@article {14711,
	title = {Mutatis Mutandis: Safe and predictable dynamic software updating},
	journal = {ACM Trans. Program. Lang. Syst.},
	volume = {29},
	year = {2007},
	month = {2007/08//},
	abstract = {This article presents Proteus, a core calculus that models dynamic software updating, a service for fixing bugs and adding features to a running program. Proteus permits a program{\textquoteright}s type structure to change dynamically but guarantees the updated program remains type-correct by ensuring a property we call con-freeness. We show how con-freeness can be enforced dynamically, and how it can be approximated via a novel static analysis. This analysis can be used to assess the implications of a program{\textquoteright}s structure on future updates in order to make update success more predictable. We have implemented Proteus for C, and briefly discuss our implementation which we have tested on several well-known programs.},
	keywords = {capability, dynamic software updating, proteus, Type inference, updateability analysis},
	isbn = {0164-0925},
	doi = {10.1145/1255450.1255455},
	url = {http://doi.acm.org/10.1145/1255450.1255455},
	author = {Stoyle,Gareth and Hicks, Michael W. and Bierman,Gavin and Sewell,Peter and Neamtiu,Iulian}
}
@conference {14710,
	title = {Mutatis mutandis: safe and predictable dynamic software updating},
	booktitle = {Proceedings of the 32nd ACM SIGPLAN-SIGACT symposium on Principles of programming languages},
	series = {POPL {\textquoteright}05},
	year = {2005},
	month = {2005///},
	pages = {183 - 194},
	publisher = {ACM},
	organization = {ACM},
	address = {New York, NY, USA},
	abstract = {Dynamic software updates can be used to fix bugs or add features to a running program without downtime. Essential for some applications and convenient for others, low-level dynamic updating has been used for many years. Perhaps surprisingly, there is little high-level understanding or language support to help programmers write dynamic updates effectively.To bridge this gap, we present Proteus, a core calculus for dynamic software updating in C-like languages that is flexible, safe, and predictable. Proteus supports dynamic updates to functions (even active ones), to named types and to data, allowing on-line evolution to match source-code evolution as we have observed it in practice. We ensure updates are type-safe by checking for a property we call "con-freeness" for updated types t at the point of update. This means that non-updated code will not use t concretely beyond that point (concrete usages are via explicit coercions) and thus t{\textquoteright}s representation can safely change. We show how con-freeness can be enforced dynamically for a particular program state. We additionally define a novel and efficient static updateability analysis to establish con-freeness statically, and can thus automatically infer program points at which all future (well-formed) updates will be type-safe. We have implemented our analysis for C and tested it on several well-known programs.},
	keywords = {capability, dynamic software updating, proteus, Type inference, updateability analysis},
	isbn = {1-58113-830-X},
	doi = {10.1145/1040305.1040321},
	url = {http://doi.acm.org/10.1145/1040305.1040321},
	author = {Stoyle,Gareth and Hicks, Michael W. and Bierman,Gavin and Sewell,Peter and Neamtiu,Iulian}
}
@conference {18666,
	title = {Building dependable distributed applications using AQUA},
	year = {1999},
	month = {1999///},
	pages = {189 - 196},
	abstract = {Building dependable distributed systems using ad hoc methods is a challenging task. Without proper support, an application programmer must face the daunting requirement of having to provide fault tolerance at the application level, in addition to dealing with the complexities of the distributed application itself. This approach requires a deep knowledge of fault tolerance on the part of the application designer, and has a high implementation cost. What is needed is a systematic approach to providing dependability to distributed applications. Proteus, part of the AQuA architecture, fills this need and provides facilities to make a standard distributed CORBA application dependable, with minimal changes to an application. Furthermore, it permits applications to specify, either directly or via the Quality Objects (QuO) infrastructure, the level of dependability they expect of a remote object, and will attempt to configure the system to achieve the requested dependability level. Our previous papers have focused on the architecture and implementation of Proteus. This paper describes how to construct dependable applications using the AQuA architecture, by describing the interface that a programmer is presented with and the graphical monitoring facilities that it provides},
	keywords = {ad hoc methods, application programmer, AQuA, complexities, computational complexity, dependable distributed applications, distributed CORBA application, distributed object management, Fault tolerance, fault tolerant computing, proteus},
	doi = {10.1109/HASE.1999.809494},
	author = {Ren,J. and Michel Cukier and Rubel,P. and Sanders,W. H. and Bakken,D. E. and Karr,D. A.}
}
@conference {18689,
	title = {Proteus: a flexible infrastructure to implement adaptive fault tolerance in AQuA},
	year = {1999},
	month = {1999/11//},
	pages = {149 - 168},
	abstract = {Building dependable distributed systems from commercial off-the-shelf components is of growing practical importance. For both cost and production reasons, there is interest in approaches and architectures that facilitate building such systems. The AQuA architecture is one such approach; its goal is to provide adaptive fault tolerance to CORBA applications by replicating objects, providing a high-level method for applications to specify their desired dependability, and providing a dependability manager that attempts to reconfigure a system at runtime so that dependability requests are satisfied. This paper describes how dependability is provided in AQuA. In particular it describes Proteus, the part of AQuA that dynamically manages replicated distributed objects to make them dependable. Given a dependability request, Proteus chooses a fault tolerance approach and reconfigures the system to try to meet the request. The infrastructure of Proteus is described in this paper, along with its use in implementing active replication and a simple dependability policy},
	keywords = {adaptive fault tolerance, AQuA, commercial off-the-shelf components, CORBA applications, cost, dependable distributed systems, distributed object management, object replication, proteus, reconfigurable architectures, Runtime, Software architecture, software fault tolerance},
	doi = {10.1109/DCFTS.1999.814294},
	author = {Sabnis,C. and Michel Cukier and Ren,J. and Rubel,P. and Sanders,W. H. and Bakken,D. E. and Karr,D.}
}
@conference {18662,
	title = {AQuA: an adaptive architecture that provides dependable distributed objects},
	booktitle = {Seventeenth IEEE Symposium on Reliable Distributed Systems},
	year = {1998},
	month = {1998/10//},
	pages = {245 - 253},
	abstract = {Dependable distributed systems are difficult to build. This is particularly true if they have dependability requirements that change during the execution of an application, and are built with commercial off-the-shelf hardware. In that case, fault tolerance must be achieved using middleware software, and mechanisms must be provided to communicate the dependability requirements of a distributed application to the system and to adapt the system{\textquoteright}s configuration to try to achieve the desired dependability. The AQuA architecture allows distributed applications to request a desired level of availability using the Quality Objects (QuO) framework and includes a dependability manager that attempts to meet requested availability levels by configuring the system in response to outside requests and changes in system resources due to faults. The AQuA architecture uses the QuO runtime to process and invoke availability requests, the Proteus dependability manager to configure the system in response to faults and availability requests, and the Ensemble protocol stack to provide group communication services. Furthermore, a CORBA interface is provided to application objects using the AQuA gateway. The gateway provides a mechanism to translate between process-level communication, as supported by Ensemble, and IIOP messages, understood by Object Request Brokers. Both active and passive replication are supported, and the replication type to use is chosen based on the performance and dependability requirements of particular distributed applications},
	keywords = {adaptive architecture, AQuA, availability requests, client-server systems, commercial off-the-shelf hardware, CORBA, dependability manager, dependability requirements, dependable distributed objects, distributed object management, Ensemble protocol stack, Fault tolerance, group communication services, middleware software, Object Request Brokers, process-level communication, proteus, Quality Objects, replication, software fault tolerance, Software quality},
	doi = {10.1109/RELDIS.1998.740506},
	author = {Cukier, Michel and Ren,J. and Sabnis,C. and Henke,D. and Pistole,J. and Sanders,W. H. and Bakken,D. E. and Berman,M.E. and Karr,D. A. and Schantz,R.E.}
}
