Linking estimates dB.C as the average of the smallest delay preceding each message.

for each message B.C, it .nds the latest message into B that preceded it and includes that delay in the average.


Although all the existing features of the AORA tool were preserved, it has suffered some modifications to be able to assess the ComBO rules and approach.

it was necessary to develop: (i) HTML report conversion, (ii) basic and automatic graphical generation of the composed rules, (iii) logging support, for the history functionality, (iv) Composition Rule persistent storage in the eXist repository, such as reading and writing, (v) concern creation and update and major refinements in the Composition Rule Editor (CRE).


In [7], we discuss operating system modifications to avoid this problem.

the proposed design adds synchronization points within the page fault handler; at each synchronization point our runtime s API is invoked.


In this position paper we put forward an idea that aims to provide useful feedback on an incomplete model exploration.

we aim to quantify in a meaningful way the degree to which the exploration of the model has covered its entire state space.


Instead, targeted interactive surveys should focus on certain user groups and involve information systems specialists from the respective functional / process field.

expectations at the system in development must be managed very carefully.


The Kodo roadmap includes optimizations to some of the limitations discussed in this paper.

query caching could be optimized in a number of areas without implementing a complete in-memory query evaluation engine, and a bucket-based less-recently-used data cache overflow policy would probably be more ideal than either of the current data cache overflow strategies.


Given a set X of instances of S1, de.ne SOLM(X ) as S I.X SOLM(I).

sOLM(X ) is the set of possible solutions for the instances in X .


In Figure 5, we give the sketch of a greedy heuristic algorithm that selects the arrays for re-layouting.

in the while loop of the algorithm, we iteratively select the pair of arrays with maximum number conflicts with each other.


As outlined in Section 4.4, however, there are several ways the interaction between region inference and garbage collection can be improved.

the widening of some letregion constructs to ensure proper implementation of tail calls is called for.


The location estimation error tends to increase as the distance-measurement range becomes shorter.

the estimation errors when dmea = 30 m are very large, where the repeated substitution via (5) seems to fail to .nd the optimal solution.


Star supports some generalizations of contracts in the spirit of Mark Jones s theory of quali.ed types [18], namely multiparameter contracts and functional dependencies [19].

it also supports constraints that are not contract constraints: it allows constraining types to record types that have certain .elds.


Object term elimination: The programmer should be able to eliminate as well as introduce object language terms.

we want to be able to use the metalanguage to perform intensional analysis of object terms while retaining full object term typing.


We believe that Template Haskell takes a more principled approach to the same task.

the static computation language is the same as the dynamic language, so no new programming idiom is required.


4 Experiments 4.1 Microbenchmarks The objective of our microbenchmarking experiments is to evaluate the performance of the building blocks of AVEK-SHA.

we evaluate (a) how many clock cycles it takes for AVEKSHA to perform event monitoring for each of the three modes breakpoint, watchpoint, and PC polling, (b) the accuracy of the energy monitoring by comparing it with measurements obtained using a Fluke multimeter and a dedicated power monitor from Monsoon Inc., and (c) the energy consumption of the TDB itself.


Our experimental results indicate that Green can signi.cantly improve performance and reduce energy consumption of several applications with only a small degradation in QoS.

we improved the performance and reduced the energy consumption of Bing Search,aback-end implementationofacommercial, in-production web-search engineby 21.0% and 14.0% respectively with 0.27%ofQoSdegradation (three queries outofa thousand returned a search result that included at least one different document orthe same documentsinadifferent rank order).We also empirically demonstratethatGreencan generatearobustQoSmodelwith a relatively small training data-set and that runtime re-calibration can enable applications to meet their QoS targets even if they use imperfectQoS models.TheQoS models producedbyGreen during the calibration phase have also proved useful in providing developers with a better understanding of their application.


Moreover, real-time integration is expected to improve current software development practice in a number of ways.

it provides explicit support for managed code sharing directly between private workspaces, which is expected to encourage cooperative resolution of con.icts before check in.


However, all the above tools are for source code, while ours is the .rst practical clone detection algorithm for binaries.


In a safe statically-typed system, the compiler guarantees in advance that no type errors [11] will occur at run-time.

the system will ensure that a method can be requested successfully only from an object that has an appropriately named method that accepts the given arguments.


In these situations performance of a given lock waiter is degraded primarily by the VMM scheduler and not by the violation of the ordering of lock acquisitions.

a lock waiter can be preempted without perceptively adding to the waiter s execution time.


Our work explores a new optimization method that uses explicit interactions between the garbage collector and the operating system (OS) virtual memory implementation to avoid GC-induced paging.

our approach is to trigger a collection within the MRE and to perform heap resizing, immediately prior to paging activity that results from a combination of memory pressure and GC activity.


We denote action assign/(j) < loadi(j)  use/(j) as a use action on shared variable vj by Thi; simi- assigni(j) < storei(j) < writei(j) < readi(j) < loadi(j) larly for assign, load, store, read, and write.

the action lock/denotes locking of all shared variables by Thi; similarly we infer that an assigni(j) cannot take for unlocki.


The method incorporates a heuristic Dependence_constant for every combination of parameters, that adjusts for the gain for that combination.

the objective function in formula 2, computing predicted overall normalized runtime, could be adjusted as follows: Pred..Runtime_function = ]-I~=lRuntime_function(pi) (3) Dependence_constant(p1,... Pn) The Dependence_constant is a value that adjusts the gain to take into account dependences between parameter values.


In practice, however, communication voids and obstacles make the algorithm much more challenging.

resolving the ownership of zones that do not contain any nodes is complicated.


4.2 Load Balancing The parallel file system at the ALCF is optimized for highperformance local access, typically massively parallel local access; this follows directly from the architecture of most modern supercomputers.

while GPFS can be optimized for single-node I/O of up to 2 GB/s, the GPFS servers at the ALCF are limited to 500 600 MB/s each.


In this case, it follows that the path from H to A and the path from H to B both go through X.

if we regard the tree as rooted at X, we can deduce that H is not in the child tree of X containing A, nor the one containing B.


DISCUSSION The case study shows that the combination of behavior space exploration and traditional formal and model-based software engineering has the potential to reduce modeling e.ort in early project phases while providing useful insights on system performance.

the goals of primitive decisions (and interaction between components) can be modeled rather than the decision process underlying each component.


You need to know where you are and where you are headed in the short term in an agile team.

you may need to know what others are working on for effective refactoring.


Doing so takes advantage of the spatial locality in disk accesses, lowers the disk/network request overhead, and reduces energy consumption.

due to the high start latency of disk accesses, a certain request size may be required to match the request rate.


This paper makes the following contributions: Extending the notion of continuous queries [39, 13, 2] to handle intermittent connectivity.

this extension requires data streaming from the mobile nodes to be buffered locally, and the ability to dynamically prioritize data both on a single stream and between different streams.


First, we assume that for each query symbol q there is a .xed tuple v of variables with the corresponding length and that each query with the symbol q is of the form q(v).

each query has an a priori de.ned tuple of variables.


Based on a variety of traces from the SPECcpu2000 benchmark suite, we have shown the generated code to be faster and to compress better on average than BZIP2, MACHE, PDATS II, SBC, SEQUITUR, and VPC3.

the automatically generated code typically outperforms handcrafted and optimized code.


They propose treating the tables used in mapping the data from different peers as mapping constraints in order to be able to reason about them.

they propose algorithms for inferring new mapping tables and determining the consistency of a set of mapping constraints.


To be able to control the environ ment inputs of a class beyond that, we need to mock them.

we create a simulated environment, which is controlled by the generated test cases.


Data tiling requires two mapping functions p and q that map an original array subscript vector to a tile subscript vector and an intra-tile subscript vector, respectively.


The goal of supporting multimodal, multi-device access to multilingual content imposed certain requirements from the application logic and the backend infrastructure.

the information access and retrieval system had to support: Information transformation and presentation to various formats corresponding to the different modalities Adaptation of retrieved information to various terminal types and models  Information personalization based on user preferences Different database systems and schemas corresponding to diverse demonstrators (i.e.


If the ontology has been modeled incorrectly, relative to the problem domain, then the most advanced techniques in program design, development, and testing will not be able to produce a useful computing application.

the usefulness of a computing application is determined by the conceptual fitness of its ontology to the domain of the user.


Such a speci.cation is relatively straightforward to write in higher-order program logics, even if it is out of scope in the more common .rst-order Hoare logics.

consider a function compile from source-language commands s to targetlanguage commands t. To do compositional veri.cation of such a compiler, we informally prove the following proof rule for any s. compilepsq t tsafe to run su t tstate could result from running su Using the separation-logic [25] interpretation of Hoare triples (where the precondition must imply that the program is crash-free), this rule means that (1) t is safe to run whenever s is safe to run; (2) if t terminates, the .nal state is one that could have resulted from running s. We say that s and t are in a backwards preservation relation.


Since the typical goal of a COTS project is to reduce (cost, effort or schedule) as compared with a traditional project, the project must be ready to give up the latter category of requirements.

the COTS selected drives the requirements to at least some extent.


4.2 Correctness In the short version of our paper, we provide only the highlights of the proof that the given implementation of the concurrent queue is correct and wait-free, deferring the further details to the longer version.

we review the computation model, de.ne linearization points for queue operations, and explain why our algorithm guarantees wait-freedom.


This paper shows part of a development methodology that we are elaborating for the construction of information systems based on Grid Computing highly dependent on mobile devices where security plays a very important role.

in this paper, we will present the analysis phase, managed by reusable use cases through which we can define the requirements and needs of these systems obtaining an analysis model that can be used as input to the following phase of the methodology, the design phase of mobile Grid systems.


We brie.y remark that reverse lookup will only obtain a subset of the registered minor s high school friends.

it will not identify friendship relations between two registered minors, since the friend lists of both minors is unavailable to a stranger.


But I, being a shallow sort of fellow, propose instead to cheat.

rather than developing my own theory of equality, I plan to steal one and gain an encoding of KIPLING which mirrors the syntax, with no artefacts for weakening or substitution, and no equality evidence.


The actions of the simulator are always to increase the response time of the victim job, within the constraints of the task model.

non-determinisms in the task model are utilized in an attempt to generate the worst possible case for the victim.


Section 3 describes our types as modules strategy and shows how PADS/ML-generated modules together with functional O CAML code can concisely express common data-processing tasks such as .ltering errors and format transformation.

a key bene.t of our approach is the high return-on-investment that analysts can derive from describing their data in PADS/ML.PADS/ML makes it possible to produce automatically a collection of data analysis and processing tools from each description.


This is an approach similar to the one proposed in [17], where a theoretical presentation of algorithms to implement a Distributed Shared Memory mechanism is provided in terms of protocols to keep replicated instances of a variable coherent.

one of the provided algorithms proposes to implement variables as multi-version lists where write operations install new version nodes and read operations .nd the most suitable version.


As an application of the higher-order naturality of UNFOLD, consider Pascal s Triangle: 1 11 121 13 3 1 14 6 41 1 5 10 10 5 1 ...

the triangular shape can expressed as the .nal coalgebra of the bifunctor U de.ned by Ua = Int × IStream × IStream × a, which gives a vertex of type Int, two in.nite edges of type IStream Int, and an inner structure of type a. Pascal s Triangle itself is UNFOLDU step (repeat 1), where step (SCons x (SCons y xs)) = let zs = SCons (2 × y)(zipAdd (xs,zs)) in (x,SCons y xs,SCons y xs,zs) (the seed of the unfold is one of the in.nite edges.


Predefined Sets: Part 2 This figure does not show the control group since it encompasses everything in this figure.

this example s control group contains all of the program s lockstep, share, and worker group s processes and threads.


After decomposing, we get stuck at ß ~ [Int].

we are unable to discharge a wanted equation, even though there is a valid proof.


On the other, we work on combining symmetry reduction techniques, data abstraction and static code analysis.

we plan to integrate SocketMC with aspin [6].


This paper describes the research problems identi.ed by the author and tackled within the associated PhD thesis.

the corresponding PhD thesis will investigate the suitability of publish/subscribe systems internally supporting conjunctive subscription languages for scenarios requiring more expressive, i.e., arbitrary Boolean, subscriptions.


p means that p is always true and the formula p W q means that q must be true as long as p is false [2].

the formula means that TSP enforcement functions are invariably performed before execution of TSC functions (any function in a system).


4.2 Online Reserved Instance Con.guration While o.ine optimization is shown to be expensive at least in the above discussion, real SEC managers have to perform online instance provisioning without seeing a full job history.

reserved instances are relatively longterm commitments (1 year and 3 years in EC2 s case) and cannot be returned , demanding a load prediction mechanism that sees rather far into the future.


Although similar to software testing which aims to prove that a product works as it should, penetration testing concentrates on exploring software security .aws.

software testing usually veri.es that products work as expected in certain scenarios or conditions.


Most of these ranking are based on test results (for example, those potent test cases will be ranked high), coverage (certain coverage criteria may be ranked high for certain testing applications), or component tested (for example, the test cases that execute a modified section will have a high priority during regression testing).

these are often based on physical items such as the test cases, test results, or software components.


If there has been no change on the values of each node's input after every node has output a new message, then fur- ther activity cannot produce new values [17].


Each process then receives all messages sent during that round from a neighbor in E(r).

communication is reliable, and each process can only broadcast a single message per round.


This is the challenge we meet in this paper.

our contributions are: We present OutsideIn, a new inference algorithm for GADT programs (Sections 4 and 5).


types of labelled ordered tree objects [12] or tree types [3].

relatively new approaches are based on XML Declarative Description Theory [I] and XML type systems ] 15 l. formal models for XML schemes are developed [ 171.  uroduct vroduct .


We need, therefore, some means to assist the system engineer in this process.

we wish to automate the process of weaving target logic mappings into the structured English grammar phrases.


The fanout of the six edges modi.ed overlap signi.cantly.

the fanout of the successor task in the old schedule and the task that has been relocated are the only two tasks whose fanouts have to be considered.


Generate a generic model for three-tier web systems which can account for contention caused by software resources.

in this paper we consider the number of threads of the Application Server (AS) and the number of database Data Sources (DS).


In addition, the Navigation Controller contains one coordinator object called Navigation Coordinator, which receives incoming messages and coordinates the execution of the other objects.

the Navigation Coordinator extracts the event from the request and calls Navigation Control.processEvent (in event, out action) (see Fig.


The JavaScript object model is peculiar in several respects.

any function is considered a method of an object: top-level functions and anonymous functions are considered methods of the global root object of JavaScript.


Our metric for trace simplicity (and interleaving granularity) is the number of context switches in a trace: a trace with fewer context switches is simpler than a trace with more context switches.

given a buggy trace t , we would like to generate the simplest variant-trace of t. we would like to generate the variant-trace with the minimal number of context switches of all variant-traces.


we rely on .ve kinds of actions: input (?, (mi,mj ), idr) with mi = nil and mj = nil; output (ids , (mi,mj ), !)


Several studies also highlighted that the techniques are good to find requirements that are either unknown or overlooked but not necessarily innovative [S5, S26, S36, S38, S42, S43].

l. Mich and D. Berry [S5] proposed the EPMcreate technique, which proved to be very effective for finding requirements, especially those not previously known to the project managers.


For the remainder of the paper we assume that interaction composition (#) binds stronger than dot-composition (·).

these operations are related by a distributivity law [26]: Distributivity I : R#(S · T)=(R#S) · (R#T) (8) the interaction of R with S · T is the dot-composition of interactions R#S and R#T.


Implementations of lazy programming languages have also used tagged pointers [29].

gHC uses aligned pointer tag ging [34] to distinguish data constructors for types with few con structor tags.


virtual processors from the given m physical processors.

we create the virtual processors with following speci.cations: m virtual processors (denoted as VPAC): From each physical processor pp of speed sp,we create one 2 virtual processor of speed sp × 2+3.


The second restriction is that no call-down may occur within a call-up.

a method that is used as a call-up (i.e., invoked by a parent object) may have call-ups in its body but not ordinary task calls (call-downs).


we will prove this by contradiction so we will assume that |U0|= k if n is su.ciently large.


However, note that in the verification of any mul-tithreaded program, it is sufficient to check only those exe-cutions which are generated by our scheduling strategy.


({k1,k3})w3 Now w2 and w3 are bisimilar even if the context knows w1.

there exists a bisimulation X such that ({k1,k2},{k1,k3},R ) .


Using this transform for global Deadline Monotonic scheduling for fork-join real-time tasks, we achieve a resource augmentation bound of 3.73.

any task set that is feasible on m unit-speed processors can be scheduled by the proposed algorithm on m processors that are 3.73 times faster.


While a good and modular structure of the generated skeletons according to the best practices above is desirable, the structure must not limit the media designer in the design of the media content.

sTRUCTURING MEDIA SKELETONS two challenges need to be addressed which result from the abstraction in the models: C1: A media component represents multiple artifacts.


3.1.1 Special-purpose software components The boundary between the standard and the dynamic AUTO-SAR software is designed to pass through the SW-C level.

aUTOSAR SW-Cs sandbox in the plug-ins, allowing them to interact with the rest of the system through standard SW-C ports, while the underlying concepts, such as the RTE, BSW and legacy ASW remain unchanged.


The only requirement that is necessary to preserve soundness is that each object is thread-local until it is initialised.

we maintain an invariant that anyshared object (reachable from more than one thread) is initialised.


ACATS includes both positive and negative tests.

tests that are intended to compile and run successfully, and those with errors that are intended to be rejected by the compiler.


Is there some sort of isomorphism lurking here?

can we pair an extra element with a BTree to get something isomorphic to a Paren?


As such, it provides a good basis for the next generation of SaaS systems o.ering features on demand.

cOP enables dynamic adaptivity of the system s behavior to its surrounding execution environment, which could be used for the dynamic composition of features according to particular situations.


NeST may fits well to data need to be shared among many users while Puffin's SpaceLease is advantageous for repeated data use by one specific user.

what Puffins SpaceLease really focus on the individual user's efficient space consumption but does not care data sharing between users.


For each run, we calculated the sum of all unique pairs on all CUTs in a project, and averaged these results over the 50 runs.

table 2 is structured in the same way as Table 1, with the only difference that the results are for found exceptions instead of branch coverage.


Several new tools have been widely adopted, but they typically focused only on the creation of code.

java developers have quickly adopted Eclipse, an integrated Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page.


Despite the missing API information, our method is able to uncover the decoder based on its characteristic code structure.

the two nested loops iterating over the pixel bu.er on line 6 and 8 are common to most decoders.


This con.guration is also tested automatically, although it may not pass veri.cation without further changes because the precision levels of various instructions are not independent.

decreasing precision in one part of a program may impact the sensitivity of other portions.


We showed that Bluetooth-enabled smart-tags were promising candidates for the implementation of smarttag based data dissemination system.

we focused on the device discovery protocol and proposed a model for explaining the distribution of inquiry times.


However, if the predicate is satis.ed at some leaf, the function will nondeterministically return either SOME(n), for a satisfying n, or NONE.

this implementation will never returnafalse positive,butit will, nondeterministically, return afalse negative.


In a second set of results we study the case where different parts of the data have different importance, modeled by assign- In smoothing, the basic idea is to trade bandwidth for space and latency.

the bytes of the input stream, instead ing a real "weight" to each byte in the stream.


However, for the parallel case we need to tweak the outermost tile size to exploit the locality within the inner loops.

we need to ensure that the concurrent threads do not interfere with each other in cache.


We infer there must exist an executed statement, event or non-event, mi s.t.

nj is reachable from mi and mi is reachable from ex.nj directly/indirectly depends on mi and mi directly/indirectly depends on ex.


From Equations 1 and 2, 2 plugging is not more expensive than logging when the absorb count is not larger than 2.

the plugging cost and the logging cost are the same when the absorb count is 2 (i.e., 2te+2b×tw).


m Adaptable cache Binary ELF x86 Linux Base code maintainer Aspect developer Ex~u~ Cache administrator Cache process (host process) / Prefetching policy source Collections of aspects Preproce~ 1 Preheated C seume Advice ~td poiatcut functions Compile llnk (gcc) Compiled aspects Shan:d library (.so) ELF x86 linux Cache [/~Dyner instrumentation t Ptefetching pelicy deployed through shell commands thread(s) thread (weave -deweave) In bold : provided by/~Dyner Figure 2: Processing to ItDyner relies on a source instrumentation of the program to reduce the cost of dynamic weaving.

#Dyner provides a source-level annotation hookable with which the base-program maintainer annotates the points in the pro- gram at which adaptation is allowed.


In these two experiments, as shown in Section 4.1, subjects with Fit tables were able to deliver source code for which a signi.cantly higher fraction of test cases passed.

fits required subjects to spend some more time, although this was paid back by a higher code correctness.


In this section we will .rst discuss the problems that emerged from the extension and then explain the key bene.ts of generating a safe template language for Java.

the types of properties that can be guaranteed (i.e., the level of safety) are discussed along with application domains that particularly bene.t from these guarantees.


The inode stores the block number which is used to locate the block that stores the data of the file.

one must first get the inode to be able to access the corresponding block (i.e., for read or write).


Given a set R of procedure throw_in 0 executions, we say that apair s~ is in R, denoted s~ E R, ifa E R. We de- note by LatestR a pair in R with the highest ~ part.

latestR = {s[s E R, Vs~ E R s.Z > so.G}.


The adversary s best move is to consider all possible colorings and choose one that eliminates as many choices for nas possible.

if we write Sfor the set of registers in the coloring, the adversary should choose a coloring that maximizes |classn nalias(S)|.


Multiple sessions are therefore not a problem for FIPA, because we can just make another copy of the agent for each session.

we assume that FIPA semantics can still be used, when we attribute mental attitudes for each session.


Further assume, that DWCS selected process 1: as the next running process due to its tighter window-constraint compared to process j. ECalls event scheduler gives process j preference over process i, if this does not lead to a missed deadline for i  (i.e., At Cj  Ci > 0, where At is the remaining time in period Ti).

process i will be delayed by Cj, but since its deadline will not expire, DWCS will select this process after process j has exhausted its service time Cj.


If the above formula is satis.able, there exist x and two keys (k, k ' ) such that the distribution of I(x, k, r)differs from the distribution of I(x, k ' , r)by more than .qms .

the secret values of k and k ' are leaked, and the amount of information leakage is more than expected.


A distance value 0 means that a fault that breaks the speci.cation is present for the input t. On the other hand, in this paper we use this distance directly onthepost-condition.

adistance value0 meansthat thepost-conditionistrue, sotheprogramis correctforthat particular input t. to calculate d(P, g(t)) the program g is executed with input t and then the result R is compared against the post-condition P to see whether the result is correct or not.


In this paper, we report on our experiences using AOP to enforce software constraints in a production software project at SIEMENS called TDE/UML (Test-Driven Environment based on UML [21]).

we discuss how both dynamic and static aspects have been used to document and enforce different types of software constraints.


Assume that there exist in.nitely many primes p for which 2 is a generator of F* p. Then for each one of those in.nitely many primes the following holds: For every b = 1, there exists a multiplicative subgroup S{ of GF(2(p-1)b) {0} of size p such that the only GF(2)-linear dependence among elements of S{ is that their sum is zero.

any set of (p - 1) elements of the subgroup are linearly independent over GF(2).


Further, we assume that system speci.cations are available.

we require speci.cations of end-user requirements and a detailed system design model.


If actions can be executed in any order, such that the system always reaches the same state, these actions are independent.

it does not matter in which order these are executed.


Opposed to the traditional application of feature models, the binding of variability results in a set of allowed operations and not in a concrete product.

a particular feature model con.guration does not specify a particular business document model variant but a set of change operations that may be applied to the generic Core Component model resulting in a valid business document model variant.


First, we can improve PiC O Q L s usability, safety, and consistency by adapting our treatment of synchronization.

to provide queries that acquire locks in the correct order, our plan is to leverage the rules of the kernel s lock validator [15] to establish a correct query plan at our module s respective callback function at runtime.


This quickly showed that generators are, by some distance, the least common form of procedure most procedures always return a single value (and only a single value).

icon s default behaviour is useful for a small subset of procedures (generators), but dangerous for the majority.


While our main result is simply a sound and effective approach to checking the equivalence of loops, we also show that suf.ciently powerful equivalence checking tools such as DDEC have novel applications.

we are able to verify the equivalence of binaries produced by completely different compiler toolchains.


TRADING OFF PRACTICALITY AND PERFECTION We designed our experiment to measure the impact of requirements formats in the implementation of a software system, but had to take into account resource limitations.

these were the availablity of subjects, qualifications of subjects, and duration of experiment sessions.


Three years of practical experience has revealed serious shortcomings of our type system.

it relied on a system of ad-hoc rules to relate combinations of predicates, it could not reason about subcomponents of data structures, and it could not follow sophisticated reasoning about the relationship among predicate tests, all of which are used in existing code.


It furthermore re.ects the e.ect of di.erent usages of MOM on performance.

the completion models the strong in.uence of the message size.


within a P2Pmarketplace peers can o.er certain services arising from the P2P-structure, e.g.


A name of type Name e is an atom a together with a proof that a is a member of the world e. A weak link of type e.f is an atom a together with a proof of the equation f = e U{a}.

the world f is the union of the world e and of the atom a.


Once the component is assessed for its merge potential, the next step in our process model is to perform the actual merging of the component in different products.

the component is transformed into a generic reusable component together with current and predicted future variants.


As stated in Table 2, the default memory scheduling we used so far (and the dominant scheduling algorithm in commercial chips) is FR-FCFS, which works by implementing .rst-come, .rst-served (FCFS) strategy in serving the memory requests, except when there are memory requests in the queue that target the current memory row in the row-bu.er.

fR- Figure 12: Results with di.erent memory scheduling algorithms (normalized w.r.t FR-FCFS (with original)).


Although the two examples look somewhat similar, the continuation style was preferred by most programmers, since the .ow of control was more localised.

the pattern matching required by stream-based I/O forces the reader s focus to jump back and forth between the patterns (representing the responses) and the requests.


We can notice that all basic interpretations are successfully recognized and presented to testers at the top of the ranking, with few exceptions regarding the delete interpretations.

for 2 out of the 36 cases related to the delete interpretation, AVA classi.es replacement as a better description of the di.erences than delete.


Each tier is assumed to be dynamically replicable.

each tier is assumed to comprise one or more VM replicas, and it is assumed that the number of replicas at each tier can be varied based on changing workload demands at that tier.


The tests have also highlighted some critical aspect.

the fact that the transfer of a behavior could determine a cascade e.ect in which many other servicesaretransferedmayintroduce somedangerous recursion.


On the other hand, UML can be tailored for analysis purposes through pro.ling.

mARTE[18]pro.lehas enabledUMLto specify and analyse real-time (RT) and embedded systems.


CCA determines two vectors u and v to maximize the correlation between Xu and Yv.

we .nd two vectors such that when X and Y are projected onto those vectors, the results are maximally correlated.


Its value (or absence of value) is de.ned by functions associated with each block.

at each tick, each block is a function from input values to output values (the function can vary from tick to tick).


Moreover,we demonstrate that for the analyses that we tried, over 98% of all undesirable results have small reasons (3 or fewer terms).

we do not overwhelm the programmer with complex reasons for eachfailure.


In this context, we integrate the notion of net utility in the pricing model that has been presented in [10].

the monetary cost of the Web content provider under a CDN infrastructure is determined by the following equation: UCDN = V (X)+ t (N) × X - Co - P (u) (3) where UCDN is the .nal cost of Web content provider under a CDN infrastructure, V (X) is the bene.t of the content provider by responding to the whole request volume X, t (N) is the bene.t per request from faster content delivery through a geographically distributed set of N CDN surrogate servers, Co is cost of outsourcing content delivery, P (u) is the usage-based pricing function, and u is the CDN utility.


IDENTIFYING THE PROBLEM Our research work for this paper began when we noticed that the implementation of Chord in the OverSim [3] simulator had an uneven distribution of in-.ngers.

the number of in-.ngers varied signi.cantly from node to node in a Chord network.


This feature, in our view, is important for the end user as it reduces signi.cantly the required time to apply the particular library on a problem.

the number of algorithms present in the library can be seen as an ease of use indicator.


Even though time-lines induce a total ordering of arrowMSGs among the entire PSC,a designer can also specify a strict and/or partial ordering of arrowMSGs by using constraints on the message and operators that we shall de.ne later.

furthermore, let m be a message on a time-line ti,werefer to ti as the present of m, the temporal space from ti-1 to ti as the past of mand the temporal space from ti to ti+1 as the future of m. in order to well de.ne the past (future ) for the message at the line t1 (tn), we implicitly assume the presence of a time-line t0 (tn+1)that has no message.


Say that a class is empty if, and only if, all the following conditions hold: it has no virtual functions;  it has no scalar .elds;  it has no virtual bases;  all its direct non-virtual bases are empty;  all its structure .elds are of an empty type.


More speci.cally, we choose a bounded clock X = (cherry(a, K ),f)with a = n and K =(2.n - 1)(diam(g)+ 1)+2 and we de.ne privilegedv = (rv =2.n+2.diam(g).idv).

note that we have : privilegedv0 = (rv0 =2.n) and privilegedvn-1 = (rvn-1 =(2.n - 2)(diam(g)+1) +2).


We consider two values to have the same shape if in their respective tree representations, their constructors at each node in the tree match, ignoring all opaque types (Section 4.2.2).

for values a and b, subVals a == subVals b Furthermore, indexes that have been universally generalized (and all their children) match any value, since a universally generalized index indicates that counterexamples have been found for any possible constructor.


Therefore, we see that while hypothesis 3 can generally be rejected across the ecosystem, there are some small niches where it may hold true.

this appears to hold true for the specialized case of translators migrating across projects in the ecosystem, as evidenced by component 4.


ACKNOWLEDGEMENTS We would like to thank all the members of the Network Computing Platform group in IBM Tokyo Research Laboratory for helpful discussions and comments.

we thank Motohiro Kawahito for implementing the partial dead code elimination routine.


Framework Implementation The requirements for .exibility, rapid development, and the need to incorporate data management into the framework services guided our decision to choose a scripting-based approach to the implementation of the framework, framework services, and component adapters.

we opted to implement those aspects in Python, making use of its strong built in support for .le operations, dynamic object management, and high level of abstraction.


Interaction 2 is a transition phase, where the Engineer formalises the information by gathering it into standard documents.

the software engineer selects, sorts and represents the information he/she perceives as relevant into a structured model.


Employing these basic update ADT operations, arbitrarily complex update programs can be written that guarantee a high level of correctness for the resulting program.

update ADT operations can prevent in addition to syntax and type errors certain kinds of logical errors, for example, those that result from forgetting to change some occurrences of an expression.


We also consider how the unconference format of the CW14 helps in eliciting information and forming future collaborations around aspects of reproducible research.

we describe three distinct areas of concern which emerged from the event: collaboration readiness, capability enhancement and advocacy.


Finding other processes Every phase-i process that completes this stage, except for possibly one (subsequently called the special process ), becomes aware of another phase-i process.

it reads the PID of another phase-i process.


In this paper we examine the use of collective communication between the storage servers to improve the scalability of .le metadata operations.

we apply server-to-server communication to simplify consistency checking and improve the performance of .le creation, .le removal, and .le stat.


While agility refers to nimbleness, a method aiding this process needs to be nimble as well.

in order to increase the level of agility, the tools (i.e., agile software development methods) used in the development process need to be agile also, i.e.


This is done by assigning the same Braille cell to characters in different languages that are phonetically equivalent.

the same combination of dots in a cell may represent different characters in each of the different Indian languages.


We now explain our approach which addresses all these challenges.

we describe the implementation of Inserter and OSR Pass shown in Figure 2(b).


Furthermore, up probabilities in the range of 0.5 0.8 imply that peers are typically up, but not enough to make the .rst-place winner get almost all of the requests.

the load of the most popular ob jects is spread over several peers, which, in turn, raises the 90-percentile of the load.


However, in addition to those binding time assignments we observed in our case study the need for richer constructs to concisely specify the staged con.guration semantics of a DSPL.

the DCU DSPL incorporates 1. features/attributes with multiple possible binding times dynamically decided and restricted during application engineering and 2. complex constraints between feature/attribute con.g  uration choices and binding times.


a peer s reputation should be associated with an opaque identi.er (such as the peer s Gnutella username) rather than with an externally associated identity (such as a peer s IP address).


One instance of Racer is applied to a base program, and a second instance of Racer is applied to code executed by the .rst Racer instance.

the second Racer instance checks for data races in the Racer implementation itself.


POLYD PolyD is a pure Java tool that, using dynamic bytecode generation, allows the user to de.ne customized dispatching policies, altering many aspects of message dispatching that are usually predetermined and that cannot be easily changed.

using PolyD it is possible to de.ne a set of methods and invoke them according to user-de.ned criteria.


While preliminary results are encouraging, there are still a number of interesting directions for future research.

there are numerous additional LHPN transformations that can be developed.


Our strategy combines the .exibility of logic programming (computation of solutions for logic variables) with ef.cient evaluation methods from functional programming.

it is the .rst known narrowing strategy for this class of programs that evaluates ground terms deterministically.


3.2 Generators for User-de.ned Types Consider the user-de.ned type Tree of node-labelled binary trees.

data Tree =Leaf | Node Tree Int Tree deriving Show a tree is either a leaf or otherwise a node with a left subtree, an integer label, and a right subtree.


In contrast, CZ allows a class to multiply inherit other classes, which may contain state.

a class may extend other concrete classes, while in trait systems, only traits may be multiply inherited.


This is acknowledged, for instance, in the software reliability community where the interest is not in whether certain properties hold but measuring the likelihood of them being violated.

it is useful and interesting to be able to analyse properties that fail to be universally true in the model of the system under assumptions on how the sofware shall be used by its environment [14].


OTHER OUTSOURCING PROBLEMS While the protocols of the previous section are speci.cally for matrix multiplication the protocol can easily be adapted to scenarios where the function being computed is any arithmetic circuit having multiplication depth 1.

the only multiplications that are performed are between inputs to the protocols (i.e., we do not multiply intermediate results).


To correctly model the application work.ow, in addition to having the names of the modules to which one can navigate from a given view, we also need to extract the set of inputs that are submitted along the link.

we need to determine which GET and POST requests parameters are submitted if a user follows the link.


Theperspectiveofa .xed uniformdistribution,inwhich onebit ofinputdata always carries afullbit ofinformation,has anintuitive appeal:forinstance,in thedivision example,itistempting to argue that .nding out that a 32-bit input has all bits zero should always count asdiscovering32bits ofinformation.However, webelieveit is ultimatelyless usefulbecause itis tied to aparticulardata representation,that oftheinputstotheprogrambeing analyzed.By contrast, channel capacity abstracts away from a particular representation to more abstractly characterize the computation a program performs.

channel capacity can be more naturally be approximated compositionally, as ourgraph-based analysisdoes.


Second, we propose an approach that exploits the intrinsic structureof SystemC.

each SystemC thread is translated into a separate sequential program and explored with lazy abstraction, while the overall veri.cation is orchestrated by the direct execution of the SystemC scheduler.


To address this, a wide range of techniques for supporting (semi-)automated synthesis of behaviour models have been investigated.

synthesis from scenarios and use cases (e.g., [9, 16, 6, 1, 18]) has been studied extensively.


But this violation of the slotted programming paradigm needs to be taken into account by all modules that are scheduled during this time.

other modules should refrain from using the radio or turning it o.. For that purpose, the startSlot() command informs the modules about the current state of the synchronization.


LESSONS LEARNED ESCORT was a complex project, for a number of reasons: diversity of partners background.

difficulties arose between partners with a strong object technology background and others strongly focused on optimisation issues and highly experienced in bare metal programming.


In fact, the tester did not observe the hotel booking (HB) service invocation (!invoke H otelBook) in a delay inferior than 120 seconds.

it did not receive a message from (HB) within this network timeout.


Future experiments: it would be useful to do more comAlgorithm    Joblib   Markowitz 8.5MB 1.2MB Fama French 1.6MB 0.42MB SVD 2.7GB 2.7GB Events 2.7GB 2.7GB Table 1: Memoization Space Required for Experiments (events is only for 12 months) parisons for intraday calculation.

intraday data is often messy and has missing data, and requires data cleaning scripts that .ll data forward and backwards: using real rather than synthetic data and seeing how avoiding repeated data cleaning saves computation time would be a good use case.


The theorem above implies that any method speci.cation T in a subtype validates the behavioral subtyping conditions.

hierarchy violations are impossible with our approach; we always guarantee behavioral subtyping.


In this section, we propose a formal model of coordinated at- tacks which can serve both as a semantic model of a concurrent computer (or network) system and as a planning model for a group of attackers.

the model incorporates the viewpoints of both the security analyst and the attackers.


and their re.nements are de.ned in a type-speci.c language.

the de.nition and re.nements of .jak .les are expressed in the Jak(arta) language, a superset of Java [3].


Since the pyramid kernel approach works with any choice of multi-dimensional features, we used the same features as in our approach.

10-level pyramid kernels were constructed from the raw corner features (not affine-invariant attributes) and were used to train an SVM classifier.


We have had a rewarding and educational experience in using small scale simulation for testing RAS code.

because small scale simulation enables the creation of fully automated tests, a regression test suite can be created.


The subtle dif.culty in such formulation is to avoid buffercon.icts using linear constraints, because two con.icting bufferscan be allocated in either order in the shared buffer.

formulation of the OR logic is non-trivial, since a buffer can beallocated either before or after another con.icting buffer as long asthere is no violations of the stated guidelines.


1-2 2-3 3-4 4-5 5-6 6-7 7-8 8-9 9-10 Move Method 14 10 49 0 3 11 1 1 2 Move Field 6 45 79 1 1 3 0 0 0 Rename Method 19 15 71 6 16 21 1 2 16 Rename Field 31 22 37 0 2 5 1 1 10 Total 70 92 336 7 22 40 3 4 28 The data from Table 2 would seem to suggest a relationship between the four refactorings.

relatively large numbers of these four refactorings are carried out in each version.


The code source contains syntactic annotations that specify if an expression belongs to the client or to the broker.

if an expression has to be evaluated on the client or on the broker.


Our scheme is e.cient and yields constant signatures of only three group elements.

veri.cation requires a small constant amount of pairing computations, though a linear (in the number of previous co-signers) number of exponentiations.


The rationale for raising this issue as first class research challenge is evident from the pathway followed by model-based UI engineering methods over the past few years.

since the early efforts aiming to replace the prevailing toolkit programming model for implementing UIs by articulating models, model-based development has shifted its focus to designing UIs.


With respect to existing solutions, our approach is characterized by some distinguishing features.

the application we propose does not assume any centralized coordination: it transparently collects and processes user information that is accessible in any mobile phone, such as the log of calls, the list of contacts or the inbox/outbox of short messages and exchanges it with other users.


The de.nition of needsDisplayUpdate is a simple translation of its description: needsDisplayUpdate (M) .typeDecl ( DC, Display , , ), methodDecl(Repaint , repaint , DC, , ), mayRead(Repaint,F),mayWrite(M,F).

m needs a display update if there exists a .eld F which may be read by the repaint method of the Display class.


Having given a left-shrinking law, the reader might wonder about a corresponding right-shrinking law as well.

we might expect being able to pull out computations that do not make use of the recursion variable from the right hand side of a .=.


We refer to each such abstraction as a tope , the Greek word for place , because each data category has a natural place in the problem domain.

problem domains involve email addresses and salaries, rather than strings and floats, and it is the problem domain that governs whether a string is valid.


In our earlier work, we proposed a search-based approach for testing an individual controller con.guration [20, 21].

we .xed the values for con.guration parameters based on those used during HiL testing, and developed search algorithms maximizing Fst, Fsm and Fr within an input search space with two dimensions: ID and FD.


The existence of these particular conceptions is not surprising as they fit, more or less, within the structure and development of the course.

the study of programming focuses on each of the elements present within the first three categories at different stages of the course presentation.


Context Some institutions need to keep large amounts of sensitive information.

some institutions keep sensitive information about individuals, other institutions, or about their own businesses.


All tasks must still be stopped at a safepoint in order for the scavenger to have a consistent view of the old generation.

consistency of the remembered set of references to young generations must be guaranteed, in order to precisely locate references from the old generation, to the young generation being scavenged.


To the best of our knowledge, this is the .rst study demonstrating the bene.ts of subcubic all-pairs alias analyses.

our alias analysis is able to analyze the 10M SLOC Linux kernel in about 30 seconds.


By writing our units so that they import the superclasses of each exported class, we can implement our dynamic participant classes in a manner corresponding to mixins [8,17].

we can represent the static inheritance relationships between pat- tern participants not in the definitions of our units or in the unit interfaces, but in the connections between units.


Second, we provide a reduction technique to e.ciently compute interpolants in many theories of practical interest that can use existing interpolating theorem provers as black boxes.

using the reduction approach for compiling various quanti.er-free theories for complex data structures to the combination theory of equality with uninterpreted functions and the theory of linear arithmetic proposedin[19], we show that from an interpolant in the reduced theory, one can construct an interpolant in the original theory.


PROCEDURES As mentioned earlier, NQC supports functions only as text continue; macros.

the function body is substituted at every } //ln(x) point of call.


When dealing with composite operations another resource for detecting con.icts may be used, namely the operation contract comprising the pre-and postcondition for the successful application of the operation.

a con.ict occurs if the application of one operation violates the contract of another operation.


This suggests that an effective underlying infrastructure used in the development, deployment, and execution of these applications has to be generic enough for use in multiple application domains, and flexible enough to offer easy customization for specific application requirements and heterogeneous operating environments.

the distributed systems deployed using WSNs require a shared application substrate in the form of a middleware platform [5].


The third is the multi-model controller, which interacts with the outside world through three interfaces: the sensor, the meta-model, and the actuator.

the sensor interface is responsible for triggering the adaptation decision work.ow in response to a live SLO input.


Although storage caches are used for improving I/O latencies of parallel applications, most of the prior work has focused on the management and partitioning of cache space.

the compiler s role in taking advantage of multilevel storage caches has been largely unexplored.


We would like to point out that in general the proposed method is not sound.


We also analyzed the maintenance issues associated to the commits responsible for the co-changes in Cluster 28.

we retrieved 37 maintenance issues related to this cluster.


Further, as the value of K increases, the PDR generally improves as it reduces the amount of IP tra.c and hence the possibility of collisions.

for K = 1 we .nd that lot of packets are lost in the network, particularly when there are many gateways in the network.


In the preceding JavaScript code, the target point is after the second animate method is called.

we want to be able to specify the animate method between the next and end methods.


But, we need to determine whether or not it is safe to do so.

is i, the free variable of g, the same when h is invoked as when it was captured by g?


4.1 De.nition The goal of this empirical study is to analyze program families for the purpose of evaluation with respect to verifying the presence of preprocessor-based syntax errors in the context of the C language.

this study addresses the following research questions: Question 1.


The reason s (., t ) does not always provide exactly one value is that s has an implicit third dimension: a replica.

each time one consults the store, one actually consults a replica of the store.


No further operations are provided on sequences sequences are immutable.

recursion on sub-sequences is only supported through indices.


To achieve transparency, the query language must be declarative rather than procedural.

queries should describe what data needs to be retrieved rather than the method of retrieval.


Ada does have excellent support for interfacing with other languages however.

the GNAT compiler knows about the gcc C++ ABI (Application Binary Interface), which is also shared with the Gnu Java compiler.


Thus, if every pair of overloaded de.nitions satis.es one of these rules, then no ambiguous calls are possible.

if S is the set of overloaded method de.nitions provided by type X for method f , then S is a valid overloading if each pair of distinct de.nitions in S satis.es the subtype rule, the exclusion rule, or the meet rule with S, as de.ned below.


the .rst step involves the addition of association due to references by association ends that have been deduced and are stored in D. whenever an association end is in D, then the respective association is added to R ' (Line 22).


If the subscript of a reference to a global array is in an af.ne form of the global ID, work-group ID, and local ID of the workitem that accesses the array, then the address of the array reference can be computed with the value of the pointer to the global array and an af.ne function of the global ID, work-group ID, and local ID of the work-item.

the address of the array reference is an af.ne function of the global ID, work-group ID, and local ID.


Congestion games have been extensively studied and generalized.

leyton-Brown and Tennenholtz [5] extended the class of congestion games to the class of locale.ect games.


As an application of the setup, we show how to relate several models of backtracking search, based on solution streams, success/failure continuations, and decision trees.

we generalize the main resultofWand andVaillancourt (2004), which relates the former two models in the special case where the underlying effect is just partiality.


p is said to be a method transition if it is performed in-between method entry and exit.

there exists a preceding transition tprev .


Linearize and LinearizeFDs perform better for the harder primitives.

linearizeFDs is the only technique that can successfully deal with vertical partitioning into N-to-M relationships (VPN).


Note that, MultiGreen is more suitable for delay-sensitive energy demand than delay-tolerant demand.

multiGreen seeks to address energy demand when it is generated immediately.


This bound holds even if we continuously allocate without freeing, since the allocator maintains its M overprovisioning factor.

the allocator is sampling with replacement.


leveldb leveldb required a larger number of manual code modi.cations compared to the benchmarks with fewer total lines of code.

the Slice class in leveldb contains a constructor that accepts a const char *.


the fraction of the whole overhead generated by TERA experienced by each single node.

the burden imposed on nodes should be fairly subdivided among all participants to avoid the appearance of hot spots.


However, CrowdLearner goes beyond prior work by making sense of collected mobile sensor data and user labeling, and employing machine learning techniques to automatically generate recognizers for high-level events and user actions.

crowdLearner s data collection mechanisms and interfaces were designed for capturing mobile on-device sensor data and facilitating mobile user labeling, which are not designed for general mobile data collection purposes.


Involved learning resources such as scripts, learning units, or tutorial services are available digitally and can be addressed or retrieved over networks easily [29].

these learning resources are digital products, characterized closer in [25] or [14], and digital services, which are described e.g.


CONCLUSION We have shown that web applications mishandle unexpected navigation sequences caused by the uncontrolled use of a web browser s navigation functionalities.

we calculated that more thanhalf of allpossible unexpected navigation sequences are improperly handled in three realworld applications we studied.


Indeed, Model 3 slightly outperformed Model 4, developed speci.cally for this case study.

several years of data for other systems was as least as informative as 10 months of data for the current system.


Automatic interface adaptation complements explicit enduser customization, and we wish to investigate customization languages and mechanisms.

we would like to enable users to easily in.uence how Supple interfaces are rendered.


We can separately optimize the agreement and execution clusters.

it takes a minimum of 3f + 1 servers to reach agreement in an asynchronous system that can su.er f Byzantine faults [7].


More precisely, it uses a Perl script to match speci.c patterns of assembly code and to rewrite them to better-optimised assembly code.

this script is of course heavily dependent on the target architecture and also on the speci.c version of GNU C. it rearranges code blocks to implement the tables-next-to-code scheme of GHC, which we will discuss on more detail in Section 3.5.


correct any code addresses such as return addresses currently on stacks.


The rest of the paper shows that anti-O is also necessary.


The column Defect Rank shows where the actual defect ranks among the isolated anomalies, based on the validation step detailed in Section 4 and combining three predictors.

defect Rank represents the maximum number of anomalies to be analyzed by the user to locate the actual defect.


Implement the protocols in this paper to determine what size matrices are required to make this form of computational outsourcing more practical than simply doing the matrix multiplication.

how large do the matrices need to be before the client spends less time doing its part of the protocol than simply performing the multiplication itself?


We implemented 248 wrappers, which we use to isolate 463 imported and exported functions.

wrapper code is often shared among multiple drivers in a class or across classes.


In this paper a further insight of the idea is given by analyzing the range of service adaptation scenarios that show up for cloud environments.

we present and analyze the different types of adaptors that will be required and the main issues that should be addressed at each adaptation level (signature, behavior, semantic and service).


They denote di.erent forms of interaction between the point where the exception is raised (exception throwing port) and the handler execution at the ExceptionHandling component.

the exception connectors determine the abnormal interactions that can take place between the Exception-Handling component and the rest of the architecture.


Example 10: Figure 6 shows some con.icting correspondences between the attributes of the X_Order_Line and Y_Order_Line logical relations.

it focuses on those con.icts between the city" attributes on both sides.


Future work will investigate cache-aware scheduling algorithms that cooperate with COLORIS, as we attempt to eliminate cache con.ict misses by di.erent workloads altogether.

we will investigate ways to provide hard guarantees on the isolation between workloads, which is important for real-time applications with deadlines.


Further, we observe all search queries for a much longer period of time to estimate the extent of malware.

we ask the following questions: What types of malware are being spread through P2P?


[12] pointed out this prevents aspects from becoming fragile by removing the power to advise fragile points, which might be sometimes inevitable [20].

the pointcut fragility problem cannot be easily solved, but it can be made less severe as in [12] where the Java language is extended with a new construct (the explicit join point ) that an extended AspectJ can then hook.


However, the reputation system can be centralized.

there are one or several central authorities collecting feedbacks, publishing reputation scores, and detecting abnormalities.


The third invocation is not well typed, as ces has type @CWGraph@Edge[], which does not belong to the group @Graph.


The equivalence between the initial object and the .nal one can be represented with the following diagram, by asserting that it is commutative.

mCGA UA MA C GA GA A GA MCGA the objects are equivalent if their marshallings are equal, which leads to the following su.cient property, completing the previous requirement.


In order to compensate for this behavior appropriately and in order to control the overall behavior according to the general requirements, the developer therefore not only has to provide the logical information of the code itself, but also of the tasks within the cloud.

he has to provide the code logic and the behavioural logic in terms of how the tasks / instances replicate, relocate, scale down etc.


To detect this, we analyze the return addresses of invoked interface calls, which are stored on the top of the stack.

suppose that we instrument an interface call entry f of a component C. In this case, we log f only if the return address of f is not part of the memory space corresponding to C. Based on this approach, we can precisely detect invocations of the interface calls to target components at runtime.


The Squawk Debug Architecture This split architecture allows many of the memory-consuming components of a Java Platform Debugger Architecture (JPDA)compliant debugging environment to be located on the development workstation instead of in Squawk, reducing memory overhead.

the debug proxy on the workstation has access to the original class .les that went into the suites on the device, so it has access to line number tables and method, .eld, and local variable names that may have been stripped from the suites.


RESULTS Before presenting the results, we show that the BDF-based technique [20] provides more useful Prediction Intervals than the traditional approach.

error Bayesian Prediction Intervals (ErBPIs) are much shorter than the traditional ones.


On the other hand the relation between both is ensured by import relations.

once the physical configuration is described, this can be imported in the description for the components and the deployment.


In both Formulate and WebFormulate, objects communicate via messages to request or announce changes in values.

computations retain symbolic links to referenced objects.


In this study, we present the results for two contest categories: Highest Tolerance and Highest Image Quality.

we use the di.erence of pairwise discrete cosine transform (DCT) coe.cients and an error-correcting code (ECC) to satisfy the requirements of the Information Hiding and its Criteria for evaluation (IHC) criteria, which both require coding tolerance and cropping tolerance.


For dynamic pages, the properties to be veri.ed depend on the type of web application.

the web programmer should write the speci.cations his/her application has to verify.


While these language-based solutions have many useful, even essential features, there is still room for improvement.

producing descriptions of unknown data sources is still a somewhat tedious, time-consuming and error-prone process.


Learning is typically a very computationally intensive process.

learning simply at the architecture-level is infeasible for any sizable system, which is the reason why its application in existing architecture-based adaptation approaches has been limited.


In our IMC semantics, we use the same modelling approach for kernels and detectors.

we associate single state Markov chains (with a single transition) to kernels, one for each scenario in which they can operate.


In contrast, the recently developed Lyapunov optimization framework [9, 26] is shown to enable the design of online control algorithms for such constrained optimization of time-varying systems without requiring a priori knowledge of the future workload and costs.

our above two-timescale power delivery model .ts well the two-stage Lyapunov optimization framework [39], that enables us to perform two levels of control strategies at two levels of time granularity.


A further drawback of 3D visualizations is that the user becomes easily disoriented while exploring the information space.

the user loses his/her sense of the current position in the information space and fails to recognize regions already explored.


The purpose of such multi-tenancy is to service requests from multiple tenants of a cluster, with specific goals that include fairness to the different applications being run, meeting real-time deadlines, and high throughput.

given the diverse goals of multi-tenancy  or GPU hyperthreading articulated above, we propose and develop flexible software, rather than hardware, methods for GPU sharing.


Because A cannot distinguish between G and T , we conclude that if we apply A to G, each node must produce the same output.

if A .nds a maximal edge packing, it must produce the solution y(e) =1/3 for each edge e. None of this holds in the port-numbering model, as the port numbers may be used to break symmetry for example, a prior algorithm [2] never sets y(e)=1/3 in any graph.


A.2 CFL-Reachability The CFL-reachability problem is to determine whether there is an S -path from node u to v in G, where S is the start symbol of the given CFG.

the CFL-reachability problem has four variants: (1) The all-pairs S -path problem: For every pair of nodes u and v, is there an S -path in G from u to v?


as interactions through the internet proliferate) the variety of disputes can also be expected to increase.

note that while most of the disputes just described typically involve only two parties, some of them (e.g.


However, it aims to share the same web page, so it doesn t allocate di.erent parts of the same content to di.erent devices.

for example, it can not allocate video content to device A, audio content to to device B, while control input is made on device C. it can not synchronize di.erent content components Figure 2: Existing Framework allocated to di.erent devices.


In a nutshell, another agent could be sent to the same shops, these shops will propose new signed offers to this new agent, and these new of_ fers can then safely replace the corresponding offers in the original chaining relation without destroying it.

the attack uses a capability which was not modeled in this particular Dolev- Yao model.


A concept is a pair of sets a set of elements (the extent) and a set of properties (the intent) (X, Y ) such that Y = s(X) and X = t (Y ).

a concept is a maximal collection of elements sharing common properties.


Our technique exploits the fact that a large number of execution traces may contain various runtime behaviors with both good and bad performance.

our technique de.nes two contrast classes over execution traces as a fast class and a slow class based on thresholds of execution time (usually speci.ed by developers as the expectations on performance).


5.3 Separable Control Constructs The types of begindef and enddef guarantee that user-de.ned procedures have no effect on the control stack.

the multiple parts of a control construct must always appear together.


THE GAME OF LIFE PHASE II During the discussion of the Phase I solutions, the instructor hands out the Phase II assignment which explicitly addresses the previously identified problems with the Phase I design.

the Phase II assignment involves having the student use the Visitor and Command design patterns to clean-up their Phase I solutions.


CASE STUDIES In this section, we explore three ICLs.

we develop and experiment with the file-cache content detec-tor (FCCD), the file layout detector and controller (FLDC), and the memory-based admission controller (MAC).


It is a minimalistic hash table interface that comes with the standard library of C++11, though it does not allow all ETS functionality to be used.

iteration over the table is not supportable and there is no .ne grained locking support either.


In addition to maintaining the details of the various workspace activities, the internal state component serves a second critical role in Palantfr.

it is the com- ponent that is responsible for subscribing to relevant types of events and processing the individual events that it re- ceives from Siena as a result of those subscriptions.


Boadilla del Monte, 28660 Madrid, Spain lauraelena.carvajal@upm.es ABSTRACT This doctoral thesis addresses the difficulties associated with building usable software.

it deals with the open problem of providing users with artifacts that enable them to design and implement usability mechanisms, focusing on those that have high implications on software functionality.


As a result, if the .rst step does not align client code well, our approach may miss some API mapping relations but does not introduce many false mapping relations.

our approach is robust to mine accurate API mapping relations.


We can think of any sequence of sorts as an index context.

we will make use of substitutions of the form .


The solution we propose allows multithreaded applications to be run on multiple processors as it uses a modi.ed cache coherence protocol to guarantee atomicity by ensuring that a consistent view of corresponding original and shadow memory locations is maintained.

to achieve atomicity, the cache coherence protocol we develop ensures the following property: Dependence Mirroring.


Our aspect refactoring approach is based on different kinds of aspect refactorings.

we use the following classification [9]: Aspect-Aware OO Refactorings: This includes those objectoriented refactorings which were extended and adapted to be used in the aspect-oriented paradigm.


the bootstrapping JAR file for composer.


5.3 Adding a Component Library As this framework is defined so far, it is a pure whitebox framework [2].

implementations are built by providing classes that implement (i.e., inherit from) the various Java interfaces.


(E4 ), x y it means that it is possible to publicly announce (2), (3) and (4) in turn if and only if the initial state is (4, 13).

the only solution of sum and product problem is (4, 13), which is consistent with the result of [8, 9].


Furthermore, if b is a branch statement on which statements in the slice are potential dependent, [3] only computes the closure of data and potential dependences of b.


The Intel Software Development Emulator [3] was used to collect statistics about the execution of the benchmarks.

sDE s mixtool was used to determine the hot functions and basic blocks in the benchmarks as well as to collect histograms about the different types of dynamic instructions encountered during execution.


The plugin can read from and write to this database via EA s API.

the additional traceability information required in our methodology, previously-generated design slices and reports, and the decisions made by users during inspections are all stored and retrieved by the plugin via the API; this communication layer thus simpli.es the implementation by hiding the underlying database technology.


Although we could derive successful predictors from the failure history in each of the projects, this may not generalize to other projects.

the specific failure history, the coding and quality standards, or other process properties may be crucial for the success.


It writes new data for a certain data page into a log page within its block.

instead of writing the data page in its entirety, IPL only logs the change information (a log record), which can reduce space requirements.


Nevertheless, the conversation is not stalled and the system continues with the other aspects of the information gathering activity.

the system registers that the caller has speci.ed a topping, skips its default question on this topic, and repeats its question about the size (see line 5 of Fig.


Motivated by their relevance in the software architecture life cycle, the architecture description has been the focus of important studies [4, 12].

iSO/IEC/IEEE 42010 standard [11], also known as IEEE 1471-2000, represents an important e.ort towards describing software architectures.


In particular, if N(true,C1) is unsatis.able, the whole sequence cannot go wrong because of C2 or C3.


This effectively prevents a failed trylock from reliably revealing anything about the state of the lock (and hence the write of the lock operation has no means to convey any synchronization information).

it is now clear that the assertion in the above example may fail.


All the functions that appear in Figure 1 may be invoked with many different parameter values, but our selective use of parameter sensitivity ensures that the central parameters often have constant values in each context.

the static analysis infers determinacy information that is quali.ed by abstract contexts, not by concrete call stacks as in dynamic determinacy analysis.


As long as the system has suf.cient memory to satisfy all currently running processes and no additional memory requests occur, pages are not dropped from the page cache.

data in the page cache is not expelled unless it is replaced by more recent data or by the kernel reclaiming pages from the page cache to serve memory allocation requests.


the criterion (line6, y) (i.e., the value of y at line 6) yields a slice which contains lines 3, 4, 5, 6 as well as lines inside the body of the functions f1, f 2, f 3.

since the slice is a (.at) set of statements, the program structure is lost in the slice.


Practice rounds are important because they acclimate the end user to the primary task.

the user is working with the primary task but performance is not measured.


Analyzing the existing COBOL programs is effective for the program understanding.

program slicing with data .ow analysis is very effective for program understanding.


batch B1 consists of the .rst half of the vector (from left to right), batch B2 consists of the next quarter, and so on.


It is even possible to integrate an AOP language [4][5] into the MDSD infrastructure.

a number of pre-built advice can be defined as part of the platform and pointcuts are generated based on specifications in the model.


consider the first case where s is the step in which a process p executes Line 9 and CSowner has a value different from p in the configuration D immediately preceding step s. let s = Line(p, k, 9).


poly(n), is not perturbable in general, by the algorithm of [3].

the class of perturbable objects is a proper subset of the class of L-perturbable objects.


It also provided insight in the effects of p, beyond the ones we observed in our small scale testbed.

larger p values greatly exacerbates any inherent variability in runtimes, increasing overall query delays.


We de.ne slow(r) to be the complement set of fast(r).

intuitively, fast(r) is the largest set of processes that see each other (appear in each other s view) in.nitely often in r. for all pi, pj .


The let rule differs from the one used in HM(X) [25], by having a less restrictive generalization re lation.

hM(X) restricts generalization to abstracting only solvable constraints.1 Since the intended use of the system is prescriptive (that is, a program analysis setting), we can safely restrict ourselves to constraints that are always solvable.


The main theme of the KOPLE workshop is to bring together researchers and practitioners to investigate the interplay between knowledge and product-line engineering.

the workshop will look into how knowledge engineering can improve the state-of-the-art and the state-of-the-practice of PLE and vice versa.


We omit type de.nitions and consider the following values: v ::= Values c(v1,...,va) a = 0 An implicit typing discipline is assumed.

a constructor c has a .xed arity, written a above.


Since SecureSync represents program entities and dependencies via labels and edges, changed/affected entities are represented by the nodes having different labels or neighborhoods, or being added/deleted.

the unchanged nodes between twoxGRUMs of vulnerable and patched code are considered to represent the entities irrelevant to API misuse.


Using Bloom s data.ow debugging tools [6], we observed that the synthesized input data passed through the data.ow only as far as the checkout_log collection, which is de.ned on lines 17 18 as a join between checkout_msg and action_log on session.

the cart service did not return any results upon receiving a checkout for an empty client session.


If {x, y}is not a candidate query edge, then it is a covered edge.

there exists an edge {x, z}in G ' i-1 such that |yz|= a and .yxz = .,or an edge {y, z} in G ' i-1 such that |xz|=a and .xyz =..


(2) Haskell offers powerful features to encapsulate abstractions.


We consider only the latter essential and argue that JIT compilers should also come with re.ective high-level APIs and extensibility hooks instead of being black-box systems.

we propose to augment JIT compilers with two intuitive and general metaprogramming facilities, upon which further functionality can be built: Explicit compilation: if programs can invoke JIT compilation explicitly, code can be specialized with respect to preexisting objects on the heap, in the style of partial evaluation [28].


In the light gray cells the values of area, clock frequency, IPC and performance are placed while in the dark gray boxes their average values for set of scenarios which are characterized by common architecture characteristics like the size of the register files and their number of ports.

the dark gray boxes with average values under the measurements in the light gray cells, are the average of the four values above the cell which refer to architectures with a specific value of register file input/output ports (1,2 and 3) while the average values on the right of light gray cells refer to architecture instances with a specific value of register file size ( 2,4,8 and 16).


(4) Pi.p1(q) Rj.p2(q) Once again, it is possible to de.ne abstract domain operators.

the join operation can avoid computing convex hulls in favor of simple set theoretic union of the individual polyhedra.


If w is ~1N wi and if the wi's are independent, then v(w) = ~¢ v(w,), that is, a(w) = ~/~1N (~r(wl))2 .


As an entry criterion of the process, we need to clearly distinguish the PHR systems from the PHR-like services which are proprietary, non-transportable and not controlled by the patients.

we need to clearly define what are PHR systems.


We demonstrate in [2] that it is superior (in terms of performance and expressiveness) to previous approaches based on run-time composition of pattern objects through interfaces.

the average overhead of our approach in comparison to a handcrafted solution is 25%, occasionally becoming even faster by about 10%.


By this construction, the only processes that are correct in run R (i.e., take in.nitely many steps in R) are those that are output by A at some correct process in.nitely often.

in run R, every correct process is output by A at some correct process in.nitely often; thus A violates the speci.cation of k-anti-O.


In general, the %eflags register is used to keep some state information about the computation.

after the execution of most arithmetic instructions, the %eflags register indicates the parity of the result, whether an over.ow occurred, the sign of the result, and whether the result was zero.


In the current implementation of Kestrel, these events are handled by XMPP-speci.c functions that form an interface between the internal system and the network.

there are many cases where messages must be sent between nodes, such as notifying a worker of a job match.


Additionally, the generated code is also exempted from typechecking.

terms that are not well-typed can be generated by a type provider, leading to potential run-time crashes.


From the user s perspective though, they need to understand that x2 and x4 were expensive methods because they are tail-library calls.

x2 and x4 were expensive because they perhaps used the API of the vendor or J2SE code incorrectly or because some aspect of their design requires unnecessary calls to the vendor or J2SE code.


If such a detector is not available, the problem can be avoided by the use of weight based codes.

from the layout structure, some inference can be made on the probability of occurrence of a crosstalk fault.


The proposed pro.le-based approach achieves its goal by maximizing the communication link reuse through compiler-directed, static message re-routing.

it clusters the required data communications into a small set of communication links at any given time, which increases the idle periods for the remaining communication links in the network.


3.2 Service Speci.cations and Interfaces In order to provide automatic service selection by the handheld, the user has to take along the speci.cations of his personal services.

a service s speci.cation contains the list of its provided functionalities, describing the service s behavior.


It relies on the observation that the general pattern for spawning a service thread is: 4.2 Actual implementation (thread-await!

(make-...-signal ...)) The current implementation in the Bigloo system, improves the current user thread blocks until the service ththe na¨ive implementation in several directions.


Observe that these optimizations signi.cantly reduce the size of alias partition sets and substantially improve running time.

without these optimizations, the benchmarks take an average of 2.7 times longer.


The observant reader will notice that the formal system requires a few more annotations be made explicit than the implemented system.

for the sake of convenience and brevity, the implemented system performs some simple annotation inference for the user in various situations.


This allows the state to be easily partitioned in independent parts, which can then be assigned to the available cloudlets.

each State component only has to maintain a limited number of cells, ensuring scalability.


A notable exception in the CBSE area is the Fractal component model [4].

fractal introduces the notion of a component endowed with an open set of control capabilities.


The code pretty clearly says that Copyright protection subsists [ ] in original works of authorship fixed in any tangible medium of expression and goes on to say, In no case does copyright protection for an original work extend to any idea, procedure, process, system, method of operation, concept, principle, or discovery, regardless of the form in which it is described, explained, illustrated, or embodied in such work.

copyright protects the form of an idea but not the idea itself.


Need for new architectural approaches for building applica-tions that take into account the complexity of the interaction patterns among application components, often not known at design time, and that can lead to unforeseen or undesired be-haviors.

the application developer must have the support of tools to assess, before the deployment of the application in the integrated environment, the possible effects of its execution on other systems currently active.


Once we can apply JINSI to a large body of programs, we want to evaluate its ef.ciency and effectiveness as applied to real-life bugs.

we want to apply JINSI to the iBugs repository [3] and compare its effectiveness and ef.ciency to other automated debugging approaches.


I(u), is de.ned as the average number of events that u, if it is event-based, consumes in order to produce a single event.

we de.ne two 1 constantsnu(v) and .nu(v) such that nu(v) .


The heap is scanned, and then marked objects on dirty cards are re-scanned.

the (mark-bits of the) children are read again to check whether a new unmarked child object has been linked to the marked parent object by the program threads.


The topology and geometry of graphs are also quite computable.

they can be expressed as data to support computer-based processes that can be performed on graphs, such as indexing and searching.


Each .gure shows the steady state availability under a di.erent combination of workload rate and time-out duration.

we assumed three types of network workload: low, i.e., 0.01/ms(Figures 12(a,b)),  high, i.e, 0.05/ms(Figures12(c,d)), and  very high, i.e., 0.1/ms(Figures 12(e,f))  and, two types of time-out durations: short,i.e,1ms(Figures12(a,c,e)), and  long, i.e., 100ms(Figures 12(b,d,f)).


Moreover, the three alternatives promote rather different approaches for separating Web Ser- In opposition, when using DI4WS, the expected interfaces for potential services are speci.ed at design time, whereas the bindings between these client-side interfaces and the server-side contracts are iteratively materialized at implementation time via our service adapters.

at design time the developer speci.es the interfaces IForecast, IRouteInfo, ISpellChecking and IEmailSending.


Bytecode-level instrumentation is an example of a cross-cutting concern that Aspect-Oriented Programming (AOP) [16] seeks to easily support.

the Join Point Model of AspectJ [1] is a rich language that could be used to specify where instrumentation (aspects) should be woven into existing class .les.


Some prior systems [30, 24, 13] have focused on means to reach DSU safe points quickly, and we plan similar efforts as future work.

we plan to extend our support for OSR to apply to running methods whose bytecode has changed, allowing the user to map an active method s PC and stack frame and those of its new version, similar to support provided by UpStare [24].


We want to mention that the remaining performance di.erence between our approach and the optimal results are mostly due to data dependencies.

in several cases, data dependencies prevented our scheduler from eliminating some L2 misses.


If so, when the function is called with crash-free arguments, the call will not lead to any crash.

a crash-free argument is an expression whose evaluation may diverge, but will not invoke error.whenever a function is called, its caller can assume at the call site that, there will not be a crash resulting from that function call if the arguments satisfy its speci.ed precondition.


Workarounds for both of these problems exist for singledispatch languages.

the visitor pattern (double dispatch) [18] circumvents these problems without compromising type safety.


As well as in tools for change analysis, we are interested in a process of synthesis: given a current situation and a driver for change (more about this later), we aim at developing tools which offer some guidance, based on past wisdom, of how change should be effected.

we aim to define Change Frames for synthesizing recurrent change situations, akin to the way basic Problem Frames [19] capture classes of recurrent software problems and their solution.


In our view, the combination of both these components can be successfully used to increase the level of trust in services in a federation.

users can have con.dence that the compliance of a service behaviour to the federation rules is perpetually checked, and that any violation is immediately reported.


More fundamentally we believe that there is much work to be done with respect to understanding how different RL algorithms interact with different types of programming patterns involving adaptives.

is it possible to analyze the structure of a program or its execution patterns in order to derive learning algorithms that learn more quickly?


This paper aims at investigating this issue.

the paper presents a review and comparative analysis of current cross-platform mobile app development approaches and a hands-on experience on utilizing one such approach for developing a typical mobile app.


In this work we employ transactional memory (TM) [11] for the shared state synchronization because it integrates seamlessly into the dataflow model.

both abstractions exhibit isolation property: dataflow in terms of exe-cution of data dependent tasks and transactional memory in terms of concurrent accesses to the shared state by different sharers.


If we update v, then the only constraints that could have different methods selected in the new solution graph must be in v s ancestor graph.2 This implies the following: in an evaluation graph, v can reach some set of variables; if we update v, it could reach a superset of those variables, and the difference must come from its reachable ancestors.

if none of its reachable ancestors reaches an output variable, then there is no way that updating v can make it reach an output variable.


Despite CompCert s groundbreaking compiler-veri.cation efforts, there still remain many challenges in applying its technology to industrial-strength compilers.

the original Comp-Cert development, and the bulk of the subsequent work with the notable exception of CompCertSSA [4] did not use a static single assignment (SSA) [7] intermediate representation (IR) [9].


The adversary s view of the hash value, for a random x chosen from a distribution of high min-entropy, can then be simulated using a random string.

the simulator achieves security in an information-theoretic sense without making any query to the point function oracle and simulates general adversaries using just black-box access (to the adversary) and no additional nonuniformity.


Goforincrementalchecking.While our incremental consistency checking support for product line models has some disadvantages (initialization time, memory consumption, redundant representation of code in models and the required transformation) the bene.ts outweigh these drawbacks as shown in our evaluation.

we have learned that the run-time performance enabling immediate user feedback greatly contributes to the usefulness and acceptance in practical settings (cf.


The experiments were carried out with 9 Servers a 5% level of coverage of object auras.

assuming no object auras overlap then 5% of the virtual world will be covered 10 Servers  Number of clients by object auras.


The use of DSLs as APIs is motivated by the belief that DSLs have, for the most part, a positive impact on the quality attributes of the resulting DSL programs.

their comprehensibility, maintainability, communicability, and reusability are said to be positively affected (see, e.g., [7 9, 20]).


4.1 Detecting Beep Arrival Time Detecting the beep signal arrival under heavy multipath in-car environments is challenging because the beeps can be distorted due to interference from the multipath components.

the commonly used correlation technique, which detects the point of maximum correlation between a received signal and a known transmitted signal, is susceptibleto suchdistortions[31].


For example, the behavior of a function application e v is determined by separately considering the behavior of the value v as it is reduced, the behavior of the function expression e as it is reduced and, .nally, the latent behavior that arises when e is applied to v. The second form of decomposition is that, for every expression, we track the event behavior of .nite traces separate from the event behavior of in.nite traces.

for an expression e we will have two speci.cations: .


haskell lacks two features that would be useful for Quipper: linear types and dependent types.


This is caused by the di.culty to obtain safe and tight information on the number of iterations executed by a loop in the worst case.

datadependent loops whose iteration counts depend on function parameters are extremely di.cult to analyze precisely.


3.2 Commercial PCMs and Variability Information Interestingly, the variability patterns observed in the car comparator PCM are almost similar to the patterns reported in our previous empirical analysis over Wikipedia PCMs [29].

we also observe Boolean yes/no values, single values, multi-values, unknown values and empty cells.


Application-speci.c behavior is added by implementing the abstract methods shown in Figure 21.

the sequentialOperation method represents the actual operation to be performed on leaf nodes, and the combine method determines how the results of performing the operation on child nodes are assembled into a result for the parent node.


However, a simple trick can help the compiler to (at least try to) infer argument types: use lambda expressions rather than passing parameters.

transform a parametrized method: def f (x1: t1,...,xn : tn) : tn+1 = e into a parameterless method with a higher-order value: def fT : t1 .


We provide a detailed description of how the representation for a datatype is generated.

we can represent almost all Haskell 98 datatypes.


Our two-phase methodology conceptually decomposes heterogeneous information systems into a unified collection of flows and views to facilitate their complex integration for different purposes and operations.

each organization is the best knowledgeable of its own processes and their potential to service provision.


; // draw light blue shading on top of the label } }  The HighlightButton class calls super to paint the default button label, but this class exploits its control over the timing of the super call.

it draws the new background, then calls super to draw text on the new background.


VicinityFailing measures how close a line of code is to a statement executed by failures only.

if Lonly is the set of lines executed by failing executions only, VicinityFailing(l) is de.ned as VicinityFailing(l) = max VicinitySourceFile(l, lonly) lonly.Lonly where |l1-l2| 0.7 50 l1 and l2 .


Another important question, left unanswered in [5, 7], is whether una is complete.

does it always .nd a solution when there is one?


Since we are automatically generating our test cases this problem is handled by allowing the tool to run until there is su.cient con.dence in the result depending on the application.

we think the test cases are su.cient when the tool has been running for a duration long enough, or when an apparent and believable result can be concluded, i.e.


We say interface x satisfies interface y if and only if x syntactically extends y in Java and the operations match semantically.


We can then check the consistently of the model change with the corresponding data type update.

what we are doing, in a way, is combining precondition and postcondition in a local function which is evaluated when the test case is executed: we could call this a dynamic precondition.


Recall from Section 2 that region hypothesis places two constraints on CU s. 1) Within an atomic region, a write of a shared location v must not be followed by a read of v .