The development of initial trust in an online company by new customers Lack of trust in online companies is a primary reason why many web users do not shop online. This study proposes a model to explain how new customers of a web-based company develop initial trust in the company after their first visit. The model is empirically tested using a questionnaire-based field study. The results indicate that perceived company reputation and willingness to customize products and services can significantly affect initial trust. Perceived web site usefulness, ease of use, and security control are also significant antecedents of initial trust. Finally, we found no support for the hypothesized effect of individual customer trust propensity on initial trust. # While B2C electronic commerce is no longer a new phenomenon, our understanding of the many factors that affect transactions between online companies and customers is still limited. The number of web users grows daily and has surpassed the 500 million mark [81] . However, only about 15% of those users make purchases online [84] . A primary reason for that is their lack of trust in companies that they only experience through the web medium [34] . Trust in the webbased vendor is one of the critical factors of success in online commerce [86] . The virtual nature of the web medium challenges traditional understanding of customer trust and calls for new and more appropriate models. Customers no longer interact with salespeople or have a direct physical experience with the store and its products. Instead, their experience is mediated through the web, a two-dimensional graphical display without any face-to-face interaction with human representatives of the company. Since the development of trust often depends on direct physical experiences with the company's store and its salespeople [22] , it is unclear how online customers develop the same feelings of trust towards the web-based companies they visit. Therefore, it is imperative, for companies and researchers alike, to study how online customer trust is promoted and cultivated.. The vast majority of studies published on online customer trust have focused on general trust as it develops between customers and companies over time and after repeated experiences. While we recognize the importance of the evolving nature of trust, our study focuses on initial trust beliefs that develop after a customer has a first experience with the company's web site. The difference between the two concepts may be subtle but, as we discuss later, it is significant, especially in the online environment.. The concept of trust has been studied in diverse contexts, by researchers from various disciplines and backgrounds, and as a result, there are manifold definitions of trust [26, 28, 45, 49, 52, 56, 78] . The attempt to distill a precise definition of trust from past research is challenging but the literature does reveal that the concept of trust tends to coalesce around a few key recurring concepts. First, as noted by various authors [22, 40, 52] , there must exist, for the trusting party, uncertainty about a potential or existing relationship-business, social, or otherwise-that leads to a certain perception of risk or vulnerability. Second, this perception of risk is generally based upon the beliefs regarding the ability, integrity, and benevolence of the trustee [52, 54] . Ability concerns the skills and competencies of the trustee in a specific context, related to the trusting party. Integrity implies that the trustee follows moral and ethical principles that are acceptable to the trusting party. Benevolence concerns the degree to which the trustee has goodwill towards the trusting party [52] . Perceptions of these three characteristics can lead to a willingness of the trusting party to depend or rely upon the trustee in the expectation of a certain beneficial outcome or that the trustee will not act opportunistically [39] . This willingness to rely on a third party is how we define trust in this paper and is consistent with how trust has been previously defined in the literature [27, 28, 38, 39] .. As we mentioned above, our study concentrates on initial trust. The definition of trust that we have previously discussed also applies to initial trust. The difference lies in the temporal context of the development of trust. In our case, initial trust is the willingness to rely on a third party after the first interaction with that party. We recognize that the development of trust is an ongoing, dynamic process that is influenced by successive interactions between two parties. However, we believe that initial trust beliefs can also be formed without any prior experience or interaction between the two parties. Those initial trust beliefs may change with time and with repeated interactions but they may also determine the extent to which such future interactions will take place [55] .. In the context of web-based commerce, initial trust is very important. Web-based companies must rely on their web sites to represent them and to show their new customers that they are trustworthy and reliable before they can prove that with their products or services. Customers visiting a web site for the first time may rely heavily on web site cues and company reputation to form their initial trust beliefs, but will lack the ''credible, meaningful information'' that develops through interaction over time [55] .. Another important reason for establishing customer trust after the first web site visit is the possibility of low switching costs for new customers [67] . In combination with the vast number of alternatives in both vendors and products that exist on the web, it may be very easy for customers to decide to switch to a different online store after their first visit. Establishing a trusting relationship with them could be essential for companies to retain first time customers. Therefore, we believe that a thorough examination of the factors that promote initial trust in new customers of online companies is critical. Our study tests some established antecedents from the general trust literature as well as two new factors that we believe can have a major impact on initial trust: perceived willingness of the company to customize and perceived security control of the web site. Our sample size was 212 of whom 128 were male and 84 were female. Eighty-four percent of the subjects were 25 years old or younger. The subjects were divided almost equally between the four sites: 51 for BCD2000, 55 for Pcpricelist.com, 52 for Expedia, and 54 for Trip.com. We tested the validity of our scales using Principal Components Analysis (PCA) with direct oblimin rotation, an appropriate method when there is reason to expect the factors to be correlated [63] . The results of the initial PCA showed that the items for the perceived size scale loaded on the same factor as those for the perceived reputation scale. This left us with two possibilities: (a) to combine the two scales into a new one measuring a different construct or (b) to eliminate one of the two scales from our analysis. The first option, combining the two scales, did not make intuitive sense, nor did it have theoretical support from any of the prior literature. Even though size and reputation can sometimes be correlated, this is not always the case. Very large companies may have a bad reputation, as is currently the case with Enron after its public accounting scandal. Therefore, we opted for eliminating one of the two scales.. We decided that perceived size was the best candidate for elimination since the subjects had very few cues to help them form a perception regarding the company's size. Past research on online trust manipulated the perception of company size by providing them with sales figures and number of products available [39] . Since we did not provide such data to the subjects, we believe that the web sites alone did not provide enough cues to determine the size of the company. Therefore, we eliminated the items for size and removed the variable from our model.. The final results of our factor analysis with PCA (after removing the items for perceived size) can be seen in Table 1 . For the scales to show both convergent and discriminant validity, each item should load highest on its related factor and have very low loadings on unrelated factors. Also, the highest factor loadings for each item should be significantly above a threshold level determined by the number of variables, factors, and data points in the sample. According to Hair et al. [32] a reasonable factor cut-off point for our sample size is 0.40. All the items in Table 1 load on their related factors with factor loadings over 0.40 and load on other factors with small loadings, always under 0.40. Therefore, our scales show good convergent and discriminant validity. We also tested the reliability of the scales using Cronbach's alpha. Those values along with the mean and standard deviation for each scale are also shown in Table 1 . All Cronbach's alpha values are above 0.7 indicating that our scales also show good reliability [58] .. Since we collected the dependent and independent measures with the same instrument at the same time, there is a possibility of common method bias in our data. We used Harmann's post hoc one factor test to examine the presence of the bias [64] . The result of the principal components factor analysis reveals that the first factor does not account for the majority of the variance (it accounts for 39% only). Therefore, there is no single general factor that accounts for the majority of the variance and since there are also multiple factors emerging from the factor analysis, we conclude that common method bias is not a problem with our data.. In order to test our model, we used linear regression analysis. Our linear regression model includes, in addition to the independent variables of our model, three dummy variables to represent the four different web-based stores that our subjects visited [32] . By including the dummy variables, our regression model takes into account the possibility that there are significant differences between the experience and attitudes of subjects on different web sites. Each web store has a multitude of differences with the other three and these differences may influence customer perceptions and beliefs. By controlling for these possible differences, we remove any possible spurious relationships between our dependent variable of initial trust and the independent variables.. After the first run of the analysis, we detected two outliers in the sample that had standardized residuals with absolute values greater than 3.0 [12] . We removed the two outliers and reran the analysis. The results of the linear regression model can be seen in Table 2 . The model has very good fit (F ¼ 59:498, P < 0:001) and a very high adjusted R 2 value of 0.716. The coefficients for perceived reputation, security control, and willingness to customize are significant at the P < 0:01 level and those for perceived usefulness and ease of use are significant at the P < 0:05 level. The coefficient for trust propensity is not significant. Therefore, the data indicate support for H2-H6 but no support for H7. We were unable to test H1. The coefficient for the dummy variable for BCD2000 is significant at the P < 0:05 level indicating that there is a significant but small difference between the web sites of BCD2000 and Expedia when it comes to the effect of the independent variables on initial trust. The VIF values are low, indicating no multicollinearity problems. The standardized residuals are normally distributed and we saw no indications of heteroscedasticity in the data. The results can be seen graphically in Fig. 2 . Our revised model does not include perceived size because the scale for that variable did not have sufficient construct validity, thereby preventing us from testing its relationship with initial trust in the company. In order to test our model, we conducted a field study and collected data via an online questionnaire. Subjects browsed a web site they had never visited before and searched for a particular product. Subsequently, they answered a series of questions regarding their experience on that site. The subjects were undergraduate and graduate students of a major Northeastern U.S. university. Participation was voluntary and each participant was paid $10 and made eligible for a drawing of $100 for completing the study, which took approximately 30-45 min to finish.. During the sessions, each participant was first asked to indicate which web sites, out of a list of four, they had visited in the past. This served as a screening procedure that enabled us to send each subject to a web site they had not visited before. This way, we eliminated the effects of prior experience with the company and its web site on customer trust [22, 31] . We directed each subject to a website they had not visited before and gave them a set of instructions that asked them to search for either a laptop or flight tickets for a trip to California.. The subjects searching for a laptop were asked to imagine that they had enough money to buy a laptop that would serve their needs for the next 2 years. They were told to use their assigned web site only and try and find what they felt was the best model for them. We required the subjects to indicate the model, price, and certain product specifications of their final laptop choice. The subjects shopping for the airline tickets were asked to imagine they were planning a vacation to California for the summer and they had enough money to pay for it. They were told to use only their assigned web site and try to find a pair of tickets that was satisfactory. They were then required to indicate the airline, flight numbers, departure and arrival dates, and ticket price of their final choice. The subject instructions for the two tasks can be seen in Appendix B. We chose to be very specific regarding the shopping tasks and required the subjects to provide us with the details of their final choices in order to ensure that the participants browsed the site extensively, becoming familiar with it, and thus increasing the validity of their survey responses. The sites used for laptops were Pcpricelist.com (http://www.pcpricelist.com) and BCD2000 (http://www.bcd2000.com). The travel site choices were Expedia (http://www.expedia.com) and Trip.com (http://www.trip.com).. Once the participants found their products and completed their responses on the instruction form, they were asked to fill out an online questionnaire. The questionnaire was set up so that the participants were required to answer all the questions before they could submit their responses, eliminating any potential missing values in the dataset. Our questionnaire used seven-point Likert items for all constructs measured. The scales were adapted from prior literature with the exception of the scale for perceived willingness to customize that included some new items added by the researchers. This was necessary since that scale was adapted from a study examining buyersupplier relationships in an industrial setting [22] . The full questionnaire with explanations on the origin of each scale can be seen in Appendix A.

O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O B I O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O B I O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Optimizing multi-dimensional terahertz imaging analysis for colon cancer diagnosis Terahertz reflection imaging (at frequencies $0.1-10 THz/10 12 Hz) is non-ionizing and has potential as a medical imaging technique; however, there is currently no consensus on the optimum imaging parameters to use and the procedure for data analysis. This may be holding back the progress of the technique. This article describes the use of various intelligent analysis methods to choose relevant imaging parameters and optimize the processing of terahertz data in the diagnosis of ex vivo colon cancer samples. Decision trees were used to find important parameters, and neural networks and support vector machines were used to classify the terahertz data as indicating normal or abnormal samples. This work reanalyzes the data described in Reid et al. (2011) (Physics in Medicine and Biology, 56, 4333-4353), and improves on their reported diagnostic accuracy, finding sensitivities of 90-100% and specificities of 86-90%. This optimization of the analysis of terahertz data allows certain recommendations to be suggested concerning terahertz reflection imaging of colon cancer samples. Terahertz (THz) imaging (imaging at frequencies around 10 12 Hz) is a novel technique for medical imaging. It uses non-ionizing radiation and can safely be used for imaging different types of tissue, such as normal cells and tumors; the contrast between tissue types is thought to occur due to differences in water absorption, protein density or cellular structure. However, THz imaging is still relatively new in the field of medical diagnosis. The optimum methods for using the various data aspects recorded by THz systems are still being determined. This research examines the use of 'intelligent' methods of data analysis to optimize THz imaging for cancer diagnosis, and determine which parameters and analysis method are most useful. This research tested different intelligent analysis techniques to discover which THz data parameters and techniques provided the best diagnostic accuracy between normal and abnormal tissue samples in colon cancer. Suggestions for useful parameters were determined by DT, and the optimum analysis methods for the various relevant diagnostic tasks were found and discussed. Results also suggest that a non-patient-specific, generalized analysis method could be possible, although further testing with a larger data set is advised. The contribution of this research is to produce recommendations for THz imaging methodology and data analysis, hopefully helping to bring it closer to being a clinically useful technology. This reanalysis of the data collected by Reid et al. (2011) has shown that the tissue classification results gained by simple regression analysis can be improved upon using 'intelligent analysis' techniques.

O O B O O O B I O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B I O O O O O O O O O O B I O B I I O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B O O O O O O O O B O O O B I O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Influence of different system abstractions on the performance analysis of distributed real-time systems System level performance analysis plays a fundamental role in the design process of real-time embedded systems. Several different approaches have been presented so far to address the problem of accurate performance analysis of distributed embedded systems in early design stages. The existing formal analysis methods are based on essentially different concepts of abstraction. However, the influence of these different models on the accuracy of the system analysis is widely unknown, as a direct comparison of performance analysis methods has not been considered so far. We define a set of benchmarks aimed at the evaluation of performance analysis techniques for distributed systems. We apply different analysis methods to the benchmarks and compare the results obtained in terms of accuracy and analysis times, highlighting the specific effects of the various abstractions. We also point out several pitfalls for the analysis accuracy of single approaches and investigate the reasons for pessimistic performance predictions. One of the major challenges in the design process of realtime embedded systems is to accurately predict performance characteristics of the final system implementation in early design stages. Reliable predictions on end-to-end delays of events, memory demands and resource usages are essential to guarantee that the designed system meets all given performance requirements before time and resources are invested for the actual implementation of the system. In addition, an accurate and fast performance analysis is necessary to drive the design space exploration and thus support important design decisions.. The system level performance analysis of modern embedded systems is generally a difficult task as the architectures are increasingly heterogeneous, parallel and distributed. Complex input event streams, resource sharing, interferences among tasks and independent scheduling decisions of the distributed computing and communication nodes make the analysis process challenging even for apparently simple systems.. The need for reliable and accurate performance predictions in early design stages as well as the mentioned challenges of the analysis have driven research for many years. Most of the approaches for performance analysis proposed so far can broadly be divided into the two main classes of analytic techniques and simulation based methods. There are also stochastic methods for performance analysis which we will however not consider in this context. The main advantage of simulation is the large modelling scope, as various dynamic and complex interactions can be taken into account. However, most simulation based performance estimation methods suffer from insufficient corner case coverage. To determine guaranteed performance limits, analytic methods must be adopted. These methods provide hard performance bounds, but they are typically not able to model complex interactions and state-dependent behavior, which can lead to pessimistic (but still correct) analysis results.. Several models and methods for formal performance analysis have been presented so far; they are based on essentially different abstraction concepts. The first idea was to extend well-known results of the classical scheduling theory to distributed systems. This implies the consideration of the delays caused by the use of shared communication resources, which cannot be neglected. This combined analysis of processor and bus scheduling is often referred to as holistic scheduling analysis. The first approach in this direction was made by Tindell and Clark in [20] where the authors combine fixed priority (FP) preemptive scheduling on the processing resources of a distributed system with time division multiple access (TDMA) scheduling on the interconnecting communication bus. In [22] Yen and Wolf presented an analysis approach for distributed systems that considers data dependencies and in [14] Pop et al. took into account also control dependencies. Later several holistic analysis techniques for various other combinations of input event models, resource sharing policies and communication arbitration have been investigated, see e.g. [15] .. A more general approach to extend the concepts of classical scheduling theory to heterogeneous distributed systems was presented by Richter et al. in [17] . In contrast to holistic methods that extend classical scheduling analysis to special classes of distributed systems, this approach applies existing analysis techniques in a modular manner: the single modules of a distributed system are analyzed with classical algorithms and the local results are propagated among the system through appropriate interfaces relying on a limited set of event stream models. Several extensions of this performance analysis framework have been worked out [6] .. A completely different modular performance analysis approach that does not rely on classical scheduling theory was presented by Thiele et al. in [19] . The method uses RealTime Calculus which extends the basic concepts of Network Calculus [7] to analyze the flow of event streams through a network of computation and communication resources. This method is not restricted to a few classes of input event models, but can model any event stream using the abstraction of arrival curves. A similar abstraction, the so-called service curves, permit to model any availability of computation or communication resources. Also for this approach various extensions have been presented [21] .. While the previously mentioned formal performance analysis methods provide hard upper bounds for the worst-case performance and hard lower bounds for the best-case performance of a system, there are also approaches that determine the exact worst-case and best-case results. For instance timed automata models can be used for exact scheduling analysis [2] . Hendriks and Verhoef have presented an approach for the analysis of distributed systems based on model checking of timed automata networks in [5] .. The set of available abstractions for performance analysis of distributed embedded systems is not limited to the methods cited above. The various approaches are very heterogenous in terms of modelling scope, modelling effort, tool support, accuracy and scalability. There is a lack of literature on their classification and comparison. In particular, it is very difficult for a designer to determine which performance analysis method is most suitable for a given system.. A direct comparison of performance analysis methods is difficult because several important aspects of the abstractions can only hardly be quantified, such as scalability or progression of the end-user's learning curve. Moreover the modelling scopes of the various approaches do only partially intersect. This means that an abstraction often allows to model scenarios that are not covered by other abstractions. Nevertheless, the comparison of different abstractions for performance analysis is necessary because it permits to highlight the specific effects of the various analysis methods and it helps to determine modelling difficulties and analysis pitfalls. Moreover, the comparison of different approaches serves to better understand the relation between models and analysis accuracy as well as to improve analysis methods by combining ideas and abstractions. Such a comparison based on a set of characteristic benchmark problems is not available so far, despite of its essential importance for any future work on performance analysis methods for distributed embedded systems.. The contributions of this work can be described as follows:. • We define a set of benchmarks for the evaluation of abstractions for performance analysis of distributed embedded systems.. • We apply different abstractions to the benchmarks and compare the results obtained in terms of accuracy and analysis times.. • We point out several pitfalls for the different abstractions and investigate the reasons for deviating analysis results. We defined a set of benchmarks for the evaluation and comparison of abstractions for performance analysis. We applied a number of system level performance analysis methods to the benchmarks and examined the results in terms of accuracy and analysis times. We pointed out several analysis pitfalls for the different analysis abstractions and investigated the reasons for pessimistic performance predictions. We showed that the analysis results of different approaches are remarkable different even for apparently basic distributed systems and that the choice of an appropriate analysis abstraction matters. Moreover, we showed that the analysis accuracy of the various approaches depends highly on the particular system characteristics and that none of the analysis methods performed best in all cases. Hence, the problem to provide accurate performance predictions for general systems is still far from solved, despite the availability of promising formal analysis approaches. The results of Section 5 show that the accuracy of the performance predictions determined with each abstraction varies considerably for the different benchmarks. The only exception is given by the analysis approach based on timed automata, which provides the exact performance predictions for all the considered benchmarks. However, we would like to point out that the exact results are often paid for by a large analysis effort, i.e. may require long verification times. Thus, considering not only the achieved accuracy, but also the necessary analysis times, we can state that none of the considered abstractions performed best in all the benchmarks.. Nevertheless, the results permit to give some indications on which abstractions are more appropriate than others for the analysis of a certain performance characteristic in a given system. For instance benchmark 1 indicates that the approximation of complex event streams with standard event models can be inappropriate for precise performance predictions at a local level. Benchmark 3 emphasizes that at the current state systems with cyclic dependencies represent a serious pitfall for the accuracy of compositional analysis methods. The benchmarks 2 and 4 indicate that holistic analysis approaches are generally more appropriate than modular abstractions in the presence of correlations among task activations and data dependencies. On the other hand, holistic analysis methods are less appropriate for the analysis of timing properties that are referred to the actual release time of an event within a large jitter interval, as described in the interpretation of the results obtained for benchmark 3. Overall, it is advisable for a system designer to use at least two different performance analysis methods, to prevent stepping in one of the mentioned analysis pitfalls.. Moreover, the results show that for the benchmarks considered simulation often provides more accurate results but these results are not necessarily correct (i.e. valid performance bounds), as the underestimation of the worst case performance of benchmark 3 shows. While in general this might be tolerable for soft real-time systems, it is not for systems with hard real-time requirements.. We would also like to emphasize that most of the encountered pitfalls for analytic techniques are not related to sys-tem characteristics that are conceptually impossible to integrate in the respective abstraction. Rather, the analysis difficulties point out aspects that have not yet been considered for the corresponding methods. In this sense poor analysis results indicate potential research directions for the improvement of the single performance analysis approaches.. Furthermore, there are also questions that the proposed set of small benchmarks cannot answer. For instance it would be useful to analyze larger systems with the aim to examine the scalability of the different abstractions with respect to analysis accuracy and analysis times. It could also be interesting to consider the combination of several system properties that have been isolated in the single benchmarks.

O O O O O O O B I O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Handling asymmetry in power heterogeneous ad hoc networks Traditional MAC and routing protocols, which are primarily designed for homogeneous networks wherein all nodes transmit with the same power, suffer performance degradations when employed in power-heterogeneous networks. The observed degradations are due to link asymmetry, which arises as high power nodes that do not sense the transmissions of low power nodes can potentially initiate transmissions that interfere with the low power communications. Link layer asymmetry in power heterogeneous networks not only disrupts the functioning of the routing protocol in use, but also results in unfairness in medium access. In this paper, we develop a cross-layer framework to effectively address the link asymmetry problem at both the MAC and the routing layers. At the MAC layer, the framework intelligently propagates low power control messages to the higher power nodes, so as to preclude them from initiating transmissions while there are low power communications in progress within their sensing range. At the routing layer, the framework facilitates the efficient use of unidirectional links. We perform extensive simulations to study the performance of our proposed framework in various settings, and show that the overall throughput in power heterogeneous networks is enhanced by as much as 25 % over traditional layered approaches. In addition, we show that our schemes are also beneficial in power homogeneous settings, as they reduce the extent of false link failures that arise when the IEEE 802.11 MAC protocol is used. In summary, our framework offers a simple yet effective and viable approach for medium access control and for supporting routing in power heterogeneous ad hoc networks. Emerging ad hoc networks are likely to consist of devices with varying capabilities. One could envision low power sensor nodes and wireless hand-held devices integrated into a single network with higher power wireless devices such as laptops, wireless routers or wireless devices mounted on vehicles, powered by inside alternators. In such heterogeneous networks nodes are likely to transmit at different power levels, thereby causing communication links of varying range. In such networks link asymmetry is likely to be the norm. Link asymmetry may also appear in ad hoc networks when power control is employed, in order to reduce energy consumption or to enhance spatial reuse in the network (as in [11, 20] ). With link asymmetry, the transmission of a lower power node might not be received (or sensed) at a higher power node, while communication in the reverse direction could be feasible. As a result, traditional MAC and routing protocols that implicitly assume that links are bi-directional will either fail or perform poorly. At the MAC layer the hidden terminal problem is exacerbated [26] ; routing becomes challenging due to presence of unidirectional links [19] , [24] , [3] .. There have been a plurality of research efforts on alleviating the effects of link asymmetry in ad hoc networks. It has been shown in [26] that the performance of the IEEE 802.11 MAC protocol degrades in the presence of link asymmetry, since low power nodes cannot acquire the channel for sufficient durations. Link asymmetry at the MAC layer has also been studied in [4] and [18] ; however, these studies are limited to certain scenarios with strict assumptions. In parallel, [19] , [24] , [3] , [2] , [31] propose methods for routing in the presence of unidirectional links; however, most of these studies ignore interactions with the MAC layer. Specifically, they either (i) employ the traditional IEEE 802.11 MAC protocol, which is inefficient with link asymmetry, or (ii) they assume an ideal MAC protocol which can only function effectively in the presence of unidirectional links. Finally, there are proposals to build link layer tunnels in order to hide unidirectional links from the higher layers [9] , [12] ; again, MAC layer effects can impact these solutions.. The prior work in [26] considers the propagation of MAC layer control messages (in particular the IEEE 802.11 MAC protocol is studied) in order to alleviate the effects of asymmetry. However, the work considered variants of flooding for the above propagation and the overhead incurred was shown to be prohibitive; as a result, performance enhancements were not achieved. We first examine if reducing this overhead via some simple strategies can improve the MAC layer performance. In particular, we study the effect of i) using an intelligent broadcasting scheme to quell unnecessary broadcasts, and, ii) reserving the bandwidth for multiple data packets with a single RTS/CTS exchange (the multi-reservation scheme). Our simulations show that these extensions offer fairly limited performance enhancements (as compared to the legacy IEEE 802.11 protocol) in terms of the MAC layer throughput.. The above studies lead us to believe that a further reduction in the MAC layer control message propagation overhead could yield higher performance dividends. In order to do so, as opposed to relying on broadcasting strategies like before, we design a cross layer solution, wherein, MAC layer control messages that are transmitted with low powers are routed to beyond the one-hop neighborhood of the low power transmitter. As before, the goal is to inform and silence the high power nodes that, being oblivious of low power communications within their sensing range, can potentially initiate transmissions that will collide with existing low power communications. However, with this approach the functionality is achieved with much lower overhead. In addition, our framework implicitly facilitates the tunneling of MAC and routing control packets via a reverse path (also referred to as the inclusive cycle [3] ) that spans a unidirectional link. Tunneling supports the effective utilization of the unidirectional links at the routing layer. In summary, our framework effectively:. • Eliminates MAC layer inefficiencies in power heterogeneous ad hoc networks, thereby increasing throughput achieved at the MAC layer to a value that commensurates with that of a power-homogeneous network. • Identifies and effectively utilizes unidirectional links at the routing layer, thereby improving the performance in terms of throughput perceived at the higher layers (as compared to that with traditional routing protocols under power heterogeneous conditions).. We implement our framework in two steps. First we modify the MAC layer to incorporate basic routing functionalities; this results in our topology-aware CTS propagation (TACP) scheme. With TACP, CTS messages are "routed" to the higher power nodes prior to any data exchange involving low power nodes. We combine TACP with the previously mentioned multi-reservation scheme. These two schemes are independent, and provide complementary improvements in performance. Second, we extend TACP to tunnel MAC and routing control packets in the reverse direction of a unidirectional link on a path that spans this link. (The structure that is formed for propagating the CTS message is used for this purpose.). We perform extensive performance evaluations of our framework via simulations. First, we eliminate higher layer artifacts and examine the performance improvements exclusively at the MAC layer. In this stage, we do not tunnel packets or perform routing. We observe that the MAC throughput of the low power nodes improves by approximately 24 % as compared to the IEEE 802.11 MAC protocol. Next, we study the benefits offered by our framework as perceived at the transport layer (UDP). We show that the number of false link failures reported to the routing layer is reduced by up to 20 %. In addition, the overall packet delivery ratio observed at the transport layer improves by up to 25 % as compared with the traditional layered structure (with the IEEE 802.11 MAC protocol and AODV in place).. The rest of this paper is organized as follows: In Section 2 we describe related previous work. In Section 3 we briefly revisit the problems due to link asymmetry. In Section 4 we describe our methodologies in detail; in particular, we discuss: (a) specific MAC layer enhancements that were initially considered, and (b) our cross layer framework. In Section 5 we present our simulation results and discuss the achieved performance enhancements. Our conclusions form Section 6. In this paper our key contribution is the development of a unified framework that offers a coupling between the MAC and the routing layers to deal with link level asymmetries in power heterogeneous ad hoc networks. While there had been no prior solutions that handle asymmetry effectively at the MAC layer, previous unidirectional routing schemes had ignored the MAC layer dependencies. In our framework the MAC layer solicits assistance from the routing layer to identify link asymmetry. Low power nodes then route MAC layer control frames to high power nodes that are beyond their transmission range, to inhibit them from performing transmissions while they are in the process of communicating with other nodes. At the same time, the framework also allows for the identification and usage of unidirectional links at the routing layer. This in turn leads to shorter routes and consequently to improved performance. We also considered two techniques that are exclusively deployed at the MAC layer based on (a) the use of an intelligent broadcast scheme to quell unnecessary broadcasts, and (b) reserving the bandwidth for multiple data frames with a single RTS/CTS exchange. We find that while these schemes can also provide improvements in performance, our cross-layer approach does significantly better. We study the performance exclusively at the MAC layer and at the higher layers. At the transport layer, our cross layer framework can improve throughput at the low power nodes by up to 25%, alleviating the unfairness introduced with the legacy IEEE 802.11 MAC. We also show a significant reduction (by 20%) in the total number of false link failures caused in the network due to interference from neighboring nodes. As a result of this comprehensive simulation-based analysis, our integrated MAC/Routing layer framework is shown to offer a simple yet viable and effective solution for handling asymmetry in power heterogeneous ad hoc networks.. In this work, we propose the use of traditional on-demand routing protocols (DSR and AODV) atop our integrated framework. While this is a preferable approach for ensuring backward compatibility with possible previous implementations of these protocols, one might also explore future optimizations to network wide routing in power heterogeneous networks. In addition, in this work we have simulated fixed power levels and therefore coarse-grained power heterogeneity. Our schemes need to be examined when nodes deploy fine-tunable power levels, i.e. in the presence of power control. There is a trade-off between exploiting spatial re-use with power control and dealing with the consequent link level asymmetry. We are planning to investigate these aspects in our future efforts.

O O O O O O O O O B O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B I O O O O B O O B O O O B O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O B I O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B O O O O O O O O O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O B O O O O O O B I O O O O O O O O O O O B I O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O B O O O O O B I O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O B O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O B O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O B O O O O B O O O O O O B O O O O O B O O O B I O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O


A language-independent and formal approach to pattern-based modelling with support for composition and analysis Context: Patterns are used in different disciplines as a way to record expert knowledge for problem solv-ing in specific areas. Their systematic use in Software Engineering promotes quality, standardization, reusability and maintainability of software artefacts. The full realisation of their power is however hindered by the lack of a standard formalization of the notion of pattern. Objective: Our goal is to provide a language-independent formalization of the notion of pattern, so that it allows its application to different modelling languages and tools, as well as generic methods to enable pattern discovery, instantiation, composition, and conflict analysis. Method: For this purpose, we present a new visual and formal, language-independent approach to the specification of patterns. The approach is formulated in a general way, based on graphs and category theory, and allows the specification of patterns in terms of (nested) variable submodels, constraints on their allowed variance, and inter-pattern synchronization across several diagrams (e.g. class and sequence dia-grams for UML design patterns). Results: We provide a formal notion of pattern satisfaction by models and propose mechanisms to sug-gest model transformations so that models become consistent with the patterns. We define methods for pattern composition, and conflict analysis. We illustrate our proposal on UML design patterns, and discuss its generality and applicability on different types of patterns, e.g. workflow patterns, enterprise inte-gration patterns and interaction patterns. Conclusion: The approach has proven to be powerful enough to formalize patterns from different domains, providing methods to analyse conflicts and dependencies that usually are expressed only in tex-tual form. Its language independence makes it suitable for integration in meta-modelling tools and for use in Model-Driven Engineering. Patterns [1] are used in different disciplines as a way to record expert knowledge for problem solving in specific areas. They are increasingly used in Software Engineering for the definition of software applications and frameworks [14] , as well as in Model-Driven Engineering to indicate parts of required architectures [2, 19] , drive code refactorings [21] , or build model-to-model transformations [6] . Their systematic use promotes quality, standardization, reusability and maintainability of software artefacts. However, the full realisation of their power is hindered by the lack of a standard formalization of the notion of pattern, as they are typically presented through natural language to explain their motivation, context and consequences; programming code to show usages of the pattern; and example diagrams to communicate their structure and behaviour.. Moreover, the use of domain-specific modelling languages, such as UML for design patterns [14] or coloured Petri nets for workflows [35] , forces pattern proposers to provide only examples of their realisation, appealing to intuition to extend them to the complete semantics of the pattern. For instance, the fact that in the Visitor GoF pattern [14] there must be a distinct operation in the Visitor interface for each ConcreteElement is only under-stood through generalisation of the examples or reading the asso-ciated text [14] . Even though natural language and examples are necessary and useful for pattern documentation, the automated use of patterns for modelling requires a formalization of some of their aspects to enable pattern instantiation, pattern identification, pattern composition and analysis of pattern conflicts. E-mail addresses: bottoni@di.uniroma1.it (P. Bottoni), eguerra@inf.uc3m.es (E. Guerra), Juan.deLara@uam.es (J. de Lara) .. In this sense, several existing formal approaches resort to languages based on mathematics or logics to formalize patterns. This allows a systematic use of patterns and the automation of patternbased tasks. Unfortunately, defining patterns in these approaches requires expert knowledge of the used underlying formalism, which is rarely found in the average engineer. Furthermore, engineers have to deal with two representations of the same patterns (the intuitive one used in the application domain for communication purposes, and its formal counterpart) and have to guarantee that both representations are consistent. As a result, tools built on top of these formalizations make it difficult to define new patterns and maintain the existing ones. Therefore, more user-friendly formalizations are required.. Moreover, many formal approaches are tied to a specific modelling language, frequently UML, and reusing the procedures developed for them in other languages and tools is not possible. Thus, it is clear that a formalization would benefit from being generic and language-independent, and hence reusable. This independence is especially useful in Model-Driven Engineering, which relies on domain-specific languages for modelling applications, and in meta-modelling tools for generating tools for these languages. Having a generic framework for manipulating patterns for any language would reduce the development time of modelling tools with support for patterns.. In this paper we tackle these problems by proposing a formal notion of pattern, grounded in category theory [25] , which sees them as formed of: (i) a vocabulary of roles; (ii) a collection of diagrams defining associations between roles, and supplemented with indications of variable regions and their instantiation constraints; (iii) a collection of interfaces that identify roles across different diagrams; and (iv) a set of positive or negative constraints defining pattern invariants. From this formalization several benefits are obtained, representing a distinguishing novel feature of our approach. First, patterns in some specific domain are formalized by using the notation used in that particular domain. For instance, the formalization of a GoF pattern will use the UML notation, whereas workflow patterns will use coloured Petri nets instead. This is so because we rely on a categorical framework rather than on the special features of particular languages. Second, a clear specification of the parts of the pattern that can be replicated (and of the admissible number of replicas) is given, without recurring to concrete examples. Third, patterns are defined via several inter-related diagrams, e.g. a class and a sequence diagram for GoF patterns, which enables their synchronous instantiation in a consistent manner.. Moreover, we can formalize additional environmental conditions that must hold for the pattern to be correctly applied. These are to be understood as pattern invariants and, up to a point, allow the formalization of some of the intentions and consequences of patterns and permit automatic detection of pattern conflicts. Finally, the formalization allows pattern composition and the creation of new patterns by reusing existing ones, thus enabling the realization of pattern-based languages. Again, all these operations are expressed in a language-independent manner, so that they can be applied across different languages and tools. This paper builds on our previous work in [7] , and extends it with a more expressive description of the allowed instantiations of the variability regions (equations instead of intervals), a representation of pattern invariants, techniques for pattern composition and analysis, and the formalization of patterns for additional modelling languages. We purposely present the results using intuition and examples. However, given that one of the points of our work is that it is a formalization of patterns, we have kept the main definitions in an appendix.. Paper organization. Section 2 overviews related approaches. Section 3 reviews our definition of pattern, presenting the new way of handling instantiation constraints of variable regions. Section 4 presents our formalization of pattern invariants. Section 5 shows the procedure for applying patterns to models. As an extension of previous work, this may imply either the addition of elements so that the model conforms to a pattern, or both the deletion and addition of objects so that the pattern invariants are satisfied. Section 6 introduces methods for composing patterns and analyse conflicts. Section 7 presents examples in different modelling languages, and Section 8 ends with the conclusions. After briefly introducing the relevant notions of Category Theory in Appendix A, we gather in Appendix B the formal details of the concepts and definitions used throughout the paper. However, the article can be fully understood without reading them. In this work we have presented a formal approach to the specification of patterns, as well as procedures for pattern-based model completion, pattern composition and analysis of pattern conflicts. In the proposed formalization, patterns are annotated by roles in a vocabulary, may contain variable parts (possibly nested), support synchronization of the variable parts inside a diagram and across different types of diagrams, and may contain constraints formalizing environmental conditions. The latter may be used to formalize some intentions and consequences of the patterns.. Our approach presents several benefits with respect to existing ones. First, the proposal relies on a general meta-model for patterns, not necessarily based on UML, and the algorithms and constructions are presented in a categorical framework so that they can be applied to a great variety of domain-specific languages. This was exemplified through the formalization of patterns in quite different domains. Moreover, the categorical framework permits using model fragments of the domain-specific language to specify the pattern. This has the advantage that the pattern designer does not have to learn a formal complex mathematical language for the formalization. Second, variability regions -with the possibility of nesting -together with the equations governing their permitted instantiations are more flexible than current proposals, which annotate single elements with cardinalities [13] and for which it is more difficult to express that several elements have to vary together. For example, complex dependencies on permitted instantiations of variability regions (like, e.g., Fig. 6 ) are possible in our approach, and difficult to express in most approaches. Third, our mechanism for pattern application considers synchronization of several diagrams. The synchronization is flexible, as it allows for example synchronizing nested variable parts with independent ones, like we showed in the Visitor example in Fig. 7 . Fourth, we separate the roles from the pattern structure by a triple graph, without extending existing meta-models. This clean and non-intrusive solution facilitates the manipulation and querying of the vocabulary models, as well as the identification of pattern instances. Moreover, using separate models for the roles and the traces facilitates the implementation, as one does not need to modify the meta-model of the domain-specific language for which the patterns are defined. Such modification is impractical or even impossible in most cases. Fifth, our use of constraints to express extra environmental conditions enables the analysis of pattern conflicts, which can be done statically. Finally, our formal treatment facilitates the derivation of recovery actions oriented to preserve the satisfaction of existing pattern instances in models. Thus, altogether we believe that this work is an enabling step towards the automated and flexible use of pattern specifications for modelling with domain-specific languages.. We are implementing this approach in a meta-modelling framework, which is a new version of the AToM 3 meta-modelling kernel [9] rewritten in Java. As the tool allows the definition of domainspecific modelling languages through meta-modelling, our language-independent formalization enables the definition of a general infrastructure to define patterns for different languages. For the algorithms presented in Section 5 (to complete models and to enforce invariants) one can resort to graph rewriting techniques.. It is important to mention that two crucial features needed are the ability to generate rules on the fly, as well as to store, interactively select and pass matches between rule applications. A future contribution will present this meta-modelling framework in depth, together with its pattern-based modelling capabilities, based on the formalization we have introduced in this paper.. Concerning the current limitations of the approach, consider for example the Critical Region pattern shown in Fig. 18 . In order to formalize the intent of this pattern completely, one should rely not only on syntactical aspects, as shown with the graph constraints, but also on behavioural ones. For example, a reasonable assumption is to ask each participant process to be deadlock free, and to control that a mutex can never receive more tokens than it had in the initial marking. In general, this cannot be done with purely syntactical means, but the constraints would have to query the reachability graph. One way to do it is to allow constraints with formulae in computational tree logic. It is up to future work to combine structural patterns with behavioural constraints. Note that in our current approach we may have constraints on behavioural diagrams, but only concerning their syntax.. Other lines of future work include formalization of patterns in additional languages and improvement of tool support, both for modelling and for analysis. The presented notion of satisfaction enables the use of our formalization for pattern identification, but heuristics specific to the domain language may be needed here. We are also working towards augmenting the expressivity of our patterns. Whereas the replication mechanism of variable parts is powerful enough to cover many interesting patterns, the replication occurs in ''width" but not in ''length". For example, with our current formalization, it is difficult to generate a path of connected nodes of arbitrary length. Even though we have detected that variability in patterns usually occurs in width, considering replication in length is also interesting, and could be done along the lines of [24] .. a class Ob C of objects; for each pair of objects A, B 2 Ob C , a set Mor C (A,B) of morphisms; for all objects A, B, C 2 Ob C , a composition operation ( Instead of f 2 Mor C (A,B) we write f: A ? B and leave out the subscript for the composition operation. For such a morphism f, A is called its domain and B its codomain. One example of category is Set with objects all sets and arrows the total functions. Another category that we commonly use is Graph with objects graphs and morphisms graph homomorphisms. A graph can be described by a tuple G = (V, E, s, t), where V is a set of nodes (or vertices), E is a set of edges, and s: E ? V and t: E ? V are the source and target functions, which assign the source and target nodes to each edge. ). The identity arrow is the arrow that maps each node and edge to itself. Graph homomorphisms are associative as total functions for sets are associative. The structure of graphs can be enriched with attributes in nodes and edges, as well as with types for nodes and edges. See [12] for more details.. One can build new categories out of simpler ones. For example, we can build the category of triple graphs TriGraph out of the category Graph, by taking as objects tuples of three graphs (named source, target and correspondence) and two graph morphisms from the correspondence to the source and target. Technically, what we build is a functor category Graph Á Á?Á . A pushout generalises the union of two objects in a given category. Intuitively, it is the object that results from the gluing of two objects along a common subobject. The shortcomings of presenting patterns in the Gang of Four (GoF [14] ) style have been addressed by several researchers, who advocate a more formal approach. However, most of the formalizations are specific to UML design patterns since they modify UML to incorporate elements of the formalization, and therefore they cannot be extrapolated to other languages.. For example, [13] extends the UML meta-model with roles and constraints, and conformance of a model to a pattern is checked as the usual model/meta-model relationship. The technique works for UML class and sequence diagrams, and is focused on the specification of patterns, not on their use for model completion. A non-uniform interpretation of interaction diagrams is provided, where reference to interaction fragments is translated to their unfolding with respect to the instantiation of roles. In [26] the authors extend the UML meta-model with stereotypes accounting for possible realizations of patterns. A distinction between roles, types and classes is used in [23] to decouple representations of roles from implementation aspects, although they resort to the lower level for defining the admissible realisations of the pattern. In [10] the UML Profile meta-model is extended with stereotypes and tagged values for pattern annotation and visualization. This also allows pattern composition through single instances. Our approach relies on annotations through triple graphs, introducing a new metamodel for patterns, but without modifying existing meta-models. Finally, an approach similar to ours -but specific for UML design patterns -is taken in [27] , where a visual language allows representing roles played by participants in patterns, which can then be instantiated by elements of a UML model. The approach provides notions of variability and (limited) support for definition of behavioural (collaboration) diagrams, but without an explicit notion of synchronization between parts of the specification. Although patterns can overlap on some model elements, there is no explicit notion of composition.. There are also other works that introduce the formalization independently of the modelling language. Such independence is achieved in [22] by using Object-Z, but no composition or conflict analysis techniques are given. Constraints on the use of patterns are exploited in [32] to maintain the consistency of a pattern-based software framework through the use of high-level transformations specific to each pattern. In [30] , the authors propose a logic-based approach, using subsets of First Order Logic -for structural aspects -and Temporal Logic of Actions -for behavioural ones -and supporting pattern combinations. As the language does not include implications, support for complex constraints appears limited. These approaches have the shortcoming of using a complicated mathematical formalism for formalizing the patterns, different from the domain language in which the pattern has to be applied.. Another axis of related work concerns the different usage scenarios of the formal specifications. The most basic activity is checking the conformance of a model against a pattern. Further activities include model completion, guidance for pattern use, pattern identification (i.e., detecting patterns in models), and pattern analysis. For example, in [20] the intent of design patterns is described with an ontology, which can be queried to obtain suggestions about the most appropriate pattern solving a certain problem. Constraints are used for formalizing patterns in [15] , where patterns are considered as paragons of good design, to which models must conform. The use of a constraint solver allows identifying defects in the design as violation of constraints. As a defective model satisfies a relaxed version of the constraints anyway, this suggests recovery actions. A similar feature is obtained in our approach, as we partially formalize the intents and consequences of patterns via graph application conditions, which declare invariants for the patterns to be correctly applied.. The inherently dynamic nature of graph transformation [12] has also been used to formalise patterns and the actions to be performed on models to achieve pattern conformance. In [28] , patterns are represented with rules, applied to abstract syntax trees to annotate the pattern instances found. In [29] , models are transformed to conform to patterns, after having exploited graph queries that detect needs for transformations. In [37] Spatial Graph Grammars provide a graph representation of GoF patterns, to transform object structure graphs so that they conform to patterns. Although declarative, the rules are based on a concrete presentation of patterns, and not on a meta-model characterisation.. Finally, several works consider pattern composition and conflicts, but again mostly with reference to GoF patterns. For example, in [36] the authors distinguish between stringing and overlapping for pattern composition. In the first case, relationships are added to relate elements that play roles in both patterns. This facilitates the identification of the individual occurrences of the composed patterns, but makes the project less cohesive. With overlapping, in a way analogous to the construction we propose, some elements play roles in both patterns. They integrate both approaches by first using stringing at a high level of abstraction, and then merging the different classes. Their approach works at the structural level only, and no technique for conflict analysis is provided. An approach analogous to pattern stringing relies on pattern componentization, proposed in [3] , through which a pattern is transformed into a component allowing direct reuse of the code implementing a solution. In this case, an Eiffel contract defines the characteristics of the component. The approach in [4] formalizes patterns in First Order Logic and sees composition as overlapping, as indicated by the presence of elements in models which conform to the specification of two patterns. A static definition of composite patterns results from the conjunction of the formulas defining the individual component patterns. The approach can thus be used to verify conformance of a model to a composite pattern, but not for model completion.. In conclusion, we observe the lack of an integrated, domainindependent formalism able to give account of mutual synchronization constraints within a pattern and across different ones, and to support pattern checking, identification, application, composition and conflict analysis. In the rest of the paper we present one such formalism.

O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O