small page sizes (large s) the efficiency
and System F an FCFS drum. In both e~ is always small. (2) For any page size
systems, the drum revolution time is t~ and there are always values of L that make ee
the number of sectors is s. Since most drum close to 1. (3) Whereas eF is constant,
allocation policies do not attempt to group ee(L -b 1) > ee(L); in other words, the
contiguous pages of a given program on paging drum is "self-regulating," becoming
contiguous sectors, we may assume that more efficient under heavier loads. (4) For
each request selects a sector at random L > 1 and s ~_ 1, ee(L) > eF(L).
[A1, C2, D3, W1]. The "drum load" L is As one would suspect, the paging drum
the number of requests waiting in the drum (System P) gives smaller transport times
queue(s). than the less efficient FCFS drum (System
DRUM EFFICIENCY RESULT. Let ep(L) F).
denote the expected e~ciency of System P DRUM TRANSPORT TIME RESULT. Sup-

Computing Surveys, Vol. 2, No. 3, September 1970

 Virtual Memory . 175

pose a page request arrives when the drum Let Cd(A) denote the space-time cost
load is L. The time each system delays this of loading a working set into memory under
request is demand paging from auxiliary memory A,
Tp = t~(L/s + (s + 2)/2s), and Ca(A) the cost of loading a working set
L~O. into memory under swapping from auxiliary
T~ = t,(L + 1)(s -4- 2)/2s, memory A. We shall establish f()ur asser-
The incoming request will be known as tions:
the "tagged" request. In System P, the • Under demand paging, the paging drum
tagged request enters a sector queue whose costs significantly less than the FCFS drum
expected length is L' = L/s. Before com- (i.e. Cd(F) -- Cd(P) is large).
pleting service the tagged request experi- • With nonmoving auxiliary storage
ences the following additive delays: L/2 for (e.g. A is LCS or ECS), demand paging never
the drum to begin serving the first request costs more than swapping (i.e. Ca(A) _<
in the queue; L't, for the drum to begin Cs(A)).
serving the tagged request; and t~/s for its • The combined swapping and demand
own transmission. Thus T~ = t~(L' -4- paging strategy is at best of questionable
½ + 1/s). In System F, the tagged request value when compared to "pure" demand
joins the single queue with L requests ahead paging with a paging drum.
of it. There are now L + 1 requests in the
• Unless predictions can be made with
queue, each requiring time t r(~1 + 1/S) to
little error, prepaging, even from a paging
complete.
drum, may not be advantageous.
From these two results we see that, under
These assertions are considered in the
normal drum loads (L > 0), ee > e~ and
following paragraphs. Assume that a working
T~ < TF, with the greatest differences
set of size w is to be loaded, that a single
occurring at heavy loads. For these reasons,
transport operation requires processor time
paging systems using FCFS drums may
to, and that the drum has revolution time
experience severe loss of efficiency.
tr and s sectors.
Cost The cost Cd(A) is determined as follows.
To evaluate the "cost" of demand paging, Suppose k - 1 of the w pages have already
two concepts are useful: "space-time prod- been loaded and a fault for the kth page
uct" and "working set." Suppose a program occurs; we must reserve one more page of
occupies re(t) pages of memory at time t; memory and stop the program for the kth
the space-time product of memory usage transport time Tk. Since there is no correla-
across an interval (t~, t2) is defined to be tion between the order of page calls and
their order of storage on the drum, Tk = T
C(t~,h) = re(t) dt. for 1 < k <: w. Thus
1

Since memory usage charges are usually Cd(A) = 5~ kTk = kT

~1 (i)
based both on the extent and duration of
memory usage, C(t~, t~) relates to the actual = T(w(zo + 1)/2).
dollar cost of using memory, and is often Now if A is the paging drum system P (see
termed "cost." Space-time cost has become the section on Paging Drum above), then
an important aid in determining the efficacy T = to + Te. Similarly, T = to + TF for
of memory allocation strategies [B5, B6, D5, the FCFS drum system F. Applying the
D9, F1, L1, P1, R3]. The working set of a Drum ~Fransport Time Result for load L,
program at a given time is the smallest
collection of its pages that must reside in Cd(F) - Cd(P) = (W(W.+ 1)/2) t~(L/2).
memory to assure some level of efficiency As long as L >_ 1 (the usual case) the cost
(~ more precise definition will be given later) difference grows as the square of the working
[D4, D5]. set size. This establishes the first assertion.

Computing Surveys, Vol. 2, No. 3, September 197~)

:i
176 • Peter J. Denning

The cost Ca(A) is determined as follows. is necessary for Ca(F) < Cd(P). For the
We reserve w pages of memory, then trans- normally heavy drum loads (L large) found
port the entire working set as a unit in a in paging systems, w0 _--~ s q- 1 is slightly
transport time T t. Thus more than a full drum circumference.. If we
repeat the analysis to include the cost of
Ca(A) = wT'. (ii)
swapping w pages out again at time quantum
If A is ECS with access time t~ (see the end, we find w0 ~ 2s; for typical drums 2s
section on Page Size above) and page trans- is approximately 8000 words, a substantial
mission time t t , then working set. To sum up: as the drum load
varies from the former extreme to the latter,
T = t0+ t~ + t~, the system enters and exits states unfavor-
T' = to + t~ "b w t t . able to swapping; even in favorable states,
swapping is cheaper only when working
Substituting these vMues into (i) and (ii) sets of substantial size are moved. Our
respectively, we find analysis does not account for two other
C~(A) - Cd(A) factors: it may be expensive to find or main-
tain a supply of contiguous sectors into
= (w(w - 1)/2)(tt - to - t,). which working sets may be swapped, and
This expression is positive if tt ~_ to -q- t~, it may be expensive to implement both a
which normally is the case. If A is LCS, swapping policy and a demand paging
then t~ = 0, and the same conclusion follows. policy in the same system. Swapping thus
This establishes the second assertion. appears at best to be of marginal value in a
demand paging system. This establishes the
A "swapping d r u m " is an F C F S drum F third assertion.
for which the system guarantees t h a t each
working set's pages are stored on contiguous Now, let Cp(P) denote the cost of pre-
sectors. Suppose a request for a working paging from drum system P, and suppose
set of w pages arrives when L other requests > 0 is the probability that a prepaged
of sizes ~ , • • • , vL are in the drum queue; page is not used. To prepage from drum P,
the swapping drum transport time is given we would specify the w pages as a group
and add them to the drum load L. Ignoring
by
to, this costs approximately wTp', where
1 T r ' is Tp evaluated at load L + w. Of these
w pages, ew were preloaded erroneously, so
there will be ew additional page faults;
(The argument to derive T' is analogous to assuming each of these replaces an erroneous
t h a t for deriving Tp .) We are interested page with a correct one, the cost for each
in comparing is w T e . Thus,
Cd(P) = (w(w + 1)/2)(to + Te), Cp(P) = wTp' + ~w(wT~).
C,(F) = w T ' . After some algebra, we find
We shall ignore to since to << t~. Consider w ~ w0 = (2L + s + 2)/
two extremes of the drum load v~, . . . , vL •
At the one, each v~ is a request to swap in a ((1 -- 2e)(2L + s q- 2) -- 4)
full working set; taking w as the average is sufficient for Cp(P) < Cd(P) to hold. This
working set size and each v~ = w, we find has two consequences. First, if • is small and
(after some algebra) t h a t for all w > 0, L large, then w0 ~ 1, and prepaging would
C,(F) > Cd(P). At the other extreme, each almost always be advantageous. Second, in
v~ is a request for a single page; taking each order that the denominator of the expression
v~ = 1, we find (after some algebra) that for w0 be positive, we require
w> wo = I + 2 L s / ( 2 L + s - - 2) e < ½(2L -b s -- 2)/(2L + s zr- 2).

Computing Surveys, Vol. 2, No. 3, September 1970

 Vir!ua! Memory • 177

If e is not small and L is small, then w0 would Replacement Algorithms

be large, and prepaging would not be ad- From now on we shall use N = {1, 2,
vantageous. Since the foregoing argument • . . , n} to denote the pages of a given
is very qualitative and based on average- program. A program's dynamic behavior
value arguments, we must be careful not to may be described in machine independent
attach too much significance to the particu- terms by its reference string
lar expressions given. Our intention is
showing that the advantage of prepaging ¢o -= r l r 2 . . . r k . . . , rk E N , k > 1,
may be very sensitive to the relations among which is a sequence of those pages from N
e, L, and s, and that careful analysis would which are referenced by the program (not
be required to assess its value in a given necessarily distinct). We suppose this pro-
system. (See [P1].) This establishes the gram has been allocated a memory space of
fourth assertion. size m, where 1 < m < n, and is to operate
The foregoing discussion establishes also in that space under paging. If t(rk) denotes
that the performance of virtual memory the time instant at which page rk is refer-
may depend strongly on the capacity of the enced, then the expected time E[t(r~+l) -
channel carrying the traffic of pages through t(rk)] is h if rk is present in memory and
main memory. Although we have not studied -~ T otherwise (see the section on Basic
it, the reader should realize that several System Hardware). Therefore the expected
parallel channels between main and auxiliary increment in space-time cost is
memory (contrasted with the single channel
presumed above) would provide further
increases in capacity.
In general, the smaller the ratio of paging
C(t(rk), t(rk+l)) =
{
m~
m(A q- T)
if rk in
memory,
otherwise.

traffic through memory to the system's When the page size is fixed and T > h
capacity for handling it, the better the (typically, in fact, T >> ~), minimizing the
performance of the virtual memory. To total cost of running a program under
minimize this ratio, we must (1) choose a paging requires minimizing the number of
memory management policy to minimize the page faults. To understand what this en-
rate at which a given program load generates tails, we need a precise definition of replace-
page faults, (2) modify program structure ment algorithm.
to reduce the rate at which a given program A subset S of N such that S contains
generates new page faults, and (3) provide m or fewer pages (written [S[ < m) is a
hardware support to increase the system's possible memory state, and 9lZ,, is the set
capacity for handling page traffic. These of all such S. A replacement algorithm
generally keeps records about the program's
three aspects are examined in detail in the
behavior; the status of its records will be
following sections.
called a control State q, and Q is the set of
all such q. A replacement algorithm con-
figuration is a pair (S, q). If the configura-
PROGRAM BEHAVIOR AND MEMORY tion is (S, q) and page i is referenced, a
MANAGEMENT new configuration (S/, qt) is entered. We
describe this behavior b y the allocation
Program behavior is among the least under-
mapping
stood aspects of computer system design
and analysis. And yet we need to model g: ~Zm X Q X N - + ffg,~ X Q,
program behavior if we are to have a sound where
basis on which to predict a program's future
memory needs or if we are to understand g(S, q, i) = (S', q')
how close resource allocation policies are to and i is in S'. Starting from an initial con-
being optimal. figuration (So, q0), a replacement algorithm

Computing Surveys, Vol. 2, No. 3, September 1970

178 • Peter J. Denning

processes the references rlr2 . . . rk by gen- mization of the number of faults generated.
erating a sequence of configurations. Since the days of the earliest paging machine,
people have reasoned that, to minimize the
(So, qo), (S,, q~), ... , (S~, qk),
number of faults, it is necessary to maxi-
where mize the times between faults [K3]. There-
fore the following has been the accepted
(Sk , qk) = g(Sk-1, qk-~ , r~), k > 1.
PRINCIPLE OF OPTIMALITY. Let S =
Thus a replacement algorithm A may be {1 ~, 2 t, " " , m p} be the memory state at time
described by specifying the 3-tuple A = t, the moment of a page fault, and let t(i ~) > t
(Q, q0, g). be the earliest moment at which page i' is
Now if A is a demand paging replace- next referenced. Define v(i') = t(i') -- t.
ment algorithm, then whenever (S', q') = Replace that page i' for which ~.(i t) is maxi-
g(S, q, i), the memory state S p must satisfy mum. I f the future is not precisely known,
these properties: replace that page i' for which the expected
• If i E S then S ~ = S (no page fault). time E[r(ir)] is m a x i m u m .
• If i ~ S and I S [ < m, then S' = In the case that we maximize E[~.(i')]--
S [J {i} (page i added to memory). the case of realizable algorithms--we are
attempting only to minimize the expected
• I f i ~ S a n d I S I = m, t h e n A selects
number of faults, rather than the actual
somej E S a n d S ' = (S - {j}) (J {i} (page
number of faults. Thus an optimal un-
i replaces j).
realizable algorithm would produce fewer
It can be shown that, for any nondemand faults than an optimal realizable algorithm.
paging algorithm A, one may construct a
demand paging algorithm A' that produces The principle of optimality has great
intuitive appeal. Belady [B3] has used it to
no more faults than A on every reference
string [A2, M2]. We are therefore justified develop an optimal unrealizable algorithm.
in restricting attention to demand paging Many other authors have developed various
algorithms. From now on, the term "al- optimal realizable algorithms, each depend-
gorithm" specifically means "demand paging ing on the particular assumptions used to
determine E[r(i')]; for example, the Atlas
replacement algorithm."
machine's algorithm assumed most pro-
Optimal Paging Algorithms grams were looping and therefore generating
Suppose r~ ..- rk -.. rK is the reference periodic reference strings [K3], and several
systems used an algorithm that supposes
string generated by a given run of a pro-
gram, and the reference moment t(rk) is E[r(i')] = t - t'(i') where t'(i') < t is the
that of a page fault. If algorithm A requires time i' was most recently referenced (this
precise knowledge of the future (rk+l --. r~) rule is called "least recently used"). We
to make its replacement decision at t(rk), shall not attempt to survey the multitude
A is an "unrealizable" algorithm. Otherwise, of paging algorithms that have been pro-
if A bases its decision at t(rk) only on as- posed and studied, these being amply treated
in the literature [B3, B4, B6, C3, (38, D4,
sumptions about the future (e.g. probabil-
ities), A is a "realizable" algorithm. In D5, D9, H1, K5, J2, K3, 02, S2, S3, $5].
most practical applications, we must be Despite its intuitive simplicity, the Prin-
content with realizable algorithms; un- ciple of Optimality is known not to hold for
realizable ones would require "preprocess- arbitrary assumptions about reference string
ing" the program and recording its refer- structure and statistics. Even when it does
ence string. Not only is this operation costly, hold, proofs of this are difficult, and are
but the record so obtained may well be known only in simple cases [A2, M2].
invalid, due to conditional branching. Even though the Principle of Optimality
As discussed in the previous section, we may not in fact be always optimal, it is a
take as o u r optimality criterion the mini- good heuristic, and experience and experi-

Computing Surveys, Vol. 2, No. 3, September 1970

 Virtual Memory • 179

mental evidence indicate that algorithms ffA,m )

based on this principle give nearly optimal
!
performance. This evidence, suggested in
Figure 18, is abstracted from the work of
Belady [B3], and of Coffman and Varian
[C3]. Let F(A, m, oo) denot~ the number of "', , / ~IZAaLE A
faults generated as algorithm A processes
the reference string ,o under demand paging
in an initially empty memory of size m,
/,,~,, "~NOOM"a~oen.Ms
and define the fault probability

f(A, m) = ~E~11~ Pr[oo](F(A, m, ~)/I oo I),

UNRIEALIZAEU[
A~ ~ ~ ~'~xxx
where Pr[~] denotes the probability of oc- 01 I "".......... ~: ~m
currence of ~, and I~[ denotes the length I n
of oo. The curves f(A, m) for "reasonable" Fro. 18. Fault probability
algorithms A lie in the shaded region of
Figure 18 (by "reasonable" we mean that
the assumptions used to determine E[r(i')] al. [M2] have discovered a very interesting
in the Principle of Optimality are reason- class of replacement algorithms, called
able). For comparison we have shown the stack algorithms, whose f-curves are always
relative position of f(A, m) for Belady's decreasing in m. These algorithms are de-
optimal unrealizable algorithm [B3]. The fined as follows. Let ¢o be a reference string,
point is: for reasonable A, f(A, m) is much and let S(A, m, ¢o) denote the memory state
more sensitive to m than to A. Therefore, after A has processed ~ under demand pag-
although the choice of paging algorithm is ing in an initially empty memory of size m.
important, the choice of memory size is Algorithm A is a stack algorithm if
critical.
S(A, m, oo) ~ S(A, m Jr 1, oo),
Figure 18 brings out one other point. (i)
Occasionally in the literature one finds l <m<n,
analyses of program behavior based on the
for every reference string w. T h a t is, the
assumption of randomness, i.e. that each
contents of the m-page memory are always
page of a given program is equally likely to
be referenced at any given reference. This is contained in the (m + 1)-page memory, so
equivalent to the assumption that E[r(i')] = that the memory states are "stacked u p "
E[r(j')] in the Principle of Optimality. If on one another. The L R U (least-recently-
this were so, the fault probability for every used) replacement algorithm, for example,
realizable algorithm A would have to be is a stack algorithm (to see this, note that
f(A, m) = (n -- m)/n. This simply is not S(LRU, m, ~) always contains the m most
the case. Programs tend to reference certain recently used pages). Consider a stack
pages heavily, others lightly, still others algorithm A and a reference string ~x. If
rarely. x is in S(A, m, w)--there is no fault when
Contrary to intuition, increasing the x is referenced--then by (i) x is also in
memory size m may not always result in a S(A, m Jr- 1, w); thus increasing the mem-
corresponding decrease in f(A, m); that is, ory size can never result in more page
f(A, m) mhy not be decreasing in m, as faults, and f(A, m) must be decreasing in
suggested by Figure 18. The F I F O (first-in- m for every stack algorithm A. The class
first-out) replacement algorithm, for 'ex- of stack algorithms contains all the "reason-
ample, is known to exhibit an increasing able" algorithms, and two algorithms known
section in its fault probabihty curve, for to be optimal [A2, M2]. They are particu-
certain reference strings [B6]. Mattson et larly easy to analyze [M2].

Computing Surveys, Vol. 2, No. 3, September 1970

180 • Peter J. Denning

The Principle of Locality and the Working R(k) are strict and the expected ranking life-
Set Model times long.
An important program property, alluded From the principle of locality comes the
to in previous sections, is locality. Infor- notion of "working set." A program's work-
mally, locality means that during any inter- ing set at the kth reference is defined to be
val of execution, a program favors a subset
of its pages, and this set of favored pages W(k, h) = {i E N I page i appears among
changes membership slowly. Locality is an rk-h+l ".- rk}, h ~ 1.
experimentally observed phenomenon mani-
festing itself partly as a tendency for refer- In other words, W(k, h) is the "contents"
ences to a given page to cluster, partly in of a "window" of size h looking backwards
the shape of the f ( A , m) curve in Figure 18 at the reference string from reference rk.
[B3, B4, D4, D5, D9], and partly in the The working set at time t is W(t, h) =
rapidity with which a program acquires W(k, h) where t(r~) < t < t(rk+l). Page i is
certain pages on demand at the beginning expected to be a member of the working set
of a time quantum [C3, F2]. Locality is not if it is referenced in the window, i.e. if
unexpected, by the very nature of the way k
programs are constructed: ai(j) ~ 1.
--Context. At any given time a program j~k--h+l
is operating in one of its modules, which (This equation, together with assumptions
causes a concentration of references in cer- about the at(k), could be used to determine
tain "regions" or "localities" of address a value for h. For example, if it were as-
space. For example', its instructions are sumed that ai(k) = al and it were declared
being fetched from within the pages of some
that pages with a~ < a0 for some given a0
subroutine, or its data are being fetched ought not be expected as members of the
from the content of some specific data seg- working set, then h = 1/ao .) Therefore, a
ment.
working set is expected to contain the "most
--Looping. Programs tend often to loop useful" pages; by the principle of locality it
for a long time within a small set of pages. changes membership slowly.
In order to render the statement of Now suppose locality holds and R(k) =
locality more precise, we introduce the (1 p, 2', . . . , n'). If i' is ranked higher than
notion of the "reference density" for page i: j ' (i.e. a~,(k) > aj,(k)) then E[r(i')] <
ai(k) = Pr[reference rk = i], i E N.
E[r(j')], and because ranking lifetimes are
long, this relation is expected not to change.
Thus 0 _< a~(k) _~ I and ~ at(k) = 1. Al- Since i' is more likely than j ' to be in
though a program's reference densities are W(k, h), there follows:
unknown (and perhaps unknowable), the WORKING SET PRINCIPLE. Suppose mem-
definition of "working set" given below ory management operates according to the
obviates the need for attempting to measure following rule: A program may run if and
them. By a "ranking" of a program's pages only if its working set is in memory, and a
we mean a permutation R(k) = (1', 2', page m a y not be removed if it is the member
• . . , n ' ) such that a,(k) ~ . . . ~_ a~,(k); of a working set of a running program. Then,
a ranking R(k) is "strict" if a,(k) > .-. > according to the principle of locality, this rule
a~,(k). A "ranking change" occurs at refer- is an implementation of the principle of opti-
ence k if R(/c - 1) ~ R(k); a "ranking life- mality.
time" is the number of references between The working set principle is more than a
ranking changes. Ranking lifetimes will memory management policy, for it implies
tend to be long if the a~(k) are slowly vary- a strong correlation between processor and
ing functions of k. memory allocation. Its implementation does
PRINCIPLE OF LOCALITY. The rankings not depend on measurement of reference

Computing Surveys, Vol. 2, No. 3, September 1970

 Virtual Memory • 181
w(h)
densities. This principle is used explicitly in
at least one computer system, the RCA
I
Spectra 70/46 [D2, O3, Wl]. / I
/
Working sets exhibit a number of impor- i i

tant properties. Let w(h) denote the expected

working set size, i.e. w(h) = E[ I W(t, h) I].
It is shown in [D5] that, for h P_ 1,
(1) 1 _< w(h) < min {n, h},
(2) w(h) < w(h t- 1) (nondecreasing),
(3) w(h -q- 1) -q- w(h - 1) < 2w(h) (con-
cave down), ~h
O
which give w(h) the general character of FiG. 19. Expected working set si~e
Figure 19. The following is also shown in
[D5]. Let g(h) denote the probability that a
page, when referenced, is not in W(t, h). presence in the working set of a page which
Suppose h is increased by 1, so that a new was not referenced in the window. This
reference (rL-h) is included in the window; definition is designed for systems where the
the resulting change in the working set size future is unknown, where the principle of
is locality holds most of the time, and where a
"maximum likelihood" estimate of the
ZxW={: otherwise.ifrt-hisn°tinW(t'h)' future is sufficient. A still open question
concerns how to use "context" and "loop-
ing" properties, together with knowledge of
But then E[5W] = g(h), and we have the program structure, to predict before it is
important result that referenced that a page will shortly become a
~(h) = w(h + 1) - w(h). member of the working set.
This suggests that measurements of a pro- Multiprogramming and Thrashing
gram's working set size function can be used Paging algorithms for multiprogrammed
to obtain approximations to f(A, m), for memories normally lie at or between two
m = w(h) and working set strategy A. It is extremes:
possible to relate w(h) to certain properties
of reference strings [D5], and to use w(h) in 1. Locally. The memory is partitioned
determining how much memory is required into "work spaces," one for each program.
in a given computer system [D7]. Finally, The paging algorithm is applied independ-
let w(h, z) denote the expected working set ently in each work space. In particular, a
size (in pages) when the page size is z, and page fault in a given program can cause a
apply the compression results of the section replacement only from its own work space.
on Compression Factor: The size of a work space remains fixed until
allowed to change by the system.
zlw(h, zl) _< z~w(h, z2) if zl < z2. 2. Globally. The paging algorithm is
That is, a working set will comprise fewer applied to the entire collection of running
words for smaller page sizes. programs, as if that collection were one
The definition given above is not, of large program, without regard for which
course, the only possible definition for work- pages belong to which programs. In particu-
ing set. As specified, the method for measur- lar, a page fault in a given program may
ing a working set is after the fact and its cause a replacement from arty program in
reliability depends on the slowly varying memory. The size of a program's work space
assumption about reference densities. The is therefore randomly variable.
method will fail to predict the imminent The working set principle, so formulated

Computing Surveys, Vol. 2, No. 3, September 1970

182 • Peter J. Denning

that it tells how memory is to be managed the kth program is introduced, it is granted
under multiprogramming, is a form of a mk' pages and the global policy changes the
local policy. Indeed, global policies are in remaining mi to mi' < m~. Letting Dj de-
general suboptimal, partly because there is note the total expected processing efficiency
no way to determine when memory is "over- when j programs are in memory, we .have
crowded," and partly because there is no k--1
way to guarantee that a program's work Dk-, = ~ d,(mi),
space is large enough to contain its working
set even if memory is not "overcrowded." k
Multiprogramming under a global policy Dk = ~ di(m~').
i=l
is susceptible to thrashing, a collapse of
performance that may occur when memory Thrashing occurs if Dk << D~_1,1 i.e. the
(or parts of memory) is overcommitted addition of one more program triggers a
[D6]. Thrashing is a complicated phenome- collapse of processing efficiency. Using (i)
non. At the risk of oversimplification, we we find
shall derive a condition that estimates when k--1
it will occur. We assume (1) that the ith Dk-j -- Dk < a ~ (f~(m~') -- f~(m~))
i~l
program in memory has average work space
m~ and fault probability fi(ml) under the -- dk(mk') (it)
given global policy, where f~ is stationary
over the time interval under consideration; aFo -- dk(mk').
and (2) for each i, fi(m') ~ f~(m) whenever Now if the quantity Dk_~ -- Dk is near its
totem.
upper bound and aF0 is not small, then it is
A " d u t y factor" d(m) for a program occu- possible to obtain Dk_l << Dk. Experiments
pying a work space of average size m m a y on the RCA Spectra 70/46 computer sys-
be defined as follows: if f(m) is the program's tem, for which a > 104 (a drum auxiliary
fault probability, then the expected number memory), show that this condition is easy
of references between faults is l / f (m); if each to induce [D2]. Conversely, we can prevent
memory reference takes expected time 5 thrashing if we can guarantee t h a t aF9 is
(see the section on Basic System Hardware) small, which may be done by using faster
and each page transport takes expected auxiliary memory or by operating programs
time T, then the expected fraction of time with space allocations which vary only in
this program spends in execution is ranges where F0 is small.
d(m) [5/f(m)l/[5/f(m) + T], Now suppose a working set policy is in
o~ = T/~. effect. Let the random variable ~(h~) denote
= 1/[1 --~ af(m)], the working set size of program i for window
Using condition (2) above, it is not difficult size h~, and let g~(h~) denote the probability
to show that, if m' < m, that a page is not in the working set. Be-
cause the pages with highest reference den-
0 ~ d(m) -- d(m') < a(f(m') -- f(m)). (i) sities are most likely to be members of the
If d(m) -- d(m') is near its upper bound and working set, gi is decreasing, i.e. gi(hi) >
a is large, a relatively small change in work g~(h~ + 1). The d u t y factor d~(h~) for pro-
space size will be reflected as a large change gram i under a working set policy satisfies
in d. This is necessary to induce thrashing. d,(h~) > 1/[1 + age(hi)I,
Now imagine the following conditions
holding for an M-page multiprogrammed where the inequality holds because a page
memory using a global policy. Initially there not in the working set may still be in the
are k - 1 programs in memory, the ith pro- memory, so t h a t g~(h~) is at least as large
gram occupies a work space of average size as t h e fault probability. Since g~ is decreas-
mi ~ 1, and ml -b " - + mk-1 = M. When Notation x << y means "x is much less than y."

Computing Surveys, Vol. 2, No, 3, September 1970

 Virtual Memory • 183

ing, we may always choose h~ large enough likely to call one another; there was a re-
so that g~(hO _< go for some given go, 0 < markable reduction in the number of page
go <_ 1 ; therefore we may guarantee that faults using the latter method. McKellar
and Coffman [M4] have studied how matrix
do ~ 1/(1 + ago) _~ ddh~) _< 1. elements should be assigned to pages and
In other words, we may always choose h~ how standard matrix operations could be
large enough that program i operates at or organized to give better performance under
above the desired level do of efficiency. paging; they too report a rather remarkable
(Normally, we would choose do so that the improvement in certain cases.
relation do ~ 1 is false.) This implies that Informally, the code distribution problem
is: How can the compiler (or the subroutine
l~do < Dk _< k. (iii) linker) be employed to distribute program
If we are considering adding the kth pro- code and data into pages in order to improve
gram to memory, we may do so if and only if locality and obtain small, stable working
sets? Formally, the code distribution prob-
k--1
lem may be stated in the following way.
w,(hk) _< M - ~ ~i(h~), A program is regarded as a directed graph
i--1
G whose nodes represent instructions or
i.e. there is space in memory for its working data and whose edges represent possible
set. Assuming that do << 1 is false, the addi- single-step control transfers. With edge
tion of the kth program cannot cause thrash- (i, j) is associated a cost c~i >_ 0 of travers-
ing. Suppose it does, i.e. suppose Dk << ing that edge (c~ might, for example, repre-
Dk_~ ; by (iii) we have sent the probability that (i, j) will be used).
Given a page size z ~ 1, a pagination of the
kdo < Dk << Dk-1 < lc,
program is a partition of the nodes of G
which yields the contradiction do << 1. into disjoint sets X~, . . . , Xr such that Xk
Thus working set policies may be used to contains at most z nodes, 1 < k < r. Each
prevent thrashing. Experiments on the RCA X~ will be placed on its own page. For a
Spectra 70/46 computer system appear to given pair of pages (X, X/), let
verify this [D2].
v(x, x ' ) = i52 52 c,j
EX jEX ~

denote the total cost of MI edges passing

PROGRAM STRUCTURE between X and X/. The cost of the pagina-
Careful attention to algorithm organization tion X1, • • • , X~ is then
and program structure can improve the C(X,, . . . , X r ) = ~ V(X,,Xj).
performance of virtual memory systems.
There are two ways in which this can be A pagination is optimal if it achieves mini-
accomplished: distributing program code mal cost. Calculating an optimal pagination
properly into pages, and improving pro- for a given program is in general a hope-
gramming style. lessly complex computation, and relatively
Program code is normally assigned to simple algorithms are known only in special
pages simply by assigning the first z words cases [K2, R1]. Even then, the prospective
to page 1, the next z words to page 2, and user of such a scheme would be faced with
so on. There is considerable evidence that the problem of deciding whether he would
this may be far from satisfactory. Comeau be executing the optimized code sufficiently
[C7] describes an experiment in which a often that the long-term savings would
program consisting of many subroutines balance the initial high cost of obtaining
was paged, first with the subroutines in the optimized code.
alphabetic order, then with the subroutines One must be careful with this sort of
grouped together according as they were approach. However attractive the mathe-

Computing Surveys, Vol. 2, No. 3, September 1970

184 • Peter J. Denning

matics involved, the results may not be must teach techniques that may be applied
particularly useful except in certain obvious without knowledge of machine details (page
cases such as those mentioned above. If the size, memory size, and the like). Highly
trend toward increased use of modular structured programming languages, where
programming continues, the value of using the "context" (see the section on The Prin-
a compiler to determine an optimal pagina- ciple of Locality and the Working Set
tion is questionable: (1) program modules Model) is readily detectable at the machine
tend to be small, and very often fit on their level, may be the answer; in other words,
own pages; and (2) in contradiction to the the programming language would "force"
assumption that the code optimizer must the programmer into the "correct" style.
know the connectivity structure of the The programming language ALGOL, which
entire program, the compiler of a module makes heavy use of a stack during execu-
may not know the internal structure of any tion, is an example of this; the working set
other module. (If it did, the very purpose of will surely contain the information near the
modular programming would be defeated.) top of the stack, and is therefore easily
The optimization process cannot, therefore, measured. Much more sophisticated ap-
be invoked prior to loading time; and if the proaches have been conceived [D14].
trend toward data dependent program
structures continues, there is some question
whether even the loader can perform mean- HARDWARE SUPPORT
ingful optimization.
Improving programming style to improve We have seen that the three principal po-
locality is an almost intangible objective tential difficulties with multiprogrammed,
and is something about which little is known paged memory systems are fragmentation,
or can be said [K6]. A few experiments thrashing, and the high space-time cost of
show that locality (and therefore paging loading working sets into memory under
behavior) is strongly a function of a pro- demand paging. These three problems are
grammer's style, and it is possible to im- partially attributable to the large speed
prove many programs significantly by rela- ratio T/A between the main and auxiliary
tively minor alterations in strategy, altera- memory; if this ratio is large, it forces large
tions based on only a slight knowledge of page sizes in order to make page transport
the paging environment [B9, $2]. It is not operations efficient, it makes processing
known, however, whether programmers can efficiency very sensitive to fluctuations in
fault probability, and it causes the space-
be properly educated and inculcated with
time cost of a single page-transport opera-
the "right" rules of thumb so that they tion to be very high. Therefore, one aspect
habitually produce programs with "good" of improving hardware for virtual memory
locality. If any such education is to be concerns the reduction of this ratio.
fruitful for a large class of programmers, it
The literature reports two directions in
which approaches to reducing the ratio
T/A have proceeded, to which we shall
refer as slave memory ("cache" memory)
[F5, L2, W3, W4] and distributive memory
[A3, D8, F1, L1, V1]. Both approaches
employ a memory hierarchy (Figure 20)
consisting of k "levels"; levels M1, ...
Mk_l are electronically accessed (e.g. core
PROCESSOR memory, thin film memory, or silicon-
register memory), and level Mk is mechan-
....... S L k V E CONNECTIONS
--- DISTRIBUTIVE CONNECTIONS ically accessed (e.g. drum or disk). The
Fro. 20. Memory hierarchy structure electronic levels may be accessed without

Computing Surveys, Vol. 2, No. 3, September 1970

 Virtual Memory . 185

latency time. Generally, the lower the num- vantage is that the mechanism is simple
ber of the level, the faster its speed, the enough to be implemented almost entirely in
higher its cost, and the lower its capacity. hardware [W3]. A fourth advantage is the
The distinguishing feature is that slave possibility of implementing certain associa-
memory permits processing only from level tive processing operations in the main
M1, whereas distributive memory allows level [$6].
processing from any of the electronic levels Many modern processors employ an
M1, -.. , Mk-1. "instruction stack," which is a small num-
Typically, the combined capacity of the ber of registers (usually no more than 32)
electronic levels in these approaches is large that store the most recently referenced in-
enough to hold all the information of all structions of a program. Not only does this
active programs. Therefore, the transport stack permit "lookahead," it' acts as a small
time for a page among the electronic levels slave memory that allows processing to
is small, because the speed ratios between proceed at nearly register speed for loops
adjacent levels can be made small. Accord- that are contained in the stack [W3]. The
ingly, a hierarchical memory organization most notable examples of slave memory
of this kind can achieve the objectives re- implemented as discussed above are the
quired to make paged virtual memory per- cache memory [L2] on the IBM 360/85,
form well. IBM 360/195, and CDC 7600. These sys-
The slave memory approach [W3] was tems use k = 3, Mj being a silicon-register
first implemented as the "cache store" on memory with cycle time about 0.1 gsec and
the IBM 360/85 [L2]. This approach is so Ms a core memory with cycle time about
named because information transfers among 1 gsec. The level Mj is about 32K bytes
levels are entirely controlled by activity in capacity, and has been found substantial
the ("master") level M~ . The rules of opera- enough to accumulate the working sets of
tion are: all but the largest programs. Even if the
1. Whenever a page is stored in M i , there working set cannot be contained in M1,
is a copy of it in each of M~+i, • • • , Mk-1. performance is not appreciably degraded
Whenever a page in M1 is modified, all because the speed ratio between M1 and
copies of it in the lower levels must be M2 is small.
modified likewise. In the distributive memory approach, the
processor may access information stored in
2. Whenever a page not in Mj is refer-
any of the electronic levels. Thus the pages
enced, a request for it is sent to the lower
of a given program may be distributed
levels; the retrieval time depends on the
among the various levels while being proc-
"distance" to the "nearest" level containing
essed. Generally, the more frequently a
a copy of the required page.
page is referenced, the higher should be the
3. Whenever M~ is full and a new page is level in which it is stored. The most notable
brought in from M~+j, a replacement policy, example of such a system is that at Carnegie-
usually least recently used, is invoked to Mellon University IF1, L1, V1], which uses
select a page to be deleted (since there is k = 3; M~ is a standard core memory with
already a copy in M~+i, there is no need to cycle time about 1 ~sec and Ms a large
move the displaced page). capacity store (LCS) with cycle time about
The principal advantage of this organiza- 8 ~sec.
tion is that a program's working set will The distributive memory system presents
rapidly accumulate in M~ and be retained certain sticky implementation problems not
there; accesses will thus be completed at found in the slave memory system. The
nearly the speed of Mj . A second advantage worst is a requirement that there be a policy
is that, because transport times are small, to determine when a page should be moved
pages may be small, and all the advantages to a higher (or lower) level. These policies
of small pages are accrued. A third ad- are generally based on a tradeoff between

Computing Surveys, Vol. 2, No. 3, September 1970

186 • Peter J. Denning

the cost of not moving the page and running A third aspect of improving virtual mem-
at slower speed, and the cost of moving the ory hardware concerns the nature of the
page; they generally require some estimate of addressing mechanisms. Difficulties have
each page's reference density for these de- occurred in virtual memories where informa-
cisions, the estimates being obtained by tion is potentially sharable among distinct
preprocessing [C1], by measurements taken address spaces [B7, D13]. Here each seg-
in a previous time quantum [F1], or dy- ment may have two names: a "local" name
namically [D8]. Systems using dynamic which serves to identify it within a given
measurement techniques require additional address space, and a "global" name which
mechanism to avoid instability [D8]. serves to identify it systemwide. Local
Which of the two approaches--slave or names are interpreted in the usual way by
distributive memory--is superior is an un- hardware (see the section on Implementa-
settled question. That the implementation tion of Virtual Memory), and global names
problems of distributive memory seem more are interpreted by software (e.g. "file direc-
severe leads one to suspect that perhaps the tories"). The mechanism for converting
slave memory approach may be the better global names to local names is quite involved
way to use the hardware. and time consuming [B7, D1]. The solution
Reducing the ratio T / A is not alone appears to require that every segment have
sufficient to improve performance of virtual one, system-wide name which may be in-
memory systems. A second aspect of im- terpreted by hardware at every level of
proving hardware for these systems con- memory [D141.
cerns mechanisms for obtaining measure-
ments useful in memory allocation. Most
systems implement page table entries with CONCLUSIONS
one or more of these extra bits present:
We began this survey of virtual memory
1. Modified bit. Set to 1 if and only if system principles by tracing the; history
the page was modified since being placed in
and evolution of the forces that compelled
memory. If this bit is 0, the page may be dynamic storage allocation, i.e. desires for
deleted rather than replaced, assuming there
program modularity, machine independence,
is a copy in a lower level of memory.
dynamic data structures, eliminating manual
2. Use bit. Set to 1 whenever the page is overlays, multiprogramming, and time-
referenced, and to 0 by a usage metering sharin~-Amoag the mo t~eg_~t solutions
routine. The metering routine can compile to the d ~ n a m i c ~ f ~ g ~ allocation~problem is
statistics on page use by reading these bits. virtual memory, wherein a-_or.p_gr:A_~._2,r--Js--
3. Unused bit. Set to 1 when a page is .given the illusion that his address spa c,e_is
placed in memory and to 0 the first time it .~.e"- ihem(J~ space. There ~-aar6t w o basic
is referenced. This hit signifies that the page ap~roa~s~o-i~p-I~menting the automatic
has not yet been referenced by the program translation of addresses from address to
that demanded it, and should not be re- memory space, these being ~mentatiox~5
moved from memory at least until that time. and .paging) since segmentation ~ i - r e O
The use bits may serve to determine a by programmers and paging b y system
working set or to calculate reference den- implementers, the best implementation c()n~- "
sities. Counters can also be used for this bines the two. We compared "pur~! seg=_.
purpose [D8]. If the addressing mechanism mentation with paging, and ffoa!ng~p_gy~
contains a large enough associative memory memory systems generally ,.J.~pexic[r except
that its contents remain stable, then the for three potential difficulties-'~ (1) suscepti-
pages entered there may be regarded as the bility to low storage utilization for large
program's working set; similarly, the pages page sizes, (2) propensity toward thrashing
which accumulate in the level M1 of the under multiprogramming, and (3) the high
slave memory may be regarded as the pro- cost of loading working sets under demand
gram's working set. paging at the start of a time quantum. One

Computing Surveys, Vol. 2, No. 3, September 1970

 Virtual M e m o r y • 187

problem with all implementations of virtuM A3. ANACKER,W., AND WANG, C . P . Performance
evaluation of computing systems with mem-
memory in which the address space is much ory hierarchies. IEEE Trans. EC-16 (Dec.
larger than the memory space is potential 1967), 764-772.
misuse by programmers clinging unduly to A4. ARDEN,B. W., ANDBOETTNEi%D. Measure-
ment and performance of a multiprogram-
the idea that space and time m a y be traded. ruing system. Proc. Second ACM Symp. on
This last statement must, however, be in- Operating Systems Principles~ Princeton, N. J.,
terpreted carefully. Programmers who have Oct. 20-22, 1969, pp. 130-146.
been warned that the space-time tradeoff A5. , GALLER, B. A., O'BmEN, T. C., AND
WESTERVELT, F. I~I. Program and address-
does not hold, and have gone to the extra ing structure in a time-sharing environment.
work of reducing the total amount of ad- J. ACM 18, 1 (Jan. 196fi), 1-16.
dress space employed, have often increased B1. BASKETT, F., BROWNE, J. C., AND RAIKE,
W.M. The management of a multi-level
the size of the working set. The objective is non-paged memory system. ProP. AFIPS
to have a small, stable, slowly changing 1970 Spring Joint Comput. Conf., Vol. 36,
working set. If this is achieved, the amount pp. 459-465.
B2. BATSON,A., Ju, S., ANnWOOD,D. Measure-
of address space employed is immaterial. ments of segment size. Proc. Second ACM
These problems can be controlled, but re- Syrup. on Operating Systems Principles,
Princeton, N. J., Oct. 20-22, 1969, pp. 25-29.
quire hardware support above and beyond Also, Comm. ACM 13, 3 (March 1970), 155-159.
that offered by many current systems. Since B3. BEL~t)Y, L. A. A study of replacement
a memory system is more than mere imple- algorithms for virtual storage computers.
mentation of an address map, we included u IBM Syst. J. 5, 2 (1966), 78-101.
B4. . Biased replacement algorithms for
study of the principles of optimal replace- multiprogramming. Rep. NC697, IBM T. J.
ment policies, and found that the ,worl~ing Watson Res. Center, Yorktown Heights,
..get prJ.aai-phb together with the .prk:w,l.ple--~f N. Y., March 1967.
loca~ is an implementation of the Prin- B5. -sharing - - - ANn KUEHNER, C. J. Dynamic space
in computer systems. Comm. ACM
ciple of Optimality. B y stating a method 12, 5 (May 1969), 282-288.
whereby one may determine each program's B6. - - , NELSON, R. A., AND SHEDLER, G. S.
working set, this principle implies t h a t one An anomaly in the space-time characteristics
of certain programs running in paging ma-
may take steps to avoid overcommitment chines. Comm. ACM 12, 6 (June 1969), 349-
of memory, and thrashing. 353.
B7. BENSOUSSAN, A., CLINGEN, C. T., ANn
DAImY, R.C. The Multics virtual memory.
ACKNOWLEDGMENTS Proc. Second ACM Syrup. on Operating
Systems Principles, Princeton, N. J., Oct. 20-
I am deeply grateful to Jack B. Dennis 22, 1969, pp. 30-42.
(of M I T ) , to Bernard A. Galler and Bruce B8. Bol~aow, I). G., AND MURPHY, D.L. Struc-
ture of a LISP system using two-level stor-
W. Arden (both of the University of Michi- age. Comm. ACM 10, 3 (March 1967), 155-159.
gan), and to David Sayre (of I B M T. J. B9. BRAWN, B., AND GUSTAVSON,F. Program
Watson Research Center), whose penetrat- behavior in a paging environment. Proc.
ing comments proved invaluable in improv- AFIPS 1968 Fall Joint Comput. Conf., Vol.
33, pp. 1019-1032.
ing the manuscript. I should also like to B10. BURRO~'~HSCORPOR~TtON. The descriptor
thank John E. Pomeranz (of the University --A definition of the B5000 information
of Chicago) for suggesting some refinements processing system. Burroughs Corp., 1961.
in the section on Demand Paging. C1. CHEN, Y. C. Selective transfer analysis.
Rep. RC-1926, IBM T. J. Watson Research
Center, Yorktown Heights, N. Y., 1968.
C2. COFFMAN, E. G., JR. Analysis of a drum in-
put/output queue under scheduled operation
REFERENCES in a paged computer system, d. ACM 16, t
(Jan. 1969), 73-90.
A1. ABATE, J., AND ].)UBNER, It. Optimizing the ca. - - - - , AND VARIAN, L . C . Further experimen-
performance of a drum-like storage. IEEE tal data on the behavior of programs in a pag-
Trans. C-18, 11 (Nov. 1969), 992-997. ing environmen6. Comm. ACM 11, 7 (July
A2. AHO, A. V., DENNING, P. J., ANn ULLMAN, 1968), 471-474.
J. 1). Principles of optimal page replace- C4. COHEN,J.A. Use of fast and slow memories
ment. Computer Science Tech. Rep. No. 82, in list processing languages. Comm. ACM 10,
Princeton U., Princeton, N. J., Jan. 1970. 2 (Feb. 1967), 82-86.

Computing Surveys, Vol. 2, No. 3, Sep~mber 19770

188 • Peter J . D e n n i n g

C5. COHEN, L. J. Stochastic evaluation of a tures Group Memo 32, MIT Project MAC,
static storage allocation. Comm. ACM ~4, 10 Cambridge, Mass., Aug. 1968).
(Oct. 1961), 460-464. F1. FIKES, R. E., LtUER, H. C., AND VAREHA,
C6. COLLINS,G. O., JR. Experience in automatic A. L., JR. Steps toward a general-purpose
storage allocation. Comm. ACM 4, 10 (Oct. time-sharing system using large capacity
1961), 436-440. core storage and TSS/360. Prec. 23rd Nat.
C7. COMEAU, L. A study of the effect of user Conf. ACM, ACM Pub. P-68, 1968, pp. 7-18.
program optimization in a paging system. F2. FINE, G. H., JACKSON, C. W., AND MclSAAC,
ACM Symp. on Operating System Principles, P. V. Dynamic program behavior under
Gatlinburg, Tenn., Oct. 1-4, 1967 (7 pp.). paging. Prec. 21st Nat. Conf. ACM, ACM
C8. CORBAT6, F. J. A paging experiment with Pub. P-66, 1966, pp. 223-228.
the Multics system. Rep. MAC-M-384, MIT F3. FOTHERINGHAM, J. Dynamic storage allo-
Project MAC, Cambridge, Mass., May 1968. cation in the Atlas computer, including an
D1. DALEY, R., AND DENNIS, J. B. Virtual automatic use of a backing store. Comm.
memory, processes, and sharing in multics. ACM 4, 10 (Oct. 1961), 435-436.
Comm. ACM 11, 5 (May 1968), 306-312. F4. FREIBERGS, I. F. The dynamic behavior of
D2. DEMEIs, W. M., AND WEIZER, N. Measure- programs. Prec. AFIPS 1968 Fall Joint Com-
ment and analysis of a demand paging time put. Conf., Vol. 33, pp. 1163-1168.
sharing system. Prec. 24th Nat. Conf. F5. FUCHEL, K., AND HELLER, S. Considerations
ACM, ACM Pub. P-69, 1969, pp. 201-216. in the design of a multiple computer system
D3. DENNING, P. J. Effects of scheduling on with extended core storage. Comm. ACM 11, 5
file memory operations. Prec. AFIPS 1967 (May 1968), 334-340.
Spring Joint Comput. Conf., Vol. 30, pp. H1. HELLERMAN, H. Complementary replace-
9-21. ment--A meta scheduling principle. Prec.
D4. . The working set model for program Second ACM Syrup. on Operating Systems
behavior. Comm. ACM 11, 5 (May 1968), Principles, Princeton, N. J., Oct. '20-22, 1969,
323-333. pp. 43-46.
D5. . Resource allocation in multiprocess H2. HOLT, A. W. Program organization and
computer systems. Tech. Rep. MAC-TR-50, record keeping for dynamic storage alloca-
MIT Project MAC, Cambridge, Mass., 1968 tion. Comm. ACM 4, 10 (Oct. 1961), 422-431.
(Ph. D. thesis). I1. ILIFFE, J. K. Basic Machine Principles.
Thrashing:Its causes and prevention. American Elsevier, New York, 1968.
D6. Proc'. AFIPS 1968 Fall Joint Comput. Conf., I2. - - AND JODEIT, Z. G. A dynamic storage
Vol. 33, pp. 915-922. allocation scheme. Comput. J. 5 (Oct. 1962),
Equipment configuration in balanced 200-209.
DT. computer systems. IEEE Trans. C-18 J1. JOHNSTON, J. B. The structure of multiple
(Nov. 1969), 1008-1012. activity algorithms. Proc. Third Annual
D8. AND BRUNO,J . L . On the management Princeton Conf., Princeton, N. J., March
of multilevel memories. Computer ~cience 1969.
Tech. Rep. 76, Princeton U., Princeton, J2. JONES, R.M. Factors affecting the efficiency
N. J., April 1969. of a virtual memory. I E E E Trans. C-18, 11
D9. - - , CHEN, Y. C., AND SHEDLER, G. S. A (Nov. 1969), 1004-1008.
model for program behavior under demand K1. KELLEY, J. E., JR. Techniques :for storage
paging. Rep. RC-2301, IBM T. J. Watson allocation algorithms. Comm. ACM .4, 10
Res. Center, Yorktown Heights, N. Y., (Oct. 1961), 449-454.
Sept. 1968. K2. KERNIGtIAN, B. W. Optimal segmentation
D10. DENNIS, J. B. Program structure in a points for programs. Prec. Second ACM
multi-access computer. Tech. Rep. MAC- Symp. on Operating Systems Principles,
TR-11, MIT Project MAC, Cambridge, Princeton, N. J., Oct. 20-22, 1969, pp. 47-53.
Mass. K3. KILBURN, T., EDWARDS, D. B. G., LANIGAN,
Dll. . Segmentation and the design of mul- M. J., AND SUMNER, F . H . One-level storage
tiprogrammed computer systems. J. ACM system. IRE Trans. EC-11, 2 (April 1962),
12, 4 (Oct. 1965), 589-602. 223-235.
D12. - - AND GLASER, E. L. The structure of K4. KNUTII, D . E . The Arl of Computer Program-
on-line information processing systems. ming, Vol. I. Addison-Wesley, Reading,
Prec. Second Congress on Information Syst. Mass., 1968, pp. 435-455.
Sci., Spartan Books, Washington, D. C., K5. KUCK, D. J., AND LAWRIE, D. H. The use
1965, pp. 5-14. and performance of memory hierarchies: A
D13. ~ND VAN HORN, E. C. Programming survey. Tech. Rep. No. 363, Dep. of Computer
Sci., U. of Illinois, Urbana, Ill., Dec. 1969.
- -

semantics for multiprogrammed computa-

tions. Comm. ACM 9, 3 (March 1966), 143- K6. KUEHNER, C. J., AND RANDELI,, B. Demand
155. paging in perspective. Prec. AFIPS 1968 Fall
D14. - - . Programming generality, parallelism Joint Comput. Conf., Vol. 33, pp. 1011-1018.
and computer architecture. Prec. I F I P L1. LAUER,H. Bulk core in a 360/67 time sharing
Congr. 1968, Vol. 1, North-Holland, Amster- system. Prec. AFIPS 1967 Fall Joint Comput.
dam, 1969, pp. 484-492 (Computation Struc- Conf., Vol. 31, pp. 601-609.

Computing Surveys, Vol. 2, No. 3, September 1970

 Virtual M e m o r y • 189

L2. LIPTAY,J. S. The cache. IBM Syst. J. 7, 1 R4. RISKIN, B. N. Core allocation based on
(1968), 15-21. probability. Comm. ACM 4, 10 (Oct. 1961),
M1. MACKENZIE, F. B. Automated secondary 454-459.
storage management. Datamation 11, 11 $1. SAMS, B. H. The case for dynamic storage
(1965), 24-28. allocation. Comm. ACM 4, 10 (Oct. 1961),
M2. MATTSON, R. L., GECSEI, J., SLUTZ, D. R., 417-418.
ANDTRAIGER,I.W. Evaluation Techniques $2. ShinE, D. Is automatic folding of programs
for Storage Hierarchies. IBM SysL J. 9, 2 efficient enough to displace manual? Comm.
(1970), 78-117. ACM 12, 12 (Dec. 1969), 656--660.
M3. MCCARTHY,J., COR~AT6, F. J., ANn DAG- 83. SHEMER, J. E., AND GUPTA, S. C. On the
GETT, M. M. The Linking Segment Sub- design of Bayesian storage allocation algo-
rogram Language and Linking Loader. rithms for paging and segmentation. IEEE
omm. ACM 6, 7 (July 1963) 391-395. Trans. C-18, 7 (July 1969), 644-651.
M4. McKELLAR, A., AND COFFMAN,E. G. The $4. - - AND SHIPPEY, B. Statistical analysis of
organization of matrices and matrix opera- paged and segmented computer systems.
tions in a paged multiprogramming environ- IEEE Trans. EC-15, 6 (Dec. 1966), 855-863.
ment. Comm. ACM I2, 3 (March 1969),
153-165. $5. SMITH, J. L. Multiprogramming under a
page on demand strategy. Comm. ACM 10,
M5. MIT. Report of the long range computa- 10 (Oct. 1967), 636--646.
tion study group, April 1961.
O1. O'NEILL, R.W. A preplanned approach to a $6. STONE, H. S. A logic-in-memory computer.
storage allocating computer. Comm. ACM .~, IEEE Trans. C-19, 1 (Jan. 1970), 73-78.
10 (Oct. 1961), 417. Vl. VAREHA,A. L., RUTLEDGE,n . M., AND GOLD,
02. . Experience using a time sharing multi- M . M . Strategies for structuring two-level
programming system with dynamic address memories in a paging environment. Proc.
relocation hardware. Proc. AFIPS 1967 Spring Second ACM Syrup. on Operating Systems
Joint Comput. Conf., Vol. 30, pp. 611-621. Principles, Princeton, N. J., Oct. 20-22, 1969,
pp. 54-59.
03. OPPENI~EIMER, G., AND WEIZER, N. Re-
source management for a medium scale time Wl. WEINGARTEN, A. The Esehenbach drum
sharing operating system. Comm. ACM ii, 5 scheme. Comm. ACM 9, 7 (July 1966), 509-
(May 1968), 313-322. 512.
P1. PINKERTON,T. Program behavior and con- W2. WEIZER, N., AND OPPENHEIMER, G. Virtual
trol in virtual storage computer systems. memory management in a paging environ*
CONCOMP Project Rep. No. 4, U. of Mich., ment. Proc. AFIPS 1969 Spring Joint Corn-
April 1968 (Ph.D. thesis). put. Conf., Vol. 34, p. 234.
P2. POOLE, P. C., AND WHITE, W. Machine- W3. WILKES, M. V. Slave memories and dy
independent software. Proc. Second ACM namic storage allocation. IEEE Trans. ~ [
Symposium on Operating Systems Principles, 15 (April 1965), 270-271.
Princeton, N. J., Oct. 20-22, 1969, pp. 19-24. W4. - - - - . Time Sharing Computer Systems.
R1. RAMAMOORTHY,C.V. The analytic design of American Elsevier, New York, 1958.
a dynamic look ahead and program segment-
ing system for multiprogrammed computers. W5. - - . Computers then and now. J. ACM 15,
Proc. 21st Nat. Conf. ACM, ACM Pub. P-66, 1 (Jan. 1968), 1-7.
1966, pp. 229-239. W6. . A model for core space allocation in a
R2. RANDELL,n. A note on storage fragmenta- time sharing system. Proe. AFIPS 1969
tion and program segmentation. Comm. Spring Joint Comput. Conf., Vol. 34, pp.
ACM 1~, 7 (July 1969), 365-369. 265-271.
R3. AND K•EHNER, C. J. Dynamic storage W7. WOLMAN, E. A fixed optimum cell-size for
allocation systems. Comm. ACM 11 (May records of various lengths. J. ACM 12, 1
1968), 297-305. (Jan 1965), 53-70.

Computing Surveys,Vol. 2, No. 3, September 1970