briefly discuss how we use proof-carrying code to develop network packet filters that are faster than similar filters developed using other techniques and are formally guaranteed to be safe with respect to a given operating system safety policy.

We present a broad extension of the conventional formalism of state machines and state diagrams, that is relevant to the specification and design of complex discrete-event systems, such as multi-computer real-time systems, communication protocols and digital control units. Our diagrams, which we

conditions and leads to a uniform treatment of rules and proofs whereby rules are viewed as proofs of higher-order judgements and proof checking is reduced to type checking. The practical benefit of our treatment of formal systems is that logic-independent tools such as proof editors and proof checkers

Consider a committee which must select one alternative from a set of three or more alternatives. Committee members each cast a ballot which the voting procedure counts. The voting procedure is strategy-proof if it always induces every committee member to cast a ballot revealing his preference. I

To support the sharing and reuse of formally represented knowledge among AI systems, it is useful to define the common vocabulary in which shared knowledge is represented. A specification of a representational vocabulary for a shared domain of discourse — definitions of classes, relations

Over the last decade, significant advances have been made in compilation technology for capitalizing on instruction-level parallelism (ILP). The vast majority of ILP compilation research has been conducted in the context of generalpurpose computing, and more specifically the SPEC benchmark suite

PVS is a prototype system for writing specifications and constructing proofs. Its development has been shaped by our experiences studying or using several other systems and performing a number of rather substantial formal verifications (e.g., [5,6,8]). PVS is fully implemented and freely available

This paper explores the structural differences and relative goodness-of-fits of affine term structure models (ATSMs55). Within the family of ATSMs there is a tradeoff between flexibility in modeling the conditional correlations and volatilities of the risk factors. This trade-off is formalized

We give an efficient procedure for verifying that a finite-state concurrent system meets a specification expressed in a (propositional, branching-time) temporal logic. Our algorithm has complexity linear in both the size of the specification and the size of the global state graph for the concurrent

Robust and powerful software instrumentation tools are essential for program analysis tasks such as profiling, performance evaluation, and bug detection. To meet this need, we have developed a new instrumentation system called Pin. Our goals are to provide easy-to-use, portable, transparent