Arnaud Dieumegard

Andres Toom

Marc Pantel

Comparing transformation languages for the implementation of certified model transformations

Precise specifications are needed for verifying and certifying the correct behavior of critical systems. However, traditional proofreading and test based verification techniques are usually not exhaustive and as systems become more complex, their coverage is less and less adequate. Use of models allows early verification, validation and automated building of "correct by construction" systems. Our work targets formal specification and verification of model transformations. In a previous paper we tackled the problem of writing formal specifications for model transformations independently to the implementation technique. In this paper we investigate the implementation phase of these specifications as model transformations using traditional MDE techniques and the difficulties encountered while generating the verification materials.

Introduction

Model Driven Engineering (MDE) is one of the techniques that has been successfully applied for designing complex systems. Splitting a system into layers and abstracting different system properties into respective models makes large systems manageable. In an iterative or V-like development process high-level system requirements and initial coarse models are refined until the requirements and models are precise enough to be implemented. In many cases, software code can be largely or fully automatically generated from low-level models. On the other hand, modeling languages have often (but not always) clearly defined syntax and semantics. This makes a model a formal specification analysable by formal mathematically based methods. Besides complexity, in critical embedded systems there is also a related strong concern regarding safety for the end-users and the environment. A critical software system cannot be released and embedded without complying fully with the certification of its corresponding domain, for example DO-178C in the avionics, ISO26262 in the automotive and ECSS for space systems. An important aspect in these normative guidelines is the need for clear separation between specification, implementation and verification. Splitting these concerns to separate tasks that can be allocated to independent parties (a requirement for highly critical systems) helps to eliminate both specification and implementation flaws. Most commonly the final implementation is verified against the low level requirements via extensive testing. If however, the requirements are in a formal language, then automatic verification or test generation can be applied. Ideally, the implementation can be even automatically generated from the requirement specification, as for example in the CompCert compiler project from Leroy [START_REF] Leroy | Formal verification of a realistic compiler[END_REF] that is currently being experimented for flight control software by one of the authors [START_REF] França | Towards formally verified optimizing compilation in flight control software[END_REF]. This approach was experimented in the GeneAuto project where this experiment also takes place by one of the authors [START_REF] Izerrouken | Machine-checked sequencer for critical embedded code generator[END_REF]. However, the proof assistant technologies it relies on is costly and requires expert users that are currently not available in the software engineering industry that implements development tools for safety critical systems.

2 Case study: Verifying transformations in the GeneAuto code generator

GeneAuto 3 is an open code generator project for transforming a set of high-level graphical modeling languages to selected common textual programming languages (see [START_REF] Toom | Gene-auto -an automatic code generator for a safe subset of simulink-stateflow and scicos[END_REF][START_REF] Izerrouken | Certifying an automated code generator using formal tools : Preliminary experiments in the geneauto project[END_REF][START_REF] Toom | Towards reliable code generation with an open tool: Evolutions of the gene-auto toolset[END_REF], 1] that describe the evolution of the toolset in the last 6 years). It currently supports subsets of Simulink, Stateflow and Scicos as input and C, Ada and Java language as output. It is intended to be used and certified for critical embedded systems. That is why its design follows a clear modular MDE approach allowing to independently verify different transformation phases. After the initial importing step, transformations are carried out as a sequence of refinements of intermediate models.

There are about 50 transformations in the GeneAuto tool. Some of them are rather small and simple structure preserving transformations, but others are complex or change significantly the model structure. Related transformations are combined into independent executables that read and output the models to files. The transformation specifications are written with respect to these observable intermediate models. However, often these are a result of several successive transformations and verifying the structural correspondence between the input and output models is non-trivial. Here, explicit transformation links provided by the transformation tool can be very helpful, as shown by the next example. Currently, the specification for most of the elementary tools in GeneAuto have been specified in the English language, with a notable exception of the Block Sequencer tool that has been specified and implemented in the Coq proof assistant [START_REF] Izerrouken | Machine-checked sequencer for critical embedded code generator[END_REF]. In our case study we have formalized some of these requirements in a way that the specification can be directly used for transformation verification using a standard OCL checker. We will look at some transformations done by a tool called Functional Model Pre-Processor (FMPreProcessor), which handles normalizing and refinement of block diagrams. Figure 1 shows a section of the simplified GASystemModel metamodel with the relevant concepts.

The FMPreProcessor tool performs several quite simple transformations. Some of these are:

-Replaces system blocks that have corresponding library equivalents by library blocks -Flattens virtual subsystems -Matches and replaces primitive blocks with library blocks -Removes Goto-From block pairs -Determines the execution priorities of concurrent blocks based on their graphical position

As a concrete example we will look at removing Goto-From block pairs. Goto-From blocks (see Figure 2) allow to avoid visual clutter in block diagrams and split signals to sections. The GeneAuto tool removes such block pairs during the model preprocessing. A matching Goto-From pair is deleted, the endpoint of the first signal is moved to the endpoint of the second signal and the second signal is also deleted. Verifying the correctness of this transformation is easy, provided that this is the only transformation. However, if transformations add up, even repetitive applications of the same transformation, like on figure 2, where the endpoint of the signal from From1 to Goto2 is also removed, then it will be much harder to verify the transformations correctness. Such analysis would have to determine in the source model the whole flow path from the block In1 to the first block that will not be removed. It would have to know a lot more about the model and transformation semantics. On the other hand, if the transformation tool maintains a link relating each port to a port in a target model, then a property like the correctness of a Goto-From removal can be specified and verified with a few simple OCL rules. All that the transformation tool has to do to allow it, is to store that after the first transformation:

1. Goto1, From1 and s2 were replaced by s1 2. The port corresponding to the input port of Goto1 is now the input port of Goto2 And after the second transformation:

1. Goto1, From1 and s2 were replaced by s1 2. The port corresponding to the input port of Goto1 is now the input port of Out1 3. Goto2, From2 and s3 were replaced by s1 4. The port corresponding to the input port of Goto2 is now the input port of Out1.

Metamodel based transformation specification

In the context of MDE the manipulated artefacts are models. The type of models is usually referred to as a metamodel: a model that defines the concepts of an instance model. This relation is purely syntactical. The Meta-Object Facility (MOF) 4 OMG standard defines a formal four-layered (M0..M3) metamodeling architecture. For example, the metamodel of the widely used Unified Modeling Language (UML) is a M2 MOF model. Similarly, all domain specific languages can also be expressed as MOF models. The core of MOF allows only expressing simple structural properties, like associations between elements, containment, cardinality etc.

The Object Constraints Language (OCL)5 is a standard declarative first order constraint and query language, which can be used to refine MOF models. For instance, one can specify structural invariants, definitions and pre-post contracts of abstract MOF operations in the OCL language. Model transformations can also be specified as models and transformation constraints as correctness properties of the transformation model. These metamodels consist of a basic structural specification with possibly additional OCL constraints.

The transformation metamodel contains three essential parts: source, target and a transformation relation. The transformation relation is a set of explicit links between elements in the source and target model. These explicit links play a key role in our approach. These links must be explicitly given along with the transformation instance to allow feasible verification of the correctness of the transformation. In our approach these links are part of the specification and it is the responsibility of the transformation performer, be it a tool or even human, to provide these links. The relation metamodel defines the structure of the links and the properties they must satisfy and the transformation metamodel defines, which links must exist.

Transformation Metamodel

To perform model-based specification and verification of the transformation, we express the transformation of interest also as a model. Figure 3 shows our metamodel of the transformation model. This model has three main parts: references to source and target models and the relation links. The links refer to some elements in the source and target models and we expect the transformation tool to provide them.

A valid transformation model needs to comply with the transformation metamodel and a set of additional OCL constraints. Some of these constraints just specify the basic consistency of a context GenericModelElement inv s r c h a s o n l y s r c l i n k s : i n S r c M o d e l implies t g t L i n k s ->isEmpty ( ) inv t g t h a s o n l y t g t l i n k s : inTgtModel implies s r c L i n k s ->isEmpty ( ) inv s r c l i n k s s t a r t f r o m s r c : . . . inv t g t l i n k s e n d i n t g t : . . . context G e n e r i c L i n k inv s r c e l e m s a l l d e f i n e d : . . . inv t g t e l e m s a l l d e f i n e d : . . .

Other constraints are transformation specific and are specified in either the context of the respective model elements or the relation links. We use a following general pattern: for source and target metamodel elements we specify as class invariants which links they must have and for links we specify as class invariants the respective transformation's correctness properties.

Implementing the specified model transformation

There exists a wide quantity of model transformation techniques that can be used to fulfill this purpose. We will describe in this section what are the main techniques that can be used in order to encode these transformations with languages that are accessible to common engineers. We will focus on the use of MOF-based6 model transformations techniques.

Model to model transformations

In [START_REF] Czarnecki | Classification of model transformation approaches[END_REF], the authors propose a classification of model transformation approaches:

-Direct manipulation of the models. Using some API to manipulate the model, the model transformer need to implement all the necessary methods and techniques to do the transformation. -Relational approaches. Defining relations between source and target elements and specifying the constraints that must be verified by the relation. -Graph transformation based approaches. This approach is based on the graph transformation theories. Some LHS graph patterns are transformed in RHS graph patterns. -Structure driven approaches. First the hierarchical structure of the target model is created and then the attributes and references are set on the target model. -Hybrid approaches. This approach combines techniques from the previous categories.

Within the Eclipse toolset, the EMF7 framework has been developed in order to provide a Java API to manipulate models. The model transformations used eclipse are based on this API. The Ecore metamodel can be seen as the EMF version of the MOF standard (more precisely the EMOF standard). on the EMF framework it is now possible to implement a direct manipulation of models.

Using directly a programming language like Java to implement a model transformation is the most obvious way to perform the transformation. This language is widely used and known by engineers. The input model of the transformation must be loaded and methods must be implemented in order to do the transformation. But this approach has the main drawback of being painful to implement as it is mostly mandatory to rewrite every mechanism for each implementation of a transformation.

OMG has defined a standard for model transformations: QVT8 . This work started in 2002 and the first version of this standard was released in 2008. In the QVT standard, three metamodels are defined in order to provide declarative (with the Relation and Core languages) and imperative (with the Operational language) ways of performing the desired transformation. This hybrid approach allows users to implement simple transformations using the declarative languages and more complex ones using the imperative language.

Implementation

Our purpose in the previous sections and paper was to express how a formal model transformation specification can be written based on a transformation metamodel and OCL constraints. Here we will detail some experiments we did on the implementation of the Goto-From transformation specified in the section 2. The complete source code of the examples can be found at http:// dieumegard.perso.enseeiht.fr/implementation.

In order to implement the transformation described in section 2 we need to follow the following algorithm:

1. The unmodified elements must be translated on the target model without modifications all the blocks that are not Goto or From blocks (with their ports) all the signals that are not involved in Goto-From pairs 2. A link must be created between each translated element of the first step.

3. Foreach signal leaving a not From block and going to a Goto block, a recursive treatment must be done to implement the Goto-From pairs elimination. 4. A link must be created on each iteration of the third step. This link contains as source all the signals and blocks involved in the Goto-From pairs and as target the signal of the transformation.

Java/EMF based implementation Our Java based experiment is a slight retroactive extension of the existing FMPreProcessor component of the GeneAuto toolset. As explained in Section 2 most transformations in GeneAuto are endogenous (same source and target metamodels) model refinements in one of the two intermediate languages. The metamodel (abstract syntax) of these languages has been specified in UML and the skeleton Java classes have been automatically generated.

Most transformations are manually coded. In our case study we have used the GeneAuto-EMF bridge and built a transformation metamodel on top of the GeneAuto metamodels. This transformation metamodel is the same one that was used also in the other experiments described in the current paper.

We augmented the existing transformation with the creation of explicit relation links between selected source and target model elements. This change was unintrusive and only made some internal information externally observable. To manage the links we employed a following strategy. First, the tool creates a partial identity relation (all elements are mapped to themselves) between selected elements (all instances of certain element classes) of the input model. Then, the tool performs an in-place transformation of the model and each time, when an element is replaced by another one in the course of the refinement or the model structure is otherwise changed the respective links are also modified. For example, if a Goto-From block pair is removed from the model a GotoFrom2SignalLink is added to the link relation and existing Port2PortLinks are updated. The fact that in our transformation metamodel the relation links and model elements are doubly linked makes this kind of updates very simple and efficient.

Such approach can also be extended to exogenous (different source and target metamodels) model transformations. In that case the initial identity relation creation phase is not relevant and the tool just has to output target model along with the the relation links.

QVT-Relational implementation

In order to implement the transformation in QVTr we use the medini-QVT9 tool set. There are many possibilities in QVTr to implement this transformation. The target and links of the transformation can be generated directly using a single transformation but it is necessary to launch the transformation in direction of the target model then in the direction of the link model to ensure that every element is created. An other possibility is to generate only the target element and here there are two ways of generating the transformation model:

-As the tooling generates automatically a trace model and metamodel for the transformation, an other transformation can be written in order to translate this automatic trace into a trace as specified in the section 4. This second solution has a major drawback because automatically generated traces are quite verbose and relies on the structure of the first QVTr transformation code (name of the relations and attributes). This implementation is not easily done and difficultly maintainable.

-A transformation can be written taking as input the source and target models and generating the transformation model. This solution is easier to implement but a proofreading must be done between the first and second transformation in order to ensure that the links elements are created according to the first transformation.

We choose to implement the first version because of the drawbacks specified below. The first part of the algorithm is quite easy to implement using the pattern recognition mechanism of QVTr. A mapping relation is written for each type of elements that must be directly translated to the target model. A specific relation is created to generate the GenericLink related to the translation and called directly on the where clause of the mapping relation. In order to implement the second part (the Goto-From transformation), a relation matching the entry point is written. A call to an other relation witch does the recursion over the Signals and Blocks and a final relation is used to create the resulting signal. During all this process, the Signals and Blocks used must be stored in order to fill the GenericLink for the trace. The same mechanism is used to call the trace creation relation but this time with the stored Blocks and Signals.

ATL implementation As ATL is a QVT-like transformation language, the principle of the transformation is the same as previously stated. The particularity of ATL is the possibility to add imperative treatments in the rules (relation in QVTr) at the end of each transformation rule. This eases the coding work but on the other hand does not helps on the readability of the transformation code. A lot of treatments needs to be done using helpers and the usage of filter in the pattern matching for rules is necessary to ensure that no mistakes are made on the application of the rules in the first or the second part of the algorithm. With ATL, the transformation is direct and it's possible to directly generate the target model and the links model using a unique execution flow.

Advantages and drawbacks of the experimented model transformations techniques

In this section we will discuss on the different implementations of the model transformations we describe on the previous section. We will base our comparison according to three criteria.

-Ease in generating the links model. Is it difficult to add a generation of the links model in addition to the target model. -Expressiveness. What are the limits of the approach to express model transformations? -Performance. What is the performance of the transformation?

6.1 Ease of implementing the transformation Java/EMF Using either an UML or Ecore metamodel, the EMF toolkit can be used to generate the java classes representing the model elements. This capability is available also in most UML modeling tools. The transformation itself needs to be implemented manually. The main drawback of this approach is the amount of required manual coding. Every mapping mechanism or pattern recognition must be implemented directly using the Java language. In a larger project like Ge-neAuto it is likely that some kind of a framework or set of utility functions will be created first and then used for coding several transformations.

Creating the explicit relation links that we propose to use for verification does not add much overhead. The transformation tool only needs to keep and maintain some internal information that would otherwise be discarded. It is of course best, if the exact requirements for these links are specified in full detail before implementing the transformation. However, if the tool is well-structured it should not be complicated to add this also retroactively, as we did in our experiment.

QVTr The version we choose to implement in the section 5 is quite easy to implement. The mapping mechanism of QVTr is well suited for this usage. Every time a direct mapping is done, a relation creating the links is called in its where clause in order to create the link related to the source and target elements of the relation. The transitive closure aspect of our transformation requires to use the OCL conditional statements and a recursive relation but the QVTr language is well fitted for this usage. Some tweaks are necessary to store the Signals and Blocks during the transitive closure step of the transformation and use them to generate the links in a dedicated relation.

ATL Writing this transformation in ATL is quite easy and as we said on the previous section the imperative part of an ATL rule helps a lot to manage the creation of the elements and the flow of execution. It's also possible to generate the target and link models directly in one execution so it makes the rule writing more intuitive.

Expressiveness

Java/EMF Using an API in a full programming language like Java brings the expressiveness of that language to the transformation implementation. This makes any computable transformation possible.

QVTr By its nature, QVTr is limited to relations between source and target model elements. QVTr allows to express high level representation of model to model transformations. But it is sometimes difficult to do complex transformations in a declarative style as used in QVTr.

ATL As we previously said, ATL is an implantation of the QVT proposal, but it is a hybrid of declarative and imperative programming. This improves its expressiveness and grants it with the ability to express any kind of transformations but contrary to QVT, ATL transformations are unidirectional.

Performance

Performance evaluations have been done on an average computer with various generated models containing from a hundred of elements to nearly ten thousand. Two kinds of models have been used, casual ones containing a low common rate of Goto-From pairs in sequence and unusual ones with higher rate of these elements (about half of the model elements are involved in Goto-From sequences). The second kind of models are only there for evaluation of the computational performance of the transitive closure. The results of this benchmark are displayed in Table 1.

Java/EMF The Java/EMF implementation had the best performance in our study. This is rather expected from a hand made "optimal" implementation. QVTr The performance of the medini QVT implementation of QVTr is very low. It is possible to handle small models containing a few hundreds of elements but using it with bigger models results in huge execution times. The main reason for that is the pattern recognition mechanism and the fact that every relation must hold for the transformation to be successful. For every relation in the transformation, it's necessary to go over all the model to find every matching and make them hold.

ATL In QVTr, the calls from a relation to another is done via the where clause but in ATL, this is not the only way to call other rules. It is possible to specify in a rule that the specified mapped element must be transformed by transforming a specific element of the source model. Using this mechanism, it's possible to reduce the number of elements that needs to be matched in a transformation rule. The fact that ATL is also compiled and executed in a virtual machine makes the execution faster than classical interpretation of the transformation rules. Using ATL we experienced good transformation performance. However, the fact that we developed only small transformations is not irrelevant.

Perspectives

As we target this work to be used in the modeling community and in industrial contexts, we plan to extend it to other different transformations in order to test the scalability of the approach both in size and practical complexity. We plan to continue the GeneAuto experiment and formalise a larger part of the transformation specification in the style proposed in Section 3, adapt parts of the existing GeneAuto tool to produce the required trace links and study the correctness of the model transformation and the feasibility of this verification approach on realistic models.

We also plan to address the verification of the specification itself by developing a methodology for combining the syntactic transformation specification with additional semantics-based analysis to show the soundness and completeness of the transformation specification with respect to the semantics of the source and target languages. By verifying the conservation of the semantic properties by the application of the transformation we may be able to prove the soundness of the whole transformation independently of the implementation language.

And last, we plan to experiment with other model transformation languages like Kermeta, QVTo and graph rewriting based transformation engines. These elements will be added on the http: //dieumegard.perso.enseeiht.fr/implementation web page during the forthcoming weeks.

Many authors target the verification of model transformations or code generation with various purposes and technologies (see [START_REF] Dave | Compiler verification: a bibliography[END_REF] for a compiler verification bibliography). The main specific aspects of our proposal are that: a) we target qualification with respect to certification standards; b) thus we must consider the global process including independent specification, implementation and verification activities; c) we rely on OMG standards for the specification and do not enforce any technology on the implementation; d) we target only structural properties and propose to handle semantic aspects using more appropriate technologies for the specification validation in a separate phase done by different people than the one that implement the transformation; and e) we must be able to handle industrial size models. As this paper mainly focuses on the implementation part of this approach, we will compare this to others present in the literature. We detailed in our previous paper a comparison of the other aspects of our approach.

Most of the related works, as [START_REF] Cariou | Ocl for the specification of model transformation contracts[END_REF][START_REF] Cariou | Ocl contracts for the verification of model transformations[END_REF][START_REF] Cariou | Contracts for model execution verification[END_REF] or [START_REF] Büttner | On Validation of ATL Transformation Rules By Transformation Models[END_REF] relies on the links inside the transformation model in order to ease the verification of transformation. They propose to extract the links from declarative transformation languages. However, these links are most of the time implementation links that appear each time a transformation rule is applied. Thus, either the rules are written in order to ease the implementation and you usually get much more links than needed, or you introduce constraints on the way you can implement the transformation in order to produce exactly the links needed for the verification. Also, there is no implementation aspect described in these proposals.

Narayanan et al. have also proposed something very similar to our proposal in [START_REF] Narayanan | Verifying model transformations by structural correspondence[END_REF]. They advocate to focus on structural properties, to specify the transformation as relations between the source and target metamodels and then to extract these links from the cross-links used for the implementation of the transformation with the GReaT language. There is a potential drawback if the structures of the source and target metamodels are very different. It might be required to build the transformation using several intermediate models as it is usually the case with declarative languages. Then it might get complicated to retrieve the specification link that is a composition of many implementation links.

The transitive closure of a transformation rule is already a complex case: should it be translated to a single specification link, to all the intermediate links, to only the implementation links? We enforce the implementation to build exactly the right links that must be precisely described in the specification. This introduces a cost on the implementation side but it also relieves the implementation team from the constraint of using a declarative transformation language. Moreover, as in our approach it is possible to reference the links in the transformation specification, complex and composed transformations can be specified and implemented more flexibly.

Conclusion

We have described in this paper a pragmatic approach for the implementation of formally specified model transformation and some examples to describe how the creation of the transformation model can be done. This approach is well suited to the development process of complex and critical software. Verification of the implementation with respect to the specification is performed automatically using an OCL checker.

We have shown through the implementation of the same transformation with Java/EMF, QVTr and ATL that on one hand, such a model transformation specification is implementable in quite different ways, of which some can be applied on industrial size models, and on the other hand, the same automatic verification technique can be used on all of those different implementations.

Further testing of the scalability of the approach for multiple and more complex model transformations needs to be done in order to assert the usability for more complex use cases. We plan also to develop a methodology for combining the syntactic transformation specification with additional semantics-based analysis to show the soundness and completeness of the transformation specification with respect to the semantics of the source and target languages.

Fig. 1 .

 1 Fig. 1. A fragment of the simplified GASystemModel metamodel

1 Fig. 2 .

 12 Fig.2. Simulink diagram with chained Goto-From blocks before the normalizing transformation (above) and after it (below)

Fig. 3 .

 3 Fig. 3. Transformation Metamodel

Table 1 .

 1 Model transformation performance

			Technology(execution time in s)
	Model type Elements in model QVTr	ATL	Java/EMF
	Low rate	150	379,556	3,441	1,057
	Low rate	1500	-	32,802	4,660
	Low rate	15000	-5189,391	261,552
	High rate	150	430,508	3,699	1,059
	High rate	1500	-	29,771	4,681
	High rate	15000	-2647,606	132,752

http://www.omg.org/mof

http://www.omg.org/spec/OCL/2.2

http://www.omg.org/spec/MOF/

http://www.eclipse.org/modeling/emf/

Query/View/Transformation: http://www.omg.org/spec/QVT/

http://projects.ikv.de/qvt/


Review Essay: Some recent publications on the anthropology of Greece and Cyprus

Iron in the Soul: Displacement,livelihood and health in Cyprus (Studies in Forced Migration,volume 23). Peter Loizos. New York and Oxford: Berghahn Books. 2008. 224pp. ISBN-10: 1845454847. Blood and Oranges: European Markets and Immigrant Labor in Rural Greece (Dislocations, volume 2). Christopher M. Lawrence. New York and Oxford: Berghahn Books. 2007. 224pp. ISBN-10: 1845453077.

The Nomads of Mykonos: Performing Liminalities in a 'Queer' Space. (New Directions in Anthropology, volume 29). Pola Bousiou. New York and Oxford: Berghahn Books. 2008. 320pp. ISBN-10: 1845454669.

ANNE FRIEDERIKE DELOUIS Université d'Orléans

Greece, which one fellow anthropologist once described to me as the "Papua New Guinea of European anthropology," probably still attracts more ethnographers per head than any other country in Europe. Berghahn Books' recent publication of three monographs on Greek-speaking peoples testifies to this ongoing trend.

For Iron in the Soul: Displacement, livelihood and health in Cyprus, Peter Loizos drew on his long-standing connection with the villagers of Argaki, in the North of Cyprus, among whom he carried out fieldwork first in 1968, then in 1975 after the partition of the island, and again between 2000 and 2004. This long-term study is an in many ways refreshing and optimistic account of the rather successful economic and social integration of Greek Cypriot refugees in the Republic of Cyprus after 1975. Out of a myriad of life stories and ethnographic observations emerges a portrait of resourceful, hard-working people, dedicated to the well-being and advancement of their children, who manage to build up new livelihoods in (at least initially) difficult circumstances. Several factors account for the reconstruction of satisfactory living conditions: the favourable economic situation of 1980s and 1990s Cyprus; thoughtful, carefully calibrated policies devised by the state; but also -even if the issue is a sensitive one -the fact that compared to other groups of refugees, Loizos's informants rather fit the category of "internally displaced persons." As much disruption as they had to suffer when leaving their homes and most of their belongings without forewarning, they remained close to their relatives, and settled among people who spoke the same language and shared the same religion, in a state that welcomed them unquestioningly as citizens with full rights and some privileges such as free healthcare.

In some ways, Iron in the Soul is a sequel to The Greek Gift [START_REF] Loizos | The Greek Gift: Politics in a Cypriot Village[END_REF]) and above all to Loizos's compelling book The Heart Grown Bitter [START_REF] Loizos | The Heart Grown Bitter: A Chronicle of Cypriot War Refugees[END_REF], featuring a selection of the same informants more than twenty years on, some of them now exuding the wisdom of old age. With time, the perspective on pre-1975 Argaki has changed somewhat. In tune with the generally optimistic tone of this re-study, Loizos describes this mainly Greek village with a small Turkish minority as a site where a massacre could have taken place in the summer of 1975, but did not. He emphasizes the cordial relations between the two ethnic groups before, and more surprisingly, after the Turkish invasion of Cyprus.

Ostensibly, Iron in the Soul is a study of the impact of refugee status on people's health. But those readers who expect a monograph on this topic alone might be disappointed.

Only one chapter deals exclusively with health issues. A comparison between two population samples, one made up of refugees and the other of non-displaced Greek Cypriots, yields a somewhat surprising result. Refugees have suffered slightly more often from heart-related illness, but report less illness overall. Ethnographic evidence makes it plain that the perception of health problems diverges from the real situation: many illnesses and untimely deaths are blamed on the refugee condition. In reality, refugees have benefitted from free health checks and perhaps easier access to preventive medical measures, which might explain their arguably better health status despite the increased workload and deteriorated living conditions at least in the first years after 1975. As far as mental health is concerned, Loizos points out individual variation in psychological reactions to displacement and loss.

If one had to label Loizos's work, one might rather opt for the category of political than medical anthropology though. For instance, Loizos offers a fine-tuned and multi-faceted analysis of why a majority of Greek Cypriots, including those of refugee background, voted "no" to the Annan plan in 2004.

Loizos's recent ethnography also provides material for the understanding of memory, its workings and social functions. In 2003, the border to Northern Cyprus was opened for the first time since 1975. Accounts of former refugees' visits to Argaki suggest that many nourish nostalgic sentiments for the village as it once was, and no longing for its actual rundown state.

Apart from some touching welcoming scenes, the lack of tidiness and cleanliness is stressed again and again. The Turkish inhabitants apparently lack respect not only for cultural heirlooms such as the orthodox village church, but also for some formerly Greek houses in which Turkish families now live, or for the village school used by the Turkish population.

The focus on dirt and untidiness is striking and calls for further interpretation.

One would like to know the Turkish take on this, as, in general, one would have liked to read even more about the Turkish Cypriot experience than Loizos's collaboration with a Turkish sociologist from Argaki has provided. But even so, Loizos's account makes it clear that despite propaganda efforts to the contrary, the decisive cleavage has always been between Leftists and Nationalists on both sides, probably more than a division on ethnic lines.

Loizos rightly calls the concept of supposedly homogenous "generations" into question, but a series of anecdotes or ethnographic miniatures shows that on the whole the longing for the place, and the sense of what is lost, remains more vivid and painful for those who were adults when they had to flee to the South than for their children and grand-children.

Perhaps unintentionally, Iron in the Soul leaves a certain impression of closure. In visits to Northern Cyprus, refugees from Argaki could confront their -surely to some extent idealized -memories with the reality of the village, taken over and transformed by Turkish Cypriots. In thirty years, the refugees have built up new livelihoods. The displacement situation does not seem to have taken a dramatic toll on their health. The younger generations look forward and outwards rather than back, and even most of the elder ones oppose a reunification of the island if there are too many strings attached. What remains, bittersweet memories, emotional pain and longing, is perhaps best captured by the phrase "iron in the soul." Loizos's book includes some photographic portraits and a selection of texts of various types and genres produced by Greek Cypriot refugees themselves.

Like Peter Loizos, Christopher Lawrence has one parent of Greek descent, but unlike the former he did not choose to study in his extended family -which makes perhaps for a more critical stance towards some features of contemporary Greece. Blood and Oranges: European Markets and Immigrant Labour in Rural Greece deals with social and economic relations in farming communities of the Argolida region on the Peleponnesos, a mainly rural area near Nauplio. Lawrence adopts a political-economy perspective to reveal the mechanisms by which modernisation and European integration have brought about a new class of marginalized and sometimes illegal immigrant labourers in rural Greece. While higher gender equality has been achieved and children's rights are better respected than before (children are pampered rather than sent to toil in the fields, and parents invest substantially in their education), rural households now rely on cheap immigrant labor to do the actual agricultural work.

Many of the mostly Albanian labourers achieve legal status when they get working permits for which they pay expensive fees. They enjoy certain social rights (their children are educated in Greek state schools, for example), but on the whole their position remains extremely vulnerable as they are excluded from citizenship, often socially ostracized, verbally and physically attacked, and insufficiently protected by the Greek police and the judicial system. Lawrence points out that in what he terms "pluriactive households" many farmers who hire foreign workers actually lead a rentier-style life as mere land-owners, holding civil service positions or running other businesses as entrepreneurs at the same time.

EU subsidies often provide a substantial part of the household income. Lawrence describes the sometimes perverse effects of European economic policies, which may hinder rather than further modernisation, diversification and innovation on the ground, and which cunning farmers and co-operative administrators turn to their (financial) advantage as much as they possibly can.

In this book, which contains eleven photographs and one map of the region, Lawrence is careful to point out local differences between the three villages under study: Agia Triada in the valley, Manesi and Gerbesi higher up in the mountains. The valley is the site of lucrative citrus plantations, while the relatively impoverished mountain villages have to rely on tobacco and vegetable growing as well as shepherding. The further a village is up in the mountains, the more its inhabitants are situated on the left of the political spectrum. Mountain villagers tend to claim descent from Albanian-speaking 14 th -and 15 th -century immigrants (Arvanites), a source of (Greek) ethnic pride.

Christopher Lawrence has crafted a historically grounded, complete ethnography, comprising economic, political, and kinship matters. Religion is the only aspect which is given short shrift (apart from a reference to Orthodox baptism of immigrant children as an attempt to get accepted into the Greek community), probably because it is of little relevance to Lawrence's research questions. The anthropologist is particularly attentive to gender issues, such as the sexual exploitation of some female East European immigrants, or their strategy of obtaining protection through marriage with a Greek.

As before with gender inequality, now social inequality between immigrants and Greek citizens is naturalized. That is, many of Lawrence's informants hold the belief that Greeks are a distinct "race" (phili or ratsa), almost genetically predisposed to attaining a higher level of civilization (politismos) than Albanians. The Greek mass media, and private television channels in particular, play an important role here, bolstering Greek nationalism through a certain type of serials and talk-shows, and fostering anti-immigrant sentiment through sensational reports on crimes supposedly or really committed by immigrants. Despite this "neo-racism," the difference between Greek citizens and immigrants lies in reality more in their respective economic statuses and, above all, consumption practices, than in divergent biological or cultural characteristics, as Lawrence shows. An Albanian immigrant who uses a cell phone, is dressed in a fashionable way and owns a nice car stands a good chance of being accepted as a "Northern Epirote" (i.e., an Albanian-speaking, ethnic Greek) in Argolida.

Globalisation, Lawrence stresses, does not necessarily create more hybrid identities than before. The ethnic and cultural nationalism of Greek farmers is a response to Europeanization rather than a survival of 19 th -century attitudes.

The third book under review, Pola Bousiou's The Nomads of Mykonos: Performing Liminalities in a 'Queer' Space, is a monograph on a highly unusual topic: a group of people who defy classification and do not consider themselves to form a community, at least most of the time. Bousiou, a Greece-born, LSE-educated anthropologist, carried out fieldwork among the Mykoniots d'élection, a term inspired by Lawrence [START_REF] Durrell | The Greek Islands[END_REF]. Who are these people, and what justifies lumping them together in a single category? Bousiou's key informants are Greek individuals who are not originally from the island of Mykonos, but choose to take up residence there for at least part of the year. Their social background varies, their economic status remains unclear to the anthropologist. What they do have in common, apart from their attachment to Mykonos, is a certain outlook on life.

Mykoniots (not to be confused with Mykonians, the "indigenous" inhabitants of the island) share an interest in Eastern, mostly Indian philosophy and religions, which they mix syncretically with rituals derived from Orthodox Christianity. They have a peculiar aesthetic sensibility, a concern for architecture, particularly the native "cubist" style, the simple but tasteful interior decoration of their homes, or treasured handicraft objects from Greece or India. Many of them take great care over their own apparel, their looks, their bodies, which they display to their peers and tourist "audiences" in everyday or festive "performances."

Mykoniots are knowledgeable about local history and traditions which they tend to merge with esoteric beliefs, theorising about energy emanating from the triangle of islands formed by Mykonos, Delos and Tinos or a particular "Delian" light permeating the Mykonos sky.

They indulge in all kinds of "Dionysiac" hedonism, in part justified by the proximity of Delos where they believe Dionysos was worshipped and amoral debauchery took place in Ancient times. The consumption of addictive substances features prominently in Bousiou's ethnography (drug-taking was the initial focus of her research). There also seems to be a lot of sexual experimentation going on, although the author is rather discreet about that topic.

Mykoniots have a tendency to reminiscence nostalgically about their group's past, or rather its multiple pasts, such as the hippie years before the onset of mass tourism on the island. They have a peculiar perception of time, linked to changes in the weather, changing seasons, and phases of the moon, punctuated by some Orthodox and Indian holy days. The group is mostly made up of men, some of them acting out their masculinity, others not at all. Some strong, charismatic, talented women are also part of the group. Social reproduction takes place through a "system" of discipleship, even if nothing is ever very systematic or well-planned in advance in a Mykoniot's life, as Bousiou shows. An aspiring Mykoniot has to live with or work for an established member of the group for an unspecified length of time before being accepted as one of them. The author estimates that there are between 300 and 500 group members gravitating around a much smaller number of core personalities.

Pola Bousiou treats us to some vivid ethnography, such as descriptions of the annual gate-crashing trip to the ancient site of Delos in September, followed by a late-night beach party; an unusual wedding ceremony; and a farewell ceremony where ashes are scattered on a Mykonos beach. Daily routines and yearly rituals of Mykoniots are set out for the reader.

Bousiou has also included several life-histories of what can only appear as exceptional, eccentric individuals to the hoi polloi.

Before getting to these enthralling ethnographic accounts, however, the reader has to plough through exceedingly lengthy passages of theoretical reflection. Augé, Baudrillard, Bauman, Benjamin, Bhabha, Bourdieu, Clifford and Marcus, Derrida, Taussig: Just about everyone fashionable in the 1990s theoretical pantheon figures here. The text is scattered with the dominant anthropological buzzwords of the beginning 21st century: liminality, idiosyncracy, performance, narrative, (commodity) fetishism, self, construction, gaze, hybridity, reflexivity, aesthetics. One has to be of the same synaphi (group sharing a particular aesthetic sensibility) as the author to fully appreciate these theoretical developments. My personal conviction is that Pola Bousiou's ethnography is strong enough to stand on its own feet and would not have needed half of these references to other people's work and thought. By contrast, factual passages on Mykonos' recent social history appear sometimes strangely disembodied -who says what and when? Some essential explanations are relegated to the endnotes of each chapter, which are all worth reading in detail.

Perhaps as an idea for further research and publication, one would like to learn more about the locals' and tourists' experience (or even "consumption"?) of the Mykoniots. The author's best intentions to the contrary, these two groups (native Mykonians and conventional tourists) are portrayed in a vague, at times almost disparaging way. This is without doubt due to the fact that some key informants perceived their temporary or permanent neighbours on Mykonos as monolithic and rather uninteresting categories of people. Locals provide the Mykoniots with lodgings, authentic food grown in some rare surviving garden plots, opportunities to revel in Orthodox festivals, and boat trips to the adjacent islands of Delos and Rhenia. While locals figure as a service-providers, tourists are mainly consumers: they buy drinks, food and objects in bars or shops run by Mykoniots and thus contribute to their livelihood. To some extent, they are also a recruitment pool for the group, producing admirers and disciples. Otherwise they rather seem to disturb, and the main challenge in summer is to live on the island while avoiding contact with plebeian or nouveaux riches tourists.

It was a conscious, but in my view regrettable choice of the author not to include any photographs, apart from a single black-and-white full-length portrait in a beach setting on the front cover.

The Nomads of Mykonos is an intellectual tour de force and a haunting read, including some touching and thought-provoking portraits of exceptional individuals. Choosing and in some ways creating such an unusual group of informants, Pola Bousiou leaves the welltrodden paths of anthropologists in Greece. For Bousiou's Mykoniots, the kin group is rather an embarrassment. Unlike Loizos's Cypriot refugees and Lawrence's Argolid citrus farmers, they do not aim at founding a family and amassing or preserving property that can be passed on to descendants. Some of them are part of the Greek diaspora in London, New York or India for months or years on a row, returning to their chosen homeland on special occasions only. Their outlook is cosmopolitan, and, characteristically, they befriend rather than reject Albanian immigrants living in the same island communities.

The three books reviewed portray groups of Greek-speaking people in very different predicaments. All authors are careful to underline their informants' interaction with socially, politically or culturally dissimilar communities sharing the same space. To a varying degree and within diverging theoretical frameworks, all three are attentive to historical change. And strikingly -without wanting to nail down an elusive essential character in any way -all Greek or Cypriot people investigated happen to have two things in common: firstly, discourses replete with historical references, in which personal, local and national memories are interwoven; and secondly, a particular attachment to the soil, be it a bag with some cherished earth dug out of a refugee's former garden and smuggled over the Cypriot Green Line, that unproductive olive grove plot in Argolida that even a debt-ridden farmer would never sell, or the barren Mykonian landscape bathed in bright, "Delian" sunlight and lashed by meltemi winds.

A final remark on editorial practices: if, as one might rightfully expect, more books on Greece will be published in the various anthropological series hosted by Berghahn Books, the publishing house might want to decide on a common policy of transliteration of Greek works and citation of Greek references. Lawrence has consistently transliterated all terms, names and book or article titles. Loizos has added several original Greek titles in his bibliography, but oddly some letters come out as question marks. In Bousiou's bibliography, finally, printer fonts seem to change in the middle of some Greek words. The copy-editing process could surely be improved.