Each application server runs the following components: a Request processor (RP), responsible for receiving the requests and starting the VSTM transactions; a VSTM executes the transactions by running a protocol described in the next paragraphs; a Cache manager (CM), responsible for maintaining a consistent cache of regularly used objects; a Persistent store (PS), responsible for persisting the updates on stable storage for later recovery; a Certi.cation manager (Cert), that certi.es the transactions ready to commit to see if there are con.icts; a Group communication service (GC), responsible for maintaining up-to-date information regarding the membership of the group of application servers (including failure detection) and providing the required communication support for the coordination among the servers.

the service provides both an Atomic broadcast service used by the VSTM to disseminate the write-sets of transactions that are ready to commit, and a non-ordered Reliable broadcast service used by an application server to notify the other application servers about commit/abort decisions of transactions.


In contrast to normal Java proxy objects, language-shifted objects have part (or all) of their original behavior executed in Smalltalk rather than in Java.

some of the methods that can be invoked on it have shifted from Java to Smalltalk: they have been translated and can now execute in the Smalltalk VM.


The evaluation of a program variable will be just a lookup in the environment, and the evaluation of a navigation expression is de.ned recursively.

assignments to locals: Assigning an expression e to a local variable v is abstracted by the following rule: ¯ F(v := e, (Eu , Eo))= Eu ([v .eval(e, Eu)], Eo[v .eval(e, Eo)]) the lower and upper bounds of e become the lower and upper bounds of x.


Using the kernel API also denotes a certain level of portability and stability in the implementation since changes in the kernel API are infrequent.

virtualization portability is protected to a large extent from kernel changes in a similar way as legacy applications are protected.


Due to the heterogeneity caused by the sensors si and actuators ai in the network topology, the binding of sensor tasks ts i and actuator tasks ta i is restricted.

a sensor task ts i is only allowed to be bound onto a corresponding node si .


the connectors and the rotation axis) within each link s frame of reference, given the joint value.

we just described the kinematics of a two-links mechanism and implicitly provided the transformations between the two links, which will be explicitly computed by the compiler as a transformation between the corresponding frames of reference.


However, computingsub-populations at run-time is a non-trivial task and is di.cult to achieve within a simulation engine like EpiFast.

it involvesjoining andgrouping ofdataand.nding the subpopulations with di.erent parameters.


Viewing static multiplicities as types whose domains are sets of bags suggests an ordering of static multiplicities based on set inclusion.


We adopt from Buschmann [3] the following de.nition: A pattern for software architecture describes a particular recurring design problem that arises in speci.c design contexts, and presents a well-proven generic scheme for its solution.

patterns have been considered as a suited solution to enhance the construction of software with support of functional and non functional properties.


The COCOMO model can be written as: Y Effort = a * Sizeb * Cost Driveri (1) i This model suggests a linear relationship between the logarithmic transform of Effort and the logarithmic transform of Size and the cost drivers.

x ln(Effort) = ln(a)+ b * ln(Size) + ln(Cost Driveri).


In this paper we present a page replacement algorithm called TNRP (Time of Next Reference Predictor) that exploits this information to predict the time each page will be referenced again and selects the victim page by considering its predicted time of next reference.

it is assumed that each page is accessed at a regular interval and that the time that a page will be re-referenced can be predicted by adding its interval to its time of last reference.


Therefore, automation of activities related to SPLE adoption is desirable.

support for extracting SPL Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page.


As a consequence, the top-level, abstractclasses are often found restricted to act as superclass/subclass in an object system.

an abstract classconceived in such a role is sometimes prohibited from being instantiated directly.


For example, Table 2 shows the table generated from a uniform sampling of 0.01% over the entire iteration space of the matrix multiply loop nest of Figure 2 with N = 256.

we generate the table by investigating 1678 ran-domly chosen iteration points from the total of 16,777,216 points in the iteration space.


The degree to which Convergence Debugging .nds related failures in the vicinity of a given failure is used as a criterion for evaluating the e.ectiveness of this method in locating faults.

the goal of the experimentation presented in this paper was to determine if there is a correlation between control dispersion and related failures in tight neighborhoods around failed test cases.


Eventually Consistent (EC): a database that guarantees an order on operations, given that enough time has passed between them.


Consider for example tuple ids; we de.ne the set of missing tuples and the set of extra tuples as follows (here - is the set-difference operator): missingTuples(Ig,Ie)= tids(Ie) - tids(Ig) extraTuples(Ig,Ie)= tids(Ig) - tids(Ie) Similarly for missing joins and extra joins: missingJoins(Ig,Ie)= jids(Ie) - jids(Ig) extraJoins(Ig,Ie)= jids(Ig) - jids(Ie) When reported to users, these sets represent a precious feedback, since they clearly point out what are the tuples and surrogates that cause mismatches between the expected solution and the one generated by a system.

our similarity measure provides two different comparison indicators: the .rst one is a number measuring the overall similarity of the two instances; the second one is a detailed list of edits (tuple additions, tuple deletions, surrogate replacements) that should be applied to the instances to make them equal.


The meta-language of the interpreter, i.e., HOP itself, is simply tail recursive.

only syntactic self tail recursive calls are implemented without stack allocation.


Conditional branches and merges are handled in the usual way.

the abstract store at a merge point is set to be the union of abstract store values at the end of each basic block that transfers control to the merge point.


Given the P2P nature of our system, as well as the fact that it is intended for large, networked, distributed computational platforms, we are faced with a problem that often appears in such situations: That of the trustworthiness of the agents.

as the origin and actual (as opposed to advertised) behaviour of the agents is outside the control of the end user, it is not possible to guarantee that a defective or malicious agent will not be present in the process.


This lower bound does not however say much about the existence of algorithms that would expedite a decision in runs where f (f< t) failures actually occur.

one would expect that, in runs where few failures occur, a decision can be reached earlier than in those with more failures.


8.3 Region Operators A key question is whether a procedure must specify its own region, or whether it can inherit its region from the calling context.

are regions supplied to procedures statically or dynamically?


By a refactoring transformation, the program is shaped to be more readable, easily understandable, whilst its semantics, or more precisely, its observable behaviour is preserved.

refactoring does not change what the program does, but it improves the look of the source code.


In this paper, we propose a search-based approach to automatic inference of polynomial MRs for a program under test.

we use a set of parameters to represent a particular class of MRs, which we refer to as polynomial MRs, and turn the problem of inferring MRs into a problem of searching for suitable values of the parameters.


We have implemented constant folding, global constant propagation, local value propagation, eta reduction, simple hoisting of arithmetic operations, simple contractions (e.g., inlining of called-once functions), useless variable elimination, dead code elimination, and trimming of memory reads.

the combination of .attened records, dead code elimination, and useless variable elimination makes programming with records and tuples (especially pack and unpack) inexpensive.


During the computation of a dynamic slice, the dyDG is traversed backwards to identify the statements that belong to the slice.

the set of dependence edges Es going backwards from a statement s can be partitioned into subsets of edges Eus corresponding to each use us and subset of edges Ecs corresponding to SS all control ancestors of s. Es = Eus Ecs .


Additional work is needed to con.rm these observations.

more in-depth analysis of the deltas associated with the .les within each segment are needed to understand why the set of .les modi.ed by a developer evolve over time.


Since the attacking packets may come from a large number of hosts (called Zombie hosts) and may traverse many different Internet paths, an individual ISP (Internet service provider) may not see a large number of packets destined to any victim.

such global icebergs (IP addresses that are targets of the DDoS attacks) may not emerge as local icebergs anywhere, and therefore may not be detectable without correlating data from multiple monitoring points.


(2009) recently reduced call-by-need (again, without non-determinism) to stylized uses of delimited continuations.

they simulate call-by-need in a call-by-value calculus with delimited control.


Two variables are considered to interfere if their def-use chains (du-chains) overlap.


thepolymorphic structure ofpolymorphic types can onlybe instantiatedby monotypes.


Thus, we select the optimal frequency/voltage for each phase.


the normal application of network coordinate systems.

in weighted networks, after using our algorithms to preprocess the network and create distance sketches we can compute the approximate distance between any two nodes in at most O(D) times the size of the sketch rounds (where D, the hop-diameter, is the maximum over all pairs of nodes of the minimum number of hops between the nodes) by simply exchanging the sketches of the two nodes.


In practice, this method does not have significant advantages unless rays are traceable toward light sources.

surfaces need to be assumed as specular elements in a modeled environment.


{(Z|nt, nt ' ) |nt R nt ' }}is a J ' -bisimulation.


In order to exploit the common subexpression and dead variable elimination optimizations of gcc, we therefore convert metadata structures into individual variables whenever it is safe to do so.

(we break the metadata structure associated with a local pointer variable when the address of the variable is not taken.)


Furthermore, we have identi.ed both desirable and undesirable behavior for dynamic weaving in the presence of class loaders and characterized it analogously to virtual method calls.The desired design has been characterized by two simple conditions based on the static and dynamic type of the callee at join points.

these conditions abstract away from implementation issues like the distinction between call and execution join points, which would introduce further subtleties [5] to the already subtle matter of dynamic class loading.


3.7 Using the Model One goal of the distortion model is to allow a user running the program in the presence of failures to obtain an estimate of how the failures in that execution affected the accuracy of the result that the program produced.

the user would take the observed failure rates x1 , .


FoxyTechnique takes the guest policy into consideration to achieve the expected behavior of a guest OS.

we make use of graybox knowledge [2] on the guest OS.


Active mediation increases the customizability and flexibility of web services.

it enables interoperation of web services without requiring that heterogeneous data be transmitted via central nodes.


{1, 0.5}  No o.OM |OM |  2.2 Object-Points Analysis For our measurement and data analysis, the structural data gathered from the programs is processed using an Object-Points (OP) analysis.

we apply the OP analysis by Sneed [17], not be confused with object-oriented variants of Function Points (see e.g.


Note that we explicitly relinquish the requirement that the counting covers all numbers.


2.2 PriorWork Our approach to pro.ler development relies on MAJOR[21,22], an aspect weaverthat enhancesAspectJ with support for comprehensive weaving.

mAJOR is able to weave aspects into all classes loaded in the JVM, including dynamically loaded or generated classes, as well as the standard Java class library.


Suppose the absolute error bound on serverjis .j.

we want to ensure that jVfinal,Vjj:.j,where Vfinal is the consistent value and Vjis the value on serverj.


Consequently, y is the only variable whose type safety is potentially affected by the capturing.

the type safety of peer variables is not affected because all objects in the captured cluster are transferred together, that is, they remain peers.


There is a relationship between observational equivalence of terms and the function Specs, because |= V1 Sat gives rise to a notion of observability from the speci.cation point of view.

two terms t and t ' are observationally equivalent in this sense iff t ~ t ' ,where def t ~ t ' = Specs({t}) = Specs({t ' }) It is trivial to check that ~ is an equivalence relation.


To keep our formalization of exotypes simple, we focus on the typechecking and evaluation of Terra code with exotype property queries.

we omit the machinery for quotes, escapes, and specialization used to generate Terra code, which can be found in previous work [7], and assume that an environment P that holds a mapping between exotypes and their properties is already constructed.


To prevent this situation, we employ the kernel hibernation mechanism.

we suspend the context of the upper kernel into the secondary storage before the lower kernel performs its memory test.


Thus, whenever we .nd one unsatis.ed predicate, we can immediately discard all associated subscriptions, and their remaining predicates do not need to be evaluated.

for a given event, we may only need to evaluate a subset of the predicates.


However, sk behaves like SA at the active processes in runs where all other processes are faulty.

sk outputs at the active processes, subsets of A that intersect and contain eventually only correct processes.


just as one thread determines that its message msg does not enable any chord, another message in another thread may arrive that enables a chord involving msg.


First, the model does not capture transient failures.

all failures (i.e., transitions from state k to state k-1) are assumed to be destructive.


This is part of the pressure experienced by professionals of Software Engineering education, which over the years has mobilized the community to meet these demands.

software Architecture discipline plays an important role in this scenario, incorporating reuse and its advantages in software development processes and allowing software engineers to understand and make decisions about design alternatives.


To document aliasing at the function level, the exit aliasing on packet set conn and entry aliasing on packet send2 are added to these functions summaries.

the points-to edge (out.last,out.first)with guard true is added to .out of packet set conn and to .in of packet send2.This aliasing must also be documented for the many other functions which directly or indirectly access out.


The two weeks of experience sampling allowed us to explore in situ how participants wanted to reply to requests for their location from members of their social networks.

several times per day, every day, the participant was interrupted with a hypothetical request for his location from a member of his/her social network and asked to respond.


Summarizing, the choice calculus provides a structured way to represent program changes as variations.

dimensions can be employed to group sets of small changes into complex ones, and applying the variation notation to itself leads to secondorder change patterns that can support the reasoning about change con.icts to support the merging of changes.


In particular, we don t support the following core features: Runtime re.ection is limited to the generation of new methods.

new types cannot yet be generated dynamically and metadata cannot be inspected at runtime.


We implemented a special tool in AHEAD (bccompiler) to implement the arrow-to-arrow mappings of Figure 7 (i.e., .B = bccompiler(.S)) [3].

bccompiler allowed us to separately compile the files of .S into bytecode (.B).


3.3 Mutation Operators To generate mutants of the subject programs, we used a mutant generation program first used by Andrews and Zhang [1] to generate mutants for code written in C. To generate mutants from a source file, each line of code was considered in sequence and each of four classes of "mutation operators" was applied (whenever possible).

every valid application of a mutation operator to a line of code resulted in another mutant being generated.


We also investigate the capability of automatically generated interfaces to provide benefits beyond what is practical for human designers to do.

we show that an automatically generated interface can be easier to learn if it is generated to be consistent with users previous experiences.


6.1 Experimental Design In this paper we are interested to assess the overall message throughput statistics.

the total number of events per second that are successfully received by all of Figure 7: Test environment the event subscribers.


This was deemed preferable to able-bodied testers browsing with the same technology which would seem unfamiliar and unnatural, and would therefore adversely affect the quality of data collected from this stage.

a Braille-literate user is required to browse the site using a Braille display.


Closure values describe a closure in the store.

it encodes a pointer graph, indicating for each store object in the graph the set of store paths that it references.


PROCESSES IN ECOSYSTEMS The initial evaluation indicates that our initial reference model is insu.cient.


FIF program is written using the new library, with no mention of the primitives unit, bind, recv, nor send, and furthermore, if the program has a type according to the new rule Te-PROG, then the program either converges to a program result or diverges.

well-typed programs written with the library do not have communication faults.


We would like to remind, however, that the whole point of resorting to FP languages is to harness the spontaneity of C++MP s syntax for FP purposes.

the syntax of C++MP is already exotic enough to make C++ programmers practice a variety of non-trivial indirections.


we would like to acknowledge Geoff Lowney, Moshe Bach, Robert Cohn, Brad Calder, Satish Narayanasamy, Chitra Natarajan, Mike Green.eld, Aamer Jaleel, Sam Strom, and Alex Skaletsky.


The most obvious, possibly weak, point is that one needs the refactoring tool itself to use it for compiling programs of the extended language.

refactorErl becomes a component in the compilation process of the extended language.


The non-rollback property ensures that older data or metadata versions will not overwrite newer versions persistently critical for journaling file systems with versions of requests in transit.

we do not need to worry that an update to a block and its subsequent secure deletion will be written persistently in the wrong order.


For classification with the modification count, we adopt the MQ (Multi Queue) algorithm [25].

it uses multiple LRU queues numbered Q0, Q1, , Qm-1.


RELATED WORK While there has been previous work in recovering ob jectoriented models [1,8] and other kinds of type abstractions [4, 2,5,3] from weakly-typed programs,these approaches,except that of Komondoor et al [3],are not path sensitive.

our approach distinguishes program states satisfying di.erent predicates at the same program point,and uses this mechanism both for more accurate analysis (less pollution),and for inferring subtyping in a general manner (previous approaches for inferring OO models [1,8] are .owand path-insensitive,and infer subtyping either heuristically or in limited situations).


systems with adequate adaptive capacity.

the state of art in software architecture the field most centrally concerned with the adaptive capacity of software addresses this issue primarily in terms of the structuring of technical software artifacts and execution processes.


Models can be constrained by a metamodel.

a metamodel includes a set of models sharing the same structure constraints.


For each of these minors we were able to create friend lists.

we found on average 38, 141, 129 friends per registered minor in HS1, HS2, and HS3.


This happens because our transformations may take addresses of stack variables.

by taking the address of array prv buff1 in function rank we cause the Intel compiler to perform some more aggressive optimizations that are otherwise not performed.


abstraction levels, composition or variants).

kobrA already provided one of the most orthogonal sets of views for visualizing software systems of any contemporary method.


From these two services, we can observe many possible dimensions of extensibility, largely driven by innovation.

someone might want to improve the system by adding one of the following, with the resultant consequences on preexisting components: A new service, such as a contextual alarm service [3].


A continuation is the portion of execution, in terms of continuation steps, reachable from a given continuation step.

a continuation represents the remainder of the execution that begins with the given continuation step.


We will use progress knowledge as a lower bound on the allowed knowledge of an attacker.

we will explicitly allow the attacker to learn whether a program will produce another observable event.


Unfortunately, YouTube does not allow for seamless playback, since for each video of a playlist the Web page is reloaded.

the application envisioned in this article is not possible to be implemented in existing commercial video sharing systems.


3.3 Compatibility with Traditional AssertionLanguage Our pointcut-based assertions subsume traditional ones consisting of boolean expressions.

traditional assertions can be encoded as pointcut-based assertions.


Debugging these instances with the proposed approach leads to a number of contradiction candidates as shown in Table II (distinguished between the minimal, maximal, and average number).

the numbers of classes and models to be inspected can be reduced from some hundreds (thousands) to no more than 1-2 dozens in just a few seconds (in around half an hour).


The global P/S event-based coordination space is based on the Voyager's publish/subscribe mechanism.

the global coordination space is implemented as an interconnection of Voyager s Subspaces (built using the connect primitive of Subspace) located on different Voyager servers.


The Titanium backend has been ported to several platforms, including SMP's running Solaris or Posix threads, Solaris and Linux uniprocessors, Cray T3E, IBM SP2, Tera MTA and the Berkeley NOW (a cluster of Ultra- SPARC's [5], I17]).

the only major Java feature which is not currently supported by Titanium is arbitrary multi-threading, the user cannot create arbitrary asynchronous threads of control within a process.


T (Lx ))) where newtype T a=T {unT :: F a(T a)} That rule s unconditional total correctness can be established in the same manner as demonstrated for the destroy/build-rule in this paper.

figure 8 in Appendix A shows that free theorems can also be automatically generated for functions involving userde.ned data types, such as for cons :: .


The rule itself is an identity whose successful (or unsuccessful) application is determined by its conditional component.

the condition .rst checks to make sure that Id0 has not been re-declared as a formal parameter to the method.


A key question is whether these tables are disjoint or not.

can the same real-world entity have a record in each of these tables?


During the 3D video generating process, the coding of the displayed content is adapted to end users requirements automatically.

the video signal is based on the control information of an external service: the mouse of the PC or the touch-screen of the PDA.


It is therefore possible to specify completely the CORBA Event Service without making any hypothesis on underlying services;  It is complex due to its versatility.

the connection to the event channel uses a non-trivial protocol between event consumers and event suppliers.


In this table, line state indicates the state of the cache line at the time of execution of the instruction.

invoking activate (deactivate) instruction on an alreadyactivated (deactivated) cache line has no effect.


Mathematically, d de.nes an ultrametric space on the set of nodes.

d is non-negative, symmetric, 0 on the diagonal, and satis.es the strong triangle inequality: d(p1,p3) =max{d(p1,p2),d(p2,p3)}for all nodes p1, p2, p3.


Data Processing Layer implements high-level data analytic functionality of Capri.

it provides dedicated functions and operators for incremental and parallel data processing.


Late launching of VMX modes permits to install a virtual machine monitor even if the system has already been bootstrapped.

late launching allows to migrate (temporarily) a running operating system in a virtual machine, and to analyze and control the execution of the system from the monitor.


However, the ability to intercept message sends to future objects requires access to the message sending mechanism of the implementing language.

the micro-work.ow process component requires re.ection.


Moreover, [9] suggested to downsampling only for smooth pixels.

they de.ned a subset ps(I) of the image I: ps(I)= {Si,j : Di,j <T } , where Si,j = {(2i + i. , 2j + j.)


In combination with the contribution presented in this paper, SOAP services will provide a .exible and transparent reference mechanism for large binary data.

we realize the advantages o.ered by RESTful services for SOAP web services by means of using references, but also maintain the advantages of SOAP-based web services such as standardized interfaces, industrial-strength tools, and the wide support by both research and industrial communities.


The main goal of our language is to provide high-level constructs that are suited to the architectural level of description of a system.

interactions are created and removed at the level of connectors, hence guaranteeing that con.gurations are always instances of the architecture.


From the HPF-2 motivating applications suite we have ex- tracted also the code NBFC [1, 3], which carries out a molec- ular dynamics simulation.

nBFC computes elec- trostatic interactions, that is, non-bonded forces, between particles.


For uniformity, we adopt Cardelli s notion that modules have explicit imports and are closed under composition [15].

two modules can be composed (or linked) to form a larger module, in which imports that are exported by the other module are removed.


StateT g m Int Determinism guarantee The StateT transformer preserves determinism because it is effectively syntactic sugar.

stateT does not allow one to write any program that could not already be written using the underlying Par monad, simply by passing around an extra argument.


It is a declarative language and supports arbitrary context-free grammars.

a syntax de.nition can be used for different purposes, including the generation of parsers, pretty printers, and data type de.nitions.


Intuitively, if the footprint of a formula F is disjoint from the modi.es clause of a statement C , the validity of F may be preserved across execution of C .

careful use of footprints gives rise to useful framing rules.


The inverse of re.ectNum is reifyIntegral, which turns a signed integer into a type that represents the given number in binary notation.

the type says how to make the given number by applying increment, decrement and double operations to zero.


In a set of solution vectors, the set of all non-dominating solutions is called the Pareto front.

if S is the population, the Pareto Front is the set, G = {u .


It is organized as a hierarchical data structure (resembling a tuple space [15]), which maps knowledge identifiers to values.

values may be either potentially structured data or executable functions.


Sender/Recipient: Allows the speci.cation of sender and recipient of a .nancial transaction.

this speci.cation contains their title or description (Title) as well as an identi.er (Identi.cation ) associating them unambiguously to an internal account.


Restarting a method also implies that contexts below the restarted method s context are destroyed (i.e., contexts for called methods).

the context of the raise method should be destroyed.


In this way, a machine-adaptable dynamic binary translator is capable of being configured for different source and target machines through the specification of properties of these machines and their instruction sets.

the translator is not bound to two particular machines (as per existing translators) but is capable of supporting a variety of source and target machines.


Being the content still the most important asset of such a kind of applications, domain experts are important partners in the analysis and design activities because they may be those who will actually provide the contents to the project team.

in this phase they need models that can provide a clear idea of the quantity and quality of the content to be produced and managed (A11).


2 we can see that the ideal points of Obama and Paul are rather different across a wide range of topics.

the .gure con.rms the notion that Paul is the most conservative on the role of government on economy but not on social issues and foreign policy matters, especially as an opponent of war.


This means that AO-ADL connectors provide support to describe different kinds of interactions among components not only typical communication as in traditional ADLs, but also crosscutting in.uences among them.

aO-ADL connectors specify how aspectual components are weaved with base components during components communication.


Such neutrality leads to lean articles that focus on the bare essence of the topic at hand.

articles are devoided of any contextualized bias.


Instead of setting the clean-first region, LRU-WSR gives one more chance to a dirty page when it reaches the LRU position in the list.

lRU-WSR keeps a cold flag for each page in the LRU list.


It is a universal medium for exchange of data and uses metadata to add meaning to data so that they can be understood, shared, processed and integrated by machines autonomously.

web contents are not only for human consumption, machines will also be able to participate.


Since the stack distance is only accurate at the granularity of page group, HitCtrs only needstorecord thenumbersofhitsfor memory sizes that are integral multiples of GrpSize.

counter j (1 = j = NumGroups) in HitCtrs records the number of accesses that would result in a hit with a memory of size j * GrpSize pages, but a miss for any smaller memory size.


As a consequence, all objects are always available, and it is possible to send any message to any object at any time.

since querying is a central part of analysis, we could directly use the Smalltalk language as a query language, instead of having to develop a specialized, ad hoc query language.


When designers want a set of features, they really want the ×-product of these features, which includes the dot-product of these features and their interactions.

the ×-product of features f and g is: f × g =(f#g) · f · g (1) where # distributes over dot and # takes precedence over dot: f#(g · h)=(f#g) · (f#h) (2) the interaction of a feature with a dot-product is the dot-product of their interactions.


Firstly, it serves as a navigation tool for the whole project.

users can choose to display and to work on any component appeared in the window.


Our results show that the proposed analyses are highly effective in producing precise input syntax trees.

the derived trees for the set of benchmark applications with bottom-up input grammars are identical to the real trees.


The concept of primary problem solving, PPS in short, is employed to express an incremental effort in programming.

programmers capture a context snapshot of a domain, and write out a program that has an invariable agreement with this determined context.


Notice that the average of the seed popularity of bundle swarms is around 2.4 times as large as that of the single ones.

the bundle swarms are likely to be more available, and hence support faster download.


e) is the same set required for the evaluation of e itself.

the two expressions have the same support.


Submodules extend Racket s module system to make the phaseseparation facet of the language extensible.

submodules give programmers the capability to de.ne new phases, such as test time or documentation time, with the same reasoning and codemanagement bene.ts as the built-in distinction between run time and compile time.


With a subset of advice and pointcut statements, Weave.NET has been able to demonstrate language-independent AOP.

we have been able to weave aspects whose behaviour is written in one language with components written in another.


Figure 2 shows (in log-scale) the mapping time as a function of the number of VMs.

the left graph of Figure 2 shows results obtained when D = 10, whilst the right graph shows results obtained when D = 100.


D. Correctness, Generality And Effectiveness Our current specialization of compiler optimizations includes two key strategies: (1) a customized ordering of the optimizations and (2) a specialized con.guration for each optimization, to collectively maximize their effectiveness while minimizing interferences.

the following decisions are made to customize a set of general-purpose compiler optimizations for dense matrix computations.


This allows keeping an appropriate level of abstraction and separation of concerns when designing a component for an adaptive and autonomous operation.

iRM benefits from recursive step-by-step top-down decomposition with precise refinement semantics.


However, the authors of the speci.cation recognize that the approach in its current version is limited.

all compensation activities are performed using a snapshot of the process state, which precludes the modi.cation of live variables.


The discrete probability distribution Pf (nf |op,n1,n2) models the manifestation of an error during an incorrect execution of an operation.

it gives the probability that an incorrect execution of an operation op on operands n1 and n2 produces a value nf different from the correct result of the operation.


Distributed rate limiting is an example of this latter class of applications.

multiple nodes may 1While FPS calculates demand in a more sophisticated manner, one may think about Di as the number of active .ows.


Wepropose to use the number of cumulative retired instructions of theprogram to indicate the performance.

we store the cumulagiving more resources to programs that make more use of them.


Each proposition is associated with one instruction: it is an equation that speci.es its invariants.

it tells when the instruction is executed, what it computes, when it passes control to the next statement, when it branches to another block.


The intuitive meaning of the .rst lemma is the following: if e is not a receive event, all the causal paths arriving at e have pred(e) as next-to-last event (see CP1).

so, if pred(e) is a relevant event, all the relevant events belonging to its relevant causal past are separated from e by pred(e), and pred(e) becomes the only immediate predecessor of e.the event pred(e) constitutes a reset w.r.t.


Figure 11 presents incremental analysis can successfully decreases the number of iteration steps against batch analysis.

an application - which is hard to converge such as RWR - achieves highly speedup as well.


r applies at the root of t ' (i.e., t ' = s(f (l1,...,lk)) for some substitution s); and 3. there is a minimal nonterminating term u = g(s1,...,sm) at some position p of s(r) satisfying that p .PosF (r), i.e., p is a nonvariable position of r.  This means that considering the occurrences of de.ned symbols in the right-hand sides of the rewrite rules suf.ces to catch every possible in.nite rewrite sequence starting from s(r).

no in.nite sequence can be issued below the variables of r (more precisely: all bindings s(x) are terminating terms).


The temporal interpretation of students performance in activity, attempted here, could be used for predicting their progress.

interpreting students participation and engagement in terms of time-spent could lead to a complementary dimension of a more concise predictive model.


Simplifying the power network, we assume that unused active probes cannot be switched o., thus reporting on the maximum read/write energy.

if we have 4096 active probes and a request demands data that are accessible by just 2048 probes, the device still consumes an amount of energy corresponding to 4096 active probes.


They can adapt the strategy used to combine the mapping predictions provided by their child aligners5 according to the speci.c characteristics of concepts which need to be reconciled.

di.erent matching strategies can often be used for pairing concepts of a same kind.


control .ow between connected components is simply sequencing.

two connected components are executed in sequence, with the data produced by the .rst component sent as input to the second component, which then executes.


With f = 1, any one process may potentially be faulty.

process pi (1 = i = n) may possibly be faulty.


This presentation reduces the required number of connectives, as they shall be de.ned by duality.

we will conveniently write the linear arrow A -B := (A .


As discussed in the introduction, we regard the graphs in .T FG as an extended tree data structure, i.e., as in.nite trees, so we shall use bisimilarity semantics rather than equality or isomorphism semantics.

2 this is not a set but a proper class, but this matter is resolved in usual way in coalgebra theory, if T is ranked.


Our empirical evaluation mainly concerns the scalability of the following passes, which work exclusively in the Boolean domain.

they manipulate BDDs without referencing any information in the IR.


ORDERING The next part of coding style that we handle involves orderings where the orderings do not have a semantic significance.

we consider import declarations, class definitions in a compilation unit, declarations (fields, methods, and nested types) in a class, interface or enumeration definition, and modifiers for type, field and method definitions.


Neither of these mechanisms meets all the requirements stated in Section 1.2.

they remain limited with respect to higher-orderness, type safety and portability.


In this paper, we will consider cache simulation.

the simulation of set associative caches (the prevalent type of caches nowadays) can be parallelized by splitting the memory reference pro.les into different sub-pro.les based on the sets that each reference will access.


The language should embody the desired component concepts in a clean way.

components should be strongly encapsulated modules, that is, syntactic structures that support information hiding approaches [14] to design and constrain interactions among the components to well-defined abstract interfaces [2] as shown in Figure 1. iii.


In contrast, SAW applications usually operate on streams of information, since they have to constantly monitor the environment under control.

the focus is on pushing dynamic individuals rather than pulling static individuals from an ontological knowledge base.


In this paper, we assume that the number of consumers NTP (i.e., the thread pool size) is .xed, and that the thread pool uses a bounded blocking FIFO queue of size QTP .

if the queue is full, producers block until there is space in the queue.


(4) Context sensitivity The occurrence of some unserializable interleavings depends on the program context or thread context.

they only happen when the involved instructions are executed upon certain stack frame or by certain threads.


Building on this linguistic foundation, OCap programmers expect modules to obey the principle of least authority (POLA) [21].

a module must expect no more authority than it requires to accomplish its task.


We check references to .elds in structures and unions in a similar way; the only difference is that we need to look up the type of a local variable .rst.

right now, we can guarantee that compilation will not fail due to dangling function invocations, and dangling references to variables, .elds, or types.


During our experiment, focus has been placed on memory management.

many important aspects such as threading, inter-process communication, or testability have not been addressed.


We find that without our transformations, the natural intra-kernel parallelism yields inferior performance.

achieving high streaming performance on CPUs requires comprehensive and aggressive optimizations, even though stream programming exposes parallelism naturally.


Babel addresses the language interoperability problem using Interface De.nition Language (IDL) techniques.

babel uses a Scienti.c Interface De.nition Language (SIDL) that addresses the unique needs of parallel scienti.c computing.


Secondly, a context-aware system should have a clearly de.ned operation context.

the beginning and end of the task of the system should be clearly known.


This is because LDF selects a victim block with the same conditions with respect to the re-reference likelihood compared to original NRU or RRIP.

both LDF and its baseline algorithm (NRU or RRIP) replace a block only after its reference bit(s) becomes 0.


A system may be realized using more than one deployment optimal configuration in RESIST is defined as one that satisfies the system s reliability requirement, while improving other quality attributes of concern.

in RESIST, reliability takes precedence over other quality attributes.


We thank John Regehr, Eric Eide, Alex Groce, Xuejun Yang, and Yang Chen for helpful comments on this work.

we gratefully acknowledge John Regehr for his helpful advice on using Csmith, for pointers to Nagai et al.


Figure 3 shows a constraint automaton for the external view of a web service that allows searching and downloading of articles from the Internet.

the client may choose to search for an article by specifying either its author(s) or its title, as speci.ed by the port names in the constraint automaton.


For a more detailed description of Template Haskell, please refer to the bibliography.

there are a number of Template Haskell experience reports (Lynagh 2003a,b; Seefried et al.


Hardware wear leveling [30, 31, 36] is necessary, but does not provide a complete solution.

coping with frequent writes to the same or neighboring locations imposes overheads when writing (e.g., higher than 100% [31]), as the hardware con stantly shifts the data to new locations.


Thetarget applicationdomainisthesmart card applications.

the results of the project are applied to the IAS, a standard for the operations of Identi.cation, Authenticated and electronic Signature on a smart card.


up in the hierarchy that are responsible for detecting high level domain concepts, such as a moving object in a video stream.

classi.cation is interpretation of extracted features in some application speci.c context.


S(l, b1): S(l, b2)if l = l ' The rule [exp fork] for fork e requires that the forked expression have atomicity cmpd.


The genetic programming variants mainly differ in the fitness function and in the set of terminal symbols used.

a fitness function optimizing both the root mean square error and the correlation coefficient have been presented; a set of ephemeral random constants have been added to the terminal symbols set, originally composed by some floating point variables.


Our approach is presented in the context of both variability and architectural decision making processes at product line and product level for designing reference architectures and product architectures respectively.

we present the steps of variability management and architectural decision making and their relationships along with our solutions for eliciting the interdependencies among the two kinds of decisions.


However, this approach has a garbage collection problem when implemented within ML: a heap entry becomes dead only when (all) the heap(s) containing it do.

in purely functional programs with no narrowing, nothing ever becomes garbage!


We .rst de.ne a re.nement relation between cover sets which describes a partial order of cover sets based how re.ned the application of the abstraction operation using each cover set is.

a cover set is more re.ned than another if the abstraction operation using the former yields a more re.ned model than applying the abstraction operation on the latter.


To our knowledge, no one has since built a heterogenous object systemallowing not only objectsbutalsoexecuting threads to move between architectures at almost any point in the program with no decrease in performance after arrival on the new architecture.

an Emerald process that moves, e.g., from a VAX to a SUN 4 SPARC and back will, when running on the SPARC, execute at the same speed as if it had originated there, and it will also execute at the originalVAX speed after returning toaVAX.


The class of strategies under consideration in a cycle is larger than in the case of a segment due to the ability of the robots to traverse the perimeter of the cycle.

the robots on the cycle can also apply a cyclic strategy, performing clockwise (direction aligned with increasing indices of intervals in V .


We hypothesize that if the target application exposes a username (or anything that is a variant of it), two different usernames should map to two different byte sequences in the messages transmitted to remote servers.

two different outputs generated from two different test inputs (with everything else being equal) suggests that the differing segments in the output may correspond to the application test parameter.


In order to increase the scalability of PostgreSQL-PS, a broker caches a number of key structures in main memory, rather than relying on its persistent storage engine.

the publish/subscribe process maintains a hash index of all event types by name.


For example, a change in the policy of execution context caused by service invocation from different countries with different regulations can prohibit some shared or sharable parts of the RWE to be produced.

the RWE of the joint action may vary depending on the filtering effect of the applied policies.


Measurements were reported by the oscilloscope every 20 milli-seconds and logged to the data acquisition computer.

each data point represents the average current reading for a 20 milli-second interval based on the TDS3014 sampling rate of 1.25 giga-samples per second.


In a hierarchy whose complexity is I, CTdperforms dispatching in ddereferencing opd erations, and reaches a compression factor of at least dllo-al d (when using a slice size ofl).

in a hierarchy whose complexity is I, the space requirements of CTdin the multiple-inheritance setting is worse than the single-inheritance setting by a factor of at most 2Ilo-ald .


Furthermore, the data communication from the sensors to the sink may take long routes consuming much energy and depleting of the sensor battery power quickly.

the sensors around the sink are generally highly used and exhausted easily, thus the network may be partitioned rapidly.


Otherwise the new routing table will be x1,x2,...,xk-1,xd+1,xk+1,...,xd .


Hence, these buffers are not overflown so often, data is reused more and stall time is reduced.

the local hit ratio of this loop increases from 65% with MDC to 97% with DDGT (the local hit ratio with MDC and no Attraction Buffers is 33%) and stall time is reduced from 805K cycles with MDC to 110K cycles with DDGT.


Combined with the host interface extensions this rule permits one to precisely tune a package interface.

it permits one to add annotations that opens opportunities for optimizations.


A.6: If a delegation rule is de.ned with a recurrence, based on the values set to the recurrence, the delegation rule is only taken into account in the transformation within its fromDate and untilDate, repeated by frequency and limited by occurrences.

only active (during recurrence) delegation rules are transformed.


Bias scheduling can be implemented on top of most existing schedulers since its impact is limited to changes in the load balancing code.

we implemented it over the Linux scheduler on a real system that models microarchitectural differences accurately and found that it can improve system performance signi.cantly, and in proportion to the application bias diversity present in the workload.


3.4 Checking code names DOCREF extracts EAPI from API references, which de.ne API elements of an API library in a semi-structured form.

dOCREF extracts four types of API elements, such as types (classes, enums, interfaces, and exceptions), variables (parameters and .elds), packages, and methods (constructors and methods).


The instructions can guide a new player to walk through the steps in playing the game in Code Hunt.

in Step 1, from the suggested sequence of sectors in the game, the player discovers a secret code segment by selecting a sector.


3.1 Server Side Integration WHIP bundles are made available through the myExperiment Web site via a simple hyperlink, which triggers some very simple Ruby code.

the Ruby code looks 1http://rubyonrails.org/ for an existing WHIP bundle on the myExperiment host machine associated with the particular work.ow being downloaded.


We caution that these results are very preliminary, and should not be interpreted as a conclusive comparison of field-based and field-independent.

there are a number of opportunities of optimization that appear to be especially important in the field-independent case that have not im- plemented in our current system.


For example, for a de.nition like x = 2.0 or for use as an array index like A(x), it is safe to assume that if x was declared to be an integer, this de.nition or use will not affect the result of the program.

for this de.nition or use of x, x is IntegerOkay.


A future s thunk is not necessarily evaluated in parallel to other expressions.

if the thunk s computation relies in some way on the evaluation context, then the computation is suspended until a touch, at which point the computation continues in the context of the touch.


It turns out that the converse also holds.

given a trace graph, if there is a .ow assignment such that each read(r)node and write(r)node gets a positive .ow and each A : write(r)such that there exists B : read(r)with AB gets a .ow equal to 1, then there is a read-write pipeline with bottlenecks for the region r. By Theorem 5, this implies that there exists such a .ow assignment for every region r if and only if the trace graph is witness race free.


The directions of the PBQP graph edges indicate the 'di- rections' of the cost matrices.

changing the direction of an edge means to transpose the cost matrix of the edge.


There automated compo sition synthesis is studied in presence of data.

decidability under certain conditions that ensure reduction of relational states to propositional states is established.


Several assessments of open-source projects by static analysis tools have been reported recently [1][7][8][9].

coverity1, with Stanford University, began using its Prevent tool to analyze dozens of open-source projects in March 2006 [1], resulting in the identification of many weaknesses.


In a language without automatic object lifetime management, such as C++, this approach is challenging.

if a lambda function outlives the scope of its de.nition, free variables in the lambda function s body dangle.


We also show the best-capacity device to evaluate the loss in capacity by the other two devices.

we have three MEMS-based storage devices con.gured with the most energy-, performance-, and capacitye.cient con.guration.


Our new view has more clearly speci.ed requirements for shortcut fusion techniques, which will enable use to explore them more systematically.

we are interested in those case where, unlike Church and Cochurch encodings, the concrete representation is not isomorphic but still faithfully represents the datatype.


Our modeling experiences [1], [2], [4] as well as others' [9] tend to confirm that it is not easy to integrate the linguistic tools needed for high-level and detailed modeling into one notation.

we have noticed that in SLANG the representation of the same process varies depending on the purpose of the modeling activity.


Although these evolutions de.nitely have their merits for themediaconsumer,theyalsointroduceissuesinthe .eldof user interactivity.

many of them intrinsically individualize the media consumption process and transform it into a much more isolated activity.


We show that for ML-like languages, there is no greatest lower bound in the subtype ordering for signatures.

given two signatures S and S' , even if there is a third signature that is a subtype of both S and S' , there is no least speci.ed signature I that is a subtype of both S and S' .


The condition is such that, given a template instance that was created from a feature con.guration satisfying the condition, evaluating the OCL expression using the usual OCL semantics over the template instance will yield the associated value.

the template interpretation of OCL involves operations over sets of value-condition pairs.


Within each class of entity, we distinguish between internal and external attributes: Internal attributes of a product, process or resource are those that can be measured purely in terms of the product, process, or resource itself.

an internal attribute can be measured by examining the product, process or resource on its own.


are de.ned as in Section 5 for F. The name clash between constants should not lead to confusion and will always be resolved by context.

the are two constructs set(X): Fa and set(X): Fna, where in the latter case X ranges over .nitary and not .nite sets of terms (we explain below how to regard the set of all terms as a nominal set).


Furthermore, our encoding relies on Scala s support for explicit self types.

the primary use for explicitly specifying the self type T of a class C is to express that C is meant to be a part of a class (composition) that conforms to T. C requires this to be of type T. This is written as class C requires T{ ... }.


s [18] framework for classifying PD tools and techniques Purpose dimension.

the framework can complement the generating ideas sub-dimension by providing tools to teams that may need assistance in creating or choosing PD techniques for intergenerational groups based on the participants and environment.


In this paper, we develop a systematic approach for specifying nonfunctional requirements of telecom OSS applications for contracts in the NGOSS framework for quality management and evaluation.

two categories of non-functional specification techniques are explored: qualitative and quantitative.


In fact, scenarios (or use cases) can be used to drive the whole life cycle of software development processes [15].

scenarios are not only for the requirement phase, but also for the design and implementation phases.


Eliminating false positives at class level w/thresholds Yet, this effect has advantages because many more false positives are eliminated than false negatives are added (with small filters).

the weakest 10% of the trace links contained only 1% of the true traces (i.e., observe that 26% false positives may be reduced to 14% false positives by only adding 1% of false negatives).


The representations of a language are computed by composing tuples element-wise.

the tuple for language FJ = Cast · cFJ is: FJ = Cast · cFJ =[LsC, LoC, LtC, LpC] · [sFJ, oFJ, tFJ, pFJ] =[LsC · sFJ, LoC · oFJ, LtC · tFJ , LpC · pFJ] the syntax of FJ is the syntax of the base sFJ composed with extension LsC, the semantics of FJ are the base semantics oFJ composed with extension LoC, and so on.


If there is no unserializable interleaving pattern, the algorithm checks the window for con.icting interleaving patterns in Table 1.

the algorithm does not doubly count a pair (con.icting interleaving pattern) that is already detected as a triplet (unserializable interleaving pattern).


Although maintaining the core small and simple, boot-strapping a system also requires a substantial degree of expressiveness, which will eventually result in increasingly richer levels.

the term bootstrap seems to have its roots on a metaphor 9an instantation assumed to be right, without any type of structural or constraint enforcement.


For commitment of operations (corresponding to R3), the crux of the argument is that even though commitment takes several rounds of messages, all composite operations submitted in this duration can be thought of as being submitted either before or after the entire commitment operation completes.

all composite operations issued at machine mi before tBeginUpdate(i) can be thought of as issued before the atomic commit, and all composite operations issued at machine mi after tEndUpdate(i) can be thought of as issued after the atomic commit.


For all k, p, q, and r, Left-Zero: (stop >>= k) = stop Stop-Identity: p  stop = p Par-Commutativity: pq =q p Par-Associativity: p(q r)=(pq)r Par-Bind: ((pq) >>= k) = ((p>>=k)  (q>>=k)) Note that these are not the same as the laws typically suggested for the MonadPlus class.

orc calls for the parallel combinator to be commutative, a property violated in many instances of the MonadPlus class, including the classic instance, List, in which  is ++ (list append).


As a consequence, we compute Aij as the weighted sum of metrics that measure how close i and j are in space and time.

p3(k) (1) (2) (3) Aij = wkI,where I,I,Iare k=1 ij ijijij (k) our three metrics, and wk is the weight for metric I.The ij three metrics we use are: Proximity.


To address the .rst issue, we have tried to sample the candidates to obtain people knowledgeable about the project.

we selected the developers that had the strongest mentorship signature using a quantitative approach described in Section 3.2.


This situation motivated us to examine the analysis of software development methods from other perspectives, such as social and cognitive ones.

this short paper illustrates how theories taken from different fields can be used in the analysis of software development methods.


The semantics associated with concepts present new and interesting capabilities for library-compiler interactions.

just as concepts allow programmers to compose independently-developed algorithms and data-types, concepts allow programmers to compose independently-developed algorithms, data-types, and optimizations.


LanguageMemoryModels.Severallanguage speci.cations, such asAda83[34] and the newC[26] andC++[25] speci.cations, do not guarantee any semantics for programs that contain data races at the source level, essentially considering all such races to be harmful.

the corresponding compilers are allowed to perform optimizations that break racy programs in arbitrary ways [4].


Orca was de- signed specifically to allow object replication.


For instance, for T2 it shows as requirements the .eld i (declared in the used trait T4) and the method m (declared in the used trait T3).

the latter actually refers to the renamed method mm, and clicking on the node for m will actually bring the programmer to the de.nition of the original method mm in T3 (which is in a different .le).


Another issue that the user research has to consider is that through the long-term cooperation participants somehow become always-beta user experts.

they in part developed a certain frugality which seemed to have influenced their open innovative thinking.


This permits the use of functions in the metalanguage (Haskell) to represent functions in the object language (Barracuda), allowing reuse of the metalanguage s name binding mechanism.

in Barracuda, the constructors representing let-expressions, reduction, and mapping use Haskell functions in their representation.


timer events as well as message generation.

writing timer events in this style can reduce the number of independent timer paths in the system, which in turn reduces phase effects (meaning related timers with slightly different periods) and the number of pending tasks.


If approximate data is stored in PCM blocks with failed cells, on the other hand, errors will be persistent.

a value stored in a particular failed block will consistently exhibit bit errors in the same positions.


It is important to note that these functions are native to the Lisp environment.

no non-Lisp mechanism is needed for these actions.


7.1 Impact on Compile Time Measuring the compile time is complicated because compilation is done in parallel with execution and thus subject to random noise.

the Java HotSpotTM VM does not allow the recording and replaying of a certain set of compiled methods.


This can be achieved with name mangling.

shadow classes introduced by different originating classes are always treated as unrelated, different classes, as described in Section 3.4, and their names are assumed to have been mangled differently.


all elements have the same type) and the elements must be some scalar type (double, int32, char, ...).

the elements of arrays cannot be handles, structs or cell arrays.


In particular, the di.erent object lifetimes (transient objects, JCRE-owned entry points and global arrays) as well as the .rewall control are not included.

some JCRMI security requirements described in Section 2 may not be correctly speci.ed.


3.1 Design Objectives & Resulting Implications A .rst important sMS requisite is multi-device and multiplatform support.

the service is intended to be maximally accessible for end-users.


Before describing our system in detail we .rst consider the runtime implementation of such a system.

due to the disjoint nature of address spaces, an implementation is free to support different load/store operations for different address spaces.


The method is once again based on the simulation code.

we perform a fault-based analysis of the simulation code to rank the relative e.ectiveness of multiple test suites.


For input port pand output port p 1 of an actor a, da(p,p 1)= d is interpreted to mean that given n tokens at port p, there will be d(n) tokens at port p 1 .

given an input stream of length n, the output stream has length (da(p,p 1))(n).


In this section, we take a look at an example that demonstrates Poli-C s ability to compose parallel libraries.

we will use a few of Poli-C s options to the require statement to cope with unavailable code and idiosyncrasies of a commonly used parallel library.


toList The Clean language offers support for polytypic programming via the judicious mixture of Generic Haskell techniques and type-class system extensions [1].

programmers can de.ne polytypic functions by providing class instance declarations that specify the functions behaviour for built-in base representation types.


The implementation only requires minor modifications of any local tracing garbage collector.

local garbage collection has been kept incremental and locally optimal (no need for overlapping traces).


architectural components) in a system be modeled in the same way regardless of their granularity or complexity.

this means that a complete system (which in a sense is just a large component) be modeling in the same way as a simple data structure (e.g.


Moreover, if f : U .leaves(TG) is a placement with congestion * at most a×cong TG over the edges of TG, then f has congestion of * * at most (a×ß) ×cong =(a×ß) ×cong G over the edges of G. TG This implies the following result: Theorem 5.2 Any placement f : U .

leaves(TG) with edge con * gestion a×cong TG over the edges of TG has a congestion of aß × * cong G over the edges of G. a placement on the leaves of TG that is an a-approximation for congestion on TG is an aß-approximation for congestion on G. Note that the above theorem only works for placements that map elements to the leaves of TG, and as such cannot be used directly with the results of the next section.


In order to keep the example concise, we have chosen not to model all of the device and OS features.

in modelling the device and the SD bus behaviour we specify simpli.ed SD command and response formats and abstract away the SD error recovery, power management, and hot plugging protocols.


In general, macro-op scheduling performs comparably or shows measurable performance improvement over the baseline.

for eon, gap, gcc, mcf, perl and vortex, macroop scheduling (with 1 extra MOP formation stage) outperforms the baseline scheduler.


While hash tables provide constant time lookup operation, there is a non-negligible performance overhead due to added lock contention, extra computation required to do the lookup, and some resulting cache pollution.

figure 1: Anatomy of virtualization wrapper the system-wide hash table is used for each resource access to determine the pod associated with the running process.


For instance, the role of an organization is of higher importance that the company instance.

a company embodying a number of substantially di.erent roles is modeled accordingly equivalent times in the SSN, with di.erent names that include the name of the company.


The key idea of this paper is that it is both possible and fruitful to separate static knowledge about a pattern application from dynamic knowledge.

we believe that static information should be "lifted out" of the ordinary source code of the system, and should be represented at the level of unit definitions and connections.


We used code from MiBench [6] as the source code for the target device in the experiments.

the set of fragments C includes fragments of code from MiBench; in particular, from the telecommunications, network, and security sections of it.


A product-based type checker fails to identify the primary reason, namely, the false optionality of feature Batch.

the type checker cannot blame the feature that is responsible for the error, which is left to the user.


A start or end point must belong to one and only one connection point.

any two connection points cannot share elements.


*(r1 .... .rn)] M8,a is .nite for each valuation a.

as long as the set of elements below each element of M8 is .nite, we can use bounded quanti.cation to reduce the truth value of EBU sentences in M8 to the satis.ability in .nite substructures closed under the below relation.


De.nition 1 (Object Containment) We write P,Sfobj 1 :obj 2 to indicate that obj 1 contains obj 2 in store Sand program P. Formally: P,Sfobj 1 :obj 2 <I S( obj 1)=< c,ctnr,F) and F( fd)= obj 2 for some fd such that < c ' ,fd,contained) .P c. De.nition 2 (Object Containment Graph) For a given store S, we construct a directed graph GS , called the object containment graph, as follows: GS =( V,E) where 2 V = rng( S) and E ={< x,y)E V I ctnr( x)= y.

there is a node in GS for each object in S, andan edgefromeachnodetoits container.


To address these concerns, this paper discusses challenges and answers questions that arose during design and implementation of the Environs framework, a multidisplay environment software framework that eases development of interactive distributed applications.

environs enables applications utilizing video portals that put high requirements on responsiveness and latency.


Although there are other components, throttling the CPU is effective in saving energy because the CPU is a major power consumer.

the Athlon-64 CPU used in this study consumes approximately 45 55% of overall system energy.2 because they have a different number of phases.)


In Our framework has a very similar architecture to PSFQ [12].

implementing a system-level task hop-by-hop.


A number of alternate metrics have been proposed [6, 9], notably the elapsed time until the .rst hoard miss, but we have shown in earlier work that these measures also have drawbacks that make them inappropriate for characterizing hoarding systems.

the time until the .rst hoardmississensitive to minorvariationsinuserbehavior patterns, and does not properly recognize the fact that some hoard misses are only a nuisance, while others are catastrophic.


They have no up-to-date copies in log space.

their data blocks are not related to any log page.


Because they do not overlap, we can safely perform an unambiguous case analysis on them that is, multimethod dispatch.

dispatch in our system is analogous to caseanalyzing datatypes in functional programming (e.g.


Blaming p (rather than p) indicates that the fault in the original cast lies with the context containing the cast (rather than the term contained in the cast).

we blame the untyped context for failing to supply an integer rather than blame the typed function for failing to accept a boolean.


The documentation produced during the evaluations seems to provide a relatively e.cient overview of the architecture.

even a short presentation of architecture in lightweight evaluation summarizes the key points, while the discussions with the other architects highlight what has been considered self-evident and omitted from the presentation.


.a..(x : a).match x with () .e1 |c( , ) .e2 | .e3 We actually seek a stronger result that parametricity.

we want to reject the function below, even though its behavior does not depends on its argument (it always returns the value ()).


We envision that the elderly users of Figure 1: Left: the .rst-generation of smart walker, middle-top: front wheel mounted with multi-rotation sensor, middle-bottom: RFID reader and tag, right-top: Phidget interface kit, rightbottom: slidometer walkers could also bene.t from the .exibility a.orded by these environments.

such smart spaces may engender new applications for the walker, including its use as a personal computing platform that can utilize the localization information sensed from the environment to augment its apparent intelligence and operations.


Algorithm ApplyScript is also deterministic: given the same S0 and D3, calling ApplyScript(D3,S0) will yield the same .nal state S3 at di.erent sites.

based on these algorithms, all replicas of the shared data model (and thus the editor contents) at all sites will be identical after sync.


To formalize this condition, we borrowed the term simultaneous agreement from contract law.

stated as a condition on two separate variables, a leader and a follower, we define it as the interval satisfying this conjunction: t0 , ti , tj : ( ti tj ) (ti t0 + d) : v : ti v tj : Pleader(v) = Pfollower(v) u : t0 u tj : Pleader(u) = Pleader(t0) the follower s value must become equal to the leader s before it changes.


When a subscriber receives a message mk that carries a publication record (B1,...BR) the subscriber checks whether it has received messages mk-1,...,mk-R from the same publisher.

then, for each message mi that was not received, the subscriber checks whether the Bi entry in the publication record matches any of its subscriptions S. the subscriber checks whether there is one of its subscriptions S such that Bi .


Represented as a Directed Acyclic Graph in Fig- ure 1, it is easily seen that MOEA tasks show more prece-dence relationships than asynchrony.

a pMOEA has a large grain size with algorithmic decompos- ability rapidly reaching a limit (i.e., there is only t,so much" that can be parallelized).


However, efficient design and operation of CVS systems is not possible using the developed models, and a description framework or model that is closer to physical realities is still required.

the exact behavior of the vehicular adhoc network (VANET) used in CVS, the effect of network performance on tracking process, and the effect of physical vehicle dynamics and the estimation process on the performance of the network are not captured by the existing models.


Indeed, we can see that this de.nition is dependent on the set of possible assignments, which itself depends on the chosen (abstract) semantic domain, so it is reasonable to think that increasing the semantic domain could restrict the relation further.

for the de.nition to be correct, the domain must be large enough to cover all cases.


Ir,B,0 = Ir+1,B,f ' r+1 Our goal is to simulate one round of algorithm A per iteration.

after iteration Ir,B,i .nishes, we will .nish r.l.l.j fj+ i)th the ( r ' =r+1 r ' round of algorithm A. Speci.cally, =4 and thus there are 4 nodes in each subpath Pi 10, we let r.l.l.j j tr = fr ' ' r =r+1 and our goal is to construct a protocol with properties as in the following lemma.


INTRODUCTION An increasingly important requirement for software-intensive systems is the ability to self-manage by adapting their structure and behavior at run-time in an autonomous way as a response to a variety of changes that may occur to the system, its environment, or its goals [6, 9].

selfadaptive (or autonomic) systems incorporate complex software components that act as controllers of a target system by executing actions through e.ectors, based on information monitored by probes.


SST ) TrC .. # BPT # BPT BPT is the set of the transitions that models the control flow among the Business Process Activities and BPTS, the subset of transition that are automatically controlled by the software system.

the transitions controlled by the software system are identified through the intersection of the sets of transition implemented by the software system, SST, and BPT.


Such predictable answers for the hard sequence do not trivialize the problem: the data structure has no guarantee about the sequence of operations, and the information it gathers during a query (by probing certain cells) must provide a certi.cate that the predicted answer is correct.

the probed cells must uniquely identify the answer to the query, and thus must encode su.cient information to do so.


The suites are optimized for grading, not performance, coverage, or usability.

(the test cases were developed and organized according to the pedagogical goals of the class.)


In this paper we will show, what adapting always beta to the special needs of designing for the Smart Home means, where we not just take care of the software, but also handle hardware components.

because of the 'materiality' of the Smart Home it is not possible to just put a beta version on the web, but an essential part of the development process is to visit the beta-users at home, build trust, face real world issues and provide assistance to make the Smart Home work for individual home infrastructures.


The taxonomy in Table 3 summarizes the results of the analysis from the individual and group survey forms.

we have specified the term that participants suggested should be used, a definition for the term, and whether there are similarities with other terms used in literature.


Such predicates with su.x -d signify that the schedulability of t other than just being established via some exact test, must additionally be ascertainable via a (potentially pessimistic) density-based uniprocessor schedulability test (similar to Lemma 2).

for t [pp] of tasks assigned on a processor pp of speed sp,to meet deadlines, it must hold that .di = sp.


Because of the black box nature of high-level control software components, any workable method for performance prediction in this domain must be able to deal with the abstraction that arises in component interface contracts.

often it is not possible to know low-level details of all components; one must have available, and be able to use, only summary information about component behavior in order to predict client system behavior.


Using react, however, imposes some restrictions on the program structure.

no code following a react is ever executed, only the explicitly provided closure.


PALE works by splitting the program into disjoint fragments that are verified separately by analyzing every statement exactly once.

verification depends only on locally specified properties mad there is no fixpoint iteration involved.


As noted above, assignment compatibility naturally derives from interpreting multiplicities as types with the ordering given in Section 3.4; however, unlike types, multiplicities have no effect on name resolution or binding.

they play no role in resolving overloading, and overriding is invariant with respect to multiplicities.


0 Out1 Out2 Out3 Out4 Out5 No Error Error = 0.25*Range Error = 0.5*Range Error = 0.75*Range Error = Range Figure 7 Mean Error for Faulty Programs 394 We have also studied the IFN capability to identify individual cases that produce incorrect output.

we are interested to maximize the probability of catching an error (True Positive Rate), while minimizing the probability of mistaking correct outputs for erroneous (False Positive Rate).


Given a mission critical system with executable software memory size N and vulnerable memory size n, assume K-variants arecreated through simple semantic preserving source code transformations and operate concurrently with their initial version, can the new system survive M attacks from malicious attackers?

what is Pu(K, M) under the given system and attackmodels?


PON04a2 A clash on what federation means.

some clouds declare to be federated because of a shared .le-system or other distributed or replicated service.


We can prove the x-ability of $2 by simply assuming that any interaction with S~ is an idempotent action.

we can reason about system correctness one service at a time.


DESIGN AND IMPLEMENTATION In this section we describe the detailed design and implementation of PLASMA.

we discuss the middleware, ADL, andADLtoolsupportweutilized,aswellasthetoolsweleveraged from the planning domain.


3.4.1 For New Architectures A binary-level instrumentation system is architecture-dependent, because it must understand (decode) and modify (encode) binary instructions.

dimension must be able to decode both the source and target binaries, and be able to encode the target one.


During the workshop the teachers were exposed to pedagogical patterns that seemed to be relevant to their pedagogical needs.

the incorporation of algorithmic patterns into class instruction plans was thoroughly discussed.


The cause is that there exist periods of times over which the anticipatory scheduler s adaptive learning mechanism does not have the intended e.ects, coupled with the issue of process blocking.

during those time periods, synchronous read requests are serviced exclusively through deadline expirations.


newtype Modulus s a = Modulus a deriving (Eq, Show) newtype Ms a = Ma deriving (Eq, Show) add :: Integral a .Modulus s a .Ms a .Ms a .Ms a add (Modulus m)(Ma)(Mb) = M (mod (a + b) m) mul :: Integral a .Modulus s a .Ms a .Ms a .Ms a mul (Modulus m)(Ma)(Mb) = M (mod (a ×b) m) Also, we need the function unM to give us the number back from the wrapped data type Ms a. unM :: Ms a .a unM (Ma) = a The type parameter s is phantom.

it has no term representation: the parameter s occurs only in type expressions without a.ecting term expressions.


The foundationof thiswork comes from the followingkey observation from the previous work: 98.7% of examined call sites have only one pattern as an argument.

the overwhelming majority of eval call sites perform the same kind of task each time they are executed.


RECONFIGURATION REQUIREMENTS To deal with the heterogeneity and dynamic nature of UC scenarios and to enable proper performance in differentiated execution contexts, UC middleware should be able to provide support facilities that adapt themselves to current context and offer dynamically differentiated QoS levels.

our original middleware aims at tackling system reconfiguration in a twofold way.


Dynamic semantics is defined as the relation of the abstract syntax to a model of computation.

it can be considered as a mapping from one language to another (provided the model of computation is captured in a linguistic framework).


This material was better organized and supplemented in the context of a student's thesis.

a web site was developed for providing supplementary material for standalone study.


Some type-safety and security motivated issues become far less critical.

we expect that much of the work on causality in [23] is not needed in the context of a type-unsafe language.


XSLT style vs. SYB style XSLTstyle is similar to SYB style.

xSLT s templates with problem-speci.c match conditions are similar to the typespeci.c casesin SYB.A template witha match condition for an element name, e.g., match= salary , corresponds to an SYB-like, type-speci.c case that is universally applicable to the speci.ed type, say the type of salaries.


Both the size and the starting address of every .exipage is an integer multiple of the standard page size.

(.exipages are aligned on page boundaries.)


After a review of the literature in Section 2,Section 3 details the proposed approach.

after the QoS composition rules are shown,the evolutionary approach for QoS-aware composition is described.


Whyisour approach sound?First,anycontractweverifyforaprogram only deals with partial correctness.

all contracts are inhabited by non-terminating programs as well.


USING THE DATA The datasets as currently collected are actually quite weak.

the lack of code quality and/or defect data correlated with changes is problematic.


Since 8d(e)(P 2)- d(m)8 remains the same under the three transformations (translation, rotation, and re.ection), an arbitrary element of R(P 2) is to be an estimator of relative locations of sensors.

the optimization problem in the right-hand side of (1) has multiple (in.nite number of) solutions.


In addition, annotations on objects via rtc annotate and rtc cast become no-ops.

instead of returning a new proxy object, they simply return self .


However, depending on the details of the base algorithm, we can completely eliminate the additional overhead.

if the base algorithm starts the lock acquisition and the lock release by testing one or more bits in the lockword, we may be able to merge the additional checks of our algorithm into the testing.


To limit the amount of dynamic information, we applied selective instrumentation of SmallWiki and Moose.

we did not instrument the entire system.


The IBC accumulates updates of indirect blocks in memory beyond multiple segment writes and later .ushes them to disk altogether at check-point time.

when the segment bu.er is full, modi.ed .le blocks in the segment bu.er are written to an empty segment on disk while modi.ed indirect blocks in IBC are not.


Coping with the challenge of innovating design, we regarded the living labs as a greenhouse, in the way that novel design concepts can grow within a fertile environment to more robust and comprehensive solutions in an always beta process.

by creating opportunities for users to have first-hand experiences is useful to address the complexity and situatedness of HEMS use in real-life environments.


Note that the above pointcut de.nition uses only features already existing in AspectJ and similar AOP languages.

our approach does not require any syntactic extensions to existing AOP languages.


The relationship is constrained that the specialization can be achieved only through restriction and extension, in order to eliminate ambiguity and to reduce computational complexity.

a legal specialization in the eFSM is either through deriving element types by restriction or through composition of multiple elements.


INTRODUCTION Reuse is a well-established issue in software engineering practice.

object-oriented programming has been seen as a harbinger of of reusable artifacts [1,2].


Our approach relies on tracing the messages between the nodes, and using one of several of.ine algorithms to infer causality from these traces.

our algorithms infer multi-hop causal path patterns, and provide statistics about latency, both of each pattern and of each node traversal as it occurs in a particular pattern.


This feature, that represents a sibling link between the classes, is a kind of shortcut to actually represent a direct link [3].

figure 2: Trace segmentation and feature vector we use a measure of similar behavior (occurrence in trace segments) as a proxy for the collaboration between classes when executing some business function.


The results show that the legacy group experienced more difficulties than did the new-code group in the construction of the diagrams.

identifying and documenting use cases was much more difficult for the legacy group than for the new-code group.


Since requested work is more important than speculative work, our heuristic gives requested tasks priority.

if an idle processor and a pending requested task exist, this task runs before any pending disclosed tasks.


Both Chameleon and Per.int showed impressive space and performance improvements for realworld benchmarks.

brainy considers memory bloat as Chameleon does.


In [1], the authors suggest the idea of piggybacking on a GC traversal to check various heap properties.

the method of [1] reuses the work done by GC traversal to evaluate queries about the heap.


As shown in Figure 4, DTFS performs better than the copy-on-write file system significantly for all workloads.

the total I/O time is reduced by 47% on average.


Thus, as always, the question is if the gains really outweigh the costs?

what is the bottom line in the context of fairly large, realistic applications?


However, number of exposed iRoots can be used as coverage metric for a saturation-based test adequacy [22, 39].

a programmer can decide to stop testing at a point when additional tests are unlikely to expose new iRoots.


In dead register re-allocation, spill_var_load can be inserted in pred_region or cur_region; spill_var_store can be inserted in cur_region or succ_region.

there are only four situations which need to be considered.


This continuation simply returns to the scheduler a thread in the end state.

it noti.es the scheduler that the thread cannot ever be reelected.


Empirical validation of Information and Process based SOA integration SOA have driven both a significant restructuring of the solution and application lifecycle and its supporting methods, as well as new tools and runtime environments to support SOA.

the advent of Information as a Service coupled with process-centric approaches to SOA promise significant new benefits and new approaches to the design and implementation of SOA solutions and environments.


The caller gives up the permission x2 @ t2, which is consumed, and in return gains a permission for the result of the function call, at type t1.

because types have an ownership reading, a function type t1 .t2 describes not only the shape of the function s arguments and results, but also the side effects that the function may perform, as well as the transfers of ownership that occur from the caller to the callee and back.


i < n, there is a basic block Ti+1, which is the logic branch target of the last branch instruction of Bi.

bi+1 is the basic block executed after Bi, and Ti+1 is the basic block that was supposed to be executed after Bi.


However, which reactive system is good depends on the behaviors of the environment.

we can not decide which reactive system program is good until it interacts the environment.


While having a single top-level goal, the design included 2 components and 20 invariants in total.

4 of them were exchange invariants, 8 process invariants, 2 present-past invariants, and the other 5 (excluding the top-level goal) activity invariants.


This way, our framework can support interaction with the programmer.

the compiler can take feedback from the programmer and pass it to the solver to guide the search for the error source the programmer needs.


This set of event values is passed to the synchronous evaluation relation, which takes multiple transitions to yield a terminal con.guration in which all events are reduced to alwaysEvt events.

the set of events successfully synchronizes to .nal results.


We also left out other features whose inclusion would have made it di.cult to incorporate in a one semester course.

bantam excludes the following Java features: Primitives besides int and boolean  Arrays  Static members  Packages  Modi.ers such as public, private, etc.


In such a system, resources could be busy with either foreground or background work at all times, improving overall efficiency.

the system should intentionally starve idletime jobs to free sufficient capacity for foreground use.


This statement is based on the fact that interprocedual branches are extremely rare in modern computer programs.

for most cases, a CFG is fully contained in a node of CG.


We would like to see this independence of clauses re.ected in our semantics.

we would like to have compositionality, i. e., if each clause of a de.nition is semantically meaningful (in particular, does not lead to non-termination), then the clauses are meaningful together.


To do so, we must .nd and display the structural di.erences among the work.ows in a result set.

we need to identify the set of most distinguishing modules MD .


The analysis is directly applicable to web applications without the need ofinstalling them on a server or using abrowser to explore pages.

our technique takes a web application and automatically extracts client side pages by exploring the relevant paths of the server side code.


For speci.cations that consist of several aspects and describe some possibly crosscutting concerns, traceability and debugging are very different than their counterparts in imperative programming languages.

the presence or elimination of a behavior (i.e., a transition from one state to another) in the program, may be the result of the application of several, possibly overlapping, non-independent concerns.


On the other hand, modules are loaded on memory during system boot, and run consecutively on system.

codes in modules have 3VHXGR PDFKLQH &RGH Figure 2 the process of converting machine code to pseudo-machine code higher localities rather than that in application.


In the following, we show that the renaming network construction solves adaptive strong renaming, i.e.

that processes return values between 1 and k, the total contention in the execution, as long as the size of the initial namespace is bounded by M. if we use the optimal AKS sorting network [15] as the basis for the renaming network, then we solve strong renaming using expected O(log M)step complexity.


This formoffailure correspondstoa true discrepancybetween the speculative evaluation and the synchronous evaluation implied bythe committed trace.

while the speculative-evaluation relation may continue to make some progress with other threads (and even commit additional trace actions), thefailing synchronization patternwill continuetofailinthe future.


if A1 subset is off, A2 subset must be exp and the other way round.


We provided a new implementation for the ReplyEnabledDispatchingService interface, using the second approach above, the one tailored to content-based systems like REDS, to implement the correct routing of replies.

we used the identi.er of the publisher, which was already provided by REDS, as the special content to be added to replies in order for REDS to correctly route them back to the publisher.


In this paper, we carry out a preliminary study on requirements modeling methods for self-adaptive software systems.

we focus on how existing requirements modeling methods address the challenges caused by self-adaptation and what are the advantages and disadvantages of their solutions.


Xbase integrates completely with the JAVA platform and JDT (Eclipse JAVA development tools).

xbase reuses the JAVA type system (including generics) without modi.cations; this means that a language that uses Xbase will automatically and transparently access any JAVA type.


By Lemma 3.4, each subcommittee contains a fraction of the core of size s -1/log n. Since al+1 = al - 20/ln n, the fraction of good successor nodes in Pl+1 is at least (1 -2lnn)· (al -20/ln n)= al -22/ln n = al+1.

the last level l* has the desired properties from which the theorem follows: Proof of Theorem 4.1.


Also, we decided to use the processor die in Figure 2 as a minimum unit of allocation to programs.

each program is provided a number of cores which is a multiple of six in the experimental platform.


For example, we cannot show that the method call list.add does not interfere with iter.This is because E f wr under(list) # rd under(iter) cannot be proven due to the inclusion E f under(iter) under(list).

our system also re.ects the fact that calling the methods next or elem on iter do not a.ect list.we can show E f (rd list.1 wr iter)# rd list.


For example, Beynon-Davies [4] identi.ed a number of uses in information systems development.

he noted that for researchers in the software engineering .eld, ethnographic research may provide value in the area of software development, speci.cally in the process of capturing tacit knowledge during the software life cycle.


they both allow type checking, but they are complementary for type inference.


The de-serialized captured object instances provide a good basis to lead the method-sequence generation technique to generate desirable object instances.

.rst, FRT selects one of the methods under test.


In this case, we can construct a hybrid test amenable to execution on either P0 or P1.

we execute test t with P0 and run it to completion without performing an update.


The process focuses on the non-functional requirements and the run-time variability.

our technique realizes the adaptation by evaluating the semantics speci.ed in components at run-time.


This CAS operation does not commute with operations of concurrent threads, since it inspects and potentially updates the shared variable m. Hence, any execution of busy acquire where the loop iterates multiple times cannot be reduced to a serial execution, and previous tools based purely on reduction cannot verify the atomicity of busy acquire.

our previous type and effect system for atomicity [17] cannot verify the atomicity of irreducible procedures like busy acquire.


Second, some conditions allow preemptive .ltering of the events.

the framework con.gures a priori which events trigger an exit, instead of .ltering out exits caused by uninteresting events.


Instead, BPL provides the sorts int and type, which we use to represent the original program s values and types, respectively.

all word-sized values in the original program map to values of sort int, and all C types in the original program map to values of sort type.


In future work we want to conduct controlled experiments and qualitative studies in order to evaluate some of our results in more details.

we have started a new study with the goal of .nding what is the impact of the use of the documentation provided by types and the documentation provided by unit tests on the development time of maintenance tasks.


A system of SLAs may be characterised as reciprocal if it contains two SLAs s1 =(p, (c, o)) and s2 =(c, (p, o)).

two parties exchange SLAs with respect to an observation.


But in either case the abstract, semantic state of queue q is the same the queue is empty!

the code is atomic, but only at the semantic level of the contents of the queue.


D Fortunately, sort-decreasingness is not a very strong restriction in practice.

many-sorted TRSs are sort-decreasing by de.nition.


Second, we assume that a mug can be completed on one time step as well.

if there is a muggable queue, then a thief processor can .nd it instantly and mug it.


To prove subject reduction in TraviataX, we break type abstraction in the lazy program type U that ReconstP reconstructed.

we build a lazy program type U. from U by making all abstract type speci.cations in U manifest, except for type speci.cations appearing in module variable signatures.


3.1 Process Self-Monitoring In Poor Richard s, each process is responsible for monitoring its own state for signs of memory pressure.

processes track how many major page faults (evicted pages that have been read back into memory) they trigger and their resident set sizes (RSS) (number of pages physically residing in main memory).


E incident to v, the node v knows both h(v,i- 1) and h(u,i-1), which constitute the fullhistory of messages received by u(e)before the round i.

v can simulate u(e)inA for i rounds to determine h(e,i)for each incident e .


The premise of that rule is enabled by the postcondition of the call of getRemoteRating and a concrete evaluation of the result of that call in an if-statement.

a rule in the component system lets us infer that ¬R(a) holds if some x contains the reliability about a and if x is false.


Thus such b and b ' are really the same position.

every diagram of the following form is a pullback: B(i .


But two threads sharing a Vector must coor-dinate at a higher level--one thread removing an element can interfere with another thread iterating over a vector.

safe implementation of a shared low-level resource does not imply correct use of that resource with respect to the invariants of a higher-level client resource.


The scalability of Augustus comes from the fact that atomic multicast, used to implement state-machine replication in a partition, spans the servers of the partition only.

the BFT atomic commit protocol proposed by Augustus does not rely on a system-wide atomic multicast.


We write p | q to mean that p evenly divides q.

(C14) (falign(f) | fo.C (f)) and (falign(f ) | nvalignC ) if f .eld of C (C15) (nvalignB | dnvbo.C (B)) and (nvalignB | nvalignC ) if B non-virtual base of C (C16) (dtdalign | nvalignC ) if C is dynamic (C17) (nvalignB | vbo.C (B)) and (nvalignB | alignC ) if B is a generalized virtual base of C (C18) (alignC | sizeC ) (C17) implies that (nvalignC | alignC ), as expected.