Instead of changing how we determine the size of the units of optimization, this section argues for changing how we determine the contents of them.

optimizers should select optimization units that reflect the current program behavior (as determined by analysis of feedback information) and are reasonably sized (given the compu- tational complexity of the optimization techniques).


Interestingly, our asynchronous replication protocol may vary at run-time, according to the asynchrony of the system, between some form of primary-backup and some form of active replica- tion.

different replicas can concurrently pro- cess different requests, which allows us to build a cluster of replicas that can dynamically scale up and down to handle the current demand.


The results show clearly that an intelligent placement may improve the performance of the cluster by 3-11 times.

a small cluster with location-aware placement can outperform a signi.cantly larger (up to ten times larger) cluster with random placement.


Useful means that the prediction accuracy should be high enough to satisfy practical needs.

it should be competitive with manual inspections (which means a percentage of correctly identified defects to be at least around 60% [25]).


On JS22 and the Nehalem platforms, we used the systems in SMT (simultaneous multithread) mode which implies that we would run twice the number of copies as the number of cores in the system.

we ran one copy of the benchmark for each logical CPU in the system.


In between, the transaction size doubled at each data point from left to right, while the total number of puts stayed constant.

the number of transactions decreased by 50% at each data point from left to right.


In [7], Fijany and Vatan propose two methods for solving the diagnosis problem.

they present transformations from a sub-problem of the diagnosis problem to the integer linear programming and satis.ability problems.


An operational procedure is a set of ordered activities associated with a stakeholder's role.

an operational procedure describes the concrete actions undertaken by a stakeholder involved in a contract.


Authors that are serious about scienti.c objectivity must provide evidence showing the exact conditions under which this complexity holds and a corresponding experiment, with humans, to verify their hypothesis.

in situations where the developer has to use an undocumented API, they help developers in understanding how the API can be used.


We saw abovethat we can choose any register and linearize all operations when they last access it.

we can choose the last register accessed, xf .


Please note that the advices and pointcuts that will be activated in the deploy block are not statically known; 1 is only known by its upper bound Logging (1 could have also been passed as a parameter).

the advices are late bound, similarly to late method binding, hence our term aspectual polymorphism.


While [20] and [31] target traditional and highly predictable software, KAMI framework [6] provides continuous dependability analysis using a model-driven approach.

kAMI uses runtime data to update the parameters of reliability and performance models.


Column 3 shows the performance when each node is run as a separate DPG, without an encompassing DDPG.

each node runs dOS, but network communication between the nodes is still nondeterministic.


The type of the coordinated pair ensures that corresponding nodes in the two lists are either both empty or both non-empty.


The interval [r, r + D - 1] for 0 = r < R - 1 represents the node IDs that are in the rth region; the last region spans [D × (R - 1), nmax - 1].

a node ID i is replicated to each other region by taking (i + D × r) mod n for 1 = r < R. the information is replicated evenly around the ID space to R locations.


But enough graphs need to be tiles to cover any single assignment or branch.

because every RTL operator can appear in either an assignment or a branch, we need at least one tile for every RTL operator.


This paper demonstrates how to program with dependent types.


If one of the premises fails, then the whole rule will fail, and in turn all the stack of rule invocation will fail.

if the premise is a boolean expression, it will fail if the expression evaluates to false.


Fortunately, we found that the scope of a rule instance only then changes if one of the model elements in the scope changes.

the scope of a rule instance changes only if its truth value is affected by a change.


However, evaluation of Stabilizer usage with multiple users will require some thought.

we would like to get some sense of how to predict the stabilization time of an application given a host of factors: the number of users, the number of bugs, the size of the application, etc.


4.1 Variable Interface The variable interface of an SPL contains all unique signatures of all existing members (i.e., classes, methods, and .elds) with a presence condition describing in which features the member is de.ned.

if a member is de.ned in several modules, it is included in the variable interface only once, but with the list of the de.ning features (i.e., the presence condition).


how many DTO objects violate the pattern described above, and therefore are not reported by the analysis?


Baselines in Requirements Tracing Senthil Karthikeyan Sundaram Jane Huffman Hayes Alexander Dekhtyar Computer Science Department Computer Science Department Computer Science Department University of Kentucky University of Kentucky University of Kentucky skart2@uky.edu hayes@cs.uky.edu dekhtyar@cs.uky.edu ABSTRACT We summarize the results of our requirements tracing work to date, focusing on our empirical results with open source datasets.

we describe the problem of after-the-fact requirements tracing for Verification and Validation (V&V) analysts, we provide a brief overview of Information Retrieval methods we have applied as well as measures used to evaluate them, we describe our tracing tool, and we present the results of a number of empirical studies.


Acknowledgments The work presented in this article in mainly developed as a master thesis by the two .rst authors[4], during that work we have received gen erous guidance from multiple members of the HIPERFIT research center.

mogens Steffensen (Department of Math, University of Copenhagen), Carl Balslev Clausen (SimCorp), Martin Elsman (then Sim-Corp, now DIKU/HIPERFIT center), Dirk Bangert (Bangert Research) and Rolf Poulsen (Department of Math, University of Copenhagen).


In this experience report, I highlight some of the features I haveparticularly found useful,drawing examples frompublished veri.cations using SAL.

i discuss the use of higher-order functions in model checking, in.nitestate bounded model checking, compositional speci.cation and veri.cation,and .nally,mechanical theoremproverand model checkerinterplay.


j from the tag output z = oi,j and the result of precomputation.

the phase searches x from given z, such that x .


Confidentiality of order of magnitude: An agent should not know the order of magnitude of some state variable.

the agent will always consider that the order of magnitude of that variable can be any possible value.


For each instant, we detail exactly how and when each thread executes: Instant 1 :Thread A gets blocked line 1 because it is waiting for a signal not already broadcast during the instant.

thread B broadcasts sig1 line 1 ,then it cooperates line 2 .B has completed its execution for the instant.


5.1 Scalability and precision: SPEC In order to test the precision and scalability of PSE, we applied it to postmortem analysis of pointer dereferences in the integer benchmarks from Spec95.


Nonetheless, the fact that we cannot dispense of human labor altogether does not mean that the current situation cannot be improved.

when an already compliant process model is changed, we can assume that only the changed portions of the model may have possibly broken compliance.


Although somewhat awkward, iterators let one write non-blocking tasks in a sequential style by yield-ing control to a dispatcher that advances the iterator through its states [CS05].

by yielding CML events, and having the dispatcher queue an action to resume the iteration asynchronously on completion of each event, we can arrange to multiplex a large number of lightweight tasks over a much smaller set of CLR worker threads.


GP is an evolutionary algorithm that automatically generates programs for a de.ned task and is traditionally represented by an abstract syntax tree or a stack [7].

sAGE generates a tree that speci.es the ordered operations of a speci.c composition approach.


To implement misspeculation detection, version numbers are maintained for each variable.

when a thread performs a copy-in operation for a variable, it copies the current version number of the variable into the Version .eld in the variable s mapping entry.


Thesis Statement The aim of this research is to improve the process of constraint definition as part of domain specific CASE tool specification in a meta-CASE tool.

the work will focus on facilitating and simplifying constraint definition process using programming by example technique.


In our framework implementation, we follow an intuitive strategy that triggers the actuator component for adding a new replica when it detects a number of continuous up-to-date monitored replication delays of a replica which exceeds its application-de.ned threshold(T )of SLA violation of data freshness.

for a running database replica, if the latest T monitored replication delays are violating its SLA of data freshness, the analyser component will trigger the actuator component to activate the geographically closest replica (for the violating replica).


Note that for nested structures, s, inside recordings, S, we have to take the least upper bound, C. | This is because when determining the kinds of values x can have in a concatenation, ·, we have to take the union of the possibilities.

x is typed as a list whose elements can be in: L(R1).L(R2); i.e., the union of the two recordings of the same name.


Joining activations to transactions ensures that there is only a single activation of a grain in each transaction.

a single transaction operates on a single copy of the grain s state.


Furthermore, the modularity and composability sections in the comparison criteria document are significantly improved.

we see composition as the act of building larger pieces from smaller ones; in the context of modeling, we take composition to mean the act of creating new first class entities of the modeling approach from existing ones (e.g., by putting together several units of encapsulation).


It improves the execution time from 2% to 28% (with an average of 8%).

it is effective for compress and mpegaudio that frequently access array elements.


A family on a cross country vacation would like information about their current environment.

while driving, they would like to be constantly aware of the points of interest in their near vicinity.


Second, since every submission must be graded, we have that Observation 2: A modi.cation of a submission must be reasonable, at the very least human-readable.

widely available code obfuscators can not help the student.


This assumption makes it possible to describe the functionality of a circuit deterministically independent of the detailed timing of the gates in the circuit by separating each combinational logic block from others with clocked registers.

the CSM is used to exploit the orthogonalization between functionality and timing in the synchronous design methodology [4].


It is worth notice that .gures related to System.Data.-DataSet ob jects are actually referred to the overriders we implemented to serialize them, since the class is not CompactFormatter.Serializable and we could not modify it.

when using an overrider, we measure performances of overrider and not of the CompactFormatter.


To the best of our knowledge this expressivity is not widely used to deliberately protect strengthened invariants, but the general pattern arises often.

an OCaml compilation unit in .le foo.ml implicitly de.nes a module Foo ascripted to foo.mli (if that exists); the body of foo.ml itself often contains ascripted module de.nitions.


That is, the following code: int m(Foo x){return x.bar;} will be successfully compiled only if the table "Foo" has a .eld bar of type int.

checks on the table shape are performed at compile-time.7 The two examples above also show that our approach allows, in a statically typed setting, an expressive power which is typical of dynamically typed languages.


Functions may be nested, following the usual static scoping semantics of nested functions.

given some nested function f , all enclosing functions, and all functions declared in the same nested scope are visible within the body of f .


Corollary 1 states that if for all the (m+1) intervals, Ii, i =0 ...m, fi does not satisfy the conditions (2) and (3) of the optimization problem OPTi, then in the optimal solution the response time of the application is limited to the set {c,(d-Bm),...,(d-B1),d}.

if the given conditions hold, in the optimal solution, the slack of the application should be exactly equal to 0, d-c or one of the break-even times {Bi}.


Basically, all sources of non-determinism in the notation have been enriched with probabilistic information.

(process) choice and parallel composition operators have been replaced by their probabilistic counterparts and, in the discrete-time case, probabilities have been added also to the network nodes used in network composition.


3.1 Design Considerations The problems described in our motivating example stem from a poor separation of concerns.

the logic for persistence and security concerns is entangled with that of the core business functionality.


A construction sequence produces a consistent model if and only if it does not assign owned use cases to actors.

for all created actors (lastCreate(me,Actor)) there should be no assignment of owned use cases (lastSetReference(me,ownedUseCase,R)).


GC Algorithms It is interesting to note that our locking using reference counters bears similarities with garbage collection algorithms based on reference counts (e.g., [13, 28]).

it is bene.cial to maintain separate reference counts from the stack and the heap.


The distributable threads model, discussed in detail in Section 3, provides a coherent, end-to-end abstraction for building concurrent, sequential activities for distributed systems in a manner familiar to Java and real-time programmers alike.

the presence of a distributed ob ject model (RMI) in the Java platform makes the distributable thread concept a straightforward step for Java programmers into the world of distributed real-time programming.


TOOL IMPLEMENTATION We developed our tool using the Eclipse development environment.

we used the Eclipse Modeling Framework (EMF) [8] as a modeling infrastructure.


This is because methodWithNameInClass/3, the SOUL query used with different parameters in the two alternatives, is de.ned as: methodWithNameInClass( ?method, ?selector, ?class) if methodInClass( ?method, ?class), methodWithName( ?method, ?selector) Once we have de.ned an anti-explanation for an abducible predicate, we are implicitly de.ning a possible anti-explanation for all the predicates that depend on the success of our abducible predicate.

if the success of methodWithNameInClass/3 depends on the success of methodInClass/2, an anti-explanation for methodInClass/2 will be an anti-explanation for methodWithNameInClass/3.


An overview of the PCM virtual machine is proposed in Section 4.

we describe its overall architecture, the principles of the scheduling algorithm and its garbage collector.


This approach divides all semantic concerns into discrete states and transition relations.

in-place model transformations [11] represent an approach for designing state transitions.


ts(m, s) =(9) s otherwise RCSin represents all di.erent preceding abstract cache states and RCSout represents the set of cache states after memory accesses have been applied to sets according p0 : a .


We add support for generating high-quality GPU code to compute stencils without changing the user facing DSEL.

existing Python programs that encode SEJITS stencil operations run unmodi.ed and with high performance on GPUequipped systems, providing both source and performance portability for such programs.


The basic idea behind our technique is as follows.Aprogram exhibits phase behavior [15] in that it goes through several phases of execution that show approximately similar runtime characteristics compared to other phases of execution.

if we can approximately predict similarity among program phases statically, we can use this information to determine assignments of threads-to-core at alow runtime cost.by monitoring theexecutionof an initial phase in the program, we can predict the execution characteristic of the later phases of the program that resemble this phase.


By making use of parametric code, It is possible to certify this encrypt-decrypter even without knowledge of the content of Bpg .

we abstract Bpg out as a parameter, and prove the general works similarly as runtime code generation, except that the code generator uses encrypted data located in the same memory region.


To efficiently support these operations we implement this data type with a sparse accumulator data structure [11].

a linked list of the elements with an array of N point- ers each pointing to the corresponding element in the linked list.


The recognizer does not interfere with the behavior of the application except via completed matches; therefore, any instrumentation point that can be statically proven to not contribute to any match need not be instrumented.

we can optimize away instrumentation where the referenced objects have statically declared types that con.ict with the query.


Consequently, a global schedule can be created in which each cyberorg receives the resources it is promised as a function of the resources entering the system.

instead of launching a new scheduler for each cyberorg, all cyberorgs internal schedules are composed into a single .at schedule of actors which is equivalent to the hierarchical schedule (Figure 6).


15, it is also possible to re.ne implementation classes, whereby the definitions of the nested classes can again be re.ned with the override modi.er.

the subclassing and subtyping relations between individual classes in standard OO are naturally carried over to the implementation classes of CIs; again with the important di.erence that our nested classes are virtual types as explained in the previous section.


For the purposes of metatheory model-checking we consider only input programs within a smaller, better-behaved fragment for which the semantics (and accompanying implementation techniques) are well-understood [12, 11, 10, 48].

to simplify the presentation we consider only monomorphic, non-parametric types.


The function F is constructed so that no matter how the algorithm redistributes its pebbles upon shaking a bin at time t, and no matter what the current state is, the decrease in F is no more than the cost incurred by the algorithm.

for any 0 = t = n - 1: w(t) = F(t) - F(t + 1), where F(t) is the potential at t, and w(t) is the cost of the algorithm at t. Summing up over t, we get that the total A cost is t w(t) = F(0) -F(n) = O(n log n/ log m), implying (2).


They might have been introduced at any horizontal point of each family member history.

this category comprises the feature s code elements that were included consistently in each family member; once they were included, they remained untouched for the rest of the horizontal history of each family member.


Unbounded space can cause thrashing of the memory system, leading to slowdowns not predicted by simple execution models.

a bind-to-element scheduler must avoid creating a runaway pipeline a situation where the scheduler allows many new iterations to be started before .nishing old ones.


Having an atomic rendez-vous as a primitive form of communication allows to derive other forms of interaction, including ones that implement .ow control between emitters and receivers.

component connectors can be realized as kells that mediate communication between two or more peer kells.


Because this tool was not working effectively, the FIC went in search of a courseware tool that would meet their needs.

the college needed a courseware tool that was flexible and easy to use for both faculty and students.


The scheme is similar to the method described in section 4 for growing the stack into dead globals.

it uses the same set of regions, the same method to detect the Out-of-Stack condition and the same mechanics for growing the stack discontinuously into the global segment.


In addition, due to the semantical complexity of certain features, a feature s implementation in one CAD system might result in geometry that is somewhat different from the geometry that a different system generates from the same feature.

the feature is the same at a certain level of abstraction (usually, overall function as perceived by the user), but different at a detailed geometric level of abstraction.


Particularly noteworthy, an implementation of weak hiding is based on iteratively applying current mechanisms for name binding, noting that binding a scope expression s1 <=| s2 is equivalent to binding s1, followed by binding s2 if unsuccessful.

bind (ref, (s1 <=| s2)) = bind (ref, s1) ?


The end-to-end nature of our approach also has positive consequences on the interface between OEM and supplier: because the models can capture cross-cutting aspects of behavior and the corresponding failure management, interface requirements can be shared between OEM and supplier in a much more precise way than what is typical today.

however, to demonstrate further utility of the proposed model-driven failure management approach we have conducted an experiment in verifying that a given implementation meets the stated failure hypothesis; We have applied this experimental setup to the running CLS case study of this paper.


When the application developer compares this abstraction with that supplied by the vendor (Figure 6), the logical comparison fails.

the new component s precondition i=jis not established by the application.


1 The use of incremental model-learning means that analytic models accumulate knowledge that allows the adaptation of the data processing.

as better parameters become available, upstream data filtering and processing can be refined.


Then, an extension of existing auto-parallelization and tiling techniques enables the necessary program transformations allowing for dramatic improvement in performance.

our technique improves performance by several factors when compared to code that just tiles and parallelizes the loops that tile and iterate over the data space code.


The key observation is that, due to the usage of higher-level design pattern that structure process communication and fault recovery, the number of such failure points that needs to be inserted can be relatively few, and can be inserted in an application independent manner.

the state spaces generated from a failure model can be generated automatically, are relatively small, and are thus amenable to model checking.


An orthogonal question, investigated for example in [4, 13] is how to ef.ciently build such generators in an effective and maintainable way using modern programming language features.

the concept of staging [25] has been proposed to build generators within a host language [1, 5].


While this approach works, it is cumbersome: we would effectively have to rerun the reason computation once for each such query by the user; speci.cally, once the user knows why s1 is in the slice, she may wish to know why s2 is in the slice, and so on.

for analyses whose lattice elements are sets, we may wish to associate a reason with each element in the set rather than a single reason for the entire set.


This effort should be proportional to the amount of customization desired by the application.

applications that wish the traditional semantics supported by existing collaboration toolkits should require no collaboration awareness.


Direct manipulation of the visualization is also supported.

if a user modifies the data structure diagram, the underlying program objects are modified accordingly.


In this paper, we further assume a single-assignment form where the iteration space of each statement exactly corresponds with the data space of the array written by that statement.

for array references appearing on the left hand side of a statement, the expression indexing the i'th dimension of the array is the index variable of the i'th enclosing loop (this is formalized below).


We choose GPUs because they contain so many cores and some extra complexity regarding the L1 store and global synchronization.

the use of larger ghost zones is especially valuable in the Tesla architecture, because unlike the grid environment where a tile s data may persist in its PE s local memory, data in all PEs local memory has to be .ushed to the globally shared memory and reloaded again after the inter-loop communication.


Statements induce constraints on the type of local variables.

an assignment v =E induces the constraint [e] =[v] where [e] is the type of the expression e and [v] is the type of the local variable v. In words, assignments induce lowerbounds on the types of variables.


By combining the likelihood of mixedversion races with the severity of the resulting errors and inconsistencies which characterizes the impact of potential upgrade failures we estimate the risk of upgrading.We then compare this result with the risk of not upgrading, obtained from the severity of the original bugs or feature requests that are addressed by the upgrade.

we estimate the expected impacts of the two alternative decisions to upgrade or not to upgrade over the typical time frame of a rolling upgrade.


The ASM framework provides a solid mathematical foundation to deal with arbitrarily complex states.

we can use state-based expressions to specify action weights, action parameters, and other con.gurations for OLT.


When moving a block, we never split its objects to more than one area.

if the remaining free space in the end of an area does not su.ce to move all live objects that start in a block, then we abandon the area and start moving blocks to a new area.


In previous code, if running thread is not privileged to read the secret value, the if condition expression is not evaluated and the normal control flow is stopped and the value of secret cannot be deduced through reading pub1 or pub2.

we prevent each user from trying to access confidential information that is not allowed to read.


That is, it has a carefully tuned timing parameter adequate for magnetic disks.

the Anticipatory scheduler voluntarily waits for some time period for the next read request hoping that it may be adjacent to the previous one.


The tester is to determine whether the usage error is truly caused by an oversight by the user , and not caused instead by an unjustified assumption or unrealistic expectation on the part of the developer.

the error s cause is to be closely scrutinized.


Although there are compelling use cases for this feature, supporting it would require implicit heap allocation, and we argue that implicit heap allocation is dangerous.

it is not uncommon to execute joinpoints by proceeding in other threads: both Laddad [27] and Kienzle [25] independently advocate this mechanism for implementing transactions with aspects, and we ourselves used such asynchronous execution of joinpoints for N-Version Programming [10].


For example, if all subjects decided after a few seconds in the raw version to abandon the tasks while they actually required only a few minutes to solve the tasks with the generic version, the resulting measurements would lead to the conclusion that they required less time for the generic version.

if this were to occur, it would be an incorrect result.


If a class is not present in the .rst set, for example: AbstractQuanti.er, it is because the result of the query gathering the tuples belonging to this set is not including this class.

the query methodWithNameInClass(?,hash,[AbstractQuanti.er]) is failing.


When the virtual machine really needs to access the object, it is very likely that the decompressed object will be ready to be used.

using a hardware-based compressor/decompressor, one can implement a pre-decompression scheme that can signi.cantly reduce the overhead associated with accessing the objects.


A combinator parser example Combinator parsers are widely popular in Haskell, but not so much in strict functional languages.

parsing combinators that are designed using applicative functors (McBride and Paterson 2008) allows us to write Haskell parsers in a very concise style.


This section applies the desire-estimation strategy of A-GREEDY to data-parallel scheduling.

a-GREEDY can be combined with prioritized task schedulers to produce adaptive task schedulers that are provably ef.cient with respect to time, space, and waste.


Note that some physical memory addresses are reserved by BIOS for special purposes such as the video card or ACPI controls.

when we install 2GB of Figure 5: Pseudo code for inter-kernel context switch physical memory, the actual range of physical addresses is larger than 2GB and some regions of physical addresses are not mapped into physical memory, but reserved by BIOS.


Our idea is based on the following two novel observations: (1) AI Invariants: There exists a unique type of invariants in code regions that are expected by programmers to be atomic (regardless whether the implementation actually guarantees atomicity or not).

during correct runs (runs that do not expose any concurrency bugs), two consecutive accesses from one thread to the same shared variable are not interleaved by an unserializable access from another thread.


occurs as an rvalue), then we .rst check to see if the kind[x] is one of UNDEF or ID, in which case no previous statement has given this identi.er a speci.c kind.

this means no previously analyzed statement has made this identi.er a VAR.


All API functions are blocking, i.e., a transaction must wait until the call returns to continue.

no processor may create parallelism inside a transaction using these operations.


First, each program (task) that executes must not interfere with other programs, either functionally, or in terms of performance.

a GC that one task triggers should not impact the performance of other tasks.


Conclusions In this paper we described a new approach to product line scoping (PuLSE-Eco V2.0) that addresses the different levels of scoping decisions in an integrated manner.

our approach supports the levels domain scoping (as a basis for domain analysis) and reuse infrastructure scoping (as a basis for architecting/ implementation).


Finev  Figure 3: XML representation of the logical structure of a JAVA class ersion has been implemented as an extension of the Subversion command line, thus inheriting all the functionalities provided by Subversion and introducing the .ne-grained versioning management.

the original commands download (check-out) and commit (check-in) have been overridden to allow the download and commit of single logical unit.


Replacing f-functions by shu.e code does not require anyglobal analysis.

tree scan is a generalization of linear scan.


It also makes the di.erences in contextual framing that is o.ered by both front-ends evident.

the 3D NVE instantiation is expected to yield a substantially more convincing and immersive usage experience.


We focus on this problem because this is where any problems and bad assumptions will be revealed.

we take into account the number of nodes on a given area and the speed of these nodes.


This approach combines the strengths of Planning-based Adaptation Middleware [3, 8, 16], Service-Oriented Architectures (SOA) [17]and Aspect-Oriented Programming (AOP) [14, 15] for leveraging the development of self-adaptive ubiquitous applications.

aOP offers a modular approach for controlling the effects of code tangling and scattering in an architecture [14] and proposes to isolate crosscutting concerns as aspects, which are woven into different parts of the architecture.


FREEDIUS extends this notion by allowing other view types (especially temporal views) to be created.

the timeline-view object allows timevarying objects to be displayed on a common timeline.


6.2.2 Explicit Relationships One of the nice things about the relational model is that relationships between tables are external.

children point to the parents (foreign key .


After some minor modifications it was approved, and became part of the architectural documentation.

the main architectural defects that had been identified in the assessment were transcribed in the "open items" section of the architectural document, and led to the start of architectural improvement actions.


Both forms of constraints do not allow building blocks from the collector and the mutator to occur in the same constraint.

we cannot have an ordering constraint which speci.es that C2 occurs after M1, but we can have an ordering constraint that speci.es that C2 occurs after C1.


The word quality is a loose term intentionally adopted to denote that the fused data is somehow more appropriate to the application than the original data.

for WSNs data can be fused with at least two objectives: accuracy improvement and energy saving.


Finally, the program generated by the code translator is compiled by existing Java Card tools and runs on the smart cards.

the code translator compiles card programs written in the concurrent thread model to programs in the master-slave model.


Nevertheless, due to the large number of optimizations, we did not implement proof preservation for every instance of every optimization.

constant propagation may want to replace a variable of type S(a) with a constant c of type S(c); rather than .xing the types (e.g.


Further application of visualisation techniques to the existing layouts and capabilities is also desirable.

the use of layout techniques that provide distortion, such ashyperbolic trees, or using a distorted view of the linear layout with a .sheye view are interesting directions in which progress could be made.


Conversely, with permissions, any locals and .elds for which the caller retains a permission during a method invocation will not be modi.ed by that invocation.

any permissions a caller does not pass into a method allow that caller to assume that the object accessible through the unused permission is not modi.ed.


Although simplified, the running example features a number of important challenges targeted by EBCS.

the physical architecture of the system constantly changes as the cars move around the city; cars and PLCSs maintain a partial view over the whole system, according to the information they obtain from components they interact with; trip planning and decision making in general is localized to the drivers (cars), as no central coordination is assumed.


groups of components to distribute between a PWD and one or more servers according to the client/server model.

since the considered applications are the interactive ones, the thinclient model represents one of the most interesting architecture to use in the context of mobile computing.


In this paper, we show how to enforce contracts if components are manufactured from class and interface hierarchies.

we focus on one style of contract: pre-and post-conditions.


2.1.2 Non-Functional requirements Location independence: When an embedded system asks for a service, it should not worry that service resides locally or remotely.

the middleware has to hide the network distribution.


However, we need to perform this calculation in order to prove that C is in fact a comeback of R. Recall that Roberts posts re.ect the semantic of a program transformation.

he used them to reason about the dependencies between refactorings.


Then, variable balance, which is a source, satis.es neither of the three properties of sources mentioned in Section 3.1.

it does not satisfy the third property because its value is dependent on the old values in the input buffer trans that were read in iterations prior to the current one.


The power cost of a vertex u .V is power(u)=max{w(u,v) |v is a neighbor of u}.

the power cost of a vertex u is proportional to the cost of u transmitting to a farthest neighbor.


The equational theory contains two speci.cations that mention method isEmpty: new JMLObjectSet().isEmpty() and !s.insert(e1).isEmpty()  These express that a newly allocated set is empty and that a set in which an element is inserted is not empty.

these speci.cations do not imply the property stated in the postcondition of method isEmpty: result == (forall Object e; ; !this.has(e))  isEmpty returns true if and only if the set does not contain any object.


Since the truth or the falsity of conditions is not known in advance, the model is stochastic.

we can associate to each branch a stochastic variable Bwith probability space (C, A,p),where C is the set of possible branch exit conditions c, A the set of events (one for each condition) and p the branch probability distribution (in particular p(c) is the probability that condition c is true).


The size and complexity of the systems themselves, combined with the risks associated with failing to make changes on time or making mistakes that brought live customer systems down, put substantial demands on system administrators, affecting error handling and verification, among other things.

we observed a number of practices that were developed to support scripting and related activities:  (1) Pairwise extreme collaboration when testing and executing scripts.


CASE STUDY As mentioned in the introduction, refactoring has been performed to GRASS, which is a large open source GIS.

the GRASS 6.1-CVS development snapshot of December 5, 20051 was used as a case study.


dom(E): build(h, E(x), G(x)) and build(h, E(y), G(y)) are consistent.

if we de.ne:  [ .X = build(h, E(z), G(z)) z.dom(E) then .X is well-de.ned.


However, while cloud-provisioned resources solve the problem of on-demand instantiation, the problem of how to con.gure these resources to seamlessly and securely integrate with one s infrastructure remains a challenge.

considering that users may provision resources from multiple IaaS providers, the con.guration demands are similar to a distributed grid: while a cloud image can be encapsulated with a grid computing stack, it still needs con.guration in terms of allocating and distributing the appropriate certi.cates, network con.guration to establish end-to-end connectivity, and proper con.guration of the middleware to establish worker, submit, and scheduler nodes.


The test suite reduction problem could be solved by testing requirement optimization.

for each optimal test suite T ., there exists one optimal contracted requirement set can generate T .


The type information of packaged scope classes is only accessible to code in the package.

code outside the package cannot extend these classes and cannot invoke methods or access .elds de.ned in a package scoped class.


At a high level, one can view the traditional approach of performing domain-speci.c optimizations as optimize-lower.

write an application in a domain-speci.c language, optimize the application using the semantic properties exposed by the DSL then lower the program into the target low-level language where other domain-agnostic optimizations can be performed.


Hence Sum2 computes every rounding error y and adds them together before compensating the classic Sum computed result.

sum Algorithm applies twice, once to the n + 1 summand and then once to the n error terms, the compensated summation being the last addition between these two values.


The results of both empirical evaluations reveal that the effectiveness of the search algorithms, measured in terms of time to solve the OCL constraints to generate data, is significantly improved when using the novel heuristics presented in this paper.

our experiments show that (1+1) EA with the novel heuristics has the highest success rate among all the analyzed algorithms, as it requires the least number of iterations to solve constraints.


We need to verify that a specific user can access a confidential document in an efficient and secure manner.

we worry that if the parts of our system that deal with access control are too large and/or distributed, they may be compromised by attackers.


From that effort, we learned that the mapping relations were mostly responsible for the generation of the integration code.

the property name of a triple did not enter into the reasoning except when we were crossing ontologies.


There were cases that one could have expected to work and which actually worked on some implementations that would fail miserably on others.

the static-file component class was wholly broken when used with pathnames without extensions such as the typical README (whereas README.txt would function correctly).


A possible simpli.cation that is meaningful in a scenario that focuses on the value of diversity is to aggregate the di.erent resource dimensions into a single resource capacity variable Rl, which expresses the num i ber of di.erent experiments that can run at location l thanks to the contribution of facility i.

ri corresponds to whatever happens to be the bottleneck resource.


INTRODUCTION AND MOTIVATION The research proposed in this paper is very bene.cial for the SPL engineering (SPLE) community and industry.

we make in this work the following contributions: Problem analysis of variability-aware development of hybrid MBAs:  Typical variation points and their occurrence in the technological environment they are settled in;  Characteristic relations among variation points.


The function G(s(x)) returns the label associated with the terminated (for programs with intermediate observable outputs, termination-insensitivity may leak more than one bit [2]).

this discounted one-bit leak accounts for termination due to failure of the NSU or permissive-upgrade check.


Automatic conversion of graphs of user de.ned data types are not supported at all.

as compared to the succinct and declarative nature of DVCs mapping in the .exible packaging approach is manual , which might turn out to be a tedious and and hard to get right job in a real life setting.


3.1 Comparing recon.gurations At this level recon.gurations are compared with respect to the underlying semantic model.

standard notions of similarity and bisimilarity in such models [5, 9] can be used to compare the behaviour of the coordination pattern before and after the application of a recon.guration.


Logging Disks Latency (µsec) Throughput (OPs/sec)) 1 938 404228 2 934 810250 3 950 1192554 NCQ Size Figure 4: The average logging latency and throughput of the Beluga prototype when NCQ queue length is varied and the logging operation request size is 256 bytes the current write request.

the N + 1-th request can be issued from the aggregate queue to the disk only after the completion interrupt for the N-th request is raised, and thus has to experience at least one full rotation delay.


The workload for handling each cell depends both on the number of objects of this cell as well as to the DoI of these objects.

the number of objects increases the workload that each cell introduces to the server, while DoI forecasts the workload that each object will introduce to the server when users will interact with it.


CONCLUSION In this paper, we presented a novel concept for separating features based on snippets, ASTs and coloring, and provided an essential step towards a snippet-based integration of compositional and annotative approaches.

we outlined the concepts of compositional and annotative views on real source code documents and proposed concepts for di.erent snippet-based organizational units, which replace classical directories and .les.


The graphical view is automatically generated by applying the View specification to the data.

as part of the current prototype, a Java library, HTTP PUT request to the corresponding Cloud-side resource, thus requiring only a simple HTTP client as Analyst-side supporting application.


Figure 5 de.nes the denotational semantics of expressions [[e]] as a continuous map from these two environments to D8.It is entirely straightforward except for application, which depends on the continuous function app : D8 × D8 .c D8, de.ned thus2: app(d, a)= df (a) if d = Fun(df ) = Bad if d = Bad = .

otherwise application applies the payload df if the function d comes from the appropriate component of V8, propagates Bad, and otherwise returns ..


If individual links of a chain are realizable, then the chain is realizable.

if each of (p1,p2), (p2,p3),(p3,p4), ...,(pk-1,pk) is realizable, then the chain p1 .


From the computed trails, we developed a tool that navigates through them and allows the user to inspect the trace of any given computation.

since the execution of main gives rise (non-deterministically) to either False and True, our tool initially shows main -> False -> True  to point out that two results were computed.


The dual to exercise-option is waive-option: > ((waive-option less-broken-lexer) (open-input-string "[") #f) bogus 10 2 #f More speci.cally, the result of waive-option is a function that behaves as if less-broken-lexer had been de.ned without a contract.

exercise-option cannot activate dep-lexer/c for the result of waive-option.


We de.ne a malware detector D as a function whose domain and range are the set of executable programs P and the set {malicious, benign}, respectively.

a malware detector D is a function D : P.{malicious, benign}de.ned as: j malicious if p contains malicious code D(p)= benign otherwise Testing a detector D means iterating over all input programs p .P and checking the correctness of the answer.


It is important to note that there is often more than one way to implement a design pattern, and a discussion of the possible choices is beyond the scope of this example.

our tool does not try to choose the best design pattern implementation but just to provide the designer with a framework that helps her to implement her choice.


Accuracy Constraint Construction To exploit the capabilities of architectures that have variable precision floating point units [12, 17, 44, 45], we now present Chisel s analysis that unifies reasoning about both reliability and accuracy.

we extend reliability predicates with the ability to characterize the difference in the value of a variable between the kernel s exact and approximate executions.


In our work, adaptation must consider strictly variabilities of implementation solutions, but not variabilities in application domains.

the set of techniques presented in this paper are not applicable to manage communalities and variabilities in a single software application domain, but are interesting to adapt model transformation assets that actually are used in more than one domain.


The isolation properties provided by multi-commit transactions are not complete.

newer transactions see the e.ect of committed subtransactions of older transactions, while the older transactions do not see commits of new transactions.


This permits a more direct and natural representation of the intuitions in the setting of passive testing.

when monitoring a timed implementation from mid-stream in its execution, one cannot infer the absolute time occurrences of any observed events but one can observe the time intervals that are speci.ed in an interval-timed trace.


A logic program with negation is called strati.ed if there is no cycle involving negation in the predicate dependency graph.

the entire program can be divided into multiple strata of de.nite (no negation) logic programs, and negation is allowed only at juncture of different strata.


While in this section we have illustrated the main elements of the deployed WSN testbed, further details for various system setups will be illustrated and compared in Section 3.

the above described testbed has been used for two main objectives: i) to estimate the channel dependent parameters used by the location engine (see Section 2.2) for positioning estimation, and ii) to analyze the localization accuracy provided by the location engine during the EECI s opening ceremony (i.e., a dynamic indoor scenario).


The manner in which this information is stored can be defined as Planned Indeterminacy.

unlike OCR which forces its results into text output, Pictographic Matching technology refrains from word determination until an actual search is performed.


The only cost of address translation our shadow memory scheme in more detail.

we meais the small cost of executing the shadow-start and shadow-end sure the overhead introduced by our coupled coherence protocol instructions for identifying SMI.


However, the concepts and structuring mechanisms supported essentially emerged by abstraction from the programming .eld [Myl99] -the same way as structured analysis came out by abstraction from structured programming techniques.

the why concerns in the early stages of requirements engineering practice [Hic74, Ros77b, Mun81, Ber91] are not addressed.


Since portions of the inherited region will be used in parts of the computation, it is obviously necessary to define regions from other regions.

let region R = [1..n, 1..n] and direction west = [0,-1].


As described in Section 3, Fay meets these challenges with generally-applicable techniques that include machine-wide code-modi.cation barriers, non-reentrant dispatching, lock-free or thread-local state, and the use of time-limited, safe machine code to prevent side effects.

fay offers the lesson that reliable machine-code modi.cation is a good basis for implementing platform mechanisms, as well as to install tracepoints.


These include: (a) isolation, where hardwareand system-level guarantees ensure that di.erent data containers are mutually isolated, (b) information hiding, where each data container s implementation and contents are dynamically separated and invisible to the other, and (c)protection, where data-sharing between containers can be controlled even if the operating systems running on devices misbehave or are compromised [11].

virtualization can ensure that only explicit sharing occurs and that it occurs only under container-established policies.


In the rest of this section we answer this question by showing that CabChat has a t-latency of at most 2t+1 .

the impact of instability in the queues is a factor of 2 in the t-latency.


(D1 vs. D2): The results of D1 vs. the results of D2 were very close.

varying measurements of testing requirements used on experiment had little e.ect on results.


This will help determine the one time cost paid by the join points that do not match in a dynamic AO language model.

the sooner the decision tree can determine that the join point is not going to match, the better.


OAuth V2.0, however, fails to provide certain features required in today s open Web environment.

it does not support dynamic introductions by users and requires relationships between parties to be preestablished.


Figure 10 shows that the proposed RMTD (with a 8-bit correctable ECC) only introduced no more than 5.2% in the increasing of the average response time for NFTL, FTL, and ASA, where the x-axis denotes the management strategies, and the y-axis denotes the average response time of each request.

rMTD over ASA introduced more performance overheads than those over other strategies.


When the speci.cation is elaborated under the transparent interpretation, however, the resulting signature declares that the implementation of each ti is the appropriate projection from a recursive bundle determined by the spec itself.

each ti is transparently speci.ed as µi(t).(t).


12 Note that the support of a vector de.nes the vector since the .eld is binary.


Essentially, this property prevents branches from becoming relevant to thread Ts merely for implementing a dependence emanating from Ts.

no new branches must be added to Ts in order to implement a dependence from it to Tt.


The authors would like to these partners for the fruitful discussions and interactions that have allowed to improve and re.ne this work.

the authors would like to thanks to Miguel A. de Miguel, Scott Hansen, Antonio Kung, Fridtjof Siebert, Ruth Tolosa and Andy Wellings for their contributions.


The second condition veri.es that in the most recent past it reached the minimum number of methods to be considered a possible Supernova class (canBecomeSupernova), and afterwards all the combinations of consecutive sizes are evaluated to verify if the relation among the three lengths hold.

we verify that over the course of time, the size of the class doubled and tripled, indicating the explosive growth.


3.1 Technological Coverage For answering question Q1, the measurement framework analyses the coverage level for each of the three essential aspects previously listed.

the considered metrics are: Activity Coverage (AC), Actor Coverage (ActorC), Artefact Coverage (AtfC).


As another optimization, we can compute the Y function only on atomic predicates.

we recursively convert .T'(~i A 7~2) to .?


We remark that this type conversion preserves polarity of record .elds.

record .elds that occur positively in the higher-order function type (namely, hk and lj .elds) also appear in positive positions of the resulting .rst-order function type; so do record .elds in negative positions (namely, hj and lk .elds).


6.5 Handling Class Initializers Java class initialization performs rather complex synchronization [14].

while a thread is initializing a class, any other thread attempting to access the class will block until initialization is complete.


Note that although Ae 1 performs duplicate computations in the case where A2 is peeking, this computation cost can be amortized by increasing the value of chanPop.

though the equations set chanPop as the least common multiple of u1 and o2, any common multiple is legal.


We speculate that in addition to the objective accuracy of the tool, subjective reasons play an important role here as well.

the issues of analyst interaction with the tool and the convenience of the user interface have to be studied.


This approach almost works, but requires a generalization.

as we show, Recurrences (10) and (12) still hold, but there is one value of .


The relational speci.cation was of comparable size, but with a better, more modular and declarative structure.

it was much easier to write speci.cations which were robust against variations in event order.


Due to the rapidly growing popularity of power-law networks on mobile platforms, studying malware propagation in these environments is an important area of research.

three key aspects of malware propagation have not received adequate attention in existing models: (i) most power-law networks are overlaid on a combination of wireless LANs, wired segments and mobile networks, with different bandwidth and latency distributions, (ii) interactions among users can be diverse, and (iii) mobility of users can affect the rate at which an epidemic can either grow or subside in the network.


After an initial prefetching of data into the .ash drive, future requests to the data can be satis.ed from the .ash drive without accessing data on the disk.

prefetching makes the evenly distributed disk accesses more bursty.


However, applying cache optimizations such as blocking (tiling) manually can be challenging for legacy MPI codes.

the memory access pattern of LULESH is complex because it uses an unstructured mesh (with non-unit stride accesses) and multiple domain regions.


But, in our view compiling to the message passing level introduces too much distance between compiled code and the computer.

message passing is a communication protocol with a variety of forms, ranging from a heavyweight synchronous form with multiple copying steps, to lighterweight asynchronous forms.


Every resource protocol we implement is pure ID R I S, using a library for resource-dependent algebraic effects [3] and ID R I S features for supporting domain-speci.c language implementation such as syntax macros and overloading.

this means the same techniques can be applied to other resources, and most importantly, combinations of resources and DSLs implemented in this way are composable.


While we have addressed subtyping, joins, and a number of other subtleties with wildcards, there is still plenty of opportunity for research to be done on wildcards.

although we have provided techniques for improving type-argument inference, we believe it is important to identify a type-argument inference algorithm which is both complete in practice and provides guarantees regarding ambiguity of program semantics.


Figure 6 shows the high-level overview of this evaluation.

uRLMON.dll maintains URL action policies as a list of memory buffers in its global data region.


String) must have arguments of the corresponding types.

(ex-pressions of those exact types, not Code.)


Much more termination situations can in fact be discovered by our algorithm.

our algorithm can detect the termination of a set of rules defined by several designers, even when no designer knows rules defined by the other designers.


Our research examines a variety of policy-driven data placement algorithms for high performance distributed environments.

we are interested in working with petascale applications to provide effective data placement.


However, these approaches primarily are the static approaches for developing product lines and thus, can not support dynamism in product lines with respect to changes.

while some methods, techniques and guidelines to handling change (i.e., variability) in product lines have been proposed to delay design decisions [6,8,16], they focus on variability management only in a static context and do not consider changes occurred during runtime as indicated in section 2.


A probe strategy is non-adaptive if for any node in the probe tree, all its children are labeled with the same server.

a non-adaptive probe strategy does not adjust the probe sequence based on the results of earlier probes.


In addition, at their specific level of concern, both need to know which features the application should have and the set of requirements to be met at each particular operating scenario.

they together need to know the overall current configuration.


This is important in practice in order to compile MLF typed programs ef.ciently.

when MLF is extended with quali.ed typesitis essentialtohavea translationschemeto SystemF that can accomodate evidence translation for quali.ed types, and we hope that the presented translation increases adoption of MLF.


It is important to identify the application usage pattern in order to design a system that is .exible enough to be responsive when necessary, for example to handle bursts of users.

by knowing when users are mostly active (see Figure 6(c)), we design the VibN backend in order to: instantiate more machines to accommodate high loads during the day, and make the clustering algorithm more responsive during peak hours.


The execution order of archpoints representing the Observer pattern is preserved even if program points, which do not change the sequence of archpoints, are added to the code.

the traceability between design and code can be maintained if there is a bisimulational relation between them in terms of archpoints and added program points do not violate this bisimulation.


2.1 FFT In mathematics, the Discrete Fourier Transform (DFT) converts a .nite list of samples of a function into the list of coef.cients of a .nite combination of complex sinusoids.

dFT converts a sampled function from the original time domain to the frequency domain.


A Meta-Circular Language for Active Libraries Marco Servetto Elena Zucca Victoria University of Wellington DIBRIS, Università di Genova marco.servetto@ecs.vuw.ac.nz zucca@disi.unige.it Abstract We present a new Java-like language design coupling disciplined meta-programming features with a composition language.

programmers can write meta-expressions that combine class definitions, on top of a small set of composition operators, inspired by the seminal Bracha s Jigsaw framework.


Allocation sites in Java programs demonstrate a far more diverse object lifetime behaviour than the short, long, immortal classi.cation used above [20].

it is common for a single site to allocate objects with a bimodal lifetime distribution.


from Lemma 1, for any system S such that S F n i=1 PEi it holds that n n A+PI S + ,...,A+PI F RRi 1 n i=1 A+PI S+ = S + ,...,A+PI is an Aspects 1 n over-approximation of SAspects = S +(A1,...,An).


3.1 System-Node Variable Domains The domain of each system-node variable contains pieces of information describing the possible security levels available on each system.

each source variable Si s contains domain elements marked with s, and each destination variable Si d contains domain elements marked with d. The network in Figure 3 has in our model 4 variables S1 s, Sd 2 , S2 d A, S s B, C B s }, with 1 , Ss with domain D(Si s) = {T s A, Ss i := 1, 2, and D(Si d) = {T d A, Sd B}, with i := 1, 2.


This problem can be revealed by comparing SDV runs with different engines, for example, SLAM1 versus SLAM2.

we observed that some Pass results with SLAM1 turn into Defect or OOR results with SLAM2.


It needs to be noted that not all splittings can help us eliminate the cycles in a given LSG.

one needs to be very careful in deciding which iterations to place into each of the resulting sub-nodes so that the cyclic dependence at hand can be broken.


It then passes this force information back to the patches via the patch s proxy objects.

the proxy patches combine all forces for a patch local to a particular processor and then send the combined set of forces back to the patch.


It is inspired by the architectural design method for software architecture, ArchPad, which combines architectural decision models and patterns (Zimmermann et al., 2008).

in ArchPad architectural decisions are used to determine and select appropriate patterns.


The more specific the data to the kind of program, the more credible the statistical data will be.

data collected for one version of a program, or for members of a program family, should be very relevant.


The simulations use a simple uniform distribution of group sizes.

if the maximum group size is 2, then about one half of the groups will be of size 1, and one half will be of size 2.


Seeker leverages DSE for dynamic analysis to synthesize sequences that can cover a given target branch tb.

given a target branch, Seeker .rst applies DSE and checks whether DSE can generate a sequence (referred to as target sequence) that covers the target branch.


From the theorem above, it follows that o' is unique if F is total.

for a given input assignment i and a given output assignment o in negative time, a total component uniquely determines the outputs o for all points in time.


5.1 Non-Applicable over Total Of the 63 papers examined, 19 of them contained no evaluation component whatsoever.

70% of the sample contained some form of evaluation.


Controlled exploration is achieved by instructing the thread scheduler in the JVM to select an appropriate thread to explore next according to the suggested thread schedule.

the thread schedule is traversed in the background along with the state space exploration.


The '' ' a , Toc, and Tip are added to the resulting expression, i.e., they are part of the transaction s new state.

parallel threads in the transaction may produce other parallel or on-commit threads.


Consequently and as illustrated in Figure7for new, Java tokens andCtokens are only recognized in the respective language s context.

the Jeannie parser can recognize code written without regard for Jeannie s union of Java and C, notably code included from platform-speci.c header .les.


Our belief is that this ILP-based solution can be useful in its own right, but it can also be used for evaluating the quality of the heuristic solutions.

once a heuristic solution has been developed, the results it generates can be compared to those obtained through the ILP-based method.


Nevertheless the keyquestion remains, in a (possibly) untrusted domain who guarantee s the integrity of the monitor?


Example: echo Using our semantics, we can prove once and for all that echo prints out any character entered at the teletype.

we can de.ne the following function that exhibits the behaviour we expect echo to have: copy :: Stream Char .


We model this condition as the conjunct use in-house only.

an integrator can create any derivative work from GPLed components as long as the resulting system is used in-house only.


Given the workload and resource usage information provided by the scheduler, the DVS manager dynamically adjusts the processor speed to save energy while meeting application resource requirements.

we have proposed three SRT-DVS algorithms, which reduce the processor energy consumption by exploiting the unallocated resource and unused resource, as well as adapting resource allocation to avoid (or reduce) the unused resource.


Our work is most closely related, at least data-wise, to the analysis performed by Liao [18].

he used similar GPS data from a Singaporean taxi operator for his analysis.


For instance, how many of the 15 meaningful use criteria listed in Table 1 explain activity outside of activity?

what makes each of those activities actually meaningful?


This data set represents an array of large hierarchies drawn from various OO languages.

the set includes all multiple-inheritance hierarchies used in previous studies of encoding schemes [28, 30, 26, 25].


We also devise taint cleaning mechanism.

if a variable is rede.ned to be an untainted variable or a constant outside taint propagation slices, we thus insert a statement after that de.nition to set its shadow variable to 0 (false).


INTRODUCTION Improvements in telecom and information infrastructure have been drastically accelerated during the past decade.

permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page.


Note that the Stratego rewrite rules use concrete syntax as well.

the rules are transformations on Java programs and thus use the syntax of Java to indicate code fragments.


During their work, the students were kept appraised of the progress on the database development.

they were briefed on the data loading aspects.


Micro-transformers tr12 and tr23 are AA compatible iff one of them is identity, or both are pointwise, or both are separable, or both are conditional, and the micro-transformers for all components of A are compatible.

if trAA 12 is a pointwise micro-transformer and tr23 is a conditional micro-transformer, then they are not compatible.


cancels out opposing, adjacent frame-action pairings until no more cancellations can be made.

if ..t | occurs to the immediate left or right of |.. in a frame string, we may delete the t pair; when no further annihilations in p are possible, the remainder is .p., e.g...a 1 |1 a..b 2|.


Hence, in the following, we concentrate on those properties of vcn that can be directly compared to other approaches via encoding of virtual classes by dependent classes.

for this comparison we consider only dependent classes with a single parameter.


In this paper we use representation theory based arguments to show that cohesion and information theoretic metrics are invalid although they conform to various advocated properties.

we show that as researchers: We do not know how to validate metrics;  We do not understand the implications of the validation actions we undertake.


we will shortly have the implementation tested and suf.ciently functional to begin exploring its performance characteristics, as well as opportunities to improve performance, as others have done for closed nested transactions [2].


Since the heap of each process is independent, the exchange of messages is done by copying.

every message gets copied from the heap of the sender process to the heap of the receiving process.


The macro systems of Lisp and Scheme have also been used to build DSLs.

racket [31] provides an interface to the static semantics of the language using macros.


This common occurrence in practice, this tendency of our colleagues toward a set of depth-first selections from the subject, naturally forces us to ask the question whether perhaps we should build the sidewalks where we find the footpaths.

we should ask whether a course should be designed which introduces the undergraduate to the topic of programming language design in a substantive way without attempting to achieve broad coverage of the area.


However, the nested structure of the original loop obscures this simple algorithm.

the stepper function nextret of the stream produced by returns has to be passed from go1, where it is de.ned, to go2, where it is used.


For example, the evaluation of the conditional expression: if ( (k ?

true : false) ) then e1 else e2 evaluates both e1 and e2, and carefully tracks the dependency of these computations on the principal k. assignments performed during e1 are visible only to views that include k, while assignments performed during e2 are visible to views that exclude k. After the evaluations of e1 and e2 complete, their two results are combined into a single faceted value that is returned to the continuation of this conditional expression.


In summary, these results demonstrate that MRWB can gracefully tolerate peer dynamics.

it performs well over the rate of churnreported inreal systems.


R, we let k = k(r, r ' ) denote the largest k = 0 such that the .rst k steps of r and r ' are identical.


Based on the services registered in the common UDDI directory, determine the services and organizations from which those data items can be obtained from.

for each item d D, find service s such that OutMsg(s, m) and Depend(d, m).


2.1.3 Memory Cognitive scientists [16] have explored the ways moving from paper to computer impacts memory, or recall of significant patient information.

they explore the implication of the missing narrative from the patient record as a result from moving from paper to computer to store patient records.


12 The second case study is performed from a service con sumer perspective, i.e., applying the black-box approach to test a service available on the Internet.

we Fitness 10 8 tested the response time property of a service producing 6 charts5 .


In each pass, we output only those Rin tuples that belong to a certain region of Rout.

the algorithm first divides Rout into nChunk chunks, and then performs the scatter in nChunk passes.


We have the groups of all commits and their con.icts detected by two strategies which we want to compare.

for the two samples, we calculate a 99% con.dence interval for the binomial distribution s probability p. given the sample the real p of the distribution is with 99% probability in this interval.


Suppose that Li,j(R) is the (average) power density 5 jL1,j P1,j L2,j P2,j m1 4113.2 14.5 223.8 25.6 3 334.8 36.9 44 8 715.4 2 5 5 15.5 10 38 1 m2 6 6 28.8 0 0 1 2 3 4 5 6 7 8 910 Li,j (a)power pro.les (b)power density Figure 2: An example for power consumption and power density of servers.

request arrival rate that server mi can serve at frequency fi,j with quality of service no worse than R. qi(fi,j,Li,j(R)) is not worse than R. For example, if the qualityof serviceistheaverageresponsetimeintheM/M/1 queuing model, qi(fi,j,Li,j(R)) = 1 = R. For aifi,j-Li,j(R) notational brevity, for the rest of this paper, we will de.ne both Pi,0 and Li,0 as0.


Towards this goal, we introduce a notion of bisimulation between two transition systems, which is suitable for the kind of transition systems we consider here.

we have to take into account that the two transition systems are over different data domains, and hence we have to consider the correspondence between the data in the two transition systems and how such data evolve over time.


A term is factorable if it is a partial application of an operator, as determined by its arity.

ot1 ... tk is a partial application of operator O if k is strictly less than the arity of O.


Although it is a modeling study, to make realistic examples, we use real data.

due to lack of accessibility to the logs of real deployment of this system, we use the availability logs published in [2, 5, 21, 27, 30] regarding the availability of internet servers.


Since we do not allow a new marking to be created duringevaluation, any parameterized subpart in a result value of a function must come from some parameterized subpart in the input value.

the type system directly represents a usual expected behavior of a polymorphic type system a value of a variable type is never reconstructed in a reminiscence of Reynold s parametricity theory [25].


As these provide a highlevel view on the requirements of our tool, they were suitable to derive questions for our survey.

we asked each participant if and why our tool corresponds to these guidelines.


Irrefutable patterns are matched lazily.

the match always succeeds at .rst; the value is only actually decomposed if the components are accessed later (leading to potential run-time failure at that point).


related segmentation-fault handling schemes) are not suited for our purposes.

given that we are targeting multi-threaded PDES platforms, we cannot simply a-priori protect the access to stocks that are reserved for simulation objects other than x upon dispatching x along any worker thread W Ti .


The approach presented in this paper aims to achieve an optimal initial partitioning of the virtual environment by exploiting objects characteristics.

the proposed algorithm on the one hand tries to balance the workload among the participating servers and on the other hand tries to minimize future communication need among them.


Descriptors representing a given (not-expired) expiration date are gathered in a descriptor list.

the expiration date value represented by a descriptor is implicitly encoded by storing the descriptor in a descriptor list for this value.


The main disadvantages of this approach are its complexity and the complete lack of static checking.

the CLASSPATHused to statically compile the classes of a component must be compatible with the runtime CLASSPATHof the classloader that loads the component.


For small d, this bound is much better than the adversarial bound 1/nk.

for the cases d =1 and d =2 (which cover all examples in Fig.


CQP combines the communication primitives of the pi-calculus [15, 25] with primitives for transformation and measurement of quantum state.

qubits (quantum bits, the basic elements of quantum data) can be transmitted along communication channels.


2.2 The SPL Language SPL is a convenient language for describing matrix factor- izations, and hence fast algorithms for computing matrix- vector products.

it can be used for describing fast signal transforms such as the FFT.


The third category of approaches [6, 13] infers constraints by testing.

gabel and Su [6] described a framework to automatically validate temporal constraints inferred from client applications by testing.


When a node i receives a new entry from a neighbor j, i updates the contribution metric cj,i (contribution from j to i): cj,i + cj,i + wf a-hf where a is a system-wide constant, f is the feed to which the entry belongs, wf is a weight of preference for feed f , and hf is a hop count for feed f .

a node gives the most credit when it receives an entry from a feed belonging to the direct subscription set, the second most credit for an entry from a feed of hop count 1, and so forth.


Whereas aspects in AspectJ act on the level of classes and objects in order to modularize crosscutting concerns, features act on an architectural level.

a feature decomposes an object-oriented architecture into a composition of collaborations.


As a software platform, HTML5 is not without its limitations, and we experienced some issues when utilizing the new features in production applications.

we had some challenges working with Web Storage, the only widely implemented o.ine data persistence API.


Experience with SC: Transformation-based Implementation of Various Extensions to C Extended Abstract Tasuku Hiraishi Masahiro Yasugi Taiichi Yuasa Academic Center for Computing and Graduate School of Informatics, Kyoto University Media Studies, Kyoto University Sakyo Kyoto, JAPAN 606-8501 Sakyo Kyoto, JAPAN 606-8501 {yasugi, yuasa}@kuis.kyoto-u.ac.jp {tasuku}@media.kyoto-u.ac.jp ABSTRACT We have proposed the SC language system which facilitates language extensions by translation into C. In this paper, we present our experience with the SC language system and discuss its design, implementation, applications and improvements.

we present the improvement to the design of transformation rules for implementing translations, which includes the feature to extend an existing transformation phase (rule-set).


Thus, yield() is replaced by scheduler !

yield, receive {scheduler, go} -> ok end the process noti.es PULSE and then waits for the message go from the scheduler before it continues.


The second idea exploited by [DPC+09] is that, if the context is .nite (i.e., there is non in.nite loop in the context), then the two following veri.cation processes are equivalent: (a) compose the context and the system, and then verify the resulting global system; (b) unroll the context into N scenarios (i.e., a sequence of events), and successively compose each scenario with the system and verify the resulting composition.

the authors transform the initial global veri.cation problem into N smaller veri.cation subproblems.


The UI text needed to be easy to navigate and to be absorbed painlessly by busy developers.

the Guidelines team faced the same dilemma that UI developers face: Create useful text in a highly readable form, and do it quickly.


Then the procedure described above, when applied to C2 with a d-fraction of errors ( ) succeeds with probability at least 1 - 2 d + E. d 1-a So the closer a code s automorphism group is to being two transitive, the better it s degree lifted version does as an LDC.

when an AG code has a 2 transitive automorphism group (as RS codes do) then the simple procedure of passing a random curve through the point of correction works well as a local corrector for any m.For some AG codes, the Hermitian codes among them, we can add some redundancy to the code and get one that is doubly transitive.


This may result in a trace slice that does not contain all the relevant events and thus lose the soundness of the predictive analysis.

the current jPredictor prototype may produce false alarms due to incomplete trace slices.


that the object id appears in the types takes care of the family requirements.

out is a .nal .eld and, therefore, the type rules require that it should have type this.out[./this], i.e., for H(.


While all our tested bugs can be successfully reproduced by PRES in our experiments and also theoretically it is feasible for PRES to exhaustively search the unrecorded non-determinism space to .nd a bug-producing combination, it is conceivable that in some cases it might be dif.cult for PRES to reproduce an occurred bug within an acceptable time limit.

it might take a long time for PRES to produce a bug (1) that has a long error-propagation time before leading to a detectable failure, or (2) that requires multiple rare interleavings (i.e.


We are faced with the challenge of ensuring system software and tools scale to the level required by these environments.

we require scalable debugging and performance tools as users will need mechanisms to ensure the correctness of their codes and the ef.cient utilization of the underlying, often unique and complex, target architectures.


T C S × A × S is a trinary relation, the transition rela- tion, which gives possible transitions between states.

t(sl, ~, s2) describes a transition from state Sl to s2, if joint action ~ is taken in state sl.


The HTN Planning technique generates plans from a developed hierarchal network of domain tasks and actions [4].

having modeled tasks, actions, and their constraints in the HTN formalism, HTN planners produce a sequence of actions that perform some given tasks.


The Liberty Alliance Project 1 is a global identity consortium developing open technical, business and privacy standards for federated identity management.

the Liberty Alliance has de.ned a variety of SOAP-based services designed to support the discovery and permissionbased sharing of identities and attributes.


In addition, the extension languages are handled as plug-ins of the extensible language.

the extensible language provides a registry, which must be used by any extension language that wishes to participate in the framework.


Our goal in conducting these experiments is to state the correlation while we envision greater benefit in using such a metric in the context of a placement tool generating solutions that optimized for this metric along with wirelength, instead of purely optimizing for the latter.

the solutions presented in Table II would be part of the solution space searched by a placement tool that attempts to arrive at a good solution with respect to the proposed measure.


To mitigate these effects and also to handle skew, we decouple the sorting of intermediate data from map task execution.

the intermediate data is .rst aggregated, and then sorted outside the context of map tasks.


For a given task, our models (SVM with linear kernel [24, 25]) predict based on a linear combination of features with their corresponding weights.

their predictions are based on a score obtained by multiplying featurevalues with their respective weights and adding these products.


5.5 SV-8 While evolution of a system over a lengthy period is difficult enough to model, user roles should be a part of this timeline.

roles that are known to be temporary should be added and removed appropriately, as well as any new roles that may come with planned functionality.


When the amount of data is small, the cost of initiating messages, a, tends to dominate, and algorithms should strive to reduce this cost.

the lower bound on the latency in Table 1 becomes the limiting factor.


Were we to do so, the .rst function name would be considered bound in all the function bodies, as desired, but the second and subsequent names would not be considered bound in the .rst body.

we would have the binding structure of a nonrecursive let.


[system] It is possible to integrate the DSL compiler into the system.

this means that the DSL compiler can be deployed as a library that can directly called from the application code.


Finally, as speci.ed by the metadata, the JDO enhancer adds persistence-speci.c methods and .elds to each persistent class, enabling its instances to interact with the JDO runtime.

the enhancer changes a persistent class to implement interface PersistenceCapable and wraps all read and write accesses to a persistent .eld with special methods that interact with the JDO runtime.


In our implementation, we use a 90-10 heuristic.


Subsequent post-hoc tests show that all three are signi.cantly di.erent from each other.

being asked by reviewers to write a second or later patch version is not a guarantee for success, but at least a good sign: reviewers see potential and really want to work on the patch.


s u p p o r t e d B y A c t i v i t y c h a n g i n g {18 l a b e l s u p p o r t e d B y A c t i v i t y 19 }20 } Listing 4: Gromp script for the new language them more powerful.

we are researching means to write Gromp scripts in a simpler way, possibly with the help of assistance.


Our solution to these challenges is to provide a host-language independent catalog of design principles and design patterns for DSLs.

this paper contributes six design principles and nine notation patterns for DSLs.


However they also have not considered a MTC domain model as we demonstrated in a TCDM.

they do not design MTCs, but they do design a PDM.


The application code is aware of the transaction status and the failed transactions are repeated until success is reported by TRANSACT.

an initiator keeps retrying until it can allocate the resources it requested.


We added in several other features that are slightly more complicated.

we used the friend name overlap count, which is computed by determining the number of friends with matching names between two pro.les.


INTRODUCTION Most of the models and tools currently used for effort estimation require the measure of the functional size of the program to be developed as input: for instance COCOMO II [16] accepts the functional size in Function Points as input.

function Points (FP) [1][2] are most often used for estimation purposes.


Only in the successor entry s parentid .eld do we store id in clear text.

we change the pairwise ordering from: a<b i. a.id = b.parentid to: a<b i. a.id = h(b.parentid) where < is the direct predecessor relation.


Of course, we cannot show that iter.next() does not a.ect the list and its representation, since iter is a part of the representation of list.

it is impossible to show E f rd list.1 wr iter # rd under(list).


Since that type may be a function of the input type, RT1 is parameterized both by the function and by the input type.

the type computation RT1::ResultType means result type of function F, when its argument type is the element type of list L .


A propagation solver solv(F,D)for a set ofpropagators F and adomain D .ndsthegreatest mutual.xpoint of all thepropagators f .

f.solv(F,D)returns a newdomainde.nedby solv(F,D) = gfp(.d.iter(F,d))(D) iter(F,D)= .f.F f(D) where gfpdenotesthegreatest .xpoint w.r.t.


[10] have proposed a domain-speci.c language, called AmbientTalk, dedicated to developing applications in the context of a mobile network.

they introduce a distributed exception-handling mechanism [23] to deal with mobile hardware characteristics [10], such as connection volatility.


We are not aware of any MOPs (or languages, or frameworks) that offer similar generic abstractions and structure as we presented in this paper.

we do not know any MOPs that provide abstractions for de.ning new composition operators with similar variety, expressiveness and composability.


If k is equal to the key of another accessible value, then their lock addresses are also equal.

if k is 1, la must be gla;ifk is equaltothekeyofa frame fr, la is same as the lock address of that frame.


5.2 Clobber Sets As alluded to in the previous discussion, a composable paral lel semantics must account for the unknown, concurrent con text in which an expression executes.

there may be locations read by an expression that are being altered (i.e.


For systems that cater for multi-languages, the above tasks are performed only for English language.

any source code that is not for English language is excluded.


1 class Point { 2 int x, y; 3 int s; 4 5 public Point(int xi, int yi) 6 { x=xi; y=yi; s=1; } 7 public int getX() { return (x*s); } 8 public int getY() { return (y*s); } 9  10 public void move(int nx, int ny) 11 { x=nx; y=ny; } 12 } 13 14 aspect adjustScale { 15 pointcut m(Point p): 16 execution(void Point.move(int,int)) 17 && target( p ); 18 19 after(Point p) : m(p) { 20 if ((p.x < 5) && (p.y < 5)) { p.s=10; } 21 } 22 } Figure 1.

point Class and Aspect indeed, precisely what the adjustScale aspect does.


The resultsdiscussedin this section arebased on10,000iterations per experiment.

for each experiment 10,000 di.erent networks are randomly generated and, for each of these, both SDD and CDD protocol have been executed.


Delay Set Analysis A number of works on fence inference [11, 20, 27] rely on concepts such as delay sets and con.ict graphs [26].

the Pensieve project implements fence inference based on delay set analysis.


Both source-level and binary refactoring are not automatic but rather programmerinitiated and driven activities.

despite the success of several research projects aimed at providing program analysis tools for discovering and suggesting possible refactoring opportunities [16][17][21], it is always the programmer who decides which changes would improve the program and ensures that they would not alter its external behavior.


However, once discussed, it was agreed that support was too limited.

users were unable to perform a multi-stage selection process, independently.


In this paper, we want to test the TOTA s generality by implementing some advanced mechanisms required for the control of a modular rob ot.

our goal is to show that TOTA enables to easily and .exibly express and program biologically-inspired control algorithms (i.e.


Vertical dependencies were easy to .x by converting them into horizontal dependencies.

if a pair of dependent headers always occurs together in consecutive order, then it is easy to move the #include of the .rst header into the second header.


The technical difficulties are mainly due to the different memory layouts, code relocation, and power management scheme of the target hardware.

the memory layout and relocation mechanism provided by microcontrollers are widely different, hence we have designed an architecture-independent executable file format for the RETOS application, with which the actual code/data relocation is conducted in binary load stage.


class whereby a class serves to factor the common properties of a set of objects and specify the behavior of all instances.

[6, page 216] an object is a runtime entity that provides state and identity through instantiation but also inheritance and operations (methods) which are provided by the class.


F , ** ** sg(A )st = Mssg(A )st = Msrg(A )rt = (M · g(A ))st r.F = (h(A * ) · M)st = h(A * )srMrt r.F = h(A * )stMtt = h(A * )stt.


Note that it is not necessary (and sometimes impossible) to collect exactly represents a:for all s .C, .

(a) if and only if s ..(a) all states reachable from T. this step allows us to han dle non-terminating executions or very long running executions.


In our framework we use the standard user-based collaborative filtering approach, based on the k-nearest-neighbor algorithm, to predict the level of interest that a user might have in a forum for which the stakeholder has registered no prior interest, given a set of ratings (ranged over .., with .. denoting an average rating).

the predicted interest of a user u on a forum f is computed as where n .


When the actor wants to write data to the output tape, it unpacks the data to scalar variables and pushes them to the scalar output tape (lines 8-11 of DV in Figure 3b).

after each read and before each write to tapes, a SIMDized actor should perform packing and unpacking operations.


The most reasonable justification is that, in a mature context, humans tend to adopt the same terms when they express the same technical concept; therefore, techniques that are able to detect similarity even when the terms are not identical results in worst performances by providing more noise rather than positive contribution.

results suggest that in case the terms are different, it is better to judge their semantic as different rather than observing any possible semantic similarity.


As a .rst contribution of thispaper, weprovide an analysisonhowSPLprogramscanbepatched (manuallyedited).

we compare the patching of SPL transformations with the patching of generated programs.


A second, related observation is that application branches are typically either always symbolic or always concrete.

it is rare that a particular branch at some point in the execution depends on input and at other points does not.


Then, we place a counter (variable) in this code, and .nd the number of times the counter is updated, which gives us the number we want.

what we do is to generate a code using the Omega Library, add a counter (variable) to the generated code, and execute it.


{x} [PURE REL] x.Xx .L .,X fp release(x) : L.L{x} [PURE IF CAS] .,X fp ei : L.L .,X fp if CAS(e1,e2,e3) break e4 : L .L The top-level judgment .

fp P states that the annotation pure eis valid if .,UnstableVar fp e: Ø.Ø a pure block may not change any stable variables or terminate with a different set of locks held than when evaluation started: see [PURE PROG].


The result type is polymorphic and can be instantiated to the one we may have had in mind: (.

as < Con of a, Lam of ([int], (E as )), Var of int>) although any occurrence of Lam in the output will in fact have been applied to a value constructed with App, one can send this output into a context that is prepared to also handle other cases for Lam.


The algorithms discussed here are general methods for the parallel implementation of multiplicative Schwarz methods.

these methods operate on graphs that are derived from the matrix graph and the Schwarz subdomains (blocks).


Conclusions: The major reason for this unexpected resultisthehighly biased sample ofpassing andfailing tests provided with the programs under analysis.

the ratiobetweenpassing andfailing runs,which has a major impact on the probability computations, does not correspondto thefalse negative(failure) rates associated with the actually injected faults.


Thus, we can remember the difference value and avoid labeling the edge with a timestamp pair each time the dependence is exercised.

for a dynamic control dependence edge cd(tc,td) which satis.es the above conditions, tc + d = td because timestamp is incremented by d whenever after the execution of the predicate when control transfers to the dependent basic block.


Note that R may appear also in BoolExp and thus this depicts a recursive de.nition of R. By Tarski s .xed-point theorem, it follows that any positive equation system (set of equations) has a unique least .xed-point (and unique greatest .xed-point).

there is a unique least interpretation for the relation that satisfy the equations.


This work assumes throttling yields the same power and performance results that using different frequencies for the processors would but ignores the settling time because it uses fixed frequencies.

if feff is the effective frequency, fnominal is the nominal frequency, and throttle is the throttling percentage, expressed as a decimal, then feff = throttle x fnominal.


2) Known Result Attack: In this attack, a translator T may send queries to S whose results are already known to T, in an attempt to learn how S selects noise values.

t can attempt to build a lookup table for every attribute a.


on the semantic abstraction of low-level real-time information streams in order to inform the decision-making processes.

this refers the understanding of the situation covered by the Virtual Director, i.e.


$5.00 separate region or setting mark-bits.

most effort is spent on rescuing live objects.


We have conducted such a work on the code base of the Eclipse programming environment.

we have computed the mapping of packages and classes to the number of defects that were reported in the first six months before and after release.


Even though the performance results seem to be scattered over larger ranges, we notice that the result trends in Figure 4(c) are similar to the ones obtained in the case of uniform binding.

software uncertain parameters have little impact on the performance results since they lead the RT(updateVitalParameters) to vary between 2.89 and 3.71 seconds, whereas hardware uncertain parameters lead the RT(updateVitalParameters) to vary between 2.39 and 4.04 seconds.


7http://conference.apnic.net/ data/assets/pdf .le/0020/ 50771/osr apnic34 1346132140.pdf 8http://www.sitepoint.com/8-simple-steps-forcontributing-to-open-source/  3.2 Folder Use and Number of Forks We .t regression models to investigate the relationship between the number of forks and the use of standard folders.

we use testing, document and example to present a basic structure for .le organization.


However, by applying information-.ow techniques to the API and programs that use it, it is possible to guarantee that passwords are not revealed while making possible to verify them.

of.ine dictionary attacks are avoided as well as some requirements as having root privileges to verify passwords.


In this way, the LUNES user does not need to deal with low-level simulation details and can transparently take advantage of all the features o.ered by GAIA/ART `IS.

to allow the simulation of large models, a parallel and distribution simulation approach can be followed and some advanced featuressuch asthedynamicmodelpartitioning and load-balancing features are implemented transparently.


Parametricity [18] asserts that the function can only drop or reorganize its input list elements, without inspecting them or constructing new ones.

an element in a view must come directly from an element in the source, and this correspondence enables an update to a view element to be translated into an update to its origin in the source, which forms the basis of a backward transformation.


The visible determinacy of the open program P ensures that the set of feasible paths corresponding to any call sequence either always end in P.E,if this call sequence is not permitted, or always end in ¬P.E,if this call sequence is permitted.

if d = dag..s, then the feasible paths corresponding to d either always end in P.E or always end in ¬P.E.


The resulting environment must be well-formed; the de.nition of well-formed type environments (typing rules for the judgment f G0 are given in Figure 4) relies on that for well-formed standard type environments (that is, those which only contain standard type assumptions, ranged over by Gs).

g is well-formed iff there exists a well-formed standard type environment Gs which entails G. A standard type environment is well-formed if the inheritance relation is acyclic, for each class all its ancestor classes are available and the Java rules on overriding are respected (that is, a class cannot declare a method with the same name and parameter types of an inherited method and different return type).This is modeled by means of a judgment Gs f c:MSS0 which holds if we can calculate in Gs the set of all method signatures of class c (empty for Object).