Tracing regulatory routes in metabolism using generalised supply-demand analysis Background: Generalised supply-demand analysis is a conceptual framework that views metabolism as a molecular economy. Metabolic pathways are partitioned into so-called supply and demand blocks that produce and consume a particular intermediate metabolite. By studying the response of these reaction blocks to perturbations in the concentration of the linking metabolite, different regulatory routes of interaction between the metabolite and its supply and demand blocks can be identified and their contribution quantified. These responses are mediated not only through direct substrate/product interactions, but also through allosteric effects. Here we subject previously published kinetic models of pyruvate metabolism in Lactococcus lactis and aspartate-derived amino acid synthesis in Arabidopsis thaliana to generalised supply-demand analysis. Results: Multiple routes of regulation are brought about by different mechanisms in each model, leading to behavioural and regulatory patterns that are generally difficult to predict from simple inspection of the reaction networks depicting the models. In the pyruvate model the moiety-conserved cycles of ATP/ADP and NADH/NAD + allow otherwise independent metabolic branches to communicate. This causes the flux of one ATP-producing reaction block to increase in response to an increasing ATP/ADP ratio, while an NADH-consuming block flux decreases in response to an increasing NADH/NAD + ratio for certain ratio value ranges. In the aspartate model, aspartate semialdehyde can inhibit its supply block directly or by increasing the concentration of two amino acids (Lys and Thr) that occur as intermediates in demand blocks and act as allosteric inhibitors of isoenzymes in the supply block. These different routes of interaction from aspartate semialdehyde are each seen to contribute differently to the regulation of the aspartate semialdehyde supply block. Conclusions: Indirect routes of regulation between a metabolic intermediate and a reaction block that either produces or consumes this intermediate can play a much larger regulatory role than routes mediated through direct interactions. These indirect routes of regulation can also result in counter-intuitive metabolic behaviour. Performing generalised supply-demand analysis on two previously published models demonstrated the utility of this method as an entry point in the analysis of metabolic behaviour and the potential for obtaining novel results from previously analysed models by using new approaches. The regulation of the supply and demand blocks of a specific intermediate by the intermediate itself becomes convoluted when these reaction blocks can also interact through other intermediates, and not only through the linking intermediate. Generalised supply-demand analysis is a framework that allows for the identification of regulatory features of a metabolic pathway, one of which is the quantitative relative contribution of multiple routes of regulation of supply or demand blocks by the intermediate that links them.. Here we have demonstrated the use of generalised supply-demand analysis in disentangling various routes of regulation in a model of pyruvate metabolism where the involvement of the conserved moieties ATP/ADP and NADH/NAD + in multiple reactions caused counterintuitive responses in the fluxes of their producing and consuming blocks, and a model of aspartate metabolism where aspartate-semialdehyde could communicate with its supply block via multiple branching routes that were enabled by allosteric affectors and isoenzymes. Our findings showed that indirect routes of interaction between an intermediate and a reaction block can play a more significant role than the direct route.. We also demonstrated the utility of using a variety of analytic techniques in the further analysis of metabolic models. Both models provided novel results in spite of their having been studied by their original authors in the past [11, 12] . Further analysis with complementary tools such as control-pattern analysis would allow us to shed light on the source of the observed metabolic control in terms of chains of local effects [37, 41] and enzyme sensitivities in terms of thermodynamic and kinetic contributions [38] ; computational implementations of these tools are currently in development. In this paper we set out to investigate multiple routes of interaction between reaction blocks in metabolic systems using the framework of generalised supply-demand analysis. This allowed us to identify routes of regulation and quantify the contributions of various reaction blocks towards metabolic behaviours such as flux responses. The two models investigated were chosen on the basis of the mechanism whereby multiple regulatory routes are mediated: moiety-conserved cycles connect different metabolic branches in the pyruvate branch model, while allosteric inhibition of various isoenzymes allows for communication between separate ends of the pathway in the aspartate model. In both cases, our analysis provided insight into how different routes of interaction contribute to the overall behaviour of the systems.. In the model of pyruvate metabolism in Lactococcus lactis multiple routes of interaction between reaction blocks are brought about by the moiety-conserved cycles of ATP/ADP, NADH/NAD + and acetyl-CoA/CoA. The regulation of this pathway in L. lactis is relatively well understood due to the extensive study of this industrially significant organism [20] . Moreover, a number of newer and more extensive models for L. lactis central carbon metabolism exist [21] [22] [23] [24] , but most only include a simplified pyruvate branch metabolism. The most recently published model [24] , for instance, lumps certain reactions such as acetaldehyde dehydrogenase and alcohol dehydrogenase, and phosphotransacetylase and acetate kinase together. Since our primary aim was to delineate and quantify regulatory routes of interaction, we chose to investigate the original model by Hoefnagel et al. [11] , because it incorporates in the most detail the multiple interactions between the different branches of pyruvate metabolism due to the presence of moiety-conserved cycles. While an extended version of this model exists [21] , which also incorporates glycolytic reactions in detail, the simpler version was chosen, as both have identical representations of the pyruvate branch metabolism and the extended model has not been published in full detail. We opted for an exploratory approach, focusing on the application of GSDA to this model in order to extract information about the effects of ATP/ADP and NADH/NAD + on various reaction blocks via multiple routes. This generated results that matched previous observations, but allowed us to offer a novel quantitative explanation.. The most striking result was that moiety ratios far from the steady-state caused unexpected flux responses in two reaction blocks: The ATP/ADP-producing flux J 5 responded positively to low ATP/ADP-values, while the NADH/NAD + -consuming flux J 6 responded negatively to high NADH/NAD + -values. The reactions, respectively catalysing the last and first reactions in these reaction blocks, are not product activated or substrate inhibited in the model [11] , therefore the observed flux responses had to originate from multiple routes of regulation. This was confirmed by utilising partial response coefficients to quantify the relative contribution of each route of interaction towards the total response of the two reaction blocks. The dominant route of regulation of its supply flux J 5 by all ATP/ADP-values below 30 was via the upstream lumped glycolysis reaction (v 1 ), rather than the direct route via the ATP-producing enzyme acetate kinase (v 5 ). This included both the steady-state value of ATP/ADP and the ATP/ADP-range where J 5 had a positive response. This is most probably an incomplete picture of regulation by ATP/ADP, as the inhibition by ATP and ADP of L. lactis enzymes such as lactate dehydrogenase, alcohol dehydrogenase and glyceraldehyde 3-phosphate dehydrogenase [25, 26] was not included in the model. It is conceivable that these additional routes of interaction could significantly affect the flux responses investigated here. It is, however, premature to speculate on any specifics without performing further work, due to the added complexity accompanying these interactions. Nevertheless, these results illustrate how a few routes of interaction can bring about unintuitive, non-monotonic flux responses, and how the different routes can be quantified in terms of their contributions towards these responses.. We found that while the direct route of interaction of NADH/NAD + with reaction block 6 via acetaldehyde dehydrogenase (v 6 ) mostly determined the behaviour of J 6 at steady-state, the interaction via pyruvate dehydrogenase (v 3 ) dominated at higher NADH/NAD + -values, thereby causing a decrease in J 6 . In spite of the limitations of this model, this corresponds well with the previously established role of redox balance in regulating pyruvate flux distribution, where low NADH/NAD + -values are associated with mixed-acid fermentation and higher values with homolactic fermentation [27] [28] [29] [30] . While a high sensitivity of lactate dehydrogenase towards NADH/NAD + [27] was not observed here, the reduction of flux towards acetyl-CoA (J 3 ) by inhibition of pyruvate dehydrogenase, and therefore also the ethanol flux (J 6 ), in response to the increase in NADH/NAD + was indeed observed [27] [28] [29] [30] . Due to the structure of this pathway, one may conclude that reduced J 3 should lead to a reduction in J 6 , but in reality matters are not that simple. While J 6 and J 3 did decrease concomitantly at higher NADH/NAD + -values, there were also values for which J 6 increased while J 3 decreased. The observed J 6 -response towards NADH/NAD + was shown to be a combination of complementary and competing nonmonotonic effects that varied in importance with the value of the moiety ratio, thereby highlighting the utility of a model analysis tool such as GSDA for providing quantitative explanations for observed system behaviour.. Unsurprisingly, NADH/NAD + has been shown to determine pyruvate flux distribution in other organisms, such as Saccharomyces cerevisiae [31] and Escherichia coli [32, 33] , in a similar manner to L. lactis [28] . For these organisms, similar analyses could improve our understanding not only of their individual metabolisms, but also of pyruvate distribution in general. Furthermore, in addition to the role of NADH/NAD + in energy metabolism, NAD + and NADP + also play roles ranging from antioxidation to telomere metabolism as discussed in a comprehensive review by Ying [34] . While the approach used here may not be appropriate for the study of every role of NADH/NAD + , its application could shed light on the specific regulatory role of NADH/NAD + in other pathways.. The second model investigated describes aspartatederived amino acid synthesis in Arabidopsis thaliana. Here we focussed on the regulation of the ASA supply block by ASA itself. This reaction block was of special interest as its first step is catalysed by four AK isoenzymes, two of which are inhibited by Thr, and the other two inhibited by Lys. Each of these inhibitors is produced by a separate metabolic branch, with two isoenzymes catalysing the initial step of each ASA-consuming branch. These features enable ASA to communicate with its supply block via multiple routes.. Our results show that the majority of regulation of the ASA supply block did not occur via the interaction of ASA with its producing reaction, but rather by interaction with its demand blocks, which in turn affected the concentrations of the AK inhibitors Lys and Thr. One intuitively expects that regulation should occur via the shortest route, especially when taking into account the relatively high sensitivity of aspartate-semialdehyde dehydrogenase towards ASA at the steady-state in this system. The most unexpected result is the apparent importance of AKI and AKII in the ASA supply block regulation, in spite of their low contribution towards total flux. Previously, Curien et al. [19] analysed knockout simulations of this model and showed that AKI and AKII could compensate for the loss of AK1 and AK2 in terms of flux, thereby providing redundancy and confirming the idea that the role of isoenzymes is to provide robustness to the system [35, 36] . We, however, postulate that these reactions play an additional regulatory role which is largely decoupled from their function as carriers of flux, and that AKI and AKII provide robustness in terms of this role for each other. Our own knockout simulations of AKI and AKII showed that, while total flux remained largely unchanged for both knockouts (showing these reactions to be practically redundant in terms of flux), they were not redundant in terms of regulatory importance. While the loss of AKI could be compensated for by AKII, the reverse was not true, and a shift of regulation towards the Lys branch took place. However, in spite of the inadequacy of AKI as a substitute for AKII in terms of regulatory function and flux contribution, it was much more effective in emulating the former function than the latter. Furthermore, a double knockout of AKI and AKII decreased the total regulation of J 5 by ASA to less than 50 % of the wild-type, shifting flux control from the demand block to, less optimally [13] , the supply block. This means that increases or decreases in Thr demand will no longer lead to effective regulation of the ASA flux.. The source of the flux responses of both models was investigated by separating the partial response coefficients into their control and elasticity components. In this way the flux response coefficients could be classified as originating predominantly from a local (i.e. enzyme) property or from a system property. We broadly classified a control or elasticity coefficient as having a dominant contribution towards the response coefficient in two different ways: either (1) the magnitude of one coefficient outweighs the contribution of the other, or (2) one coefficient changes in value over a parameter range while the other remains relatively constant; the varying coefficient therefore determines the change in response coefficient. In certain cases we found that the elasticity coefficients dominated the flux response (e.g., the large values of v 7 R The work presented here reiterates the fact that metabolic systems can exhibit complex behaviour that cannot be predicted from simple inspection of the reaction network. Even when the network structure is considered together with enzyme-kinetic properties, in some cases understanding does not emerge intuitively. Furthermore, as the size and complexity of a system increases, so too does the variety of possible behaviours. Examples are the instances of apparent substrate inhibition and product activation in the pyruvate model (Figs. 4a and 6a) , where no such mechanisms exist on the enzyme level. Another example is in the aspartate model, where the seemingly predictable negative response of J 5 towards ASA is not due to product inhibition of ASADH, but rather due to upstream inhibition of the aspartate kinase isoenzymes by inhibitors downstream from ASA (Fig. 9) . The phenomena in both these cases stem from the existence of multiple routes of interaction between metabolites and reactions and were only brought to light through simulation and analysis. We could not only demonstrate unintuitive behaviour, but also quantify the contribution of the different routes of interaction towards bringing about this behaviour.. It is possible to analyse regulation at a deeper level by analysing the control coefficients that form part of the partial response coefficients in term of so-called control patterns [37] . A control pattern can be understood as a 'chain of local effects' that propagates through a metabolic pathway following a perturbation in a pathway parameter such as enzyme concentration. Each control pattern is a scaled product of elasticity coefficients, and each control coefficient is a sum of control patterns. Going even deeper, it is possible to partition the constituent elasticity coefficients into additive kinetic and thermodynamic terms [38] . The fact that control coefficients are complex functions of elasticity coefficients is also the reason why certain control coefficients, such as C in the pyruvate model, responded non-monotonically to changing parameters, whereas the elasticities themselves responded monotonically. In this study there was only one situation where we could unambiguously relate an observed flux response to one of the terms in an elasticity coefficient: in the pyruvate model the infinite elasticities of reactions 6 and 7 towards φ N at φ N = 0.0012 were due to these reactions being near equilibrium, a situation where for any reaction the thermodynamic term determines the value of its substrate and product elasticity coefficients. This observation was therefore only possible due to infinite elasticity coefficients being a very obvious and well-known sign of a reaction near equilibrium. To fully understand the pathways investigated here in terms of control patterns or in terms of the thermodynamics and kinetics of the pathway enzymes will require further analysis.. Both pathways studied here have potential biotechnological and industrial applications. L. lactis is an important organism in the dairy industry where the desirable products of pyruvate metabolism, such as diacetyl and acetaldehyde, are not always produced in equally desirable quantities [11, 27, 29] . Modification of L. lactis to increase these products is therefore an appealing prospect. While A. thaliana itself is not industrially important, it is used as a model organism for plant species in general. Here the modification of the aspartate-derived amino acid synthesis pathway to increase the production of the essential amino acids threonine and lysine could lead to the development of crops with increased nutritional value [39, 40] . However, the development of rational metabolic engineering strategies to leverage the metabolisms of these organisms requires a detailed understanding of their function. Application of the methods demonstrated in this paper can act as a stepping stone towards the development of such strategies by providing additional insights into mechanisms of metabolic regulation. The primary concern of molecular biology is to identify and characterise the individual components of biological systems. By focussing on the component level, this approach has generated an enormous amount of knowledge, but at the expense of disregarding emergent phenomena that arise from the multitude of interactions between these components. One way of overcoming this limitation is to construct, and subsequently study, mathematical models of these biological systems. This technique has become increasingly common, with models describing systems ranging in complexity from metabolic subsystems to genome-scale reconstructions of metabolism [1, 2] being available on various online databases [3] [4] [5] . More recently the goal of building a silicon cell [6] was arguably realised with the construction of a whole-organism model of Mycoplasma genitalium [7] . With models growing in size and complexity, approaching that of the modelled systems themselves, it has become more difficult to extract biological knowledge and understanding from them without extensive analysis. Model construction is therefore only the first step in the study of biological systems using the 'modelling approach' .. Generalised supply-demand analysis (GSDA) is a conceptual framework that views metabolic pathways as a molecular economy [8] . It is built on the principles of metabolic control analysis (MCA) [9, 10] , which is itself a framework that allows for the quantification of the control that any step in the system exercises over the variable steady-state properties such as fluxes or intermediate metabolite concentrations. The basic procedure of supply-demand analysis is to divide a metabolic pathway into separate reaction blocks around a chosen variable metabolite by fixing its concentration; the 'generalised' in GSDA implies that this is done in turn for each metabolite in the system. The supply and demand blocks, which respectively produce and consume the fixed metabolite, are subsequently treated as separate metabolic units, and MCA is performed on each reaction block. This approach allows for the identification of certain regulatory features of the pathway and for the quantification of the behaviour of the reaction blocks towards to changes in the concentration of the fixed metabolite. One such feature that GSDA helps to identify and quantify is the effect of different routes of interaction between the variable metabolites and their supply and demand reaction blocks.. The simplest way that reaction blocks can interact is through the common intermediate that links them, which can serve as either substrate or product or allosteric effector of supply and demand enzymes. If the only interactions are via the linking metabolite the situation is easy to analyse. However, it is possible that reaction blocks also interact indirectly through allosteric effects of a metabolite in one reaction block on an enzyme in the other reaction block; such a situation is quite common and it is here that GSDA is particularly useful in that it dissects all the routes of communication between supply and demand, both direct and indirect.. Another common situation is where cofactor cycles such as ATP-ADP or NADH-NAD + link supply and demand reaction blocks. These cycles are called moietyconserved cycles because they interconvert different forms of a chemical subgroup or moiety, the total concentration of which remains constant. For example, in the ATP/ADP cycle the moiety is ADP, which is interconverted between its free and its phosphorylated form. When there is no de novo synthesis or degradation of the ADP-moiety during the time-scale of observation, the sum of ADP and ATP remains constant even while their individual concentrations change, and the cycle is therefore moiety-conserving. In supplydemand analyses of such cycles the relevant variable that links the supply and demand reaction blocks is not a single concentration but rather a concentration ratio such as ATP/ADP or NADH/NAD + . These cycles usually form metabolic hubs where many functionally distinct pathways are integrated; an analysis of the interplay between supply and demand around these cycles is crucial for our understanding of metabolic regulation.. In this paper we use GSDA to investigate the regulatory effects brought about by multiple routes of interaction between supply and demand reaction blocks. We have chosen to analyse models of two metabolic pathways that differ from each other in terms of their regulatory mechanisms. The first is a model of pyruvate metabolism in lactic acid bacteria [11] where multiple interactions are brought about through the moietyconserved cycles of ATP/ADP and NADH/NAD + . We show that changes in the ratios of the different forms of a moiety can cause counter-intuitive responses in reaction block fluxes. The second is a model of aspartatederived amino acid synthesis in Arabidopsis thaliana [12] in which we analyse the routes of interaction brought about by allosteric effectors in combination with multiple isoenzymes. Here we explore the functions of the various isoenzymes and construct a map that shows the importance of the routes of regulation between a fixed metabolite and its supply block. In both models the importance of each route of interaction originating from a change in the fixed metabolite will be quantified and compared, illustrating that the direct route of interaction is not necessarily the most important. More generally we demonstrate the utility of investigating previously published models with a new analytic tools such as GSDA.

O O O O O O B I I O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O B I O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Application of the Random Forest Classification Algorithm to a SELDI-TOF Proteomics Study in the Setting of a Cancer Prevention Trial Abstract: A thorough discussion of the random forest (RF) algorithm as it relates to a SELDI-TOF proteomics study is presented, with special emphasis on its application for cancer prevention: specifically, what makes it an efficient, yet reliable classifier, and what makes it optimal among the many available approaches. The main body o the paper treats the particulars of how to successfully apply the RF algorithm in a proteomics profiling study to construct a classifier and discover peak intesities lending the most strength to the constructed classifier. Via Monte Carlo study, it is shown that (1) under the null hypothesis, the normalized importance measures display non-normal fat tailed asymptotics, so that a step down procedure such as the Benjamini Hochberg False discovery rate results in observed false discovery rates that are highly inflated and (2) some implications about power and sample size are hinted at using a second Monte Carlo study generated under an alternative hypothesis containing an important peak having simple odds ratio 10 for the affected class in a balanced design. This paper appeared in a slightly different and longer format in [1] . One of the most promising developments in the field of biomarkers and early detection has been the advent of genomic expression profiling using microarray technology, as it has provided the ability to profile the expression of an entire genome on a single chip. Thus researchers can determine the expression level of thousands of genes simultaneously and thereby "hunt" for differentially expressed genes across a variety of mRNA samples. For example, an experiment designed to study a potential cancer prevention agent could be designed by treating several samples of LNCaP cells with the agent, while designating another set of samples of LNCaP cells as controls. Then, mRNA collected from each cell population is hybridized to a gene microarray in order to search for differentially expressed genes among them. However, microarray technology has inherent limitations because the actual biological effectors are usually the resulting protein molecules. Thus any study of the genomic expression levels is blind to post-translational modifications and because of this, levels of mRNA expression often correlate poorly with the actual in vivo protein concentration due to differential rates of mRNA translation and varying protein half-lives [2] . For several decades, the identification of serum proteins and peptides has been conducted using mass spectrometry and electrophoresis gels. The limitations of these techniques are similar to those that existed in genomics before the advent of microarray technology. Until recently, only a relatively small number of proteins could be studied simultaneously. Now, however, as in genomics, recent high throughput technology coupled with the analytic tools of bioinformatics has accelerated the rate of discovery within the realm of serum protein chemistry, giving birth to the field of proteomics. Specifically, the first widely used such mass spectrometric technique is known as surface enhanced laser desorption ionization (SELDI) coupled with time of flight (TOF) mass spectrometric detection [3] . The principle behind this is that in the presence of an energy-absorbing matrix such as sinapinic acid (SPH), large molecules such as peptides ionize instead of decomposing when subjected to a nitrogen UV laser. Thus partially purified serum is crystallized with a SPH matrix and placed on a metal slide. Depending upon the range of masses the investigator wishes to study, there are a variety of possible slide surfaces. For example, among hydrophilic exchange media one choice is the strong anion exchange (SAX) surface, which has range from 2 kilo Daltons (kDa) to 50 kDa. This can be used for a "first pass", while the weak cation exchange (WCX) surface has greater precision over a more narrow range (2 kDa to 20 kDa). The peptides are ionized by the pulsed laser beam and then traverse a magnetic field containing column. Masses are separated according to their times of flight as the latter are proportional to the square of the mass to charge (M/Z) ratio. Since nearly all of the resulting ions have unit charge, the mass to charge ratio is in most cases a mass. Therefore, the terms "M/Z ratio" and "mass" will be used interchangeably in the following. The spectrum (intensity level as a function of mass) is actually recorded digitally, so that the resulting data obtained on each serum sample (hereafter, subject) is a series of intensity levels at each mass value on a common grid of masses (hereafter, peaks, peak intensities or features). A typical machine has a digitized spectrum of length in the tens of thousands with masses ranging from 2kDa to 50kDa. Notice that, at this level of resolution, that which is conceptualized as "a protein" translates into at least several consecutive peaks. For instance, it is known there are variations isotopic ratios from person to person so that at the level of resolution attainable by SELDI-TOF, the identity of a given protein in an aggregate of human subjects is most likely a range of similar masses differing by a fraction of a Dalton.. The organization of the remainder of this paper is as follows. First, it is pointed out that, from the point of view of classical statistical methodology, most if not all datasets arising in a proteomic profiling study are under-specified problems so that no unique classification rule can be assigned to a given dataset using any of these methods of classical statistics. Consequently, the analyst must turn to machinelearning for answers. This will open a short synopsis of some of the available machine-learning tools that have enjoyed popular use, especially in the substantive literature (such as a single classification tree, neural network, or genetic algorithm).. The following discussion will attempt to give one appreciation for the reasons why many of these algorithms tend to over fit the training data giving results that are not reproducible. Following will be a thorough discussion of the random forest (RF) algorithm [4] and [5] . Specifically, what makes it an efficient yet reliable classifier, and what makes it optimal among the many available approaches. The main body of the paper treats the particulars of how to successfully apply the RF algorithm in a proteomics profiling study to construct a classifier and discover peak intensities most likely responsible for the separation between the classes. Towards that end a nominal t-statistic for the important peak discovery component of analysis is investigated. This has recently become available in the current release of the software [5] . This discussion is illustrated via a Monte Carlo study using "realistic" simulated data generated from characteristics of a proteomic study from the author's previous work. The case of null relationship between spectra and outcome and the case of a specific relationship of a given magnitude between spectra and outcome will be considered at a range of sample sizes. The newest (version 5) of RF was posted on 11/12 and is available as FORTRAN [5] . There is a version in R originally translated into C from the FORTRAN version 3 which has recently been updated to closely resemble the newest FORTRAN version 5 of the original author's. [6] The topic of aggregating base classifiers has been one of intense and fruitful activity in the area of machine-learning. Nonetheless, even among the most current substantive work in medical bioinformatics, the analysis tools of popular choice are base classifiers [21] . It cannot be stressed enough that, from the standpoint of reproducibility and validity, no other tool can be expected to match the performance of a bagged classifier. The reason for this is that the bagged classifier gives the closest and most reliable approximation to the true relationship between the spectra and the outcome. Furthermore, 632 cross-validation is made possible, and this is clearly the most efficient use of available data. The reason for this is that bootstrapped replicates are sent to train each classifier so that each element in the sample will have been left out of roughly 1/3 of the training sets of all of the classifiers in the ensemble, so that validation is done by sending each element in the sample to classifiers which it did not train. This is nearly as good as having an independent validation sample in addition to a bagged classifier, depending upon the degree of overlap (statistical dependence) of the classifiers in the ensemble. Bootstrapping ensures a degree of independence, depending upon how large a series of bootstrapped replicates and how large the sample size. The random forests algorithm reduces the level of correlation even further by using random feature selection every time a node is split. The performance of the RF algorithm was investigated via Monte Carlo simulation. This was done both under the assumption that no relationship exists between the spectra and outcome (the global null), and under a stipulated "effect" of a given magnitude at two different sample sizes. The first Monte Carlo investigation using data under the global null demonstrated a non-normal asymptotic distribution for the mean decrease in margin (MDM) t-statistics, having a larger tail to the right of the moderate-to-extreme value, 2.48. It was noted that this has a profound effect on important peak selection using a multiple testing selection criteria such as the Benjamini-Hochberg false discovery rate (FDR). Peaks selected using MDM t-statistics filtered using the BH criteria controlled at FDR=10% resulted in an empirical false discovery rate of 79% when referring to the incorrect (standard normal) null distribution. When referred to the correct null distribution, the empirical false discovery rate was 9.5%. In addition, the relative efficiency of peak selection using importance measures returned by RF filtered using BH at FDR=10% relative to logistic regression endowed with the knowledge of the correct peak and the correct split was hinted at but not resolved. Further work needs to be done to understand the nature of the true null distribution, and in the mean time, an additional series of simulation studies may shed light upon the efficiency of RF relative to logistic regression in the hands of a deity. For now it can be said that the upper bound is , and most likely, the correct answer is substantially smaller. The implications of this are profound. If an investigator is putting together a proteomics profiling study from scratch (as opposed to adding onto a completed clinical trial), the question is posed "what kind of reasonable effect is expected of the strongest single predictor split at the most informative threshold"? From this one can easily obtain the required sample size from a binomial test of proportions. The required sample to sift through all of the extraneous information (i.e. to do data mining) is going to be substantially larger than three times the above. In conclusion, the most striking advantages of the random forest algorithm are its robustness to noise, its simplicity, lack of dependence upon tuning parameters, and speed in computation. As an additional note we mention that an entirely new set of visual diagnostic tools has been made available4. Two such new diagnostic tools are the person-peak specific MDM measure (to assess the influence at the person by peak level) and predicted prototypes (to create meaningful summary displays of a trained classifier). A thorough investigation of these is recommended. Finally, there has recently appeared a plethora of publications promising a comparison of various statistical techniques in the analysis of proteomics profiling data. Usually these apply a range of techniques to one or more datasets taken from profiling studies1. Presumably, the use of clinically obtained data is intended to attach a greater level of credibility within the audience of bench scientists and medical researchers. However, several clinically obtained datasets cannot begin to illuminate the statistical properties of a analytic tool in the way that can be done using "realistic looking data" generated in a Monte Carlo study. For example, "how does the method fare when there really is no relationship between the spectra and the outcome variable" and "how does the method fare when there really is a relationship between the spectrum and the outcome variable of a given strength" are questions that can only be answered via a thorough simulation study. This paper only begins to provide a thorough study, and as one does not yet exist, this can be taken as an invitation to the reader to write one. One important issue would be to pay better attention than time has permitted here to the generation of even more realistic looking spectra. By "realistic" it is meant that the goal is to create data that share a reasonable amount of statistical characteristics with proteomic spectra of human serum. For this purpose spectra from several studies could be combined to provide stable estimates of the required cross moments, and substantive experts would be required to weigh in on the level of "reality" having been attained. The most thorough kind of "methods bench-marking" work should contain "real data" as well as a thorough Monte Carlo study. While this paper has not quite made the cut stipulated by the above razor, it is hoped that a convincing case has been made.

O O O O O O O O O B O O O O O O O B B O O O O O O O B I I I O O O O O B O O O O O O O O O O O B B O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I I O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


An architecture for automatically developing secure OLAP applications from models Please cite this article as: C. Blanco, I.G. de Guzmán, E. Fernández-Medina, J. Trujillo, An architecture for automatically developing Secure OLAP applications from models, Information and Software Technology (2014), doi: http://dx.doi.org/10.1016/j.infsof. 2014.10.008 This is a PDF file of an unedited manuscript that has been accepted for publication. As a service to our customers we are providing this early version of the manuscript. The manuscript will undergo copyediting, typesetting, and review of the resulting proof before it is published in its final form. Please note that during the production process errors may be discovered which could affect the content, and all legal disclaimers that apply to the journal pertain. Decision makers query enterprise information stored in Data Warehouses (DW) by using tools (such as On-Line Analytical Processing (OLAP) tools) which use specific views or cubes from the corporate DW or Data Marts, based on the multidimensional modelling. Since the information managed is critical, security constraints have to be correctly established in order to avoid unauthorized accesses. In previous work we have defined a ModelDriven based approach for developing a secure DWs repository by following a relational approach. Nevertheless, is also important to define security constraints in the metadata layer that connects the DWs repository with the OLAP tools, that is, over the same multidimensional structures that final users manage. This paper incorporates a proposal to develop secure OLAP applications into our previous approach: improves a UML profile for conceptual modelling; defines a logical metamodel for OLAP applications; and * Corresponding author Email addresses: Carlos.Blanco@unican.es (Carlos Blanco), Ignacio.GRodriguez@uclm.es (Ignacio García-Rodríguez de Guzmán), Eduardo.Fdezmedina@uclm.es (Eduardo Fernández-Medina), jtrujillo@dlsi.ua.es (Juan Trujillo) Preprint submitted to Information and Software Technology November 4, 2014 defines and implements transformations from conceptual to logical models, and from logical models to the secure implementation into a specific OLAP tool (SQL Server Analysis Services). A DW is a repository which manages a great amount of enterprise historical information integrated from different data sources [1] . This information is usually organized following a multidimensional approach by using facts (for instance, a product sale) and related dimensions with classifications by subjects (for instance, departments, cities or product categories). The information managed by DWs is very sensitive because involve critical business information which is used to support strategic decision making processes and furthermore, it usually involves personal data which are protected by legal regulations in most countries. Therefore, establishing the necessary security rules in design time and enforcing them when DWs are being queried by users is crucial for protecting the information stored in DWs [2, 3, 4, 5] .. DWs development is composed of several stages. Firstly, data from heterogeneous data sources is integrated into the DW in an acquisition stage. The ETL (Extraction / Transformation / Loading) processes are responsible of extracting, transforming and loading these heterogeneous data. DWs repository stores data and is developed by following all the databases development stages: business, conceptual, logical and physical modeling. Finally, DWs are queried by tools (such as the OLAP tools SSAS, Oracle or Pentaho) which manages cubes or views of the corporative DW defined by using multidimensional models (facts, dimensions and classification hierarchies). The most critical point of the DW life cycle in order to incorporate security is the DW design, since security can be analyzed together with other requirements and integrated within the DW models. This is positive, because security is defined from an implementation independent approach and designers can make better design decisions. Regarding with the security characteristics that could be addressed in DWs' development (confidentiality, integrity, availability, etc.), confidentiality is the most important one since DWs mainly deal with read operations.. On the other hand, the Model-Driven Development (MDD) offers a great change in the way we develop software, and particularly in the way we design data models. It is based on the definition of models at different abstraction levels (from the system modelling towards specific technologies) and transformations between models, by reducing as a consequence development times and costs. OMG proposes Model Driven Architecture [6] for the MDD development. MDA establishes three abstraction levels for models, that can be aligned with the traditional DW design process: business models (CIM) with system requirements; conceptual models (PIM) which do not include information about specific platforms and technologies; and logical models (PSM) with information about the specific technology used. Furthermore, it proposes Query / Views / Transformations (QVT) [7] as an intuitive language to implement the transformations between models and MOFScript for the transformations from models to text. Our research efforts are thus applied to the development of secure DWs by following the model driven philosophy, defining models and transformations. In our proposal, security requirements are not improvised and incorporated once the system has been completely built. We early identify and include them in all the stages of the development process, fitting them into a most robust solution that provides us a better information assurance and a saving of time in maintenance.. In our previous works, we have developed a model driven architecture for secure DWs focused on a relational approach which leaded towards the final implementation into a DBMS [8] . However, DWs are finally queried by using tools which manage certain cubes or views of the corporative DW (multidimensional models with certain cubes, dimensions and hierarchies). That presents an intermediate metadata layer between decision makers and the DWs repository, in which is necessary the establishment of security aspects over. Therefore, we will be able to automatically check security constraints over every particular OLAP query posed on the DW. This paper therefore compliments our MDA architecture for secure DWs with support for OLAP systems. In order to achieve this goal a new logical (PSM) metamodel for secure OLAP applications has been defined and connected to the architecture by developing the necessary transformations from conceptual (PIM) models and towards the eventually secure implementation. Furthermore, the previous UML profile for conceptual modeling (PIM) has been improved to support the representation and the automatic transformation of more complex security rules which were defined by using OCL expressions.. The rest of this paper is organized as follows: Section 2 will present related work; Section 3 will provide an overview of the model driven architecture for secure OLAP applications presented in this paper; the next three sections (Section 4, 5 and 6) will present the three stages of our proposal: conceptual modelling, transformation to logical models and transformation to OLAP implementation; Section 7 will describe the application of our proposal to a DW for a sales department; and Section 8 will finally present our conclusions and future work. DWs manage vital business information which is very sensitive and has to be correctly assured in order to avoid unauthorized access. Because an early detection of security requirements has influence in the further design decisions providing better security specifications and final products, security measures should be considered in the whole development process from early stages to final tools. Furthermore, since DWs are queried by tools which manage specific cubes or views from the corporative DW, security constraints should be also defined in this metadata layer by using the same multidimensional elements that will be managed by the final users of OLAP tools.. Thanks to our proposal we are able to develop secure OLAP applications, providing a complete MDA architecture composed of several security models and automatic transformations towards the final secure implementation. That is: (i) a new logical multidimensional metamodel (SECMDDW) which is based on the OLAP package of CWM extended with security issues allowing the definition of the security configuration of the system and both structural and security aspects of cubes and dimensions; (ii) a set of QVT transformations from our conceptual models (PIM) to the new multidimensional logical models (PSM), which integrates the new PSM metamodel in the MDA architecture; (iii) the corresponding model-to-text transformations which allows the automatic code generation into a specific OLAP tool (SSAS) from the new multidimensional logical models (PSM).. In order to fulfill our MDA architecture, in this paper has been also included support to the transformation of complex security rules which are defined in conceptual models as OCL expressions. To achieve this goal, our UML profile for the conceptual modelling of secure DWs (PIM) has been improved with new metaclasses for managing information about complex security rules which are next used by QVT rules to obtain PSM models. The improvements carried out in the PIM do not affect the MDA architecture and the previously defined rules for the relational approach. Furthermore, an application example has been presented in order to validate our proposal, in which a conceptual model is defined and transformation rules are applied to generate the secure multidimensional logical model and the eventually implementation into SSAS.. Our further work will improve this architecture in several lines: (i) including new PSM models, giving support to other final platforms (such as Pentaho); (ii) defining inverse transformations for allowing modernization processes; and (iii) including dynamic security models which complement the existing models dealing with the inference security problem. Security in software engineering is considered as a critical issue to be taken into account in the development of information systems. Several relevant works concerning with a complete secure development of information systems can be found, such as UMLsec [9, 10] , MDS (Model Driven Security) [11] or PSSS (Process to Support Software Security) [12] . Nevertheless, although these are relevant contributions on secure information systems development they do not are specifically focused on DWs and their specific security problems.. Although research efforts in the development of secure DW and OLAP applications have been traditionally carried out, the majority of them have been focused on the final stage of development (logical modeling or implementation) [13, 14, 15, 2, 16] . Concerning with a complete secure DWs development we solely found the methodology of Priebe and Pernul [17] in which the authors analyze security requirements and their implementation into commercial tools by hiding multidimensional elements such as cubes, measures, slices and levels. They extend their proposal with a DWs representation at conceptual level with ADAPTed UML, but do not establish the connection between models in order to allow automatic transformations.. In our previous works, we have developed a model driven architecture for secure DWs focused on a relational approach which leaded towards the final implementation into a DBMS [8] (Figure 1 ). This approach was composed of several secure metamodels at different abstraction levels and automatic transformations from models to the final secure implementation in a specific DBMS, Oracle Label Security.. At the business level, a computational independent metamodel (CIM) supports an early definition of the security requirements. This metamodel [18] defines both functional and non functional requirements for DWs by using a UML profile based on the i* framework [19] , which is an agent oriented approach towards requirement engineering centering on the intentional characteristics of the agents.. For DWs secure modeling at conceptual level a Platform Independent Metamodel (PIM) called SECDW (Secure Data Warehouse) [20] has been defined as a UML profile specifically created for DWs complemented with an Access Control and Audit (ACA) model focused on DW confidentiality [21] . SECDW thus allows, on one hand, the specification of structural aspects of DWs such as facts, dimensions, base classes, measures or hierarchies, and on the other hand, the definition of security constraints by using the ACA model. The transformation from secure CIM models has been also dealt in [22] where the MDA methodology for secure DWs is described by using the standard Software Process Engineering Metamodel Specification (SPEM).. Following a relational approach at logical level (ROLAP) a Specific Platform Metamodel (PSM) called SECRDW (Secure Relational Data Warehouse) [23] has been defined as an extension of the relational package from Common Warehouse Metamodel [24] . SECRDW models secure relational elements such as tables, columns or keys, and express security rules defined at conceptual level. Moreover, the automatic transformation from conceptual models to relational logical models has been implemented by using QVT and also the eventual implementation into a DBMS, Oracle Label Security, has been dealt [25] .

O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B I I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O B O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B O O O O B O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B O O O O O B O O O O O O B O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O


A Small-Gain Theorem with Applications to Input/Output Systems, Incremental Stability, Detectability, and Interconnections A general input-to-state stability (ISS)-type small-gain result is presented. It specializes to a small-gain theorem for ISS operators, and it also recovers the classical statement for ISS systems in state-space form. In addition, we highlight applications to incrementally stable systems, detectable systems, and to interconnections of stable systems. r A common feature of control analysis is the application of small-gain results. One is often faced with feedback laws or auxiliary systems which are connected to a plant. Small-gain theorems can be used to verify stability of the resulting ''closed-loop'' systems, under appropriate conditions. Small-gain theorems have a long history, starting with the seminal work of Zames, Sandberg, Safonov, and others (see e.g. [1] [2] [3] [4] as well as expositions in for example [5] [6] [7] [8] [9] ).. Most of this classical work, though not all, applies to norm-based (linear) gains. Much recent work has focused on versions of small-gain theorems expressed in terms *Corresponding author. Fax: +1-626-796-8914.. E-mail addresses: ingalls@math.rutgers.edu (B. Ingalls), sontag@math.rutgers.edu (E.D. Sontag). 1 Supported in part by US Air Force Grants F49620-98-1-0421 and F49620-01-1-0063. of ''nonlinear gain functions'', see [10] , and in particular on results which incorporate explicit estimates on transient behavior, expressed in the input-to-state stability (ISS) framework. The fundamental work along these lines was that of Jiang, Teel, and Praly in [11] , which gave rise to an extended follow-up literature, see e.g. [12] [13] [14] [15] [16] .. The present work is also concerned with ISS-type small-gain theorems. The purpose of this paper is to present a very general principle, expressed in abstract terms, which allows application to a wide variety of contexts, which we summarize next.. The ISS property was introduced in [17] ; it represents a natural notion of stability for nonlinear control systems. Systems which satisfy the ISS property exhibit trajectories which are asymptotically bounded by a nonlinear gain on the inputs. In addition, the ISS bound includes a transient term which allows for a bounded overshoot depending on the size of the initial condition. The theory of ISS systems now forms an integral part of several texts [6, [18] [19] [20] [21] [22] , as well as expository and research articles, see e.g. [11, [23] [24] [25] [26] .. Also introduced in [17] was an accompanying notion of input-to-output stability (IOS) which can be expressed either for systems with state-space representation or for purely input/output systems. The result in this paper can be applied in either caseFthe statement is made in sufficient generality to allow applicability to several situations.. ISS notions can also be generalized to incremental stability properties, which characterize systems for which each trajectory converges asymptotically to every other trajectory. The incremental-ISS property was addressed in [27] . The small-gain result presented here can be applied immediately to incrementally stable systems.. Another useful generalization of the ISS and IOS properties is to notions of detectability. Introduced in [28, 29] the input-output-to-state stability (IOSS) property is a notion of zero-detectability for nonlinear systems (see also [30] ). The recently introduced property of input-measurement-to-error stability (IMES) [31] is a further generalization to systems with two outputs. Applications of the small-gain theorem to such systems is outlined below.. Perhaps the most common use of small-gain results is in verifying the stability of an interconnection of stable systems, and this is often how the results are presented. Some small-gain theorems for interconnections satisfying ISS properties have appeared in the literature. Interconnections of IOS systems with finite-dimensional state-space representations were addressed in [11] . ISS interconnections for time-delay systems were studied in [32] . A small-gain theorem for purely input/output systems satisfying the IOS property was announced in [33] . The result in this paper recovers each of these results when applied to the appropriate situation.. The contents of this paper are presented as follows. Notations and definitions are presented in Section 2. The small-gain theorem is stated and proved in Section 3. Section 4 is devoted to applications of the main result to various notions of stability and to interconnections of stable systems. The proofs of some basic results are included in Appendix A.

O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Model execution: An approach based on extending domain-specific modeling with action reports Abstract. In this paper, we present an approach to development and application of domain-specific modeling (DSM) tools in the modelbased management of business processes. The level of Model-to-Text (M2T) transformations in the standard architecture for domain-specific modeling solutions is extended with action reports, which allow synchronization between models, generated code, and target interpreters. The basic idea behind the approach is to use M2T transformation languages to construct submodels, client application components, and operations on target interpreters. In this manner, M2T transformations may be employed to support not only generation of target platform code from domain-specific graphical language (DSGL) models but also straightforward use of models and appropriate DSM tools as client applications. The applicability of action reports is demonstrated by examples from document engineering, and measurement and control systems. Over the last few years, there have been increased efforts within the academic community to improve software engineering through application of software models [33] . In numerous works, there are remarks that the adoption of Model Driven Software Development (MDSD) and the Unified Modeling Language (UML) as its main language has only partially achieved the proclaimed goals related to development productivity and software quality [19] , [21] . Some authors consider the unfitness of UML for domain specific problems to be the main reason for this failure. Expecting that an average software engineer uses or thinks in domain independent abstractions might have been unrealistic. Several approaches, including Domain Specific Modeling (DSM) and MDSD, still focus on software models, which are sufficiently formal but also understandable to both machines and humans.. One of the important goals in the aforementioned approaches is that models should not only be part of the specification but also of the implementation of the corresponding systems. Software industry experts are more pragmatic in regard to these issues and not determined to use general purpose modeling languages, such as UML, at all costs. They are more focused on developing modeling tools that satisfy requirements for highly specialized production and control systems. Although the quality and usability of these tools are not being questioned, the manufacturers are constantly faced with high costs of development and customization, even for very similar domains. Taking all into consideration, we expect that the software industry will base its highly specialized tools on the DSM architecture to a much greater extent. The following two improvements could be particularly important: (i) better support for the construction of modeling languages and their syntax, including abstract, concrete graphical, and concrete textual syntax; and (ii) better synchronization between meta-models, models, generated code, and target interpreters or "execution machines". Our research is oriented toward the latter improvement, i.e., better synchronization between meta-models, models, generated code, and target interpreters. The aforementioned synchronization is closely linked to model debugging and execution.. The topic of our research presented herein is also present in other domains of application within the field of software engineering. One such domain is software development based on MDSD and Computer Aided Software Engineering (CASE) tools. The traditional CASE tools support the creation of platform independent model (PIM) software specifications, their automatic transformation into platform specific model (PSM) specifications, and ultimately the generation of program code. However, it cannot be actually expected that these tools support incremental interpretation of specifications and dynamic changes of the applied meta-models. These requirements may be gradually fulfilled in the evolution of CASE tools into MDSD tools by insisting on retaining the complete synchronization between the created PIM models and the generated program code. An example of one such MDSD tool, which is developed by the authors of this paper, is the Integrated Information Systems CASE Tool (IIS*Case) [26] . At present, this tool relies on the PIM model of an information system to generate: (i) implementation description of a database schema and (ii) prototypes of the applications supporting operations on that database. In the current version, any modification within the model requires a new generation of the implementation description of the database schema, as well as a new generation of the prototype applications. In this manner, in forward engineering, there is support for a one-way synchronization. One of the future research tasks includes implementing in IIS*Case the automatic two-way synchronization between the model and the system executing the applications. As opposed to the existing abovementioned approaches to the execution of models created using a DSM tool, our approach supports incremental interpretation of specifications. Each user operation on a model in the DSM tool is directly interpreted in real time, which may be utilized to verify the correctness of the specification. Simulation tools have supported this approach for quite some time, but they set restrictions on the semantics of simulation languages, i.e., meta-modeling is considerably limited. The execution of models whose semantics is not known in advance represents a significantly more complex problem with respect to both the theoretical and practical issues. The most difficult problems are the definition and automatic generation of a target interpreter that supports incremental verification of specifications. Moreover, the goal of our approach, to which we actively direct our efforts, is to support the two-way synchronization by allowing the direct execution of changes on a model. This may be achieved by using operations on the application that represents the result of the incremental specification. There should be support also for the direct extension of a metamodel in real time according to the operations executed on the previously created models.. Our initial application of MDSD, DSM, and model transformation principles is related to complex problems in document engineering, previously presented in [7] , [11] , [14] , [22] , [24] , [26] . Positive experience with the construction and application of domain specific languages (DSLs), together with problems related to the development of client applications for measurement and control systems, indicated that the Model-to-Text (M2T) transformations in DSM may be significantly improved and utilized in model debugging and execution. By employing extended M2T transformations, namely "action reports", we intend to make possible the use of modeling tools as client applications. Notwithstanding the fact that current techniques for code generation from models have great capabilities, we demonstrate herein the practical value brought by: the introduction of the submodel concept and appropriate operations; the introduction of the transaction concept in the context of (sub)models; and the use of action reports (generators) as synchronization units during the testing of meta-models, models, client applications, and target interpreters. The practical value of introducing submodels, transactions, and action reports, is that M2T transformations, in addition to being employed for the generation of code in a target language, may also be used for expressing semantics of user actions on a PIM, i.e., on the graphical interface of a DSM tool.. In order to refer to the activities related to meta-modeling (Me), modeling (M), interpretation (I), and documenting (D) of model changes and execution flow, we introduce the term/acronym MeMID activities. Consequently, the approach to the modeling and development of software systems that includes all of the aforementioned activities is named the MeMID approach. When compared to the traditional approach to modeling, the MeMID approach includes interaction between all of the components in the DSM architecture, incremental specification, and visual representation of all changes within a real system being modeled. We took a pragmatic approach to the issue of model execution, with the goal of having solutions that may be sufficiently understood by a wide range of users and quickly applied in various business domains. The emphasis is placed neither on the definition of syntax of user semantic actions, nor on meta-modeling, but on the definition of action semantics, i.e., on the interpretation of user actions in a DSM tool during their execution and not solely afterwards, during code generation.. Besides the Introduction and Conclusion, the paper contains eight sections. In Section 2, we describe the state of the art and what is expected from DSM for model execution. The description of the concept of action reports and how they differ from code generators may be found in Section 3. In Section 4, we describe Model-to-Application (M2A), Application-to-Model (A2M), and Model-to-Document (M2D) transformations with respect to application generation. In Section 5, we describe usage of submodels and transactions in the testing of a DSL, model, and target framework or interpreter. This is illustrated with examples of using DSM tools for modeling documents, document templates, and modeling systems by documents. In Section 6, we describe how arbitrary user components may be integrated into DSM tools with the goal of visually representing abstract language concepts. In Section 7, we give examples of the synchronization between a client application and modeling tool. Section 8 describes usage of action reports for the purpose of implementing operations on DSM models, the target interpreter, and user applications. Chapter 9 contains a survey of related work, and overview of the current state of technology in the area of model execution. In this paper, we present the first practical results and foundations of an approach aimed at further improvement of DSM tools. Our objective is to better automate the MeMID activities: meta-modeling, modeling, testing of models, generated code, and interpreter, and generation of documentation about test cases. In the areas of document engineering and development of measurement and control systems, the action report approach allows us to specify the following procedures within abstract models: (i) the process of documenting model validation; and (ii) in the context of certain business rules and procedures, the synchronization of actions on a model to the state of the real system. Owing to this, action reports are especially effective when combined with DSM tools that, instead of relying on patterns, conduct M2T transformations by using a dedicated target language and interpreter. In production systems where business procedures are specified both precisely and formally, there is also a need to document each action on the model or to execute each action on the model by relying solely on the previously generated and authorized document. By using action reports, it is possible to synchronize not only the different components that are part of the MeMID activities but also the heterogeneous business and control processes, which feature complex business rules and operation of arbitrary control systems.. Our future research directions include: (i) construction of a language for the description of constraints on presentation elements (graphs), which in turn would simplify the customization of meta-modeling and modeling tools for different domains of application; (ii) construction of M2T transformations, i.e., code generators that would produce binary or assembly code for different processors by starting from abstract models; and (iii) conceptualization of run-time systems that would interpret abstract models, which in turn would be transformed into different target languages, software logic or wired logic. The ultimate goal of our research is to support, to the greatest extent possible, the MeMID scenario, which consists in using modeling tools as client applications to manage business and control processes. The approach presented in this paper was created to be focused on the domain of application and provide pragmatic support to users. For these reasons, its application capabilities may not be fully generic. However, the goal of developing the approach is not primarily oriented to this end, but to provide the foundation for a quality support to users in the domain of monitoring the measurement and control processes. At present, our approach supports modeling and executing models of measurement and control systems. We expect that our ideas, examples, and practical solutions presented in this paper are going to contribute to a better use of DSM tools as client applications for the monitoring of measurement and control processes. Over the last few years, Executable UML has been a recurring topic in both the academic and engineering community [32] . Numerous papers and practical solutions extend its usability for simulations and model execution [17] , [23] , [36] . However, it seems that the transfer of very narrow specialized knowledge to web services (Cloud computing) is advancing more rapidly as opposed to the use of UML tools for the domain-specific problems. In the academic community, much of the model transformation research relies on the OMG's specification Query/View/Transformation (QVT) [28] . The specification consists of three interrelated languages: (i) Relations, (ii) Core and (iii) Operational Mapping. Atlas Transformation Language (ATL) [2] by the Eclipse Foundation [15] is an example of a model-to-model (M2M) transformation language in accordance with the QVT standard. Among the commercial tools, one of the best known transformation languages is MetaEdit+ Reporting Language (MERL) [30] . It is a language mainly focused on model-to-text (M2T) transformations. It partially supports transformations that conduct synchronization between the model, client applications, and target interpreter. By minimally extending MERL to allow specification and interpretation of action reports, it would be possible to synchronize applications that feature disparate user interfaces, and target interpreters or "execution machines" [1] , [4] , [6] , [24] , [31] , [38] .. In [20] and [27] , the authors present ideas and solutions for domainspecific model transformations and debugging. Our consideration of code generators differs slightly from the one presented in [20] . We believe that template-based M2T transformations are complex, insufficiently flexible, and complicated to be implemented within the HMI components and target interpreter of models.. In [16] , the authors present a translational and an interpretational approach to execution of domain-specific models. These approaches are based on explicit definition of semantics for execution of each model. The translational approach relies on generating code that should be compiled and then executed, while the interpretational approach relies on model interpretation by a target interpreter. The disadvantage of the former approach is that it is unsuitable for simulations and rapid prototyping. On the other hand, the latter approach is considerably more suitable for both rapid prototyping and incremental update of an active system. The authors recognized the necessity of the use of transactions and logging of all model changes for the purpose of backtracking. They resolve the issue of the synchronization between a model and the execution engine by relying on the concurrent access to configuration files used by the DSM editor and execution machine. From their simple example implemented using Eclipse EMF, it seems that the application of their idea is limited to less complex cases. In our approach, which is based on the use of M2T transformations, there are slight extensions of existing navigational languages for M2T transformations and two logically independent execution engines: a report interpreter and a target interpreter of models.. In [37] , the authors describe the OMG's approach to standardization of UML model execution, which involves using Action Semantics, i.e., explicit definition of execution rules at the level of the UML meta-model. The goal of this standardization is to allow: (i) software independent specification of actions on UML models; and (ii) execution of UML models. Their approach is based on the following three abstractions: meta-model, execution model (UML model), and actions. The semantics of actions is defined, but not the concrete syntax, because it depends on the target language used in code generation from a model. Because this approach requires knowledge about UML meta-modeling, it seems unlikely that it will be widely applied in domain specific problems, particularly for modeling measurement and control systems.. Among numerous tools for modeling measurement and control system that may be used in the extension of DSM tools, or for better illustration of action reports and use of modeling tool as client applications, the following two stand out: Simulink [36] and IbaLogic [17] . Simulink is a tool primarily aimed at drawing function block diagrams. It features a large library of function blocks that may be customized and supports generation of source code in the C language. In the context of the MeMID activities, Simulink does not adequately support meta-modeling and generation of documentation about model execution. IbaLogic is a tool for modeling measurement and control systems that employs structured text and function block diagrams according to the IEC 611.31 specification, where a function block model is also an execution model. This tool supports linking to various run-time systems that may interpret or execute a model. However, meta-modeling and code generation for different programming languages are not supported. Owing to the featured implementation of a set of basic operations on models, it supports: (i) every version of the incremental update for a target system during interpretation; and (ii) visualization of the state of a real system within the modeling tool.

O O O O O O O B I O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Two-Factor Remote Authentication Protocol with User Anonymity Based on Elliptic Curve Cryptography In order to provide secure remote access control, a robust and efficient authentication protocol should realize mutual authentication and session key agreement between clients and the remote server over public channels. Recently, Chun-Ta Li proposed a password authentication and user anonymity protocol by using smart cards, and they claimed that their protocol has satisfied all criteria required by remote authentication. However, we have found that his protocol cannot provide mutual authentication between clients and the remote server. To realize 'real' mutual authentication, we propose a two-factor remote authentication protocol based on elliptic curve cryptography in this paper, which not only satisfies the criteria but also bears low computational cost. Detailed analysis shows our proposed protocol is secure and more suitable for practical application.

O O B O O B I O O B I O O O O O O O O O O O O O B O O O O B O O B I O O O O O O O O O O O O O O O B O B I O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B O O O O O O O O O O B O O O O O B O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O