ESC4, the ESC component of the JML4 project, is able to verify many more kinds of methods in part because of its use of novel techniques which apply multiple theorem provers.

we present Of.ine User-Assisted ESC (OUA-ESC), a new form of veri.cation that lies between ESC and Full Static Program Veri.cation (FSPV), that allows users to control the level of completeness of the tool.


While we have described trace formulas for our simple programs, a C program with .nite bit width data, e.g., 32-bit integers, can be converted into an equivalent Boolean program by separately tracking each bit of the state, and by interpreting .xed-width arithmetic and comparison operators as corresponding Boolean operations on each individual bit.

our implementation handles all features of ANSI-C, including function calls and pointers.


However, such approaches use end-to-end .ows, and thus su.er from the shortcomings of the E2E policy discussed before.

they allow a single bottleneck to block the utilization of bandwidth that gets freed up elsewhere in the path.


Because Haskell programmers are already familiar with type classes, they can bring all their intuitions to bear on the propagation of con.guration data, along with guarantees of coherence.

a type annotation can always be added without ill e.ects.


Transform Tenure by logarithms to make interpretation of the learning curve more straightforward.

in the simplest case when S is linear S(x)= c + pX, by exponentiating we obtain  L = C(x, ID)Tenurep .


Needless to say, the essential operational requirement for software frameworks is uncompromising reliability, acceptable performance and perhaps some level of design consideration for maintainability and scalability.

robustness is the key for what can be defined as a good software framework.


A related issue would be to investigate how to use the Planning Layer to analyze adaptive workflow processes.

how does one analyze a workflow process whose detailed picture becomes known only after execution [8]?


In essence, transformation-rule dependencies denote a kind of strict partial order between transformation-rules.

when a set of transformation-rules being applied, the target rule in a dependency should always be applied before the source rule.


The Spearman correlation of -0.035 between what developers consider as important and what reporters provide shows a huge gap.

it indicates that reporters do not focus on the information important for developers.


select function{ main }.body.loop end apply insert after %{ ... }%; $body.insert before %{ ... }% end Furthermore, multiple pointcut expressions can be joined and associated with a single apply, allowing access to mul-tiple branches in the join point hierarchy at once, thus re-ducing the size of the aspect definition.

lA-RA supports the (::) operator which, when used in an apply definition, joins the results of two pointcut expressions.


However, some .le system checkers may not implement some of the structures outlined, or may use additional structures not captured by it.

many modern .le systems provide more advanced features, such as indexed directory entries.


There are a variety of ways to de.ne who are one s friends for the purpose of recommendation [He and Chu 2010].

we need to determine whose ratings should be included when predicting a user s rating.


These studies .nd that virtualization and multi-tenancy are keys to EC2 s performance variation.

workloads running in EC2 may exhibit long tail network latency if co-scheduled with incompatible VMs [51].


This example also shows the complementarity of Re.nements 1 and 2.

re.nement 1 will not detect that ParallelExecute and its call-descendants cannot run in parallel with the procedures invoked on Lines 0 to 3.


5.3 Permission Checker The permission tool is designed to check the permissions on the .les and directories in a Forest description on a multi-user machine.

it enables one user to determine which .les a second user can read, write, or execute.


The generated method annotations provide information about the assumptions that several key methods make about the roles of their parameters.

these annotations show that the program invokes the CallNode method (this method implements the primary computation on the net- work) on a node only after the freeze method has converted the representation of the edges associated with the node to the more efficient form.


This later code might be the implementation itself in an interpreter, or a code-generation routine in an IR-based or JITcompiler emulator; we will refer to it as per-instruction code.By exploring the instruction decoder with symbolic execution, we can discover which byte sequences the emulator considers to be instructions, and group byte sequences that are the same instruction in the sense that they have common per-instruction code in the emulator.

we start symbolic execution at the entry point of the emulator s instruction parser, mark the bytes that are the input to this parser as symbolic, and explore execution paths up to the selection of the per-instruction code.


We highlight that the assumption that the levels of importance related to the same category of DDRD information are different for different DDRD UC(s) is valid only if the above null hypothesis is rejected for one or more combinations of i and j.

each specific combination of i and j in which the null hypothesis is rejected, identifies a specific pattern in the perceived importance level of a category of DDRD information.


Excel, however, does not support propagation of assertions to other cells, does not automatically display assertions, and does not automa-tically update the display of assertion violations when changes are made.

the data validation feature is primarily an optional data entry check that can be invoked from time to time by the user.


Further optimization is possible but incorrectly eliminates depth of .eld blur (d,e).


A concept in the context of our approachis apair(O,F), whereO is a set of classes, and F is a set of use-cases.

given a speci.c behavior of the system that is de.ned by a set of use-cases F; a concept (O,F) identi.es the set of classes O that realizes the given set of use-cases F. a concept can be used to identify the set of classes that can realize a given behavior in the system.


to accommodate the new generalized data structures, we have to slightly extend the interface of the transform method that emit the staged C-IR: case class F2() extends SPL { override def transform[AR[_],ER[_],T:NType] (in: Vector[AR,ER,T]) = { val out = in.create(2) out(0) = in(0) + in(1) out(1) = in(0) -in(1) out }} Calling this generalized F2 function with the input val in = new SplitComplexVector[Rep, Double](2) will be resolved as transform[Rep,Complex,Double](in: Vector[Rep,Complex,Double]) the internal storage type will be Rep[Array[Double]].


Such sequences are more frequent than true stride behavior [6, 19].

alternating sequences occur relatively often when variables toggle between two values.


The Linux coding style provides guidelines on the use of the preprocessor directives [2].

it discourages putting #ifdef directives directly into the baseline C source, as shown on the top portion in the code example shown below.


That is, rpowerB ( A) is the relative power that a peer A is cur rently able to deliver, as perceived by a peer B.

it is estimated by peer B as the average execution time of the tasks B ran locally, divided by the average execution time of the tasks B ran on A. mean{exectime(t B)} rpowerB (A) = B , where mean{exectime(t A)} B {exectime(tB B)} denotes the execution time of the tasks that B ran on B (i.e.


And, .nally, (c') implement an advice to map an individual back to a solution in the application domain.

this advice should return an instance of a candidate solution independent of any EC framework.


The hypothesis of this research is that in comparison to object-oriented programming, harmony-oriented programming improves the ease of dealing with some of these factors, and thus the ease of dealing with software evolution effectively.

the hypothesis posits that harmonyoriented programming has the following advantages over traditional object-oriented programming: 1.


The key of our concept is the following rule: [Separate ] PointsTo(x, 1, v) *-* Perm(x, 1, v)*Hist(x, 1, {v}, E) The [Separate ] rule splits the PointsTo predicate in two separate parts: i) Perm(x, 1, v) predicate, which keeps the access permission for the location x and its current local value v and ii) Hist(x, 1, V, H ) predicate, which stores some global information about how the value of x has been changing in the past.

the parameter V is a set of possible values that x initially had and H is a history of changes of the value of x.


We extend the approach of [3] by reusing as much as possible of the original C++ code.

we reuse a large part of the C++ code (namely the parts corresponding to local computations of processes) to implement LOTOS operations.


A register dependence from Ts to Tt involving (virtual) register r must be communicated at safe points,where Ts has the latest value of r. This property is necessary for correctness because communicating r at an unsafe point would, in some control paths, overwrite r in Tt with a stale value.

a dependence from a de.nition of r not in Ts to a use of r in Tt would not be respected, thuschanging the program s semantics.


Intuitively, a self-stabilizing system ensures that, after the end of any transient fault, the system reaches in a .nite time, without any external help, a correct behavior.

a self-stabilizing system repairs itself from any catastrophic state.


Fortunately, the consequences of not separating this concern are not so drastic.

that would not prevent alternative customizations for the system since the synchronization calls are not middleware dependent.


But if we want to build the optimal solution both options must be considered.

the merge should require one of the two y transitions but not necessarily both.


But sometimes, even though a method reads a .eld, it does not depend on it.

the method s return value and its side e.ects do not depend on the .eld.


Two pieces of advice are strongly independent when they do not interfere with each other regardless of the contents of the advice bodies or the contents of the programs they are applied to.

strong independence is determined exclusively by analysis of the pointcut designators of the two pieces of advice and consequently it is orthogonal to our analysis which (mostly) ignores the pointcuts and examines the advice bodies instead.


Our motive for looking further is that the visual NPATRL language is a trace-property-language while we are looking for a protocol- definition language.

the visual NPATRL language does not define the traces of a particular protocol, but the properties (i.e.


Procedural code metrics measure internal attributes of functions and procedures, therefore they are applicable to almost all programming languages.

the following metrics are considered: Lines of Code, McCabe Cyclomatic Complexity [11], Halstead Volume [5], Fan-in and Fan-out [5].


In this paper, we propose a generic framework, BOLT, which uses MapReduce style parallelism to scale top-down analyses.

we consider top-down analyses that are demand driven, such as the ones used for software model checking.


Thus, we propose an improved approach, thatexploits the intrinsic structure of SystemC.

each SystemC thread is translated into a separate sequential program and explored with lazy abstraction, i.e.by constructing an abstract reachabilitytreeasin[8],[12].Theoverallveri.cationis orchestratedby the direct execution of the SystemC scheduler, with techniques similar to explicit-state model checking.


Furthermore, in all the following cases we know that: t0 = tg (G6) since tg is the ghost thread that does not take part in execution.

we cannot have: H, ., (e0,tg,s0) r (e0' ,tg,s 0' ), H ' , . '


Note that the number of inputs refers to the number of times penumbra assigned a taint mark to an input.

inputs that are not actually read by the application are not counted.


For instance, the Financial Domain Model layer in Figure 1 illustrates a domain speci.c business document model based on the Generic Domain Model.

considering the ABIE Person, in the derived version of the ABIE the BBIEs Title, Age, Birth, IBAN, and BIC have been deleted.


This work is still in an early stage, and there is much work to do.

rather than designing a new bidirectional language, we are interested to look into the possibility of making the existing transformation languages like XSLT to be e.ciently bidirectional.


Here, one of our fundamental assumptions is that the approach is only feasible for qualities that can be clearly related to the component-connector meta-model of architectures.

we can only design architectural solutions for a quality if we are able to decompose an abstract requirement (e.g.


In addition, if the branch of the loop is not scheduled in the last stage, there may be potential exit points in the prologue, each requiring an epilogue to finish the iterations that have been initiated up to this point.

sC -BS -1 epilogues are required for early prologue exits, where BS is the stage where the exit branch is scheduled.


Our scheme incurs signi.cantly fewer retrying messages under all scenarios.

comparing the scenario with timeout range of [0.3s, 2s] to the default setting, the retrying message overhead for both Yang et al.


Conclusion This work contributes to building a solid theoretical foundation for memory management.

it extends previous work by providing new lower and upper bounds on the effectiveness of partial compaction.


The rule below represents a possible resolution of an inconsistency occurring in the Move Operation model refactoring.

this rule ensures the creation of a new association from the target class to the source class and an instance of this association being used in the sequence diagram.


The role construct we introduce in Java promotes the separation of concerns between the core behavior of an object and its context dependent behavior.

the interaction among a player object, the institution and the other roles is encapsulated inside the role the object plays.


This solution has been already shown to outperform approaches alternatively based on the use of incremental or non-incremental log/restore, but not supporting optimized coexistence of the two di.erent modes.

we compare the evolutionary approach against an highly optimized log/restore solution.


Second, there is a steep increase in execution times of a concurrent schedule even for small amounts of memory oversubscription.

k-means degrades by 540%, and Linear Algebra by 654% with only a modest 15% oversubscription of the physical memory.


By this I mean to give up on the ontological differences and to begin making ethnography, design, and users practices mutually constitutive as interdisciplinary practices.

to start considering participatory design practice as ethnographic practice and vice versa.


UsingTheorem3, we canhence compare Pl(RT0(P))with Pl(RT1(P))in a fairer way.

we use for RT0 the limit L for eachtarget(so at most (n + m)L test cases in total), whereas for RT1 we use l = E[WRT0(P)].


Unfortunately, there are two callers and we are not sure which one leads to the failure.

given only the log message, there remain several uncertainties that prevent us from diagnosing the failure.


Clearly, the transformed code in Figure 1b is far from optimal, especially for a high spatial-locality reference such as v1[i] with i=0 N. For high-locality references, it is trivial to compute the number of useful data present in the current cache line.

we can easily compute the number of loop iterations for which the current cache line can provide data for such references.


Reimagining Leaderboards: Towards Gamifying Competency Models through Social Game Mechanics Katie Seaborn Peter Pennefather Deborah I. Fels University of Toronto University of Toronto Ryerson University 5 King s College Road 144 College Street 350 Victoria Street Toronto, ON, M5S 3G8 Toronto, ON, M5S 3M2 Toronto, ON, M5B 2K3 kseaborn@mie.utoronto.ca p.pennefather@utoronto.ca dfels@ryerson.ca ABSTRACT Competency models have been widely employed within education, training and development contexts.

medical education programs have become a platform of exploration around innovations in competency-based assessment.


In other words, we discuss the local evolution of a class change to observe defect incidence that can be used to identify fault-prone classes.

we analyze the correlation between churn and structural change with bug.xing commits in the given windows.


In order to determine the number of processors that results in the best execution time for a given nest, we used pro.le data.

using our simulator, we executed the nest with different number of processors and selected the one with the minimum execution time.


Identifying some common cases where no signi.cant sharing would be lost by increasing the arity is not hard, however.

unlike g, it is safe to increase the arity of f to 2, because f does no work (except allocate function closures) when applied to fewer than 2 arguments.


In the case of SR=0.25, our two-stage adaptive sampling scheme performed as well or better than systematic sampling in 17 of the 18 attack types detected.

there were three types of attacks (land, loadmodule, and warez) detected using our sampling scheme, which were not detected at all using systematic sampling.


Textual formatting conventions, which function as a sort of visual representation, provide useful visual information about the programming-language structures of code (to readers familiar with the programming language).

an if-statement looks different from a for-loop or a function de.nition.


As a future work, we want to explore di.erent strategies to make the frontend producing less code, maintaining compa rable or better performances.

we are working on a way to automatically detect loops in the user code, as tracing JITs do [7].


All the 89 false negativesinLimeSurvey areduetotheanalysisinaccuracy of the PHP string analyzer used in our implementation.

in LimeSurvey,thereareconstantstringsthat arecompared with the default values of input tags in the generated web pages that are fetched by $POST[ name of the input tag ].


We can frame the choice of protocol as a run-time decision to be made by the various participants.

participants would then use the re.ned version of a protocol that best matches their local preferences.


Second, the performance potential of true TLP is estimated.

an optimistic upper bound on the speedup achievable (at the loop-level) via autoparallelization [17] is determined.


The parameterize form with current-custodian sets the current custodian during the evaluation of an expression.

parameterize can be used to install a custodian while creating a new thread, and the new thread is then controlled by the custodian.


Hence, it is crucial to understand the source of past security holes.

for each security hole it is desirable to understand the: error which is the (initially latent) bug, environment which is the semantics enabling the bug, fault which is how the bug is triggered, and failure which is the types of security breaches that could result.


As this example shows, the master and the slave must collaborate.

the master cannot ignore the will of the slave once the slave is initiated.


intx=(int)1.0. intx =(int) (2) The semantic re.nement constraint (also) suggests that only terms having particular shapes be considered as candidates for removal.

syntactic well-formedness alone does not form a suf.cient criterion for the basis of removal.


Runtime objects from the heap are then abstracted to pairs to types and domains.

one or more runtime objects of the same type and in the same domain are considered to have the same role, and are abstracted into one abstract object.


Yet, the change in community size follows the traditional notion of freedom in the OSS pro ject.

people in OSS projects are free to join or leave at any given time.


Hence, linear memory allocation times and the size of the backing store, which doubles the size of one object in the ScopedMemory, lead to the assumption, that the scoped memory area is controlled byte-per-byte.

for one data byte the virtual machine needs one control byte in memory (to handle the absense of the garbage collection).


However, in this work, we mainly focus on exploiting the information about frequent .eld values within the virtual machine.

our schemes can reduce memory space requirements of Java applications without rewriting the application code.


Observing Refactorings Our study evaluated refactorings associated with clones among versions of the JBoss Application Server, an open source implementation of J2EE, and ArgoUML, an open source tool to develop UML diagrams, both of which are written in Java.

the refactorings were identified by observing changes from each pair of consecutive releases between version 2.2.0 to 4.2.3 (44 versions) for JBoss, and nine versions from 0.10.1 to 0.26 for ArgoUML.


Cloud-based resources (e.g., storage objects, message queues) are upgraded on schedules set by the service providers, and upgrades may occur during an asynchronous message exchange between tiers.

third-party provisioning, despite all its bene.ts, will likely introduce the risk of mixed-version races for a wide range of applications.


The following parameter values were kept constant across all the runs.

the size of a log entry is 50B, size of a checkpoint is 2000B, bandwidth of the wired network is 2Mbps, ratio of bandwidth of wireless to wired network (r) is 0.1, time required to apply a log entry (Telog) is 0.0001s.


Fquence s0 ends ) and are related to non-terminal variables.

for a pat tern of the form var xN and the sub-relation that constrains xN and either s0 .


There exist many other static analyses that can improve the performance of lazy programs.

the GRIN project [3] takes a di.erent spin on static analysis.


However, such strategies su.er from the .ghting the last War syndrome.

systems are being designed and developed to e.ec tively contain worms whose behaviors are similar to that of Slammer.


Furthermore, we can apply di.erent development methodologies optimized for each plane.

we can apply control oriented development methodology to the control plane and data oriented development methodology to the data plane, which increases reliability and e.ciency of the system.


While for the details of the OWL syntax we refer interested readers to [7], by exploiting the example provided in Section 3.1 about the car domain, we show a mapping between the SHOIN(D) and OWL DL syntax.

in such example we used the SHOIN(D) assertion Maker T to de.ne the concept Maker.


objects reachable from its arguments, these effects are still bounded even if some arguments are mutable.

the method can only mutate objects that are reachable from its non-immutable arguments.


This special protocol is enforced by the hard real-time Java byte-code verifier.

the byte-code verifier requires that the spawning of a new thread or BoundAsyncEventHandler occurs within a try statement, and that the corresponding finally statement includes an invocation of the join() operation on the corresponding ThreadStack object.


The entire application emerges from local collaborations between Instance Managers that solve adjacent architectural fractions.

each Instance Manager associated to a type finds or creates Instance Managers that are associated to the connected types, according to the architectural model.


(MAM, Name, =, ·) is a re.ective distillery.


Thus far, we have implemented a small number of base evolution action modules.

available for reuse are a module that stores each version as an entire baseline, a module that stores a first version as a baseline and any subsequent version as a change (creating a branch when needed), and a module that simply maintains one baseline that is continually replaced when a new version is stored (as used for directories in the CVS policy, for instance).


A local proof cannot contain an inference that uses both red and blue symbols.

colors cannot be mixed within the same inference.


This means that the interfaces of software components are often designed so as to admit speci.cation-equivalent sequences of operations.

sequences that have the same intended e.ect according to the component speci.cation, and therefore that are interchangeable at run-time.


Although Mycroft s rule is known to render ML type inference undecidable [11], this is not so for our system, as it conservatively extends the ML type system.

since only well-typed ML programs are typable in our system, we can use Milner s rule to construct an ML type derivation tree in a .rst pass, and subsequently use Mycroft s rule and the generalized types inferred in the .rst pass to instantiate dependent types at (polymorphic) recursive call sites.


The resulting static model is overly conservative, mainly due to limited support for aliasing and class constructs; currently, we address these limitations by extending the number of program statements to be monitored dynamically.

we try to preserve soundness at the cost of greater run-time overhead.


As in the basic parallel execution model, once an event commits, any new events it may have triggered are initiated.

any asynchronous methods called by the event will now begin, starting from the head node as with other events ( 6 @).


These problems all arise from the fact that the underlying language speci.cation does not mention threads, and hence does not suf.ciently constrain the compiler.

the current speci.cation does not suf.ciently de.ne when a data race exists in the original program, or when the compiler may introduce one.


This pattern selects recon.gurations based on speci.c scenarios or events.

the InferenceEngine matches incoming Triggers with speci.c Rules.


Theabove assumptionsimpose only moderaterestrictions on PA programs.

they hold for most if not all programs written in AspectJ.


L-BFGS This is a parallelized version of the classical memorylimited BFGS method, as described in [18].

the root machine obtains subgradients from each of the client machines to aggregate into a global subgradient.


The resulting representation is called the scale-space signal, and describes the location of sharp change points in the curve.

the intensity at a point in a scale-space signal is the highest scale at which the change disappears.


This prevents the analysis of the loop from stabilizing by inferring the closure, and the loop analysis instead terminates by widening to the universal relation.

the generated summary allows the values of the next and previous .elds of any Entry object to change, meaning that any number of entries may be removed from the list.


Object gget() when "not empty" and "not after-get" { ... } }  Clearly, this can only be achieved adding code to get to keep track of its invocations.


When the thread encounters XMP directives, synchronization and communication occurs between nodes.

no synchronization or communication occurs without directives.


Therefore, we conducted experiments to study the overhead introduced by the data collection when using the Beaker component of Netlag.

we conducted two experiments to study a) the execution time required to collect sample points, and b) the overhead on the average CPU load introduced by Netlag.


Only certain properties are preserved by our reduction algorithm.

under this execution semantics, the reduction algorithm proposed here preserves (i) deadlocks, (ii) cycles3 , and (iii) local assertions, more formally, assertions on Dom(li) for each process i that are invariant under stuttering.


It appears, therefore, that orthogonality should be treated as an optimization property of a viewpoint framework rather than as a mandatory, identify property (just as it is in physical orthographic projection).

a modeling approach should still be worthy of the name orthographic even if its dimensions and views are not orthogonal in the strict, optimal sense.


The execution model we have is that the loop iterations to be executed in parallel are distributed across available client nodes.

each client node is assigned a set of iterations to execute.


2.4 Algebraic Factorization m P A sum-of-products (SOP) expression, f = Ci, is alge i=1 braic if no cube, Ci, is contained within another cube.

.i, j, i .j, Ci An expression that is not algebraic = .


Our future work includes the exploration of more accurate costbene.t models.

the proposed cost model for loop diverge branches requires the pro.ler to collect DMP-speci.c information.


x Under-mitigating a risk leads to realization of the risk in higher probability or with more severe consequences compared to meaningfully mitigated option.

the risk may realize more frequently or have more severe consequences than is acceptable.


Similarly to the .d language of Moreau [18] we use functions instead of special forms to model binding constructs.

let x = e0 in e is desugared as (.x.e) e0.


Similarly, a MCW developer switched from team A to team C because he knew that according to the MCW software architecture, his team (A) depended on a component implemented by team B, and that B s component was dependent on a component implemented by team C. This developer followed the software architecture to find out to which team he should switch.

software components with a higher degree of dependencies had to be handled more carefully because of their larger potential for impacting other components in the architecture.


Although embedded virtualization has diverse advantages over traditional embedded operating systems, performance issues have been continuously challenged because those systems have inherent performance requirements while having limited hardware resources.

i/O latency in a virtual machine needs to be carefully addressed since it affects the performance of a real-time guest OS.


If the implementation violates the corresponding archface, defects are detected by archface compiler.

the inconsistency between architectural design and its implementation can be checked.


It states that if code only has the capabilities (i.e., non-null references) to write into memory locations at or above certain security level £, then it respects such capabilities.

executing such code does not alter memory locations at security level £i where ££i.


By forcing the underlying invocation graph to ignore the class constructor for sun.io.CharacterEncoding as well as all methods in classes Object, String, StringBuffer, and NullPointerException in package java.lang, and classes TimeZone and SimpleTimeZone in package java.util, we improved execution time significantly without affecting the resulting Permission sets identified.

this optimization is a consequence of the fact that the analysis could be performed incrementally.


Accordingly, Int is interpreted as the set that contains the values 0, 1, -1, 2, ...; Bool is interpreted as the set the contains the values true and false; and so on.

then, unions, intersections, and negations (ie, type connectives) must have a set-theoretic semantics.


The DomoML Framework and, in particular, its ontology is demonstrating its usefulness in many different contexts.


We can say that the postcondition of C1 is a precondition of C2; C3.

if N(true,C1) is unsatis.able, the whole sequence cannot go wrong because of C2 or C3.


Information in the documents was hard to trace in the documentation.

it was dif.cult to trace documents from one department to the next.


Pop, push, and copy methods are then defined, and placed in slots with corresponding selectors, with slot guards that indicate that they pertain to stackParent, which we say is in the role of rcvr, or along the dimension rcvr.

messages sent with a context that includes the coordinate stackParent in the rcvr dimension, or any coordinate descended from stackParent, as well as an appropriate selector and argument list, will match these methods (regardless of any additional dimension-coordinate pairs in the context).


For each issue we make predictions by using all previously submitted issues as training set in which we search for nearest neighbors.

this means that for the .rst submitted issue, we cannot make any predictions as the training set is empty.


Conclusions The block-atomic execution model used by EDGE architectures provides potential performance and energy advantages compared to traditional ISAs, but also presents new compilation challenges.

the compiler must generate full blocks of useful instructions but still obey the block constraints imposed by the ISA.


However, to us, the real problem was that this people, having an object-oriented solution as a target, could not envisage a design solution without objects flying all around the computer and following always the same patterns of behavior, even when the problem would require an alternative solution because of a different balance of quality attributes was needed.

they were not able to apply abstract software architecture concepts, and preferred instead thinking following a specific technology.


2.3 Dynamic Analysis Gaug ute, and/or analyze measusystems.

they inte  models, to produce higher-level outputs: gauges can emit events just as can probes can.


Discrete Triangular Sylvester Equation description equations.

it transforms a single equation into a set of equations, in order to generate divide-and-conquer solutions to the problem.


Therefore, it is apartof a StateMachineLanguage and there cannot be a StateMachineLanguage without the outer container of its body.

meronyms can be used to infer mandatory features in the variability model (see for instance Fig.


3.2 Multi-POST A single POST method call may result in the creation of one or more than one resource classes.

a POST method may have one or more than one targets.


The geometric mean of the GC time overhead is 1.25.

assertion checking slows down garbage collection by just 25%.


From the above analysis based on independent Bernoulli random variables, we see that PM PM t=1 t=1 VarG[F0(S)] pt(1 - pt) pt 1 = PM = PM = .

e2 [F0(S)] ( pt)2 ( pt)2 EG[F0(S)] G t=1 t=1 the number of grounded-stream samples (and estimators) needed to guarantee small relative errors is inversely proportional to EG[F0(S)] (the quantity that we want to estimate).


We show that those term representations are composable in the same way as the languages that they represent.

this composition also re.ects the types of the DSL expressions.


Di.erent service instance dependency graphs can thenbe created according to the preset conditions.

we can enable an adaptive service placement and stitching that changes the service instances, i.e., resulting in di.erent service instance dependency graphs coordinatedby preset rules.


Secure execution of JavaScript code is based on a sandboxing mechanism, which allows the code to perform a restricted set of operations only.

javaScript programs are treated as untrusted software components that have only access to a limited number of resources within the browser.


This allows to generate a chain of speculatively committed transactions that are serialized in an order compliant with the sequence of optimistic deliveries.

during the time window that starts with the optimistic delivery of a transaction T and ending with its .nal delivery, SCert strives to serialize any concurrently executing T 1,...,T n according to their optimistic delivery order, achieving an overlap between communication and processing that is not possible with a conventional (non-speculative) certi.cation scheme.


Their work shows some similarity with the problem studied in this paper.

palsberg and O Keefe develop a constraint-based type inference where typings are generated by solving constraints and extracting a least solution for each variable.


Second, history can help us even when only one user initiated action is su.cient to trigger a bug.

a user initiated action may actually result not only in one event (e.g., new sibling in FreeMind) but an event burst (e.g., new sibling quickly followed by a focus gained event for the edit .eld in the new sibling node).


(list a))) We must instead choose one of: (forall ( a) (list a)) ; polymorphic (?mutable?

(list a)) ; monomorphic in this system, there is no principal type that we can infer for p. Given this, we must .x these maybe types to either mutable or immutable at a let-boundary.


Basically, it resembles a full featured graph editor due to the underlying JGraphX [14] library.

it allows to add or remove nodes and edges, alternate their appearances, apply layout algorithms to automatically place nodes and edges of the model on the screen, and also provides an undo history.


The results of such analysis are the UML diagrams describing entities and relationship involved in the interaction, and the temporal sequence of the interaction messages between the system and the involved users.

the Class Diagram has been produced deriving classes and relationships from the logical data schema (Figure 5) and defining classes that represent the environment (e.g., network and devices).


To narrow the problem space, we identify all supported instructions and then we test the emulator using only few peculiar instances of each instruction.

for each opcode we generate test-cases by combining the opcodes with some prede.ned operand values.


We want to keep the sets small throughout the algorithm execution, certainly, but there is no harm in having a few non-minimal elements.

we need to show how our algorithm can be implemented on sets of representative types, while giving the same answer (up to the operation of picking the minimal elements of a set), and without necessarily using minimal sets at each step.


Many architectural patterns have been created for software architecture, but not for system-of-systems architectures.

standard strategies for end-to-end resource management (including handling degraded modes of operation) do not exist for SoSs.


The sensitivity analyses of our model, shown in Table 4, indicate that the model developed in this study is robust and does not breakdown within reasonable ranges of the artificially introduced bias.

the model only breaks down at 1.5 bias or higher not at regular 1.0 bias levels.


A constant-time function that partitions a set of objects with the same static type into equivalence classes based on the inheritance path of the static type within the dynamic type.

our technique for ef.cient type switching:  Is open by construction (§3.2), non-intrusive, and avoids the control inversion, as typical for visitors.


However, we discovered some limitations which we were forced to eliminate.

although Erlang term handles and pointers to data had been widened to 64 bits, the representation of integers (both small .xed-size integers and heap-allocated big integers) was unchanged from the 32bit runtime system.


Finally, we will use the Dolev-Yao intruder model (see [11]) and the associated assumptions.

we need a way to store the intruder knowledge.


Song and Li did a similar study for Jacobi relaxation [17].

they showed how the dif.cult problem of tiling the time loop in Jacobi can be solved by suitable loop transformations.


It is worth mentioning that a newly introduced technique [18] can handle a special case of this problem.

[18] presents a post-processing mapping re-writing algorithm, which focuses on maintaining the key constraints (equality generating dependencies, or egds) on the target.


All the data from these empirical experiments have been statistically analysed following the guidelines in [1].

we used the Wilcoxon-Mann-Whitney U-test and the Vargha-Delaney A 12 effect size.


Checked exceptions are used to represent those error conditions that a program can recover from and are therefore statically checked by Java s type system.

a checked exception that can escape a Java method (or constructor) has to be a subclass of the exception classes declared in the method s (or constructor s) throws clause.


f S * T .C states that under the assumptions ., if the proposition S * T holds, then C must be true of the inference variables.

when C holds of the inference variables, S * T does not have to hold for every valid instantiation of the bound type variables.


Parametric properties like MQ2 are useful, and we have thus introduced some syntactic sugar to facilitate their writing.

we introduced the concept of parametric multi-expression (or parametric expression in short), i.e.


In order to properly frame an evaluation, we will need to specify a context or downstream analysis for the required facts.

we need to have a task sample that consists of more than just source code.


Time complexity We now establish the complexity of the lattice agreement algorithm.

we measure the time complexity [1] de.ned as the time it takes for a correct process to learn an output value, under the assumption that every message sent to a correct process is delivered in one unit of time.


w to a dictionary witnessing the type-class constraint Modular s a.In general, we want to manufacture and use type-class instances at run time.

we want to declare type-class instances not just at the top level but also locally, under the scope of variables.


(a) Modifying the type staged to accommodate more complex types such as staged pairs and records.


The transformation has now been specialized for the XMail subtype.

the output of reply is of type XMail and hence its linearisation will produce a valid document (up to the limitations mentioned above).


Hence it is vital to integrate it into the application and reuse given software components when possible.

moMi requires two communication mechanisms from an application: Snooping on neighborhood tra.c for collecting remote observations.


$10.00 Employing a recently discovered simple technique for representing multisets, predicates and projections using symbolic representations of collections, our implementation avoids the quadratic run-time penalty of multiplying out cross-products, which often makes using the otherwise attractive use of list comprehensions for SQL-like querying unviable.

(equi)joins can be de.ned na¨ively by composition of selection and cross-product, yet get executed by invoking an ef.cient join algorithm.


The simulation is parameterized by a support set W. As will be clear later, the support set W has the effect of restricting the behavior of PW .

pW will be shown to have .nitely many reachable states and transitions when W is .nite.


Thus while the number of slices being saved increase by a factor of 10., the memory needs of the algorithm increase only by a factor of 1.14 to 5.11.

roBDDs are highly effective in exploiting the clustering and overlapping characteristics of dynamic slices.


At the same time, the whiteboard does not help the exercise either.

whatever is drawn or written remains static and cannot be manipulated other than drawing over it or erasing it.


When docking windows, users can construct a workspace through the action of juxtaposing windows without declaring a group structure of windows.

in DWF, when a user allocates windows side by side, then these windows are mutually connected and the workspace is created automatically without selecting any command to create a workspace and without arranging a window layout.


Major results from the case study are: significantly better than a random technique.

a random ranking has a Lag value fifteen times higher the best NLP technique.


While this inverse proportionality relationship holds for MarkSweep and SemiSpace, we .nd that, on average, GenMS runs in time inversely proportional to the square of the heap size.

the function execution time factor = a/(b - heap size factor2)+c characterizes the trend for GenMS, where the execution time factor is performance dilation with respect to Lea, and heap size factor is the multiple of the minimum required heap size.


In our approach, con.ict is based on potential future behaviors, and threads make nondeterminsitic choices that avoid con.ict (Section 4).

threads may specialize both their view of the shared state (e.g.


In the current setting with both hidden information and hidden action, F P SS ' achieves a Nash equilibrium in the absence of per-hop monitoring, and a dominant strategy equilibrium in the presence of per-hop monitoring, consistent with the results in section 3 where there is hidden action only.

with per-hop monitoring, B G the principal declares the payments si and si to each node upon failure or success of delivery to the next node.


4.1 Experimental Prototype Our prototype extends the MEAD fault-tolerance middleware infrastructure [11] to provide support for multi-modal applications.

the MEAD Replicator is enhanced with MDFT capabilities [6].


The di.erence between versions shows the developers modi.cation on the previous version, and thus we generated faults only in such di.erence so as to simulate most developers faults in software evolution.

for each of the 11 functions of Apache 3.2, we applied MuClipse [62] to generate a number of mutants whose mutation operators10 occur only on the di.erent statements between Apache 2.2 and Apache 3.2.


The deployment has to be highly e.cient because its main uses are administration tasks and development of parallel applications which are interactive tasks.

the user waits for the result of his deployment before deciding what to do next.


All signals are produced during the begin phase and are consumed during the end phase.

registers are written in the begin phase of the write-back (WB) stage and are read during the end phase of the ID stage.


The scenario consists of an instance of class Customer passed to a remote method call that uses only some of the fields of the class.

the remote method invocation uses the Customer s id and postal code to determine a shipping rate.


Binary temporal connective S means since .

a temporal formula F1 S F2 means that F2 held at some time in the past, and since then F1 always holds.


In general, there is a one-to-one mapping from classes to C API types but in some cases, such as image types, we choose to break this model and use inheritance.

we felt that OpenCL C s choice to represent image and buffer objects as a single cl_mem type was a mistake and did not .t with our original goal of typesafety when possible.


Therefore, the rate of events that peers receive and forward though lacking a matching subscription (false positives)is an important factor for the resource overhead in such a system.

false positives waste system resources by increasing network bandwidth utilization and inducing extra processing load on the peers in an overlay network [30].


Most JITs, however, prefer to implement faster allocation algorithms in an effort to increase allocation ef.ciency.

linear-scan algorithms are a popular choice for runtime compilers [19, 22, 18].


Furthermore, execution of a single thread does not interfere with the state of other threads present in the system.

any of the previously veri.ed threads can also be veri.ed in the .nal con.guration.


A level 3 answer would correspond to an average answer, which is considered as indifferent.

the average answer corresponds to not identifying significant benefits, or drawbacks in using the Theme/SPL approach, when compared to the baseline alternative.


The state of a user interface, however, consists of more than the combined states of its individual attributes.

it includes information on which functional dependency was applied to obtain the current value of each attribute.


3.8 WWW Link Graph The second semester of the course, especially the Java thread semantics and the foundations of concurrency (Section 2.5), contains much technical material and concepts that students are not familiar with.

the fact that the scheduler decides on the order of the execution of individual JVM instructions is in stark contrast with the deterministic execution model taught in introductory courses.


{cameron, candebat, david.gray}@computing.dcu.ie  ABSTRACT In this paper we describe an architecture that supports the secure operation of Location Based Services (LBSs) over the Internet.

we describe a three-party protocol that is used to mutually identify and authenticate users, LBSs, and a trusted middleware infrastructure that is responsible for managing the users identity and location information.


If that expression in turn reads from the original, it will create an infinite loop.

two classes cannot query each other to determine their interfaces unless special care is taken.


First, we will extend our CloudSim based simulation system to allow us to assess the range of usefulness of DTVM given variation in duration and extent of increased resource demand.

we are interested in characterizing when DTVM is a better choice and when the cost of live migration should simply be incurred.


This paper proposes the use of a Vector Auto Regression (VAR) model, a generalization of univariate Auto Regres sion (AR) model, to capture the evolution and the interde pendencies between multiple time series.

we use the bivariate Granger causality test [4] to identify if the changes of a software artifact are useful to forecasting the changes of another software artifact.


This constraint only applies if the playback rate is increased.

l denotes the lower bu.er threshold in seconds, B the current bu.er .ll state in seconds, bc the client s bandwidth, and br the bit-rate of the selected representation.


An individual personality can act as a motivational factor in the modeling process.

it is possible to argue that the main activities of software modeling are influenced by the personality of the software engineer.


In our current implementation, we have chosen to relax transparency in this case.

native code executing from the code cache that reads the hardware table descriptor registers would be able to observe that they point to DRK memory locations, rather than the original tables.


This definition emphasizes that the vulnerability is an internal quality of the depender in a dependency.

how vulnerable an agent is, regarding a dependum is only related to the importance of the dependum for the agent himself.


Cases in which a feature does not use a plausible capability are not necessarily errors, but indicate that a programmer may have found a different way to implement the system than envisioned in the requirements.

a programmer might choose to virtualize the implementation (e.g., consuming a capability for the .le system but actually using an in-memory store instead of the persistent store).


This separation allowed us to implement several previously proposed approaches as policies that plug into the framework.

we reimplemented the following strategies: (1) a randomized version of preemption bounding [19], (2) AtomFuzzer [22], (3) simple random sleeps, and (4) probabilistic concurrency testing (PCT) [5].


There are many other straightforward examples of the power of the supported models, but also many open problems.

many classical lower bound results no longer apply, which makes it more challenging to understand the fundamental limitations of local algorithms in the supported model.


A plugin de.nes (a) base types and primitive operations, and (b) a change representation for each base type, and an incremental version for each primitive.

the plugin speci.es the primitives and their respective derivatives, and ILC can glue together these simple derivatives in such a way that derivatives for arbitrary simply-typed .-calculus expressions using these primitives can be computed.


In our study proper statistical tests were used.

a non-parametric test (i.e., Mann-Whitney test for unpaired analyses) was used to statistically reject the null hypotheses.


This result is consistent with the results described in §4.1.

the .rst four linearly-increasing portions that appear in the TRIM test result of Fig.


It can happen that a load instruction may bypass the ucache only along some of the execution paths and cannot bypass the ucache along other paths.

the bypassing probability of a load can be less than 100%.


While these methodologies lead to executable prototypes relatively late and are expensive when requirements change, we explore a rather evolutionary approach with explicit support for change and rapid feedback.

we apply Extreme Programming, a modern agile methodology from object-oriented software technology, for the design and implementation of multi-agent systems.


In this paper we sketch answers to a subset of these questions, based on our perspective of research over the past three years on the Rainbow Project at Carnegie Mellon.

we describe how we have instantiated the general paradigm outlined above.


Because of this, the altitude parameter is not implemented.

the search is still performed on the 2D data and the resultsshowninGoogleEarth arethendisplayed as3D sensor data.


Treating them as different turns out to be impractical, because it can expose compiler optimizations.

a compiler might optimize (+ 12) to 3; if frames are really compared at the level of their content, then such optimization differences become detectable within the language (which is generally against the spirit of optimizations).


Since all parts of the system are modeled as separate processes running in parallel, they are activated in all macro steps, although some of them might not contribute to the overall result.

if no arithmetic operation is executed, the ALU is nevertheless activated and some output is produced (depending on the implicitly speci.ed operation and arguments), and accesses to the register .le are made even if they are not needed for the instruction.


We further assume that sensor nodes forward the sensor data one by one to the base station as shown in Figure 1.

node N1 sends its data to node N2 , and N2 sends its own data as well as the relayed data to node N3 and so on without interweaving transmission among the nodes.


The model can be visualized in ROSE and used to navigate the transformation paths.

the model query features that ROSE offers are helpful in targeted searches for specific elements.


However, DTFS consumes less space than existing copy-on-write file systems that provide the same reliability level.

we provide two versions of file systems logically, but they share data blocks that do not differ from each other as shown in Figure 3.


When a procedure is called, the stacked registers are renamed such that the caller s first register in the output area becomes r32 for the callee.

the frame of the caller and callee overlaps the output area of the caller is the input area of the callee.


Thus, the contents of the object .les has to be parsed.

symbolic references must be distinguished from raw binary content.


The main drawback is that there is often a disconnect between the desires of application users (low turn-around time, fairness) and the schedules computed by batch schedulers [42, 28].

it is often dif.cult for a user to estimate when a job may complete, sometimes motivating creative strategies to mitigate this uncertainty [35, 10].


The central role of architectural concepts in our system model changes that fact.

it allows us to leverage explicit architectural styles, subtyping relations among components, and behavior and constraint specifications for three important purposes.


Further, they can be weighted with probabilities in the model.

an architect can estimate the probabilities of occurrence of .exibility scenarios.


In the open environment available information about a non-local software entity (and its owner) is often incomplete and inaccurate, which make it very difficult, if possible, to verify and validate the software component and system objectively and accurately in the same way as used before.

the autonomy and cost-of-use of software entities in open environment makes white-box analysis and black-box testing on them generally infeasible.


Proof of Correctness for the Checker After building and testing the checker, we wanted to prove its correctness with respect to the sandbox policy.

we wanted a proof that if the checker returns TRUE for a given input binary, and if that binary is loaded and executed in an appropriate environment (in particular, where the code and data segments are disjoint), then executing the binary would ensure that only the prescribed data segments are read and written, and control only transfers within the prescribed code segment.


Nevertheless, it is common practice to use a denotational style [18] for reasoning about Haskell programs, and we do so as well.


The ROI is calculated for each set of random input values.


P Syntax and Semantics Figure 3 shows the syntax of the core of P. Some of the features presented in the examples of Section 2 can be compiled using a preprocessor into this core language.

state descriptions in the core language are triples of the from (n, d, s1, s2), where n is a state name, d is a set of deferred events, s1 is an entry statement, and s2 is an exit statement.


The compiler examines whether direct bu.ering can handle all references to this global variable and only applies direct bu.ering in that case.

the variable will never be accessed through both software cache and direct bu.ering.


Agitator does Software Agitation, which is defined as an automated way of exercising software code and providing observations about its behavior .

agitator creates instances of the classes being exercised, calling each method with sets of input data (provided by static analysis of the source code to cover both boundary conditions and normal conditions), and analyzing the results.


As mentioned in Section 3.3, while the values for variable inputs must be saved at the time of the compilation, the values for fixed inputs can be saved at the arbitrary time.

the values for fixed inputs can be saved at the time of creating the system dump.


However, incorporating the techniques in Section5should address these issues and improve performance.

using multiple replications in SybilControl was expected to help improve performance.


Architecture domain is concerned with management of architecture resources.

the management of the reusable components library is carried out by this domain.


al [18] provide a detailed discussion of recovering C++ data structures from binary code.

they are the .rst to describe heuristics for recognizing C++ objects by monitoring the use of the ThisPtr in binary methods.


This is done by populating IDE views only with elements interesting to a developer.

mylar .ltering decreases the size of the text-based IDE views, making them manageable in large software projects.


Figure 4 shows the median total movement of all hosts along time.

at any timepoint t > 0 we computed the total movement of a host i that us incurred during updating its coordinate for the latency 0.6 0.4 Vivaldi MP-Vivaldi, 0.2 W = 4, a = 0.5 (reaches 10504) 3 4 measurements lt j. i,j , i= Figure 4 is created after taking the 0 1 2 median total movement of the hosts at a speci.c timepoint 95-th Percentile relative error per host (b) CA-Vivaldi, .


If a lease is not refreshed (i.e, its life is not extended), it can expire and, consequently, the entry is deleted from the registry.

the host assumes that the queue will be unreachable from that point in time.


Di.erently from the Linda model, TuCSoN has been conceived originally for providing a suitable infrastructural support for engineering distributed application scenarios [13].

tuple centres are distributed through the network, hosted in the nodes of the infrastructure, and organised into articulated domains [4].


However, it works well enough to illustrate the bene.ts of inter-transfer scheduling.

wFA will work well on a full bisection bandwidth network, where the outgoing links from the nodes are the only congestion points.


Both these steps take into account intra-core and inter-core data access and reuse patterns as well as the on-chip cache hierarchy of the target multicore architecture.

the mapping component further contains two sub-steps: iteration-to-virtual core mapping and virtual core-to-physical core mapping.


Variability Modeling Variability modeling in EASy-Producer is based on the notion of decision modeling, but provides specific concepts supporting the requirements for variant-rich ecosystems.

this includes model composition, access restrictions for parts of variability models, and extension of variabilities to support variabilities without predefined ranges.


Conclusion In this paper, we revealed that the data prefetching problem is closely mirrored in the business discipline of supply chain management (SCM).

the inventory theory models can be used to draw insights into the prefetching resource allocation problem when concurrent application request streams possess different accessing speeds, as well as the access pattern information propagation problem in multi-level prefetching.


In our evaluation, of the final constraints produced by INDICATOR, 86.5% were validated using criterion a, while 13.5% were validated using criterion b.

iNDICATOR determines whether the error messages and the candidate s description are alike, by computing the highest similarity between each pair of the error message and the candidate s description.


To ensure this, just before the process q enters the CS, q captures all processes that have a smaller ticket (line 23).

since process p .nishes the doorway before q starts the doorway, process p s ticket will be strictly smaller than q s ticket.


Each expression is designed to show whether a particular condition positively or negatively a.ects the outcome of a decision.

if the expression is true, then the corresponding condition is guaranteed to a.ect the outcome of the decision.


Assumption error is about whether we are sure about the actual values of project P being estimated.

there are different possible values representing project P that we should consider.


The coordination between attackers is specified at action level trough precondition and concurrent conditions.

a coordinated-attack plan P is a sequence of joint actions: p : (a0(s0),al(sl),,ak(sk))  where a joint action aj (s j), taken in state sj, is defined as the com- bination of all concurrent actions executed by each attacker in sj : aj(sj) : (alj(sj), a2y (sj), ..., ann(sj)) Every coordinated-attack plan starts in the current state so and finishes in some final state where the attackers's goal (or goals) is achieved, i.e., the system security is compromised.


We can .x this by adding the type signature fact :: Cmd (s,Int) (s,Int) Now the program typechecks, but when we try to use it, we immediately fall into a blackhole.

the outer fact cannot be evaluated without evaluating the inner fact.


Thus we de.ne our estimator F 2(S) = VarG[F1(S)] + dK 1d2 2.

since VarG[F1(S)] = 0 provided all 0 = pi = 1, the sum of the .rst and third terms above is a non-negative quantity; hence, summing a (1 ± E) estimator for dK1d2 with exact values for VarG[F1(S)] yields an estimator for EG[F2(S)] that is within a (1 ± E) factor with probability at least 1 - d. our probabilistic AMS technique (pAMS) is a guaranteed (E, d) estimator for EG[F2(S)].


Note that existing ADLs deal only with variants and options in architecture.

all variants must be represented in an architecture description, so that users can choose among them.


Because .oating-point arithmetic is only an approximation to real arithmetic, MF(v) is not necessarily equivalent to MR(v).

there are ways in which MF(v) can fail to be locally deterministic.


As the functionality of these sub jects does not change from Apache 2.2 to Apache 3.2, these inferred MRs should not be violated.

the false detections in this table result from low-quality MRs, which are inferred by our approach without MR .ltering.


We used the same parameter tuning as in the original (highly optimized) collector.


The problem in both cases is that if a data structure is extended (i.e., a singly-linked list becomes doubly-linked), then all operations should be updated to maintain the consistency of this extension, and not just some.

if a singly-linked list has both insert and delete operations, when the structure becomes doubly-linked, both operations must be updated to work on doubly-linked lists.


In both cases, any pre-existing move instructions are aggressively coalesced prior to register allocation.

the allocator cannot simply split a live range by choosing not to coalesce; a move must be inserted.


By getting such data from the relevant I/O devices, it is possible for the system to identify applications that are of immediate interest to the user, and prioritize them accordingly.

this solves the problem shown in Figure 1; the results, in which Xine is automatically prioritized relative to the stressors and retains its full frame rate are shown in Figure 5.


For this reason, we decided to simplify some things.


In this step, each edge in the graph might pair with each of its neighboring edges.

for a given node j,each of j s incoming edges might pair with each of j s outgoing edges.


We model the I/O dynamics of a large-scale SSD, and use the mean .eld theory to derive the asymptotic results in equilibrium.

we classify the blocks of an SSD into different types according to the number of valid pages contained in each block, and our mean .eld results can provide effective approximation on the fraction of different types of blocks in the steady state even under the general workload.


|capture(fi)|=|alloc(fi)|-|escape(fi)| |control(fi)|=|capture(fi)|- |capture(c)| c.children(fi) This computation of cardinality from the primitives alloc and escape is precise, even in the presence of set subtraction.

we prove that we only lose the knowledge of what objects are in each set; we still know the exact size of the sets.


It would also be useful to o.er more .lter options for feeds.

it should be possible to distinguish between items that require action, such as failed builds, and items that do not require any action, such as successful builds.


Therefore, a natural question is: is there anything in between the reproducing it after thousands of reruns reality and the reproducing it on the .rst replay goal that existing research ideas are shooting for?

are there any methods that can reproduce bugs on multiprocessors with only a few (e.g., < 50) replay attempts while adding only small (e.g., < 50%) recording overhead during production run?


In agreement with experiment [26], results suggest that small changes in L-type calcium and sodium/calcium exchanger total fluxes in the junctional cleft may significantly affect the cell function.

figure 12 shows a Lenth plot for the AP duration.


When comparing abstract values, we cannot ordinarily infer concrete equality from the abstract.


What is worth noting is that the interplay between hashCode and equals is speci.ed as part of the object contract.

the hashed values must respect equality of objects.


These groups of subprograms reflect both functionality (Prepare / Response) and non-functional properties (Deliver / Observe) with real-time constraints bound with the architectural artifacts.


4.1 Experimental Setup and Workload We implemented the recovery protocol as a pluggable module which integrates into any publish/subscribe application and protocol that provides a common publish/subscribe API.

the publication record and other metadata required by the recovery protocol is attached to messages as an array of bytes treated by brokers as application payload not subject to the matching process.


Theorem 8 implies that r must be O(n+ b)to achieve a small error probability.

if d>max{j3 ,2m,8}and we pick r>1.5(n+1) +2b, then the error probability 3 (r-1.5(n+1)-2b) is bounded above by ( d 1 ) 2 .


Relators are the foundation for material relations [11], such as the relation defines an operational definition for between Organization and Measure.

material relations have material structure on their own.


For example, novices in OO-programming or programmers with a large experience on procedural languages (who naturally find it difficult to adopt the object oriented way of thinking [2]), tend to capture most of the domain and application semantics within a small subset of classes, occasionally within a single object [13].

the outcome of the analysis is often one or more "God classes [20], which perform most of the work in the system.


On-Demand remote invocation (target structure) Figure 1.

class X .rst gets the in-VM reference of class N and then invokes the methods of N. Such a structure does not support of.oading any computation in class N because if N is of.oaded to a remote server, N s in-VM reference held by X becomes invalid, i.e., it cannot help the VM pass the method invocations to N, and X will fail to obtain the new in-VM reference of N. Figure 2 presents the typical code structure that enables class X to invoke the methods of a remote class N. X gets a remote reference to N from a remote communication service, then uses the reference to interact with N remotely.


WEAK: an entry in the spark pool is only alive if the object to which it points is independently reachable.

the spark pool contains weak pointers in the usual terminology.


For example, going from scalar to static array more than doubles the overhead.

these microbenchmarks reflect worst case scenarios as they are always busy tolerating races inside a critical section.


We have exemplified our approach using scenario-based notations and scenario synthesis because they are being used increasingly to support behaviour model construction.

in this paper we have used an example based on scenarios and OCL pre- and post-conditions.


Our idea of using stateful breakpoints to de.ne runtime monitors goes, however, much beyond the idea of simple control-.ow restrictions.

we propose to enable programmers to de.ne stateful breakpoints using declarative patterns such as regular expressions.


This favors the re-use of Heptagon/BZR nodes in di.erent contexts.

the repair manager is re-used in the replicated tier and for the load balancer.


Whether a thrown exception represents a real fault is an import question for automated unit testing.

it is important to develop techniques to .lter out uninteresting exceptions that likely are just due to violated implicit preconditions.


This approach lets us handle a range of situations that may occur in real programs.

it accounts for cases where an offset is added to (resp., subtracted from) a pointer, and the offset was computed by subtracting (resp., adding) two pointers.


Ourtechnique makes severalimprovements over their approach.

the static analysis that we use in Phase 2 is context-and .ow-sensitive, which allows us to be more precise and to capture distinct interfaces that correspond to di.erent paths of execution.


It is important to remember that since the Timber compiler has been developed by a very small team, the compiler has some restrictions.

the compiler only does simple program analysis and optimization, it generates C++ code whereas other Java compilers usually generate machine code.


6.2 Open Issues 6.2.1 Generalization of the Method We are now aiming at generalizing this approach to other securitypropertiesthan sequencingproperties, and to other formalisms than regular expressions.

we have mentioned in Section 3.3 the possibility to express the security properties as temporal logic formulas.


In this paper, we describe the design and implementation of a component framework for vector, which is undoubtedly the most used container of the C++ standard library.

we specify the details of a vector implementation that is safe with respect to referential integrity and strong exception safety.


Secondly, we strive for the protection of the type system but not the application itself.

we only protect those items which are necessary to preserve spatial isolation provided by a type-safe programming language.


5.1 Requirements Since we want to isolate the performance impact due to memory contention, it is important that the Bandit does not fight with the Target for any other shared resources.

the Bandit must avoid using a significant amount of the shared cache, as the Target's performance may be sensitive to its shared cache allocation.


Finally, using jOLSR and OMOLSR we have modified an existing group communication middleware (JGroups) to support MANET settings.

group membership is obtained from the OMOLSR protocol, failure detection from the jOLSR protocol, and our modified flow control protocol benefits from jOLSR topology information.


Contrarily to conditional directives, macros cannot be completed since each call to a macro would provide a different ending, in order to parse macros, we propose having the scanner work as a filtering process sothat the parser receives tokens corresponding to the C grammar.

when the scanner finds a macro identifier, instead of sending the identifier to the parser it will send the replacement text.


it is dividing an SMC into multiple secure computations and neighbor peers execute each computation in parallel.


This is the curvature scale-space as described in [10, 7].

it can be shown that in the case of Gaussian smoothing, the zero-crossing contours are always closed at the bottom (higher scale) and open at the top (U shaped curves).


However, opportunities to improve on the canvas based editor concept may remain.

the 2D canvas idiom may be the source of several types of navigation inef.ciency.


Instead, we introduce a minimal form of annotation, that might be generated by the development environment from higher-level defaults, and show how it can be given a sound semantics.

we allow module expressions containing coercions, e.g.


This property represents the desired interaction protocol for accessing the information related to the water .owing in the pipe of zone p1.

it is mandatory for C3 to be authenticated before accessing to the information related to the zone p1.


It is measured as follows:  X X P(t, c) IG(t)= P(t, c)· log (24) ¯ P(t)P(c) c.{ck ,c¯k }t.{ti,ti } From its de.nition, it is clear that the IG strategy is a supervised strategy.

it uses the document labels in its choice of features to retain.


The core of FORM lies in the analysis of domain features and the use of these features to develop reusable and adaptable domain artifacts.

fORM is a feature-oriented approach to product line architecture engineering.


This evaluation semantics is designed to avoid leaking information between public and private facets.

if C[ ] is any program context, then the computation C[(k ?


We observed that architecture teams with this information appear to be somewhat better at designing fault tolerance measures in a system than those without the information.

they can better select tactics that are compatible with the architecture.


Finally, FT s subtype relation forms a join-semi lattice.

any two types T1 , T2 have a well de.ned least upper bound (denoted T1 .


For each toplevel function, the inputs controlled by DART were the arguments of the function, and the search was limited to a maximum of 1,000 iterations (runs).

if DART did not .nd any errors after 1,000 runs, the script would then move on to the next toplevel function, and so on.


In order to allow the last chunk to be received by all receivers, we need to choose our observation interval end time wend such that wend >tC .

let be wend = tC + Dmax, where Dmax is the maximum delay we are considering in our evaluation of the system.


In addition to heap symmetries, our checker also handles other symmetries.

if the actual values of integers in a program do not matter but only their relative ordering matters, our checker prunes states which are symmetric in the above respect using e.cient BDD operations.


Interfaces exhibit some of the part-whole relationships found elsewhere [30, 21, 2].

an interface I may implement functionality required by another interface I. to carry out a particular activity.


4.4 Benefits and issues 4.4.1 Benefits Transition from standard Java to PERC Pico requires very few modifications of the original software architecture and code.

the application remains mainly free from memory management code (creation, deletion).


4.3 Impact on Execution Time From the results, our schemes have a significant improvement over a unified circular buffer and a generational buffer in terms of A common pitfall in cache performance evaluation is the miss reduction, which translates into considerable performance overemphasis on miss (rate) reduction while omitting the fact that speedup.

the adaptive scheme does as well as the a significant miss reduction sometimes affects little in the overall fixed scheme in most cases, and in a few cases does substantially optimization objective.


pmap g Thus a parameterised monad is just a type-indexed family of monads.

for each type c, the map f c sending a type a to fac is the monad whose return operation is given by preturn, and whose bind operation is given by >>!.


Data Manager Library The second library, the ESDataManager2, implements all aspects related to formatting, storing, and transmitting the data.

this library di.erentiates between three kinds of data: sensor data, application error data (e.g., exception messages), and extra data of the form (tag, data).


The genericity is related to the total decoupling of application and protocol personalities.

an Figure 2: The schizophrenic architecture application personality can collaborate with any protocol personality, and in a transparent manner.


Since attribute values often capture information that is speci.c to a given execution, but with little relevance when compared with other executions, such as the case of process identi.ers, LFA pre-processes attribute values to extract more general and reusable information than concrete attribute values.

lFA eliminates attribute values and modi.es event names to incorporate information about the regularity of the distribution of those values across events.


It is a theoretical study that proposes a general formulation that in some sense encompass the existing ones and outlines the fundamental limits of the method.

it does not consider the problem of .nding pruning properties, but only the one of re.ecting them as precisely as possible, without the help of any complementary method (e.g., graph transformation).


In .gure 6 we show the graphical interface we use to load the XMI documents of the analysed Software Artefact, which is drawn on the right, and the ODOL+OWL-S representation of the examined Pattern, reported on the left.

here we show the UML class diagrams representing the Active Object implementation (right panel) and a graph representing the original pattern (left panel), which portrays the instantiated class of the ODOL ontology (rectangles with a white background) and the corresponding individuals (rectangles with a dark background).


hBad x) Therefore,we shouldimpose some restrictions.Anaturalideaisto exclude those that duplicate, discard, or disorder elements.

as the following equation describes, the function should be able to put back the original list if no computation is performed.


Absence of errors in small instances can thus boost the con.dence we may have in a positive answer for the whole veri.cation.

most .aws in models can be observed in small instances, since they arise from some shape being handled incorrectly.


The reason for this separation is to enforce a few syntactic restrictions on the language.

nested datatypes(Bird andMeertens,1998) and constructors with functional parameters having recursive occurrences (Meijer and Hutton, 1995) are excluded, since traversals are hardtode.nefor those types.Despite these restrictions, the data constructorpresentedhereis comparablein expressive power to ML-style and Haskell 98-style datatypes, allowing us to express (type-)parametrized datatypes, mutually recursivedatatypes and existentialdatatypes.


Vehicular Content Delivery Network (VCDN) refers to the organization of a VANET as a CDN.

it means that some vehicles are selected to act as content providers and to then help on the delivery by using vehicleto-vehicle communication.


We now set up the formal notation to describe the run prediction phase.

the prediction algorithm will ignore computation of threads, and interleave at the level of blocks of local computations that happen between two reads/writes to global variables.


New requests are issued with the Prop rule.

we In this phase we use the space explored by the Explore algorithm to create patterns.


In order to guarantee exclusive access to a resource, the algorithm must preserve the lease invariant.

all valid leases for a single resource must have the same lease owner.


Anice feature of k-FCFS is that it makes sense for all k = 1.

for k = 1, it is simply the FCFS property for ordinary mutual exclusion.


A Java method can invoke native functions written in C. In the HLD level, a native method is modeled directly as a Coq function (see [9]), not using the Java-like syntax.

an interface is needed to combine the model of the native code and the one of the Java methods.


there are no promises regarding safe delivery (except no reordering), especially during temporary communication failures.


Because .eld reads yield permissions, we have to be able to track for how long those .eld permissions are used after reading a .eld.

if a .eld carries a unique permission, as a in Figure 2, then we don t want that permission to disappear on us.


The model aims at establishing a common understanding of the support that should be provided by a generic B3G-SOM and can be considered as a facilitator for designing architectures of speci.c B3G-SOM solutions.

the entities and relationships within our model, and the rich textual description, should be intended as base guidelines to be considered while designing B3G-SOM architectures.


Based on these dependencies there were 19 different possible combinations of alternatives.

we need to evaluate 19 architectures against each other.


Our study focuses instead on the "why", that is, the causes behind the problems observed.

we study Paradigm-type systems, where a pre-ID serves as a reference for the construction phase, but is not strictly enforced.


If the subgraph rooted at a shared node can be fully covered by a single tile, the shared node remain unaltered, otherwise shared nodes become roots of trees to be tiled.

shared nodes are .xed unless they represent an expression that can be fully covered by a single tile.


From Figure 2, we can see that after using the information of all levels, the estimation accuracy has the potential to be considerably improved.

suppose there are two optimal estimators, the .rst can use only the information contained in one level of bits, while the second can use the information contained in all levels.


Informally, the above definition states that for a protocol P to satisfy the K-protection requirement, whatever information it passes to a peer X (other than C and S) should not increase the certainty of X about the result beyond a certain limit.

x should not be able to determine, with a probability above a certain threshold, that any given value v belongs to a column RjX in the result RX (the translation of RC to X s schema).


CSSV applies a whole program .ow-insensitive pointer analysis to detect statically which pointers may point to the same base address.

for every function, it provides a summary of all of its calling contexts.


Since both of these properties are desirable, PDT incorporates both small and large neighborhoods.

pDT tracks the best locations in three-particle neighborhoods and a global neighborhood.


Through them, state containers can be manipulated using any CORBA-compliant programming language or platform.

multiple implementations (possibly in different languages) of the same object can exchange their state, making it possible to migrate an object to an incarnation written in another language.


except for addition of new permissions for ..


Both functions take a constraint-list argument and return a constraint-list result.

they return the empty constraint list when passed as an argument.


However, we can make some general observations, which seem to support our hypothesis that change metrics are better defect predictors than code metrics.

those are: For Eclipse release 2.0: Regarding the percentage of correctly classified instances the change model performs significantly better than the code model.


However, this area tends to take fundamentally different approaches than necessary for our framework.

it is centered around issues with engineering name binding (e.g.


A PROPOSAL OF A PATTERN MV-C-UI For the use in ambient computing environments, this work proposes a derivation of the MVC-pattern called MV-C-UI (Model&View-Controller-User Interface Implementation), in which the cuts to implement physical distribution are denoted by the symbol - (minus).

the controller is separated from the application host and free to (partially) migrate to other devices.


Such bugs are often di.cult to .nd because they happen only under very speci.c circumstances which are hard to reproduce.

a successful pass of all tests doesn t guarantee the absence of data races.


These are used to schedule phase-B subtasks and are referred to as VPB virtual processors .

from each physical processor pp,we create 1+ .


Damasc can be leveraged by existing applications without rewriting the application code, as long as data management libraries (e.g., NetCDF [20], NetCDF-4 [34], HDF5 [13], MPI-IO [10]) are rewritten to interface Damasc.

rewrite only the external libraries to issue declarative queries instead of reading/writing byte extents.


As a remedy to these problems, this paper presents CMOD,a novel tool that provides a sound module system for C by enforcing four rules that .esh out C s basic modularity pattern.

c MOD aims to enable safe modular reasoning while matching existing programming practice as much as possible.


Although this minimalist approach is useful in the first stages of teaching objects and in exploratory design, we suggest that most designs should evolve towards building classes with a rich set of constructors and methods so that the instance objects may be born mature, that is, ready to use in the program without further tweaking.

we believe that if students are taught to design in this manner, then they will be more effective both as students and as computing professionals.


When the language evolves and a new construct or idiom is introduced, it should be accompanied by a refactoring that replaces instances of the outdated construct or idiom.

such refactorings would be developed proactively, alongside changes to the language, rather than as a reactive, best-effort attempt to upgrade codebases.


CONCLUSION AND FUTURE WORK The main objective of our project is to investigate whether the recommendations of CompetiSoft would be useful for a middleranged governmental organization.

we introduced a case study for improving customer satisfaction at the Informatics Area of the Justice System of Neuquen, Argentina.


Our model is similar to the cellular automata that have been studied extensively since von Neumann s early work [4], but differs in that it is more closely related to biological processes.

we support a notion of cell division, a communication model based on chemical diffusion, and a rudimentary model of the physical forces involved.


Given this data tile, we can easily identify the set of iterations (iteration tile) that access the elements in the data tile.


LLL supports (a) programs seeking to load a new component [14], (b) applications trying to reduce memory usage [30], and (c) interface oriented systems trying to switch between implementations [39].

traditional procedural programs stand to benefit the most.


There is an invariable, no doubtful and static agreement between the program and its context.

the programmer may say that it is not his/her responsibility when he/she faces the above difficulties.


A test case providing requirements antecedent coverage over such a requirement will ensure that the antecedent A becomes true at least once along the satisfying path.

the test case would satisfy the obligation G(A .


Before the aspect weaving is performed, the AO-Handler ensures the aspects are type compatible by performing type-safety checking using the TypeValidator component.

it checks if the aspect exposes a matching interface and receptacle and its methods operations at the callee and caller components.


Most regression testing techniques and tools would be complementary, rather than alternative to BERT.

test input generation and maintenance tools, such as Parasoft Jtest [5], could be integrated with BERT to improve its test generation and execution phase.


Implementing this automatically requires some annotations on the speci.cation, as well as a fairly complex analysis of the base program, however, going well beyond the cheap techniques we have introduced here.

such analysis is necessary when it is not deemed acceptable to modify library code, to check that certain objects are constructed only in the compiled code, and not elsewhere.


(j, t) = 0 for all i < j < n, or there exists a position i < k < n such that t is released at k and .

(j, t) = 0 for all i < j < k. once a task t is completed, it cannot be executed until the next schedule(t) instruction.


To show a linear address range in a 2D display map, the linear range is wrapped repeatedly.

the upper-left corner of the display map represents the smallest address, and the lower-right corner represents the largest address.


its major limitation is that our techniques are limited by the Heisenberg effect; for example, we cannot gauge the presence of a small file (less than a page in size) in the cache without bringing the entire file into the cache.


With the .rst condition, we address refactorings that are applied to the feature model.

this condition ensures that all combinations of features speci.ed as valid in the before-edit version of the feature model are also valid in the after-edit version.


Here, we show what these skipped paths correspond to in typical programs, i.e., we show what code is typically analyzed at a particular approximation level, and what code is not visited at all.

the analysis typically only applies full sensitivity for classes whose object contents must be distinguished to precisely answer a query, e.g., to .nd the contents of a particular Vector object.


A class of a component is just an implementation of functionality specified in the metainterface.

a metaclass may consist of a metainterface only (having an empty class), and then the whole implementation should be synthesized automatically from a metainterface.


This project is using several exemplars from a variety of US Federal agencies as the first step to providing guidance in how to improve access to tables.

we are examining the tables presented in government statistical portals such as Fedstats (www.fedstats.gov) and the American Fact Finder (http://www.census.gov), and CD-ROM sources such as the Statistical Abstracts of the United States.


It also agrees with the interview-derived data from Project D. We also used several additional measures to triangulate our results: evidence is stronger where analyses using distinct measures concur.

we used two additional metrics to measure productivity: the number of modules modi.ed per sta.-month and the number of completed MRs per sta.-month.


We demonstrate this observation empirically on several SPEC benchmarks and commercial applications.

we focus on degreebased metrics of the heap-graph, such as the percentage of heap vertexes with indegree = outdegree, percentage of leaves and roots, which are sensitive to the structure of the heap-graph.


The change to new design processes is text driven.


Finally, removing geographic bootstrapping to yield the basic Pyxida algorithm, we see a large drop, showing that the majority of Htrae s performance advantage comes from this bootstrapping.

it is clearly not due to the use of spherical coordinates, since we .nd Vivaldi does badly when modi.ed to use them.


Duplicating queues Aduplicating queueisa double-ended queue that potentially returns a pushed element more than once.

the Push and Pop operations behave like normal, but the Take operation is allowed to either take an element (and remove it from the queue), or to just duplicate an element in the queue.


In other words, every state that can execute the trace Tr.p can also execute the trace Tr.p ' .

if p ' is a sound slice of p and WP.true.


But we again decided to use de Bruijn indices for the same reason as for term variables: names are dif.cult to reify ef.ciently as types in GHC, and reasoning about freshness would introduce a lot of complexity and force us to restructure the code signi.cantly.

essentially the same arguments that led us to choose de Bruijn indices for the term variables, led us to use de Bruijn for term-level type variables.


if ((wheat & farm) or (wheat & commodity) or (bushels & export) or (wheat & tonnes) or (wheat & winter & ¬ soft)) then WHEAT else ¬ WHEAT Such a method, sometimes referred to as knowledge engineering , provides accurate rules and has the additional benefit of being human understandable.

the definition of the category is meaningful to a human, thus producing additional uses of the rule including verification of the category.


The counts shown in Table 1 represent the full execution of each benchmark on a server class machine.

the SPECjvm98 benchmarks each ran 6 iterations at the 100 workload size.


Therefore, we propose the following SS implementation: the accumulated overrun is saved in an overrun pool Opool, i.e., when an overrun O occurs, Opool+= O;  each recharge amount is limited by the initial server budget Q,i.e., if the server executedfor(Q+O)units, the recharge amount is set to Q;  at each replenishment time t: 1. the replenishment amount is, as usual, added to the current server budget q; 2. if Opool > 0,both the overrunpool Opool and the current budget q are decreased by min{q,Opool}; 3. a recharge of min{q,Opool} units is set after one period, i.e., at time t +P.

in case of an overrun O, the proposed mechanism works as if a budget amount of O (or as close as possible to O) is instantly consumed by the server at the next replenishment time.


While the data presented above concerns conflicts, executing threads simultaneously can result in constructive interthread behavior as well.

prefetching occurs when one thread touches data that will soon be accessed by a second thread; the second thread will then find the data in the cache, avoiding a miss.


Third,butprobably most important, we want to determine whether or not the practitioners are in agreement.

to what degree do the practitioners, regarding how they work, what they prefer, andwhat they considertobeimportant, vary.


always follows records goto follow tokens that do not depend on the kernel item lookahead sets of predecessor states.

this table records goto follows that will never change no matter how IELR(1) may split the LALR(1) parse states.


Note that the above allows lazy allocation of the handle and, hence, of the associated physical slot.

the handle may be allocated here or later upon its first use to store a record in the RecordStore.


Hence, it retrieves theCSID and PC of the recovery point that corresponds to var2 (CSID=1 and PC=7 in this case), and sends the latest value of var2 to T2.With such information, T2 now can start the incremental recovery.

it reexecutes the code from the instruction whose PC is 7, and uses the latest value of var2 and thevalue storedin space1 for all othervariables.


Furthermore, when a fight is started, the servant will perform a number of actions in a particular order.

(1) dropping the current order she holds, (2) playing a particular animation (e.g., fainting) and (3) afterwards running away scared.


AspectJ Speci.cation For widespread acceptance of aspectoriented languages, a complete speci.cation of the syntax and semantics of the language is important.

concerns about modifying the semantics of the host language could be reduced by at least having a complete speci.cation of the syntax of the language.


It must be selective and focus on the common behaviors, behaviors where we can amortize the over- head of run-time optimization.

the monitoring sys- tcm should ignore the program's exceptional (uncommon) behaviors.


However, every node N on this static chain between R and Q is in this subchain and hence is in the dynamic chain.

n is in the part of this dynamic chain that extends from R to Q; hence N is in L, and therefore in T´ since it is in T. For part (b), suppose the contrary, so that X´ is in T´, and thus in L. Since L is strongly connected and R is in L, there is a path from X´ to R. Since X is a static descendant of R, there is a path from R to X, by Lemma 6.


For example, we have Pr[4887 =fbI =5,113] =76%.

with probability 0.76 the relative error is no more than 2.26%.


For annotating the Ecore metamodel with visual concrete syntax information, we have utilized EMFatic [10].

using specific annotations the viewpoint definer states for each metamodel (viewpoint) element the corresponding graphical notations.


We did not implement all features of that architecture.

we did not address what Etzion and Niblett call "pattern policies", which are used to disambiguate the semantic interpretation of pattern matching.


1 lst_nd* q(lst_nd *y) { // Inferred Pre: list(y) 2 lst_nd *x, *z; 3 x=malloc(sizeof(lst_nd)); x->tail=0; 4 z=malloc(sizeof(lst_nd)); z->tail=0; 5 // Abducted: list(y), Framed: z|->0 6 merge(x,y); // Obtained Post: list(x)*z|->0 7 merge(x,z); // Obtained Post: list(x) 8 return(x); 9 } // Inferred Post: list(ret) This time we infer anti-frame list(y) as before, but using biabduction we also infer z.0 as the frame axiom that won t be needed by procedure call at line 6.

we obtain a solution of the bi-abduction question x.0 * z.0 * ?anti-frame f list(x) * list(y) * ?frame where ?anti-frame = list(y), ?frame = z.0.


We set out to answer this question within the context of an IBM middleware product-line.

we wanted to know if AOSD could help us achieve consistent Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page.


For example, the maximum number of stereotypes of a modeling element is 1.

we cannot associate more than one stereotype to an element.