As an example, in Listing 4 the .rst statement sets the localized value of point to a new value, so the localized execution of this second statement will use this new value of point in combination with the original values of its neighboring points.

even though each thread is updating an Array Element value in the .rst statement, in the second statement all threads consistently read their neighboring point values as they were prior to the foreach block, and only the particular update to a particular Array Element reads the new value of point when it is used in the second statement.


2.2 Choosing a Schedule Given a Store The second problem is to find an optimal schedule for a given size of the store, if any valid schedule exists.

we are given m and choose O such that 1) (O, m) respects the schedule and storage constraints, and 2) O assigns the earliest possible execution time to each instruction.


One could imagine an extension of interval consistency requiring that all relevant credentials remain valid from the time that they are received until the end of the interaction between the two parties participating in the authorization protocol.

if Bob negotiates with GeoTech to gain access to their database (as in Example 1), GeoTech might want to guarantee that it could detect if any of Bob s credentials were revoked after the end of the authorization protocol and consequently prevent Bob from further accessing their database.


Our further investigation shows that the servers take similar amounts of time for delivering noti.cations, but they have different resource provisioning policies on allocating resources for uploading video messages.

the WeChat server only advertises a 2,856 Bytes TCP window for receiving uploading traf.c from clients.


For each one of the hash table operations, we will now show that one can pick a linearization point within its execution interval, so that at this point it has modified the abstract state, that is, the set H, according to the specified operation's semantics.

we will choose the following linearization points: the insert operation is linearized in line I5, at the list_insert operation,  the search operation is linearized in line $4, at the list_find operation, and  the delete operation is linearized in line D4, at the list_delete operation.


Pure embedding takes a more structural approach than string embedding and represents programs as API calls [15].

a programmer can nest or sequentialize calls to such a special-purpose API.


With respect to those aspects which are more related to Web applications, the work in [17] proposes a development process based on architectural centric transformations from design to implementation.

models are integrated by means of transformations which adopt an implicit weaving in order to amalgamate together architectural and functional models.


6.3 SDN Controllers A major recent development in computer networking is the notion of a Software-De.ned Network (SDN), in which network behavior is programmed through centralized policies at a conceptually centralized network controller.

the Open.ow protocol [13] has established (1) .ow tables as a standard abstraction for network switches, (2) a protocol for the centralized controller to install .ow rules and query states at switches, and (3) a protocol for a switch to forward to the controller packets not matching any rules in its switch-local .ow table.


This paper presents a fresh view on self-healing web services composition.

rather than building baseline system model a priori, we advocate using statistical learning theory(SLT) technique to extract it by observing the behavior of web services composition and locate the potential anomaly.


We, further, have summarized three debugging strategies (Section 4.1).

the attribute change strategy seems the most interesting because the attribute of feature is closely related to the variability analysis.


P.O.Box 107 HUNGARY +3614377169 mats.cronqvist@ericsson.com ABSTRACT In this paper, we discuss some experiences from a large, industrial software project using a functional programming language.


A careful organization of worklist is crucial for performance of points-to analysis algorithms.

an important idea is to propagate the points-to set throughout the rest of the constraints before returning to evaluate the constraints.


However, a critical problem is how a plan designer can make sure the specified plans are reliable?

are the multi-agent plans feasible for accomplishing the goal?


This is because each execution unit only deals with a subset of the entire application memory.

the .ow management in Protocol Processing threads bene.ts from caching recent .ow data for subsequent packets belonging to the same .ow.


However, we have a basic feel that there would be some generic skeleton-like structure regarding reachability.

with the description of reachability for SPk and the description of an analysis for SP2, we can generate the description of an analysis for general SPk.


PRIME therefore analyzes the downloaded code snippets using interprocedural static analysis with points-to and aliasing information, and tracks the sequences of API method invocations observed in them for each API object, in order to derive the PTSs.

pRIME has a special treatment for unknown types and methods to allow us to work around them and extract the knowable information, while clearly marking the unknowns.


We continue to tune the teaching process along with the development environment.

the transition phase at the beginning and end of the semester gets smoother and more effective.


Since " )= T -1(q "" T = T , there must exist a variable v such that T " (v)= q , " but T (v)= q<q ".

t types v with q ", but T types v differently and lesser in the preference ranking. "


The typing rules (Figure 7) ensure that we consider only well-formed expressions.


The particular method used in this research [2] is to integrate colored Petri nets (CPNs) [3] with object-oriented architecture designs captured in terms of UML communication diagrams.

this paper will present a method to systematically translate a UML software architecture design into an underlying CPN model using a set of pre-defined CPN templates based on a set of object behavioral roles.


Our analysis processes exceptional edges selectively.

we only process the edges associated with relevant exception types.


In each round, Vi(t) loses or gains at most one node at each end of the path.


Many other functional programming languages more or less support dynamic typing and dynamic loading.

clean [28] has good support for polymorphic dynamic types.


The same goes for why erase cost is relevant for the order-oblivious vector.

when vector is used in the order-oblivious manner, find is a relevant feature.


Because binary refactoring can be thought of as a new activity in the software development chain, we have provided support for using BARBER as a task in the popular ANT build tool [2] for Java.

the BARBER task is a separate build step that runs after all the standard build steps have been completed.


Because we aim to be applicable to general binaries, our prototype implementation handles nearly all of the 300+ opcodes ofthe x86 architecture; previous efforts have focused on a much smaller set of register-to-register operations.

wepresent the .rst techniques for correctly inferring superoptimizations involving memory accesses and branches, as well asthe .rst approach that takes the context (e.g., the set of live variables) of an instruction sequence into account.


Considering the execution of the application discussed in the previous section, these chunks could be instances of the ob jects used by the OpenCV methods.

openCV uses mainly two methods for face detection and face recognition.


In fact, we not only see the importance of parallelism (how often both threads are executing), but also the importance of lack of parallelism (how often the support thread is running alone which implies the main thread is stalled, waiting for the support thread completion).

for crafty and parser, where we still suffer slowdown in the fast spawn scheme, we .nd that these benchmarks spend a signi.cant portion of time where only the support thread function is running.


As a result, the end of the first release is in a sense where the requirements engineering of the next version begins.

the system model facilitates the refinement of the user model and the user model again promotes the improvement of the system model.


The main idea behind our abstractions is to preserve only a limited amount of order inherent in a store buffer.

our abstract buffer representation preserves information about: i) the most recent store to a buffer, and ii) the order between a bounded number of the oldest stores in the buffer.


We then suspend the background activities, expecting that the foreground processes will consume the resource capacity reclaimed from them.

we conservatively assume that those background processes have stolen resources from foreground processes and caused foreground throughput degradation.


Introduction Design patterns were first introduced by Christopher Alexander who proposed a collection of patterns for urban design and defined the concept as follows: Each pattern describes a problem which occurs over and over again in our environment, and then describes the core of the solution to that problem, in such a way that you can use this solution a million times over, without ever doing it the same way twice [1].

a pattern is a way to document recurring design problems, associating them with a name, a set of forces which influence them, a proven solution, examples of the solution s application, and any other information relevant to problems documented.


In our opinion, the result of not teaching functional programming to students in natural sciences inhibits them from using computers for manipulating mathematical structures directly.

quantum-mechanical entities that are considered too abstract for computer programs in standard programming languages are only treated as algebraic formulae: they are processed with computer-algebra systems instead of computed with language processors.


This transformation can be performed using any all-pairs shortest path algorithm.

we use the Floyd-Warshall algorithm because it is straightforward and has time complexity of O(n 3).


To achieve this, the CPA needs to be restricted to running code without causing side effects.

the CPA will run code that reads the program state, but is not allowed to run code that would change the state.


First, Tesseract does not appear to train using fuzzy logic.

training with deformed instances of letters seems to confuse Tesseract rather than increase its ability to recognize further instances of that letter as originally hypothesized.


Several works survey the area of temporal databases and query languages.

[55] surveys temporal query languages, distinguishing between abstract and concrete languages and studying formal semantics, expressiveness, and query processing.


It is, however, surprisingly dif.cult to specify their behaviour in detail.

the popular precondition-based approach tends to produce somewhat unwieldy descriptions if advanced features of the object language are taken into account.


The solution is to de.ne a member, called Sig, that represents the type signature of the polymorphic function.

sigis our way of representing arrow types.


40% 30% do not report the maximum times, as the results are quite stable.

for SPECjbb, the maximal compact time with the new parallel compaction algorithm never exceeds 6% above the average time.


However, accumulative updates can be performed asynchronously.

a processor can start update at any time based on whatever it has already received.


These test cases came with the original nanoXML distribution.

we focused on the parseDTD method (method #109), since its implementation was fairly easy to understand.


Seemingly irrelevant prose is useful, however, in that it helps define a context of use.

knowing how the system is to be used helps the analyst identify which classes are relevant, and which objects in the environment are usefully identified as system classes.


CVS makes the job of analysis more dif.cult by failing to preserve important kinds of transactions in the revision history.

it is notorious for its inability to properly re.ect .le renames and directory deletions.


In the context of API recommendation, developers often know what the targeted library is.

the API candidates for a API query should be in the list of all APIs in the targeted library.


Finally, we apply the grid DEM constructed by TerraNNI to analyze the terrain dynamics.

we interpolate a multitemporal LiDAR of Nags Head, NC and study the movements of sand dunes in the coastal region.


AspectJ is more flexible mainly in the variety of mechanisms that it provides to specify join points.

aspectJ allows the use of wild cards and pattern matching, and allows methods to be targeted only if they are called from within a certain scope.


As a positive side-effect, this would also scale to higher dimensions.

if we can .nd a proper interface for the lower-level implementation details, we could then provide different implementations (aka variabilities) for those details.


Syntax of types application to FLP, relying in a new type system [20], are new.

the liberality of the type system avoids the need of a typecase construction in the target language, resulting in that translated programs do not need to enhance the syntax of FLP systems with that construction.


Actually, it has a solid background, category theory.

with respect to the categorical manifesto of Goguen [8], our spec i.cations conforms to the .rst dogma (category for interpreting a programming language), the second one (functor for the constructions associated to a data binding) and the third one (natural transformation associated to the preceding constructions).


Our work is a logical extension of their work, in that our analysis identi.es the extent of redundancy that is practically remediable by introducing caches at allocation sites.

we provide actionable reports to developers.


For this reason, we employed descriptive statistical analysis techniques that attempted to count how many times certain behaviors occurred (quantitative methods), coupled with observer narratives (qualitative methods).

for the online survey, we employed a 7-point scale to allow a non-forced middle option of "sometimes".


we created a60 - 20 - 20% split of the available data [1].

60% of the data (for each program on each machine, over the range of CPUs and threads) was used to train the parameters of a neural network, which were tuned further (i.e.


Note that this reasoning about the measurement plan does not occur only during the creation of the GQM plans, but also during the execution of the measurement (e.g., to understand what metrics to collect, and how to collect them), during the interpretation phase, and even afterwards, when reuse of measurement data and plans are evaluated.

the possibility of reusing existing metrics can be assessed by comparing the current process model with the model corresponding to the existing metrics.


In our metho d, we use a publish/subscrib e system for event delivery.

when a player executes an event in vi, the event message is sent to the resp onsible node of vi (i.e., the event is published), and the responsible node forwards the event message only to player nodes which have subscrib ed to vi.


The adaptive replacement policy AB is 2robust with respect to both A and B.

aB, as de.ned above, never incurs more than twice as many faults as either A or B.


Our preliminary results support the hypothesis that maximum reached nesting and distance from the limit of bu.ers help to guide the search.

a .tness function accounting for the distance from bu.er boundaries, on our data set, outperforms .tness functions not using the same factor.


The lines connecting the dark gray motes depict position and orientation of the edge of the shadow.

the shadow s edge must lie within the bounds of all the five lines shown in Figure 11.


Our main contributions are the techniques used within our compiler for CAO which automatically convert AES into an executable target program that is close to the ef.ciency of a manually constructed, low-level alternative.

we present a novel form of Intermediate Representation (IR) to support matrix and vector container types, a novel de.nition of memoisation for imperative programs and its associated transformation, and a transformation to perform vectorisation on the code.


Intuitively, the desired correctness condition is that whatever information the attacker could observe in the right-hand side of an evaluation rule could have been observed in the left-hand side, i.e., no rule can ever provide an attacker with additional information.

starting from a program with an empty memory, i.e., with the attacker not knowing anything, then if the program terminates the attacker is guaranteed not to have learned anything.


Since the program execution model of FLAT is based on SPMD, it is required that all register variables of all threads on a GPU are independently stored.

fLAT compiler gathers such variables and adds them into an array of the variables into status_dev.


We utilize ADL models and system goals as inputs for generating plans.

our solution has the ability to generate new plans in response to changing system requirements and goals and in the case of unforeseeable component failures.


For example, normalizing a set-monad computation defers elimination of duplicate elements until the end, rather than eliminating duplicates in intermediate results [35].

the performance of a normalized set monad will typically be no better than converting to a list, using the list monad, and then converting back to a set again.


n. From this, we can de.ne our improvement relation.

wesay that M is improved by N , written M .N, if the ; following statement holds for all contexts C: C[M].m == C[N]..m a term M is improved by a term N if N takes no more steps to evaluate than M in all contexts.


The demo advances by the interactions of the user with the application under demonstration.

the demo framework is itself a reactive application.


there are no edges from vertices with higher order numbers to vertices with lower order numbers.


The Bloom .lter keys are generated deterministically by the client using a cryptographic hash, so that the client can e.ciently keep track of them with only logarithmic storage.

a bit set to 1 at position pos in the Bloom .lter is represented by Tpos =Hash(sk | pos | level | gen | 1), and a bit set to 0 by Fpos =Hash(sk | pos | level | gen | 0).


If this assumption is correct we should be able to estimate both N and aby minimizing the variation in the squares between the number of predicted defect observations and the actual number of observations.

we can apply the method of least squares and find those values of N and a that minimizes the sum n .


Technically, to achieve such a separation, the framework requires the capability of retrieving at run-time information on the component, mainly relative to the methods signature.

the component to be tested must enable re- flection mechanisms [ 12], allowing for the component run- time introspection.


The well-formedness judgement for terms appears in Figure 2 and is mostly conventional.

the rules for coercion abstraction and application (ECABS and ECAPP) mirror those for terms (EABS and EAPP).


In network-intensive applications, such as Internet servers, are consolidated in a physical machine using VM technology, the inter-domain shared memory communication mechanisms is necessary.

nearly all the virtual machine monitors are not very efficient in I/O performance to meet these applications requirements.


However, it employs only one translation gear.

all the target code that it generates uses the same translation .ow.


At version v1, A links to B, B links to D, and D links to C. Suppose that now node A points to node C, and a new version v2 is created.

at the version v2, the value of the href attribute of node A is doc2#c .


Later or concurrent executions of Client.run are not a.ected.

the advice is lately bound, similarly to late method binding; hence, we call this kind of polymorphism aspectual polymorphism.


We present our .ndings indicating that whereas current technologies can be considered loosely coupled as far as they provide platform independent solutions, they achieve a di.erent degree of coupling according to all of the other facets.

no technology per-se provides loose coupling in terms of all the facets.


For naturals, it is usual to describe changes using standard subtraction and addition.

for naturals we can de.ne v.dv = v + dv and vnew 8 vold = vnew - vold.


The other pattern variants use the inherited error reason (e), which represents the closest enclosing description around the pattern.

it represents the nearest explainable frame in the matching context.


The properties are sound over the observed executions but are not guaranteed to be true in general.

different properties are true over faulty and non-faulty runs.


The linking algorithm takes a collection of polymorphic bytecode fragments, checks their mutual consistency, and possibly simpli.es and specializes them.

linking a self-contained collection of fragments either fails, or produces standard bytecode (the same as what would have been produced by standard compilation of all fragments).


We also need to clarify how to measure usage of API methods.

how to precisely distinguish distinct methods so that counting uses is well de.ned.


The fragment depicts a hierarchical component for intelligent vehicle navigation and the components in its environment that it communicates with.

the navigation component relies on its local subcomponent ParkingManager, which via its required interfaces communicates with a parking lot to manage reservations (using the ParkingReservation interface), and a garage door/bar to enter (using the GateOpener interface).


A major source of overhead in GPU implementations of tree traversal codes is the data movement required as a thread moves up and down the tree during traversal.

after traversing one path in the tree, a thread must return to higher levels of the tree to traverse down other children (viz.


This function node has a set of implementations {fr,i}np , and in our Stage 2, we have actually shown that each i=1 fr,i, being a point on the (E ' ,T ' ) curve, is achievable by some explicit randomized program Pi.

this new function node fr is a real function node: every approximate implementation fr,i has a corresponding randomized program Pi that can be constructed by our algorithm.


The view transformation is essentially the inverse of the J operation.

if a winner tree matches tl J tr , then it is guaranteed that the keys in tl are strictly smaller than the keys in tr .


One assumption of re.ection checking is that the program under analysis .ts the closed world model.

during development time, the tool has access to all of the source code that is relevant to the use of re.ection.


Let P be the host space and let dim P = d. A graph embedding is a mapping of the graph vertices to positions in the host space.

each vertex gets assigned to a point in the host space.


CONCLUSIONS AND FUTURE WORK We have presented an EUDWeb approach and tool enabling end-users develop Webapps embedding RBACbased access control policies.

we have extended a previous mockup-based approach and tool [8], by empowering it with visual languages for specifying RBAC policies.


These two sorting steps have the e.ect of favouring longer strings over shorter in the case of equal minimum edit distance.

we consider count and counts to be closer together than say x and j .


Our research effort involves the scanning of executable files for software security vulnerabilities.

it involves the scanning of files that conform to the portable executable (PE) format designed for software running on Windows NT/XP computers.


In order to provide an incentive, a user may o.oad tasks to other containers so long as she reciprocates accordingly.

more precisely, Tasklets of a user u are only allowed to be executed at a remote Tasklet container if the ratio between the Tasklets that u s container has executed on behalf of other users, o, and the Tasklets that u has remotely executed, r, is greater than a threshold, t. if o/r > t holds the user may execute Tasklets with other users containers.


Discussion Though we have focused on just three applications, the lessons learned have implications on the design of future automated software engineering tools.

the conversion process of transforming sequential C++ code to pipeline stages is a necessary step when trying to use a task-based library.


Many of the teachers were aware of various higher-level languages such as Visual Basic and HTML along with tools for building programs using these languages.

many were familiar with web-page building tools such as FrontPage and Dreamweaver.


For example, if class Person has a method public Address getAddress() readonly, then readonly Personhas method publicreadonlyAddress getAddress() readonly.

the return type of a method call depends on the type of the receiver expression and may be a supertype of the declared type, which violates Java s typing rules.


By focusing on expressing what computation is to be done rather than how to do it, DSL compilers can often apply optimizations speci.c to both the computation and the target hardware whose applicability would be dif.cult to infer from imperative code expressing lower-level operations.

embedded DSLs (DSELs) have the additional advantage [7] that programs can take advantage of most or all features of the embedding language, and that complete programs in the embedding language can include subprograms in multiple distinct embedded languages.


Since OSGi does not impose any restrictions on services and in fact accepts potentially every Java object to become a service, R-OSGi has to deal with the same miscellaneousness that is expressible in Java.

the service interfaces of remote services can have (tightly coupled) dependencies to either classes from inside the original module or other modules.


The content in bytes of these beacons is defined in SAE J2735 DSRC Message Set.

beaconing is used to advertise the presence of a node to its neighbor nodes.


Thus the key challenge is to track which durable write requests, i.e., those that need to be persisted to the secondary site, are causally related (dependent) on which externally-visible network packets.

pipelined Synchrony replication must guarantee a causal ordering between externally-visible and durable events as de.ned by Lamport s happened-before .


In this work, we build upon and extend this prior work to improve MRE-OS-hardware interaction in a way that facilitates GC avoidance.

we design and implement a simple prediction scheme that identi.es, with very low overhead, the amount of free space a particular GC invocation is likely to yield from dead objects.


This strategy reduces the number of back merges needed and minimizes the likelihood of conflicting changes during parallel development.

mVP developers employ partial check-ins to avoid being affected by other developer s changes in the same files.


The output of our new generator is a random C program that manipulates volatile variables.

every time randprog is run, it produces a (probably) unique C program.


However, we do believe that a limited amount of interaction with site queueing software and administrators would be worth pursuing.

advance notice of planned downtime and noti.cation of large reservations or large spikes in the number of submitted jobs could improve the parameterization scheme for our simulation model.


Note that the mapping of activity Ai to remote node Nk is a deployment step that does not impact the logical identity of Ai s place in the X10 program.

the expression, here, will continue to refer to place Pj for activity Ai,evenwhen Ai is executing on node Nk.


We have also addressed the conceptual consolidation problem.

we have carefully studied the characteristics of GPUkernels that can and cannot bene.t from consolidation,andbasedonthis,havedevelopedamethodfor computing the af.nity score betweentwoor morekernels.Wehave also introduced two new molding techniques, and have developed anoverall algorithmfor mappingasetofgivenkernelstoapairof GPUs.


All datapoints of an annotated dataset had the n least-signi.cant bits set to zero; blind and directed search performed, with a search bound of 216 = 65, 536.

at most 216 provenance marks were considered.


This is meant to identify the main pillars of a domain interpretation for VPTs and wildcards.

we focus on providing a general means to understand the rules behind access restriction: as a reference we take the restriction rules of VPTs, remarking the (actually small) di.erences with respect to wildcards throughout.


This simple model tells us that the setting of option o1 is strongly correlated with the manifestation of failures ERR#1 and ERR#2.

con.gurations with o1==1 fail with ERR#1 and those with o1==2 fail with ERR #2.


During the debugging, by comparing the stack frames printed out in Check and Fail, we discovered that the edges of the node referenced by other in one invocation of mergeNode() may be changed by the statement at line 193 in the recursive invocation of mergeNode() that is called at line 186.

nn at Figure 7: A behavior view for investigating Bug 2. line 186 must point to the same object as other in the .rst invocation of mergeNode().


Asking what and how is necessary, but more information is needed.

current documentation methods tend not to record why the design needs to be one way as opposed to others (many of which may appear to be simpler or easier to implement).


This restriction ensures program analysis can accurally bound the set of mesh elements referenced by a variable.

it prevents a program from performing a mesh traversal of unbounded depth which would produce an imprecise stencil.


In our exploratory study, we collected information on different kinds of feature interactions, one kind per subject system: Structural interactions in LIN U X: With the help of Jörg Liebig and his code-analysis tool C P P S TAT S [37], we analyzed the nesting structure of C-preprocessor directives in the LI N U X kernel.

we determined the presence condition of each code block.


However, the standardisation procedure provides additional mechanisms.

aOP could be covered in an addendum to the Cobol 2002/2008 standards.


If they happen in di.erent iterations, the dependence is said to be loop-carried.

if a load from an address is covered by a previous store to the same address in the same loop iteration, the load is said to be covered by the store and thus is prevented from being involved in any loop-carried RAW dependence.


The mutex declaration on line 22 of Figure 4 states that calls to getCD and register cannot occur simultaneously.

that the methods are mutually exclusive.


Until recently, package managers in FOSS distributions followed a monolithic architecture (re-)implementing all functionalities to .t speci.c formats of meta-data and user requests.

dependency solving was often implemented by ad-hoc algorithms instead of employing well known solver technologies.


(B) The model does not assume that the maximum length of the queue of transactions waiting for a read/write lock is boundedbyone unit.

we can accuratelycapture heavy contention e.ects and their impact on the .nal perceived performance.


The natural evolutionof thisresearchistoexpand ourfocus from a single experiment to a whole series ofexperiments.

we plan to study how to better characterize systembehaviorsby automating the exploration of theparameter space.


It is true that advice code such as the invocation of trace in Listing 1 is executed depending on a point- cut whose concrete definition is not known in SimpleTracing.

it is not known in SimpleTracing when this ad- vice code will be executed.


We demonstrate next how we can use Lancet to transparently optimize existing libraries by adding JIT macros after-the-fact that convert library calls into optimized implementations.

this enables us to now use Delite as a general-purpose accelerator for arbitrary existing Java bytecode programs, through appropriate macros.


The system is self-described as using tit-for-tat as a method of seeking Pareto e.ciency [4].

there is some idea of incenting good strategic behavior from a rational user.


SectionIII-B3 showedthat PMf1 0.9 × PMp.Using thisin equation(3), we obtain (0.4 × PSp +0.6 × PSp) × tp (0.9 × 0.4 × PSp + 0.6 × PSp) × ta > 1 (5) Simplifying equation (5) gives .E = tp 0.96 × ta (6) as the system level energy savings.

equation (6) speci.es how the application level performance ratio impactsthe systemlevel energy ef.ciency.Figures3(a),(b) and (c) show the percentage performance degradations when Mf1 is used instead of Mp.


EMFMigrate relies on a language to implement migration libraries.

each library is related to a given metamodel (e.g., the metamodels of ATL, Ecore, and GMF) and is used in programs consisting of migration rules speci.ed as follows: include {library* } migrate A : MM with Delta { rule mr1 [ guard1 ] {rewritingRule* } rule mr2 [ guard2 ] { rewritingRule* } ... rule mrn [ guardn ] { rewritingRule* } } a migration rule mri is applied on an artifact A conforming to the metamodel MM if the corresponding guardi evaluated on the difference model Delta holds.


To overcome this prob- lem, we use the RandomAccessFile class that provides more sophisticated file I/O.

it provides the seek method that we require.


For many applications, there are only a few tactics.

the number of practically useful ways to partition the application is a very small fraction of the number of theoretical possibilities.


Hereafter, we simply say (SN-)binding algebra.

d in a binding algebra M, the carriers satisfy dMs = M[N]s by speci.c isomorphisms given by bind.The map bind is a key ingredient for the notion of binding in this framework of algebraic semantics, that is, binding is the way of transferring an element of type sto that of type [N]s. This will be clear in the case of C = Set and M = TX which is a term algebra de.ned in Section 3.4.


Once a handler starts to execute, the server cannot execute other handlers until the current handler .nishes.

a server can execute only one handler at any time.


The theory of such analyses is well understood, there exist different styles of describing these analyses and ascribing meaning to them and their interrelationships are clear.

the different styles can concentrate on the questions of whatmakesavalid analysisofaprogramorhowthe strongest analysis canbe computed,butitisknownhowto relatethetwo aspects and thereisanobviousand technically meaningful analogytovalid Hoare triples and strongest postconditions/weakest preconditions.


4.3 Time Complexities This section analyses the time complexity of our self-stabilizing mutual exclusion protocol.

we provide an upper bound of its stabilization time under the synchronous daemon (see Theorem 2) and under the unfair distributed daemon (see Theorem 3).


It is nevertheless instructive to go through those trivialities before everything gets obscured by the technicalities.

please note the use of implicit conversion, copyinitialization and substitution of reference for variables.


Before describing how the HashRF algorithm improves on this, we must observe that edit distance between trees (number of modi.cations to transform one to the other) can be reduced to symmetric set difference between sets of bipartitions.

each intermediate node of a tree can be seen as partitioning the set of leaves into those below and above the node, respectively.


The remainder of the paper comprises a detailed description and analysis of our embedding and retrieval algorithms; now we provide a high-level characterization of our technique, using common parlance of the watermarking literature for clarity.

we classify our system under the standard categories of perceptibility, robustness, and capacity [9].


It is important that the application calculate the price of the stock symbol within the bounds of a guaranteed worstcase time, otherwise, considering the fast pace of the stock market, the price could be stale and not usable.

the guaranteed worstcase time must hold even when the load on the system is high, which generally happens during peak stock trading hours.


CONSEQUENCES FOR RUN-TIME CHECKING The main consequence of the behaviour described above is that it causes run-time checking with jmlrac not to be completely transparent, where transparency means that if no annotation violations are reported (to the user), running a program with run-time checking results in the same behaviour as running the program without run-time checking [3].

both the second and the third example program in Section 2 will behave di.erently when executed with run-time checking enabled or disabled even though no annotation violations are reported (to the user): run-time checking will ensure that the method decrypt is not executed, while it will be executed when run-time checking is disabled.


However, there are also signi.cant differences between both systems, concerning the underlying syntax, the implementation techniques and their facilities.

mETA-S is implementedinCommonLispwhereas TOY isimplementedinProlog.


The Themis 2.0 type system is also similar to work on dynamic typing.

papazoglou, et al., observed that the traditional class-instance object model does not serve well the representation of real-world entities that change attributes and behavior over time [15].


For example, sallies receives a change noti.cation whenever students is changed; its result is updated incrementally.

the predicated (s => s..rstName == Sally ) is executed exactly once for each student that is consecutively added in lines 7, 8, and 13.


The results of the application of these metrics on the JDK provide interesting insights into the usage of interfaces.

we detected a certain dominance of so-called enabling [7] interfaces, comprising the tagging (or marker) and the Listener interfaces of the JDK (and possibly more).


Reduction rules are written in the form H, V , t --H ' , V ' , t ' .

terms t are reduced in the context of a heap H and a variable environmentV .Figure 2 shows their syntax.


This facilitates the continuous evolution of the performance model if changes occur to the underlying performance determinants.

the model gives preference to the most recently recorded data, which can be regarded as an intuitive form of data aging in a learning module.


We reuse the LOC definition first provided by Jones in [9] and cited by Kan in [10].

we define LOC as the number of source code instructions in a component, including data definitions, but excluding comments and prologues.


Then, when run in ASMsz , T re.nes S in the sense of CompCert:  @B1 P [T ]sz , DB P [S], B1  B.

t cannot go wrong and thus does not stack over.ow.


Application modi.cations for debugging the bug with the default logging settings.

it would be helpful to have more information about the range headers of the requests.


Unfortunately, a small window can quickly fill up when there is a long latency operation.

consider a long latency cache miss serviced from main memory.


For anti-dependence edges in single assignment code, the latency is typically zero.

the source operation must execute before or in parallel with the sink operation (before the sink operation writes a new value).


PROOF OF OUR MAIN THEOREMS 5.1 The sampling matrix formalism For notational convenience in the proofs in this section, we de.ne an n×n diagonal sampling matrix S. The diagonal entries of this matrix are determined by coin .ips of the SRLS Algorithm.


Adding LHRP to multi-core CPU's would also create the need to implement it in multidimensional layers.

the block of work assigned to a CPU by the Grid would have to be repartitioned with the LHRP algorithm to distribute the work among the cores.


As a result, released software versions may present unveri.ed dependability properties sub jecting customers to blind software reliability assessment.

concurrent systems present certain behaviour that require a more complex system analysis not easily grasped at system design and architecture level.


Although, the drawback is that they are not sufficient to test implementation specific features.

inheritance hierarchy can be taken into account when the test cases are divided into test suites.


From these three facts, it follows that after executing the instruction, we are immediately in a locally-safe state.


4.4 Leaves of Refinement The rule of thumb is that refinement is finalized when each leaf invariant of the refinement tree is either an assumption or is associated with a real computation activity a process or knowledge exchange.

an invariant that is referring to a single component captures only the operational normalcy to be maintained by a process of the component.


Nested Abstract Syntax In functional programming languages such as HA S K E L L, it is possible to remedy to this situation by using nested data types and polymorphic recursion.

one parameterizes the type of terms by a type that can represent free variables.


Compared with the former approach in [4], the proposed approach (Algorithm 3) has better performance and provides more information during testing.

algorithm 3 provides more information about possible starting state and possible trace compatible with the observed sequence Q and performs better in situations where there is only one state in S0 that is compatible with Q.


The formalization phase consists of the following steps: M2.1 Formalization of each requirement fragment by specifying the corresponding UML concepts and diagrams, and/or the CNL constraints; M2.2 Linking the formal elements introduced in the previous step to the textual requirements; the link is used for requirements traceability of the formalization against the informal textual requirements, and to select directly from the domain requirements document a categorized requirement fragment to be validated.

in the step M2.1, we adopted classes and class diagrams, to formalize the requirements that have been classi.ed as Glossary, and CNL constraints to specify requirements that have been classi.ed as Functional, Property, and Scenario, and to impose constraints on the class diagrams derived by the Glossary requirements.


If the access is a read, thread t checks whether there exists another thread u which also wrote to v, such that awv [u] = stt[u].

t checks whether it knows only about a release that preceded the write in u, and if so reports a data race.


A class with inconsistent constraints can never be successfully instantiated.

every environment in the program (generated by class and interface de.nitions) must satisfy the consistency rule that .


However, the feasibility of complex dynamic analyses is often impaired by the large runtime overhead introduced in the base program, which in some cases can run more than 1000x times slower [13, 14].

this overhead often stems from frequent execution of .ne-grained analysis tasks that do not produce anyresults on which the execution of the base program depends.


In the case of a di.erent trajectory, or user, or even if we reach full capacity of the current candidate node, we follow a right-most policy of node insertion.

we .nd the rightest free child, if it does not exist, we create it and add it as a child to the current parent node.


OtherSum problem: given an array of integers a = [a1, ..., an], compute the array b =[s - a1,...,s - an] where s =Sin =1ai.

b[i] equals the sum of every element in a other than the ith one.


BRA uses a memory proportional to 1337 Figure 7: Convergence with 30% of random falls Figure 9: Memory usage with 60% of random falls  Figure 8: Convergence with 60% of random falls the number of nodes in the system.

the higher number of nodes the system has, the higher memory BRA uses.


SEMANTIC MODELING WITH TTIQ In this section, we demonstrate how a type system can be used to model the Semantic Web.

we show how to represent linked data along with its semantics in a type system, how heterogeneity is resolved automatically using coercions, and how querying is performed by proving type judgments.


Scenarios in LSC are also multi-modal in nature.

lSC events have behavioral properties that de.ne modalities of behavior in three dimensions: must vs. may, allow vs. forbid, and execute vs. observe.


Yet, due to the challenges portrayed in Section 2, the analyst is unable to perform dynamic code analysis on the target system.

the system lacks system resources, analysis tools are not available or can not be run and the userspace application, the analyst is interested in, can not be executed in a virtual environment as the peripheral hardware is missing there.


C2BP does not compute compositions of weakest preconditions over paths with complex control flow.

c2BP does not re- quire programs to be annotated with function pre-or post-conditions, or with loop invariants.


The entity may then be de.ned in another class with a stronger type (or type-bound) than the required one.

class member abstraction introduces typeslack between the required and provided interfaces for the same service.


This is because in that case, any aliases with v can be destroyed by assignment v = w. The only command that affects the typestate is a method call.

trans(v.m())(h, t, a) performs a strong update on the incoming type-state t according to the typestate function [m] associated with m, when v is in a, and transitions it to the error type-state otherwise.


This map needs to capture the structure and content of the trees, and thus is crucial for the success of vulnerability extrapolation.

to construct this map, we describe the AST of each functions in our code base using a set of subtrees S .we experiment with the following three de.nitions of the set: 1.


Prior (adding thread code directly to the original program code), can to this study, several prototype solutions existed for loop create substantial code tangling between the program s original pointcuts, but the solutions were not very granular.

primary concern(s) and the newly introduced parallelization they were not able to differentiate between loops that are concern.


To understand how much the DNS load balancing deployed by a CDS is biased by the queried DNS resolver, we repeat the experiment from Section 2.2 using two other DNS resolvers.

we pick the next most popular DNS resolvers found in our traces: GoogleDNS and OpenDNS.


We wish not to overly constrain implementations of this protocol, allowing implementors to make tradeo.s to re.ect the needs of their users.

the Common Lisp implementation supports this protocol natively for all sequence types) and an implementation where existing code su.ers no run-time performance penalty; additionally, we do not wish to render a portable implementation impossible, though we believe that such an implementation would necessarily have visible seams.


While a SAX-based parser would reduce the time/space spent building the in-memory representation of the XML document, the performance gains may be too small to invest the substantial development time required to re-factor the DAnCE con.guration handlers, which serve as a bridge between the XSC generated code and IDL.

a SAX-based approach would still require a substantial amount of runtime text-based processing.


The parsing of all the constituent symbols of the rule, either terminals or nonterminals, is guarded by a comparison.

the dynamic control dependence caused by the comparison discloses the hierarchical relation between child symbols and their parent.


Moreover, to enrich the context awareness an event management subsystem could be also added to FineVMS.

such a module has the responsibility to notify events, i.e.


Having de.ned the syntax of the language, we turn to de.ning its semantics in denotational style.

we aim towards a function that takes an expression of type t and a suitable environment and returns a value of (the Agda type corresponding to) t .


However, these analyses cannot be applied for synchronous programs due to the different underlying model of computation and its different de.nition of equivalent computations.

actions do not immediately update variables, since changes of the variable s values are synchronously done at the level of macro steps.


The method enjoys the typical benefits of formality, i.e., rigor and precision, both in specification and in verification and the possibility of using powerful tools (e.g., to generate (semi) automatically test cases for the implementation).

the fact that the semantics of both application specification and architectural design is expressed in terms of logic formulas allows one, at least in principle, to prove the correctness of the design as a typical logical implication.


Building an experimental implementation of the hierarchy with types `a la Danvy and Filinski as presented in this article is another task.

one can use the syntactic correspondence between context-based reduction semantics and abstract machines [6] to obtain an abstract machine equivalent with the reduction semantics of this article, or one could adjust the existing abstract machine for the hierarchy [5] accordingly and prove its correctness with respect to the reduction semantics.


We aim to relieve the user from the burden of providing adequate bounds.

the necessity of specifying bounds is a considerable obstacle to the integration of animated operations with other code, since it requires a modi.cation of the operation interface.


This is because all service scenarios depend on the centralized server.

if the home server fails, all the scenarios become unavailable.


However, the purpose of this simple sample is to demonstrate the potential ability of the XVM, especially the extensibility of the XVM.


Collaborations among components can be abstracted by contextual pointcuts such as cflow.

archface does not contain implementation details.


The validity condition states that the limit of the state trajectory of each cooperative agent exists and is contained in the interval formed by the initial states of cooperative agents, regardless of the adversaries trajectories.

if we de.ne the interval I0 =[minxi(0),maxxj (0)], i.Vc j.Vc then the validity condition is formulated as lim xi(t).I0, .i.Vc,xa(t).C.


To implement a new target language, it su.ces to implement these operations only.

there is no need to modify the core Twig interpreter, which assumes only the language-independent model.


However, without waiting the grid to shrink, DANS lets each operator instance adaptively modify the initial range parameter.

dANS implements three range selection approaches: the incremental, decremental, and r -steady.


Comebacks For each supported refactoring we formally de.ne a comeback a behavior-preserving transformation, which de.nes how a compensating adapter is constructed.

we create an adaptation-oriented pattern problemsolution library of transformations, where a problem pattern is the occurrence of a component refactoring and its solution Refactoring History Generator F3 AL1 AL2 P1P2 P3 time Figure 1: Refactoring-based plugin adaptation.


Finally, we show that the rules for reordering memory operations across locking primitives are in fact different from what we believe most implementors would have expected.

a memory operation immediately following a pthread mutex unlock operation may always be moved to just before the pthread mutex unlock.


In this paper, we collate and classify techniques for programming with dependent types in Haskell, and contribute some new ones.

through extended examples merge-sort and rectangular tilings we show how to exploit Haskell s constraint solver as a theorem prover, delivering code which, as Agda programmers, we envy.


This execution includes some anomalous requests generated synthetically following the pattern of SQL-injection attacks, which may enable the attackers to bypass authentication and extract sensitive data [3, 18].

a tautology-based attack is to inject code in one or more SQL conditional statements so that they always evaluate to true (or they are effectively removed from conjunctive conditions).


5.1 Known orientations (1) Let pdenote a relative localization solution for cluster (1)  one.

u1K1p=0, where U1 is derived solely from measurements between nodes in cluster one, and K1 forms the necessary di.erences between positions of nodes in cluster one.


The .rst predicate, Fresh, indicates that a variable is fresh relative to an expression.

the variable does not appear free or bound in the expression.


The experiments mainly focus on the feasibility and scalability of the system.

we evaluate memory usage, network tra.c generation, data availability and response time on the system.


Di.erent from previous work, our solution is fully distributed and self-organizing without requiring specialized servers or IP multicast support.

we decouple the stream processing in MVoIP services into two phases: (1) aggregation phase that mixes audio streams from active speakers into a single stream; and (2) distribution phase that distributes the mixed audio stream to all listeners.


We executed experiments varying several parameters, in order to compare their relative signi.cance.

for every implementation, we varied the number of processors (NP), the tile size (K), the depth of the tile execution pipeline (D), and the problem size.


Building on the same principles, a generic genotypic Universal Information Distance (UID) for individuals in LGP is proposed.

considering two individuals Ii and Ij , the UID is de.ned as U I D(Ii, Ij ) = |S(Ii) D S(Ij )| (4) where S(I) represents the set of symbols in individual I, D is the symmetric di.erence as de.ned in Equation 1, and the operator |S| denotes the cardinality of set S. the UID between two individuals is the number of distinct symbols they do not have in common.


So, it can be used to generate an output model from any set of models conforming to the input metamodel.

the model transformation program works for any model defined according to the input metamodel.


The .rst is roulette selection [31], a .tness-proportionate selection strategy which assigns a selection probability to each ordering based on its coverage e.ectiveness score.

the framework contains a regular roulette selection operator (ROU), an exponential transformation operator in which the square root is taken of each .tness value (ROUE), and a linear ranking  Operator Type Abbreviation Full Name Mutation [12] DM EM ISM IVM SIM SM Displacement mutation Exchange Insertion Inversion Simple inversion Scramble Crossover [12] CX MPX OX1 OX2 PMX POS VR Cycle Maximal preservative Order Order-based Partially-mapped Position-based Voting recombination Selection ROU TRU TOU Roulette [31] Truncation [15] Tournament [20, 31] Transformation (Roulette only) ROUE ROUL Exponential [13] Linear ranking [13] Figure 5: Genetic Algorithm Operators.


We instead inline only functions related to critical regions, i.e., functions that can be called by threads holding locks.

we collapse regions of the global inlined Petri net that contain no lock-related operations because they are irrelevant.


This new speci.cation allows a thread to discharge a req using the preceding fut predicate.

the thread gives up the ability to ever acquire the resource, and instead forwards this capability to future threads.


Formally, latent semantic analysis seeks d orthogonal directions in the vector space that capture as much of the variance inside the data as possible.

one technical way to obtain these d directions is by performing a singular value decomposition (SVD) of the matrix M.M is decomposed into three matrices U,Sand V as follows M US VT = .


In conventional systems, each portion of the text is identified by its level within the document so that moving it requires changing its syntactic iden- tity.

in a standard hierarchical document, writers have to not only cut and paste the right span of material but also change the designations for all of the headings.


7 Thanks to the constitution function, the system is able to retrieve the traits that make up an object for any given set of active contexts.

note that the constitution function is not necessarily injective, meaning that two di.erent contexts C1 and C2 can have a same associated trait T(l,C1) = T(l,C2) for a given object l, and also that two di.erent objects l1 and l2 can have the same trait T(l1,C) = T(l2,C) for a given context C. a same trait can be reused as adaptation in di.erent contexts and for di.erent objects.


Implementing a dynamic allocator inside the language is not feasible for many kinds of embedded programming tasks, and makes others more di.cult.

it is di.cult, though not impossible to implement a kernel in a language that supports dynamic allocation inherently, as the allocator itself depends on some parts of the kernel.


RELATED WORK The iterative refinement of invariants found in IRM is reminiscent of goal-oriented requirements analysis from the field of requirements engineering [22].

the Keep All Object Satisfied (KAOS) method [20] is a well-established method for capturing and analyzing system requirements in form of goals, assumptions, and domain properties.


In fact, it appears from inspecting publicly available code as if functional dependencies are normally used in a way that can be directly translated into associated types.

even sophisticated uses of functional dependencies, such as HList [18] and a type safe evaluator, can be mirrored with associated types.


Crucially, our placement also satis.es the following property: when uniform slot service assignment is used, all requests are satis.ed w.h.p.

our placement is such that (5) and (6) are not only necessary but also suf.cient for (4) to hold (c.f.


In general, tree transducers induce a relation on trees that pairs each input tree with each of its corresponding outputs.

tree transducers may be non-deterministic and partial.


The result can be used portably across all architectures supporting a CAS-like primitive, and thus signi.cantly extends the kinds of operation that can be safely performed in contexts such as user-level signal handlers, where a lock-based solution is not safe.

15the CAS operation in the push function must have release semantics, forcing all prior memory operations to become visible before it.


As expected, our portfolio scheduler performs better than all individual scheduling policies, under all workload traces.

it outperforms the best constituent policy under KTH-SP2, SDSC-SP2, DAS-fs0, and LPC-EGEE by 8%, 11%, 45%, and 30% respectively.


4.1 Leveraging existing optimizations The initially-generated STIR representation contains many opportunities for optimization.

the STM operations are amenable to many conventional optimizations already performed by StarJIT such as redundancy elimination, dead code elimination, inlining, and loop transformations.


The schema declares the node and edge types of the integrated graphs as well as of the correspondence graph.

a TGG schema consists of a pair of metamodels of integrated models and the types of correspondence links between them.


9 demonstrates the interconnection hierarchical interfaces.

the HI interface (SparseSolver) connects to the MI interfaces (GenericPreconditioner and GenericAccelerator) through the pSKIT-Solver component.


Every time q.si eats in any dining instance, it sends a ping to p.wi and does not exit until an ack has been received.

when q.si exits eating, p.wi has recorded that a ping has been received from q.si.


With this interpretation of inv, our proof obligation for the correctness of compiling statement s is: for any continuation statement k, if we know invpkq is a valid speci.cation for the compilation of k, can we establish that invps; kq is a valid speci.cation for the compilation of s; k?

abusing the Hoaretriple notation, the proof obligation is: compileps, kq c tinvps; kqu c tinvpkqu the job of a statement s is to take us from a state where we must run s; k before returning, to a state where we only need to run k before returning.


At this point, the results of the analysis are propagated back to the PSM, and finally onto the PIM, where the software designer can inspect them.

they are formulated as additional attributes of the > elements.


The goal of each player in congestion games is to minimize her own cost without trying to optimize the global situation.

all players will try to lower their own cost by changing their strategies individually.


Only few of the comparisons involve actual programming, and even if they do, they are di.erent from the Plat Forms setup in several aspects: They involve much less controlled conditions for the production of the solutions.

authors can often put in an arbitrary amount of work during the course of several weeks.


Additional bene.ts include the fact that, having a formal FD opens the way for automated queries and reasoning on the change speci.cation through the use of an FD tool such as FAMA [7] or the one described in [17].

this allows a safe and e.cient integration of change-based FOP with those tools.


This forces ParaMEDIC to use algorithms that can generate metadatafrom the result and re-generate the resultfrom the metadata with minimal processing requirements.

for most applications, the framework ensures that the post-processing cost required to process the metadata and generatethe .nal outputissigni.cantly lessthantheactual computation needed by the application.


A data group represents a set of variables and other (nested) data groups.

a data group can represent variables that are not in scope.


Since those techniques are expensive, in our current implementation, we use a heuristic.

to increase the chance of connecting usages of objects having implicit data dependencies, each action node of an object will be connected to the nearest (downward) action node of any other object.


The macro debugger does not show the expansion of any opaque macros, but if an occurrence of a macro has subexpressions, it does display the expansions of those subexpressions in the context of the original macro form.

hiding a macro effectively removes its rewriting rules and adds expansion contexts, as if it were truly a primitive of the language.


The integrity and maintainability stereotypes, although not explicitly shown in Figure 6, are characterized by similar complex NFP attributes.

the integrity stereotype has an attribute of type Error that supports the speci.cation of communication errors (guideline-4)and the maintainability stereotype has an attribute of type Repair to be used for the characterization of the repair process (guideline-2).


data adjacent to the requested data are possibly to be accessed in the near future.


$10.00 David Sands Department of Computer Science and Engineering, Chalmers University of Technology, Sweden dave@chalmers.se many similarities between problems that arise in the access control and information .ow control domains.

problems regarding policy speci.cation and modelling of principal actors are quite similar, much due to the fact that these issues are not purely technical, but rather relate to the interface between the system and its users (implementor, admins).


PostgreSQL places considerable load on the operating system, and this is re.ected in the substantial virtualization overheads experienced by VMware and UML.

the OLTP benchmark requires many synchronous disk operations, resulting in many protection domain transitions.


All terms typable in the weak system are still typable in strong system.

the strong system is complete with respect to the weak system.


These basic mechanisms ensure that the system achieves eventual consistency.

after some .nite time, all replicas in the system reach an identical state, appearing to have applied all noncon.icting updates to an item in the same order.


They need to be explicit, precise, adequate, non-conflicting with other requirements and complete.

application-specific requirements should anticipate application-specific attack scenarios such as, e.g., attacks on a web-based banking application that may result in disclosure of sensitive information about bank accounts or in fraudulous money transfer.


CONCLUSIONS GORE can provide a promising methodological foundation for the analysis of value co-creation in service systems.

softgoals and satisficing objectives are extremely important for the analysis of value co-creation relationships, because they can elicit the idiosyncratic and contextual character of value.


A concept interface, that is, an interface with member types that have not been bound to concrete types, can only be used as type parameters subtype constraints, or as a base interface of another interface or class.

one cannot declare a variable, function parameter, or a .eld of such a type, nor use it as a type argument to a generic method or type.


template  struct graph traits {Inside the breadth .rst search function, calls to functions asso-typedef int vertex; ciated with the concepts, such as out edges from Incidence Graph, typedef pair edge; typedef list::const iterator out edge iter; are resolved by the usual function overloading rules for C++.

... each is resolved to the best overload for the given argument types.


If he continues in this manner, (t =(CT )n ci), he will have a complete view of the network after n = large iterations (under the assumptions that C is irreducible and aperiodic, which we guarantee in practice and address in Section 4.5).

fortunately, if n is large, the trust vector tpi will converge to the same vector for every peer i. Namely, it will converge to the left principal eigenvector of C. pt is a global trust vector in this model.


for some k > 0, then the urns de.ne the same stochastic process.

urn weights can be rescaled without m consequence.


Second, while one requirement shock was introduced in previous semester, we felt that having only one shock could not really propel the students to design their systems to be agile and flexible to changes.

according to our observations, most students still suffered from the tendency to design their systems in a tightly coupled manner and they were less likely to structure their systems using the component-based approach, which has been hailed as a way to significantly lower the barriers for reuse of pre-built self-contained functional blocks and amendment of the system architecture to cater to future changes in requirements [16].


Bit .ips to computation circuitry and memory elements are a form of memory corruption, and the results of the study conducted in this work are equally applicable for transient errors.

the observation that a corrupted memory location , most often, corrupts only a few other memory locations can be taken advantage by a system that recovers from transient errors.


As we argued in Section 2, we believe that DHTs, while more ef.cient at many tasks, are not well suited for mass-market .le sharing.

their ability to .nd needles, i.e., exceedingly rare .les, is not needed in a massmarket .le-sharing environment, while their ability to ef.ciently implement keyword search, which is crucial for this application, is still unproven.


Finally, the methodology should meet some user needs in order to facilitate the adoption of the methodology by non experts in formal methods.

the following non-functional requirements are important to make the methodology applicable in practice.


We propose a novel ranging algorithm that executes q-range estimation and localization in an interleaved and iterative manner.

feedback from the current localization result is used to constrain the search space of q-range estimation, then the new estimates are used in the next localization phase, thereby iteratively re.ning the result.


Taking into account our previous work on analysis of staged metaprogramming, we have now developed the theory to handle both problems.

this demonstrates how to analyse information .ow statically in languages like JavaScript in the presence of eval.


RELATED WORK As we mentioned before, so far in the software architecture literature we .nd only a very few studies that provide empirical evidence regarding architectural understandability.

one existing study examines the in.uence 1Seventh Workshop on SHAring and Reusing architectural Knowledge (SHARK 2012).


3.2 Interferometric Tracking: inTrack Radio-interferometric localization in sensor networks focuses mostly on stationary deployments.


However, with careful analysis it can be seen that as the usage of such technologies increases a number of issues arise.

we assume that in future ubiquitous environments there will be sufficient specialisation to allow for the coexistence of multiple service location and interaction technologies simultaneously.


We demonstrate that the knapsack scheduler is highly con.gurable, presents examples and methodology for tuning the allocation policies, and discuss speci.c results and conclude with recommended deployment practises.

we explore the e.ects of varying the strengths of an external userspeci.ed monetary metric, an intrinsic estimated response time mediated by nearness to completion time metric, and of varying the shape of a sigmoidal normalizing utility function.


Unlike Gay and Hole, we have chosen a lambda calculus because it is trivial to embed sequential programs in it.

our variant is based on a simply-typed, applied call-by-value lambda calculus in A-normal form[1].


An important contribution of our approach is that com-ponent and aspect interfaces are detached from their im- plementation classes.

as context conditions vsxy, the framework picks at runtime the imp]ementation rood-u]e that is adequate to the current context.


In this paper, our focus is on scheduling support for CAD architectures.

we propose and evaluate a storage system specific scheduling support for CADlets, the code fragments that need to be scheduled/executed on the parallel active disks.


This modi.cation aims at adding one more adaptation scenario to the system.

di.erent encryption mechanisms can be chosen when sending con.dential information to the bank.


The question that then arises, is how should the functionality of Si and Sj be modified?

some outputs of Si may need to be redirected to Sj; also, some inputs of Sj may have to be obtained from Sk.


Box interface x extends box interface y if and only if interface handle (x) = interface handle(y), type (x) extends type(y) in Java, and x is a behavioral subtype of y [5].

the provided interfaces of B should provide at least the operations of A, and the required interfaces of B should be at most as much as that of A.


Sistemas Inform´on, Universidad Complutense de Madrid aticos y Computaci ´ fraguas@sip.ucm.es jrodrigu@fdi.ucm.es jaime@sip.ucm.es Abstract Non-con.uent and non-terminating rewrite systems are interesting from the point of view of programming.

existing functional logic languages use such kind of rewrite systems to de.ne possibly non-strict non-deterministic functions.


Then based on the alignment results, SAM derives a sequence of graph edit operations.

the un-aligned (unmapped) nodes are considered added or deleted (lines 1112).


When simdizing a non-unary operation, data involved in the original computation must reside at the same byte offset in their respective vector registers.

streams involved in the same SIMD operation must have matching offsets.


They happen mainly because these tools work with an environment of emulation, hindering the process of content production.

once content is generated, it will be shown via an application previously defined to present it, or by using virtualization to show the preview.


== edges in B ' become multicoloured, and multicoloured edges in K remain multicoloured.


PRIOR WORK Previously, we have made several other improvements to the framework or organization of ACATS.

we have noted that ACATS does not come with a test harness, nor with automated grading tools.


The .rst instance is already consistent within feature Weighted, that is, method display is already de.ned in class Edge.

both the requiring and the required elements are within a feature, which just happens to be the same.


In order for programmers to use Frenetic effectively, they must have an understanding of the cost of applying the basic operations in the language.

it is important that they have an understanding of the number of packets that must be diverted from the fast path in the network and sent to the controller due to a query.


This pointer is used by the kernel scheduler upon re-dispatching the thread after it has been context-switched o. the CPU.

this pointer is reloaded into the page-table pointer register CR3 upon the occurrence of a context switch that gives control to the thread.


ZipPy uses the Truf.e framework [26] to op timize interpreted programs in stages, .rst collecting type feedback in the AST interpreter, then just-in-time compiling an AST down to optimized machine code.

our implementation takes care not to prevent those subsequent optimizations.


In [9], [4] and [10] authors propose to optimise the sensing process in terms of power saving.

[9] exploits a speci.cation-driven reasoning technique to learn relationship among context attributes to optimise the internal logic of an awareness framework.


Finally, browsing the source code is necessary to see where the functionality has been moved to.

each removed message-send must be checked to see whether (new) methods defined on the same class perform that same message-send.


When we restricted the data included and analyzed in this way, the results, averaged over the seventeen releases representing four years of .eld exposure, were almost the same.

the 20% of the .les identi.ed by the model contained, on average, 84% of the faults.


(Partial) An imperative implementation, written in Java, of a representation invariant for red-black trees.

by using information obtained while solving declarative portions of the invariant we are able to help prune the search for partially valid structures from the imperative portion of the speci.cation; and having a declarative invariant allows for querying characteristics of the valid structures that lead to reductions in the search space when solving the // empty tree has size 0 (thiz.root = null => thiz.size = 0) and // root is black (thiz.root != null => thiz.root.color = BLACK) and // tree structure is ok (this.root != null => thiz.root.parent = null) and all n:TreeSetNode | { n in thiz.root.


However, the assumptions of SDF are not an intuitively good .t for all streaming applications.

the node s decision on whether to send an output message in response to an input, and which subset of output channels to send messages on, may naturally be datadependent.


Mobile code is theability to move executable code across the network, on demand, tothe place it is needed, where it is executed securely and reliably.The power of mobile code is in its ability to extend the behavior ofentities on the network dynamically.

part of theagreement that must occur between two interacting entities movesfrom development time to run time.


The Multi-Cloud developers needs to understand each particular interface in order to connect each service, fact that is not compliant with R2.3 and R2.5.

the achievement of portability or relocation (R1.5 or R2.10) is considered a moving target, di.cult to reach, if the set of APIs to comply with is constantly increased.


It is necessary for the proper execution of the code.

it has to be put in the .ash memory of an embedded system.


The input and output are given names, and the post test speci.es that there are to be two parallel executions and how to modify the inputs and compare the outputs.

this .le speci.es that the NaiveBayes program (a machine learning classi.er) has the property that, if the input ( training data ) is perumuted, the output ( model ) should still be the same.


at runtime, arguments treated linearly are never should be no such restrictions on its use, as we can indeed write functions from Nat to Nat which use their arguments more than once or ignore them altogether.


Figure 2 illustrates the IVML model editor, depicting an excerpt from the variability model of the YMS case study.

figure 2 shows the definition of enumerations, two (refined) compound types, two decision variables of the defined compound types and a constraint (in the last line in Figure 2) linking the two constraint variables.


We observe that traditional metaprograms are perceived as functions converting one object program to another.

suppose P to be the set of all programs .


This chain of adaptation causes multiple problems.

the user can be annoyed by the multiple adaptations, and through the sequence of adaptations the desired pro.le can become unreachable.


When running the kernel at 1000 Hz we can see that the situation improves dramatically the e.ective quantum length, even for interactive applications, is typically several ticks long, so the scheduler bills the process an amount that re.ects the actual consumed time much more accurately.

on a 1000 Hz system X is billed for over 93% of the time it consumed, with the missed quanta percentage dropping to 64% the fraction of quanta that are indeed very short.


Example c For the sake of illustrating how a P-chart can be used to monitor QoS requirement and detect violations, suppose that there is a running software system and the requirement is No more than 2 seconds response time for 95% of the requests .

the requirement is that the proportion of response time that is greater than 2 seconds is 0.05.


It suf.ces to introduce context-switches after only these operations; since a private operation in a machine commutes with operations of other machines, a context switch after is redundant.

if an error occur in an execution with a more .ne-grained context-switching, it can be shown to occur in another equivalent execution in which context-switches happen only at the points mentioned above.


{snRMQ} end foreach end foreach Figure 2: Iteration space partitioning algorithm and the target iteration of each dependence distance vector.

the dependence span of a distance vector J D(d)= d = (d1,d2,...,dm) is the set of iterations that start at Ji = (i1,i2,...,im)and end at Ji+ dJ= (i1 + d1,i2 + d2,...,im + dn), as long as both are in the iteration space.


4.2 Project Tenure and Code Centrality After identifying the overlap of developers in projects and general paths that developers take after joining a project, we evaluated the effect tenure has on participation in a project, specifically with respect to code centrality.

we investigate whether the number of releases during which a participant is active in a project affects whether they make core contributions.


The programming language has a signaling paradigm as the top execution level.

only events can trigger code ex- ecution.


From this table we see that 196 out of 256 times (77%) when a group came up with a program that would yield useful information for an exercise the group was able to answer the exercise correctly.

students are often able to e.ectively use the information obtained through the PL-Detective.


In this paper we demonstrate how to take advantage of these architecture features to e.ciently map OpenMP into this platform.

we exploit relevant architecture features such as: (1) the capability to con.gure a section of every SRAM bank as scratchpad memory, which provides a fast temporary storage to exploit locality under software control; (2) a rich set of hardware supported in-memory atomic instructions.


Conclusion and future work We presented SO U N D EX T, a formalism for syntactically extending a base language without affecting type soundness.

sO U N D EX T veri.es language extension to guarantee that desugarings adhere to type preservation and progress.


Before returning, Insert, Delete, and Search nullify the hazard pointers to guarantee that the amortized time of processing a deleted node until it is freed for reuse is (logarithmically) bounded by contention.

whenever a thread is not operating on the object, its hazard pointers are null.


The second precondition is that there must be an ethos of collaboration within the community.

there must be a willingness to work together to solve common problems.


Another goal of our work is to protect users in the face of a strong adversary.

we assume the following threat model: We allow adversaries to obtain the user s password either through phishing or by compromising weaker sites (for which the user has reused a password).


As another case let s consider that any one or more of the trust values on a path are 0.

one of the sites has no trust in the entity that it has a trust relationship with.


The Communication models that form the input of our UI generation process define the interaction between two parties as well as the content they exchange.

they specify an interface between UI and application logic and allow parallel development.


It would indeed be interesting to base Jeeg on quanti.ed linear temporal logic (QLTL) or monadic second order logic (MSOL), second order variations of LTL of greater expressiveness.

qLTL and MSOL stay to regular languages as LTL stays to star-free regular languages.


In comparison, while these techniques detect the insecurity of target components, we focus on detecting insecure usage of the components.

we model insecure usage of a component as inconsistent evaluations of security policies maintained by the component.


we show that the runtime overheads of these obfuscations tend to be small.


This is because of the overhead of the recovery system.

every load or store has to be performed on a state history a list of the pairs of space ID and value.


While A-STEAL is an extension of classic randomized work stealing and the feedback algorithm of A-GREEDY, combining the algorithms posed novel technical challenges, because unlike classical randomized work-stealing, A-STEAL must deal with dynamic changes in the job s processor allotment.

when the allotment decreases, we use a mechanism called mugging [14], which involves a processor stealing all the work of another processor, rather than just a single task.


This is bene.cial since it fosters a clean decoupling, but it is disadvantageous with respect to an ontological reach-through.

the semantic grounding depends on the aspects the simulation software provides to the outside.


Note that the approach for obtaining V(r)is data driven.

the choice of parameters will vary if the service software is rewritten or the cluster hardware changes.


Therefore, we use a simple table lookup algorithm to further reduce the trace size.

we trace the program of.ine and identify the most frequent subsequence in that trace.


Both direct and indirect conflicts are generally discovered at a time later than when they are actually introduced.

between the time a conflict begins to emerge (e.g., a developer starts to change a file that another developer is already in the process of changing, a developer inserts references to Java methods that another developer already removed) and the time it is actually detected, significant time passes during which the conflict may grow from small and innocuous to large and complex to resolve.


However, a persis tent problem has repeatedly bothered the collaborators: when one programmer introduces a bug, everyone has to live with that bug until someone .xes it.

a compilation error created by one programmer s work-in-progress might prevent others from seeing less catastrophic compiler errors of their own, or might prevent them from running the program to test their code.


Due to .ow-insensitivity, the order of propagation in C Gstd does not matter from a correctness perspective; any propagation order produces the same .xed-point as long the propagations continue following the subset constraints.

whenever source of an edge contain an additional points-to fact than the destination node, the points-to fact is propagated.


Maximum time retailer will wait for back order M  Minimum cost associated with back order lead time proposed by supplier Cmin  Maximum cost associated with back order lead time proposed by supplier Cmax  Acceptable lead time of the supplier for particular retailer L  Minimum viable lead time of the supplier for retailer Lmin  Maximum viable lead time of the supplier for retailer Lmax  Cost of lost sales in case retailer chooses to no longer do business with supplier CB,LS  Actual number of items requested by the retailer x Although based on total cost, the client-specified fitness function actually weighs the ordering cost more heavily than the other two expenses.

each fitness value is the sum of the total ordering cost (OCost) and the average of the sums of holding (HCost) and shortage (SCost) costs over all retailers R (Eq.


In a recent study on the use of social tags for development tasks in IBM s Jazz environment [16], we found that developers used the tagging .eld to organize tasks.

we found that tags such as linux , windows or testing were used to overcome the lack of a corresponding task category.


To avoid other unnecessary misspeculation, several bit .ags were expanded to take entire bytes.

this avoids misspeculation that occurs due to a read of the common.public .agvariable in the IR structure that appears to be fed by an update of the common.static .agbecause they are contained in the same byte.


The point of this undertaking is to make some of that method explicit in a contemporary vernacular, while showing the greatest respect for the underlying method itself.

don t change the method as much as .nd a better way of describing it.


Notably, content placement and replacement are fundamentally different from strategies for content staging, which essentially prepopulate or initialize the caches.

content placement and replacement strategies together determine the steady state behavior of the caches rather than the initial conditions that may only impact a few initial requests.


As given in Section 4, the normalized leakage energy consumption of our approach and the hardware link shutdown method are around 30% and 48%, respectively.

the proposed scheme achieves a leakage energy reduction of about 37% over and above the hardware link shutdown scheme, demonstrating the importance of selecting routes based on individual send operations, rather than .xing it based on source-destination pairs (i.e., 37% saving versus 20% saving).


The idea of the module reduction semantics may have other applications.

it should permit a typed operational semantics for Cardelli and Leroy s dot-notation calculi [CL90].


As in the breadth-.rst strategy, a priority queue of plan nodes is created by traversing the test plan, and is used to increase task parallelism during the early execution stages of the plan.

for the initial task requests from test clients, tasks for nodes in the queue are assigned to all available clients immediately at the beginning of plan execution.


1 transformation uml2qn(uml:UML, qn:Gpmif) { 2 top relation PaStep2TransitType { 3OMG -MOF 2.0 QVT Final Adopted Speci.cation v1.1 http://www.omg.org/spec/QVT/1.1/ 4EMF web site: http://www.eclipse.org/modeling/emf/ 5Details about the JTL environment are available on [4] and at http://jtl.di.univaq.it 6DLV web site: http://www.dbai.tuwien.ac.at/proj/dlv/  Listing 1: Fragment of the UML2QN transformation Furthermore, the relation GaExecHost2ServerType in lines 17-26 maps UML Components in Service Centers.

the Component metaclass annotated using the GaExecHost stereotype is mapped to the ServerType metaclass of the GPMIF metamodel.


In either case, the value of the reference to the widget object may very well end up being null, which would result in an app crash when an access such as the following reading of a value from the EditText is attempted: num = Integer.parseInt(et.getText().toString()); Sometimes the students instantiate the EditText independent of findViewById and the UI altogether.

they create an EditText object that has no connection whatsoever to the declared UI.


Such a value can only be used by .rst extracting and checking the type.

one can only write values that are consistent with the packaged type.


Dispatch handles, on the other hand, are remote references through which components can raise events.

dispatch handles are used to invoke procedure calls on remote event handlers residing on other nodes.


File write: Writing a .le requires handling a few more details.

if the write operation is an append operation (writing to a new .le can be viewed as creating an empty .le and then appending to it), the VM s .le system requires allocating new empty data blocks and send their identi.ers to the vPipe VM module.


While many bene.ts related to the use of design patterns have been stated, a little has been done to empirically investigate pattern change proneness [3] or whether there is a relationships between the presence of defects in the source code and the use of design patterns [24].

there is lack of empirical studies aimed at analyzing what kind of changes each type of pattern undergoes during software evolution, and whether such a change can be related to changes contextually made on other classes not belonging to the pattern.


In a program understanding tool, our system may not immediately produce the reason that the user needs.

for lattices whose elements are sets, our system computes a single reason instead of one reason for each element within the set As an example of this, suppose a programmer requests a program slice and the slice is much larger than what the programmer expected.


Given that profiling information flows is costly, in this study we explore the use of combinations of simple program elements of different types to help locate defects following a Tarantula style suspiciousness metric.

we will investigate the prevalence of the scenario when the failure is more correlated with combinations of simple program elements than it is with singular instances of them.


CenWits employs several important mechanisms to address the key problem of resource constraints (low signal strength, low power and limited memory) in sensors.

it makes a judicious use of the combined storage capability of sensors to .lter, organize and store important information, combined battery power of sensors to ensure that the system remains operational for longer time periods, and intermittent network connectivity to propagate information to a processing center.


For example, a 95% con.dence interval on q outputs an interval that includes the true value of q of the underlying experiment with 95% certainty.

if the outputted interval does not contain the true value of q for the experiment, then the observed event must have a likelihood of at most 5%.


The current version of XMI captures only the semantic information of UML model information (i.e., the relationships), while discarding most of the visual details of a particular UML diagram.

it does not preserve diagrammatic layout.


For each query q, we de.ne F(a)q =1 if and only if there exists a derivation of q.


Our system exploits a relational database as a backbone for e.cient extraction and retrieval of matches.

the entire process of managing both sources is performed within the DBMS.


Beside the minimization of energy consumption, the maximization of the system performance under a given energy constraint is another important direction.

researchers in [2, 13] targeted the maximization problem of the system reward under given timing and energy constraints.


3.3 Fields Field types include non-null annotations, but no initialisation modi.ers.

there are no free .elds for  free type committed type unclassified typype Figure 2.


Note that we do not patch any pointers to the original code of optimized procedures in the data of the program.

the return addresses on the stack still refer to the original procedures.


the number of defects at time T minus the number of defects remaining at time t or A(t)=N(T)-N(t).


We use Qs,j,k to represent the Figure 3: The process of determining the set of iterations (from all the nests) that will be executed by processor s. set of loop iterations from loop nest k that touch the elements in Zs,j .

the global parallelization strategy assigns the iterations in Qs,j,k to core s. each core executes the iterations that access the array region it is assigned to.


In our work, we focus on the second approach.

we are interested in investigating the impact of applying client-side server selection mechanisms to reduce the response time of geographically replicated web services.


The basic idea of the .rst step (data localization) is to divide the entire data space of an array into data blocks, such that the data elements in each data block are mostly accessed by only one processing unit (thread block/thread).

data localization ensures that the data elements accessed by the same processing unit are not spread over the entire data space.


Any address a produced by injection is considered a partially evaluated value of the term, and SE ' is recursively applied to that value until the context stack becomes empty and the evaluation .nishes (this is the last case in Figure 16).

staged evaluation uses and calculates new addresses in the same way as standard evaluation uses and calculates new values.


The resulting models were then implemented in the Java programming language and integrated with the web server previously described.

simpleSensors are used to periodically gather performance measurements from active servers.


3.5.1 Guiding concurrency policy The guiding concurrency policy of a class sets an upper bound on the extent of interleaving for the methods of a class and its subclasses.

the guiding con- currency policy defines (safe vs. unsafe) concurrency for a class implementation.


The first and most obvious one is that a preset distinguishing sequence is also an adaptive one (for which every path from the root to the leaf has the same input portion on its label), while the reverse is not true.

if an FSM has a preset distinguishing sequence, it has an adaptive distinguishing sequence as well, but there are FSMs that have adaptive distinguishing sequences but do not have a preset distinguishing sequence.


It may be that continuous compilation and continuous testing truly had no affect on time worked, or it may be that true positive or negative effects were masked by Parkinson s Law: Work expands to .ll the time available for its completion.

students may have budgeted a certain amount of time to the problem set, worked toward that budget by either rushing to complete if they were behind, or gold-plating for code clarity if they were ahead, and turned in whatever they had when time ran out.


3.1 Cloud Support Our extensions to AppScale facilitate interoperation with Neptune.

we modi.ed AppScale to acquire and release machines used for computation and to enable service placement (statically or automatically).


2.2 Temporal logic Temporal logic allows expressing properties related to time formally.

we work with linear temporal logic, which expresses for every computation path what must be satis.ed.


Our results show that majority of base class tests can be reused for aspects, but subtle modifications to some of them are necessary.

positive (or negative) base class tests can become negative (or positive) aspect tests.


Since we are more care about the destination of a seek operation, we calculate the accumulated frequency of seeking destinations.

we are more interested in the marginal distribution of seeking destination rather than the joint distribution of both the seek source position and the seeking destination even though it also provides useful insights.


We discuss several non-trivial examples of theories that are relevant in program veri.cation and to which our framework applies.

we consider the theory of arrays with difference function [10].


The irony is that this is one factor where we have data indicating that no one seems to perceive him/herself as part of the problem.

people believe they are no less helpful to remote colleagues, but the same population of respondents reports they are less likely to receive help from remote, as compared to local, colleagues.


Without any further forced-induced acceleration, this vector always includes the gravitational force, and thus, it can be used to determine the orientation of the otherwise steady device.

the y coordinate of the vector is used later in line 18 to compute the current vertical position of the user s (left) paddle, based on whether the device is standing upright (p .


[22] observe that a large fraction of the casts between unequal types in real programs are either upcasts or downcasts, and our experiments support this observation.

we have observed that around 63% of casts are between identical types.


Many of these techniques monitor runtime events to .nd those events that correspond to the executions that fail.

researchers have investigated using the runtime coverage of entities such as statements [1, 2, 8, 9] and branches [10, 11], which require lightweight instrumentation, and information .ows [12], which require more expensive instrumentation.


3.5.3 Fitness Functions The .tness value we used for the NEAT algorithm is the arithmetic mean of the performance of the benchmarks in the training set.

the .tness value for a particular performance metric is: .s.S Speedup(s)Fitness(S)= |S| where S is the benchmark training suite and Speedup(s)is the metric to minimize for a particular benchmark s,which in our case is the run time (i.e., running time of the benchmark without compile time).


We assume that Gls is closed with respect to Int: for any arbitrary suite S e AllSuites(Int), any class that could be referenced during the execution of S is included in Gls.

we consider test suites that only test inter- actions among classes from the given set Gls.


In addition, the iterative behavior of the classical Abstract Interpretation might slow down the analysis such that it becomes impractical.

this can be observed for the analysis of program loops with high iteration counts for which each loop iteration is separately simulated.


Indeed, this consumes space, but it allows keeping information about the dirty object.

we use this word to keep a pointer to the location in the thread s local buffer where the object s pointers have been logged.