the preferred embodiment of the invention has been implemented in a common data model framework that provides a base for sharing part information among different tools . the framework combines a model mechanism for standardizing the information built by individual tools and a common repository for the information supporting partitioning and code generation . an example of a common repository structure as implemented in the preferred embodiment is the subject of the related application titled &# 34 ; a hierarchical metadata store for an integrated development environment &# 34 ; u . s . application ser . no . 08 / 956 , 413 , and is fully described therein . the remainder of this disclosure contains references to the common repository , as needed , in order to fully understand the preferred embodiment of the present invention . as discussed above , the principle of the framework is that the tool information is organized into model objects of various classes and relationships between those objects . each model object is characterized by three items of information : a name , a set of attributes and a set of relations containing references to other model objects in the framework . a model class hierarchy is shown schematically in fig1 . fig2 illustrates the c ++ interface to the object abstract class of the preferred embodiment . referring to fig1 and 2 , the information associated with the object 1 is defined in a number of separate strings , such as the name of the object 2 and its attributes generally designated by 3 . each attribute 3 contains a value which is either a standard string 3a or a &# 34 ; blob &# 34 ; 3b . ( the term &# 34 ; blob &# 34 ; is an acronym for &# 34 ; binary large object &# 34 ;, a term commonly used in database technology . here , it refers to an amorphous string of bytes . this is described in more detail below .) fig4 shows a c ++ interface to a blob abstract class according to the preferred embodiment . values which are too complex or too highly structured to be represented in string form can be implemented as kinds of blobs . every blob must provide operations to set and inspect segments of its data as keyed by strings whose interpretation is entirely up to the blob , another aspect of the framework mechanism , according to the preferred embodiment , is that the relations 4 of the model object shown in fig1 and 2 are defined in separate classes and have mutually unique names fig3 shows the c ++ interface to a relation abstract class of the preferred embodiment that defines some of the attributes set forth below . returning to fig1 every relation 4 of a model object 1 is characterized by a name 5 which is a string . each relation 4 also contains a set of references 6 ( 0 or more ) to other model objects . the relation 4 must provide operations to inspect its name and to add , inspect or remove any of its references . the function of the reference 6 is to load its model object from disk into memory if the object is not already in memory . the references must be bidirectional . that is if one object references a second object , the second object must , in one of its relations , include a reference back to the first object . also , references are either &# 34 ; strong &# 34 ; or &# 34 ; weak &# 34 ;. when a model object 1 is deleted , all model objects it strongly references are also deleted , whereas when an object which weakly references another object is deleted , only the bidirectional references to the deleted object in the other objects are deleted . two other mechanisms illustrated in fig1 must also be defined . these are the search context 7 , and lock context . the lock context has three aspects , delete lock 8 , rename lock 9 , and modify lock 10 . a model object may assume different context is depending upon the path taken through the model to the object . fig5 shows the c ++ interface to a search context abstract class , according to the preferred embodiment . a search context 7 represents a path along the subset of the objects in a model . a search context provides operations to find and inspect attributes , and when asked to find an attribute , the search context navigates along its lists of model objects until it either encounters an object with the requested attribute or reaches the end of the list ( 10 in fig5 ). if an object with the requested attribute is found , the value of that attribute is returned ( 11 in fig5 ). thus , different search contexts allow a single object in the model to appear to have different attributes . model objects in relationships must be locked by a tool before they can be mutated by the tool . locking will be discussed in greater detail below in the context of the preferred embodiment of the framework hierarchy . to change the attributes of a model object , only the object itself needs to be locked . to rename a model object , the object itself needs to be locked along with all relations referencing the object by name . to delete a model object , the object itself and any objects directly or indirectly strongly referenced by the object , as well as any relations referencing these objects , must be locked each object in each relation is independently lockable , and this basic behaviour is sufficient for an operation as simple as changing the attributes of an object . the model framework includes lock context objects to handle the more complex rename and delete scenarios . fig6 shows the c ++ interfaces to delete lock context 8 and rename lock context 9 abstract classes . a rename lock context can be constructed from a model object prior to renaming the object . the rename lock context locks the model object in any relation containing a reference to the object , since some relations may be key to the object &# 39 ; s name . a delete lock context can be constructed from a model object prior to deleting the object . the delete lock context will lock the model object and any model object reachable by a chain of strong references ( since , under the framework , they will be deleted as well ), and any relation containing references to any of the aforementioned objects . these reference have to be removed from the relations to prevent dangling references . in a further preferred implementation , the object classes are actually a pair of classes , namely an abstraction class and an implementation class . this is illustrated in fig7 . every model object consists of an abstraction object 11 containing a reference 13 to a corresponding implementation object 14 . the complete interface to and behaviour of an object is presented through its abstraction portion . however , only the name 12 of the object is actually stored there . the attributes 15 and relations 16 of the objects are hidden in the implementation portion . any request for information about an object beyond its name is secretly met by the implementation portion and perhaps by some of the relations contained in it . as the abstraction , implementation and relation objects are independently persistent , a request for the name of an object will incur the cost of loading the abstraction portion from disk 17 without the implementation portion or the relations . this technique minimizes the amount of data transferred from disk to satisfy an inquiry and improves the overall performance of the tools under the framework . utilizing the above definitions , the framework of the preferred embodiment provides an environment and supporting mechanisms for implementing a flexible containment hierarchy of development parts . the base classes define standard behaviour for part locking ( also called containment support ), references between objects , attribute / property access , runtime type identification and persistence . all tools derive concrete implementations from the base classes . fig9 illustrates an abstract base hierarchy according to a preferred embodiment of the invention . the core functions in this hierarchy are persistence 20 , notification 21 and locking 22 , identified as base classes in the hierarchy , above the broken line . this is not to say that any of these classes may not be overwritten as is possible in c ++ programming , but some form of persistence , identification and locking are core functions required for the framework of the invention to operate . the classes below the broken line , beginning with ide element 24 illustrate some of the data model types that can be included in the framework hierarchy . these additional classes are defined in the appendix below , and a number of them are discussed in detail in the related application u . s . applications ser . no . 08 / 956 , 413 . inheritance under the framework hierarchy of the present invention operates to provide the foilowing . a persistence service maintains the state of a data model in a host computer &# 39 ; s file system and shares this data among several running programs . model objects derived from the framework hierarchy are grouped into files in the file system . objects in the file system are referred to as the &# 34 ; committed model &# 34 ;. when running a program using a framework model , only the data in the committed model is visible . all changes to the model are performed on in memory copies of the model objects in the private address space of a single running program . a locking service enforces mutual exclusion from modifications to the model . since each running program makes changes to private in - memory copies of model objects , no two programs may be modifying or deleting the same objects concurrently . the locking service provides a mandatory locking scheme which prohibits concurrent access . this is discussed in detail below . referring to fig9 inheritance from the persistence base class 20 provides that model objects are constructed from each program &# 39 ; s default local heap and shared , by persistence through the host computer &# 39 ; s file system . in many c ++ implementations , dynamic or runtime binding is normally implemented as a pointer in each object to class - specific tables of constant method pointers . the method table pointers are usually stored in a dynamic link library or executable program , but are inaccessible because every executable image is different and the location of the tables is different . as a result , in ordinary implementations , it is not possible to store c ++ objects in shared memory and access their data from different executables . the persistence service in the present invention avoids this problem through the default local heap construction . the persistence class 20 also provides the mechanism for all classes in the framework to write to and read from disk . all derived classes within the model that extend the base object state must provide their own &# 34 ; read &# 34 ; and &# 34 ; write &# 34 ; methods , but the persistence class also defines a mechanism for object streaming so that a class overrides the streaming operators for use in conversion between the disk form of the object and the in - memory form . the streaming operators invoke each object &# 39 ; s own &# 34 ; read &# 34 ; and &# 34 ; write &# 34 ; methods to do the actual processing . the following implementation convention is used in all classes in defining the &# 34 ; read &# 34 ; and &# 34 ; write &# 34 ; methods for a derived class in the preferred embodiment . the framework provides a standard interface for implementing mandatory mutual exclusion for c ++ objects , in the preferred embodiment . classes using this implementation are derived from the locking class 22 . since mutual exclusion is only required for objects shared among running programs , locking 22 is itself a subclass of persistence 20 . the locking scheme provided by locking 22 is discussed below . however , there are two cases in which these mechanisms are inappropriate , first , in the global &# 34 ; parts &# 34 ; list , a data structure guaranteed to contain all objects of a particular type ; and second , in the &# 34 ; dirty pool &# 34 ;, a mechanism for updated meta information which is stored with but not as part of a model object . the locking class 22 is a model abstraction for a persistent object that can be locked . it provides the locking primitives used within the model . in general , these primitive are not directly used , but are rather invoked as part of a composite object lock . an object lock is constructed in two steps : 1 . a lock identifier is obtained for the intended type of action . in the preferred embodiment , the lock pool is a singleton c ++ class located in a scalable shared memory pool , described below that manipulates named shared memory segments of fixed size . because of this , a lock identifier is really an array index into a pool . 2 . a shared lock or an exclusive lock is then constructed using the obtained lock identifier by instantiating a lock object type . in the preferred embodiment , the lock is acquired by way of a c ++ constructor which is usually used as a local instance so that the destructor will be run automatically no matter how the code block exits . failure to get a lock is conveyed by way of an exception . the destructor frees up locks in most cases , one exception being the modify lock context . singleton class refers to the c ++ programming convention that there can be only one instance of the class alive at a time per process . the scalable shared memory pool is a peer to peer pooling mechanism that involves allocating fixed size segments from the system named shared memory pool . the name of a segment is created by taking a predefined character sequence and then appending the segment number ( starting from 0 ). each process has a singleton pool that manipulates the pool segments for that process . when a new segment is required , the name is calculated and an attempt is made to find the segment in current memory . if not found , the segment is allocated . this process is synchronized such that the first process to require the memory segment will allocate it and every subsequent process will reaccess it ( hence , peer to peer as opposed to client / server ). each singleton pool class in a process keeps an array of all of the segments it knows about this allotsws access to any segment in the process as a quick indirection into the array . in addition to the array of segments , a special named area is allocated that contains global information about the pool . the name of this area is fixed and the first process to start up its pool will allocate it . access to the global information in the pool is synchronized to avoid a race condition between two or more processes . each segment is treated as a fixed size array of objects so that each segment is divided into &# 34 ; n &# 34 ; pieces of size &# 34 ; x &# 34 ; ( where &# 34 ; x &# 34 ; is the size of objects to be placed in pool ). each process requests to get a pool id when it needs a piece of storage . the pool uses the global information segment to find out the current highest index that has been given out . if the next value is still within a segment ( i . e . is not a multiple of n ), then it is simply returned . otherwise , a check is made on all objects currently in the pool to find an object that is not in use . each of the &# 34 ; n &# 34 ; pieces of storage in the pool segment must have an indicator to mark whether it is used , or unused , such that the singleton class can perform this check . if an unused object is found , its index is passed back and the storage is marked as used , otherwise a new segment is allocated . once an index has been doled out , it can be used to access the shared memory storage via a special pool method . the pool method simply takes the index and calculates the segment number and the index within the segment . it then accesses the array of segment addresses and after calculates the address of the object in the segment . in this way , the same id can be used by multiple processes , even though the shared memory may be assigned to different virtual addresses as is the case on some platforms , such as windows ™ nt . the calculation is as follows : the pool is scalable since it allocates segments as needed . it is peer to peer in that it does not matter how many processes are involved or in what order they are started ( no server is required ). the mechanism requires only two indirections to access any item by its id . in the preferred embodiment of the present invention , the lock object types are : as illustrated in the state diagram of fig9 constructing a lock object locks access to the underlying lockable model object . destruction of the lock object is required to unlock access , in most cases . thus , by instantiating a delete lock type to remove the instantiation of a shared lock type , shared restricted read / write access to the underlying model object is restored . this guarantees that the object will not be deleted , and allows others to read or modify it ( that is to obtain a shared or exclusive modifying lock ). the exception is when the underlying locked object is modified . the lock can be destructed when the modification is saved . mandatory locking for construction and destruction is enforced through a convention . the constructors and destructors of framework classes are &# 34 ; protected &# 34 ;. this prevents a program from directly creating or deleting an object . instead , class data &# 34 ; create &# 34 ; and &# 34 ; destruct &# 34 ; methods are provided for every framework class . the create method obtains the lock needed to create and insert an object into the existing model before constructing the object . the destruct method obtains all the locks need to remove all references to the objects from the model before deleting the object . failure to acquire the lock results in the modification operation being aborted , the model state being unchanged , and an exception being thrown . the lifetime of a lock is dependent on both the persistence subsystem and the existence of a lock object referencing the lock in memory . this is illustrated in fig1 . the lock object class 100 has as derivatives shared lock 102 and exclusive lock 104 . the difference between these is that a shared lock can have many processes ; an exclusive lock is &# 34 ; exclusive &# 34 ; to one process at a time . a single process resource can have either one exclusive lock on it , or one or more shared locks . when a lock object 100 is instantiated by a lockable object 106 , a lock is located by referencing the lock pool 108 via the lock id assigned when the lockable object is constructed . the lock 112 within the lock pool contains the process id of the lock owner 116 . if a lock owner attempts to reacquire a lock which it already owns , this is permitted . in the case of shared locks , process ids are always a dummy or reserved identifier . the same dummy identifier is used by all attempts to ascuire a shared lock . thus , if a shared lock is already held by any process , the process ids will match and the lock will be granted . to keep track of the number of shared lock owners , a reference counter is used . the counter is incremented every time the lock is acquired and decremented every time the lock is released . when the counter reaches zero , the lock is no longer owned by any process , and is available for use as either a shared or exclusive lock . in the case of exclusive locks , the real process id is used , to prevent sharing . a special type of exclusive lock is a &# 34 ; modify &# 34 ; lock which keeps track of a locked object &# 39 ; s modified state . if the object is unmodified , the lock is immediately freed when its destructor is run . if the locked object is modified , the modify lock will not be released by the modify lock destructor until all changes to the locked object are committed by a save or cancelled . if the modify lock is not destructed ( even when a save is performed ), the object remains locked . programs can rely on this behaviour to keep an object locked across saves . two exceptions were noted above for use of the locking mechanism , global parts list and &# 34 ; the dirty pool &# 34 ;. the global parts list contains a set of uniquely named objects . in the framework of the preferred embodiment this is contained in a single object , that is a singleton class . when a shared memory list containing data structures that detect name clashes is implemented , a part is added to the global list in one program , and the name of the part is tested for uniqueness in both the committed list of parts and the shared list of uncommitted part names . if the name is not unique , the add operation fails and an exception is thrown . otherwise , the insertion operation completes , and the name is added to the shared heap to prevent other programs from using it . each running program maintains a list of objects it inserted . when a save operation is in progress , the program removes all of these objects . by storing only the names , scalability is provided , in that the amount of shared memory used to prevent name clashes in the global part group is minimized . the second exception is the dirty pool this refers to an index pool that tracks whether objects have been modified without a corresponding update to their source code files . an object must be regenerated when its dependencies change . not modifying the actual object reduces lock contention among processes as well as improving performance . when the object and its source files lack concurrence , the object is referred to as &# 34 ; tainted &# 34 ; or &# 34 ; dirty &# 34 ;, hence the name for the index pool . the dirty pool uses the scalable shared memory pool mechanism to support remote data for a shared object . remote data is encapsulated object state which does not depend on the object this data can be modified without going through the lock the object , modify the object , save the object sequence , reducing the need for lock contention between processes . the pool uses a lock pool indexing scheme and one an object is assigned an identifier , a bit segment in the dirty pool index that is permanent for the life of the model object . each dirty pool segment is divided in half the first half has the in - use bits and the second half has the dirty state bits . the pool is persistent in the preferred embodiment . the dirty pool can stream itself to and from disk . in this way , information on whether source for an object needs to be regenerated can be queried in subsequent sessions . there are three requirements on the persistence service when committing changes to a model : 1 . a program cannot read new versions of old objects while operating from the committed model ; 2 . failure to complete writing change to files cannot corrupt the committed models , and 3 . changes made in one program cannot overwrite changes committed by another program . save is implemented as a two phase commit into the file system synchronized by an interprocessed communication protocol . this process is illustrated in the flow diagram of fig1 . the interprocess communication protocol utilizes two events ; &# 34 ; save pending &# 34 ; and &# 34 ; save complete &# 34 ;. these events are implemented with a shared memory flag , a shared memory counter , and two host system semaphores called &# 34 ; notify &# 34 ; and &# 34 ; acknowledge &# 34 ;. the save starts when the saving program sends a &# 34 ; save pending &# 34 ; event ( block 40 ). &# 34 ; sending an event &# 34 ; consists of setting the events shared memory flag to true , initializing the model shared memory count to the number of programs attached the model , resetting the &# 34 ; acknowledge &# 34 ; semaphore , and posting the &# 34 ; notify &# 34 ; semaphore . when the flag files indicate that phase one of a save has started ( clock 42 ), the saving program writes all files it has modified to temporary files ( block 44 ) saving to temporary files prevents other programs from accessing the temporary files if they are still actively utilizing the model . this satisfies half of part one of the safe save objective , that other programs cannot mix objects from the committed model with objects in the temporary files . once the saving program completes writing all changed files into temporary files ( block 46 ), it waits for the &# 34 ; save pending &# 34 ; event to complete . this will be acknowledged to the sending program when the &# 34 ; acknowledge &# 34 ; semaphore is posted ( block 38 ). the save pending event is processed by a worker thread found in each program attached to the framework model . when the event is received , the worker threads wake up . the threads determine if their program is attached to the model being saved by comparing all models open in the program with a model which has the saving flag set . if the program is attached to the saving model , a cross thread package is used to post the notification into the programs main thread . this notification is received asynchronously after the main thread has completed processing all gui events and notifications received previous to the saved pending notification ( block 58 ). when the program main thread receives the same pending notification , it stops demand - loading or changing objects in the model ( block 60 ). this completes requirement one , that programs cannot mix old and new objects . as the other programs receive and process the save pending event , they acknowledge receipt of the event by decrementing the shared memory counter ( block 62 ). when the decrementing counter equals 1 , all programs have processed the &# 34 ; notify &# 34 ;, and the events &# 34 ; acknowledge &# 34 ; semaphore is posted , indicating the event is complete ( block 64 ), thereby waking the sending program ( block 48 ). when the &# 34 ; save pending &# 34 ; event completes , the saving program flags the first phase of the save complete through on disk flag files ( block 46 ). before this point , an interruption , such as a system crash , loses all changes but leaves the database in a consistent state . if no error occurs , all the data needed to access the change version of the model is written to disk , and it is not possible for a system or program crash to leave the on - disk model in an inconsistent state . the saving program then renames all temporary files to their proper names and removes all empty data files from the committed model ( block 50 ). this means all changed files have their contents replaced with the versions in the temporary files , and this satisfies part 2 of the safe save requirement . the saving program sends the &# 34 ; save complete &# 34 ; event ( block 56 ) to the waiting worker threads and program main thread , to indicate to all these other programs that the on disk model is consistent , and waits for the event to complete ( block 54 ) before cleaning up ( block 56 ). the other core function , found in the notification base class 21 in fig9 provides the mechanism for communicating changes in tool data in the framework to other users . this is also illustrated in fig1 . all other programs attached to the model wake up when they receive the &# 34 ; save complete &# 34 ; event ( block 64 ). these programs then call the framework refresh method which visits each file the program has opened and loads the latest revision of each changed object ( block 66 ). once this process is complete , every program contains a private in - memory version of the model that is consistent with the most recently saved changes . if the program contains any objects which were deleted or modified by the saving program , the program receiving the &# 34 ; save complete &# 34 ; event will also have a model / view / controller notification sent to every observer of the affected objects ( block 68 ). observing these notifications is the hook that programs use to make their internal state consistent with the changes committed to the model . after performing the refresh , each program acknowledges receipt of the save complete event ( block 70 ). completing the save complete event wakes the saving program and all the worker threads . the saving program completes any housekeeping chores and returns from save . the worker threads return to their waiting state on the save pending interprocess event . as it is not always possible to determine in advance whether an operation changing many model objects will complete successfully , in a further preferred embodiment of the invention , the persistence service provides the ability to return to a known good state in the event of a failure . this process is illustrated in fig1 . this check point mechanism restores the private in - memory state of a program . the state to be saved includes all object deletions , creations and modifications which have occurred since the program started or saved the model as well as the persistence service data structures used to manage the objects and data files . during operation of the check point mechanism , this data is preserved in a temporary file . a program calls the check point mechanism to indicate it is starting a modification which may require restoring the previous state ( block 76 ). the persistence subsystem then visits each persistence file opened by the program on the model . the persistence system identifies objects for which the in memory state is different from the committed state ( block 78 ). in memory , modified objects are flagged as saved into the temporary file ( blocks 80 , 82 ). when an attempted modification is unseccessful , usually because an exception is thrown and caught ( blocks 84 , 86 ), a &# 34 ; roll back &# 34 ; method is called ( block 88 ). the roll back method recreates objects deleted after check point , removes objects created since the check point , and restores the state of all modified objects and of the persistence service data structures to their state when check point was called ( block 90 ). if the process determines that the algorithm completed successfully ( blocks 84 , 86 ), it calls &# 34 ; commit &# 34 ; ( block 92 ) to release the resources used by the check point mechanism and to flag the internal model state as consistent . modifications to the above preferred embodiments of the invention which would be obvious to those skilled in the art are intended to be covered within the scope of the appended claims . the following defines data model classes set out in fig8 according to the preferred embodiment :