Selecting the best statistical distribution with PROMETHEE and GAIA Three methods have previously been presented in Computer and Industrial Engineering for the selection of a statistical distribution to describe a data-set: the weighted sum model, the weighted multiplication model and data envelopment analysis. These are based on distinctive preset of parameters and result in three different rankings. In these approaches there is no interaction with the decision-maker (DM). This leads to the question: which method should a DM choose? In this paper, we adopt another approach where the DM is the central actor. Based on the multi-criteria decision aid methods, PROMETHEE and GAIA, we will show that different preference parameters (given by the DM) lead to different rankings. Finally, a group decision can be reached using its extension: PROMETHEE GDSS. A debate has arisen recently over the best method for selecting a probability distribution to represent a set of data (Ramanathan, 2005; Tofallis, 2008; Wang et al., 2004) . Wang et al. (2004) have proposed a simple weighted additive model, whereas Ramanathan (2005) prefers data envelopment analysis and Tofallis (2008) supports a weighted multiplicative model. These three multi-criteria decision making methods produce a ranking (which may all be different) based on setting parameters distinctive to each method:.  The weighted additive model assumes linear indifference functions..  The weighted multiplicative model has convex indifference curves, which favours compromises over extreme solutions..  The data envelopment analysis (DEA) will, through a linear optimisation, choose weights which show each candidate under their best profile. Unlike the two other methods, it is not compensatory in the sense that bad scores may be ignored.. These three proposed methods have a prescriptive approach based on normative hypotheses, which are included in the method and do not depend neither on the data nor the type of problem. They aim to prescribe an optimal solution based on a rational model, established a priori to represent a simplified version of the reality. For example, in a weighted additive model, we assume that a 4% error is twice worse than a 2% error. In a multiplicative model, 4% is n power (where n is the weight of the criterion) worse than a 2% error. This is not PROMETHEE has already been used successfully in several cases. Behzadian et al. (2010) enumerated 195 papers, from its conception until 2008, where PROMETHEE is applied in environment management (47 papers), business and financial management (25), hydrology and water management (28), chemistry (24), logistics and transportation (19), manufacturing and assembly (19), energy management (17), social (7), design (2), agriculture (2), education (2), sports (1), information technology (1) and medicine (1) . Recently, PROMETHEE has been used in water management (Kodikara et al., 2010; Silva et al., 2010) , banking (Doumpos & Zopounidis, 2010) , energy management (Ghafghazi et al., 2010; Oberschmidt et al., 2010) , manufacturing and assembly (Kwak & Kim, 2009; Saidi Mehrabad & Anvari, 2010; Tuzkaya et al., 2010; Venkata Rao & Patel, 2010; Zhu et al., 2010) , logistics and transportation (Lanza & Ude, 2010; Safaei Mohamadabadi et al., 2009; Semaan & Zayed, 2010) , quality (Nikolic et al.) , chemistry (Cornelissen et al., 2009; Ni et al., 2009) , maritime commerce (Castillo-Manzano et al., 2009) , strategy (Ghazinoory et al., 2009) , project management (Halouani et al., 2009) , construction (Castillo-Manzano et al., 2009; Frenette et al., 2010) , urban development (Juan et al., 2010) , location analysis (Luk et al., 2010) , environment (Nikolić et al., 2010; Soltanmohammadi et al., 2009; Zhang et al., 2010; Zhang et al., 2009) , safety (Ramzan et al., 2009 ) and e-commerce (Andreopoulou et al., 2009 ). PROMETHEE method is on the basis of two sorting methods: Promsort (Araz & Ozkarahan, 2007) and FlowSort (Nemery & Lamboray, 2008) . As selecting a statistical distribution is a complex, fuzzy and unclear problem, which needs interactions with the decision-maker, PROMETHEE method complemented by GAIA (Brans & Mareschal, 1994) is appropriate. This method permits easily the modelling of this decision problem according to the preferences of the decision-maker. Moreover, the developed software iDA (interactive Decision Analysis) supporting PROMETHEE and GAIA has a user-friendly graphical interface, which facilitates the interaction.. [Pre-print version], please cite as: Ishizaka A., Nemery P. Selecting the best statistical distribution with PROMETHEE and GAIA, Computers & Industrial Engineering, doi: 10.1016/j.cie.2011.06 .008, Advance Online Publication 3. In this paper, we first discuss the methods proposed in the previous papers. In the next section, we present three different scenarios modelled with PROMETHEE and GAIA, which lead to different results. Then, we introduce PROMETHEE Group Decision Support System (GDSS) in order to incorporate the view of several decision-makers. Finally, we conclude the paper with a discussion on the advantages of the proposed approach. Three methods have been introduced to select a probability distribution to represent a set of data (Ramanathan, 2005; Tofallis, 2008; Wang et al., 2004) . These three methods use predefined parameters without interaction with the decision-maker. However the correlation coefficients are high (table 9) , their rankings is different (table 8) . The ranking should depend on the preference system of the decision-maker, otherwise she/he will be dissatisfied. In this paper, we have introduced PROMETHEE and GAIA, which allow such modelling through interactions with the decision-maker. Four scenarios modelling different hypothetical decision-maker preferences have been discussed. This constructive approach does not impose a set of parameters, like in a rational approach, but aims to capture the real preferences of the decision-maker. PROMETHEE does not require any normalisation, which avoids the commensurability problem. The ranking of PROMETHEE I contains more information than other rankings because it can also highlight incomparable actions. GAIA with its visual interface allows a global view of the problem, which can lead to constructive discussions between the analyst and the decision-maker. For group decisions, PROMETHEE GDSS, an extension of PROMETHEE, can be applied. Unless an urgent decision is needed, where a constructive approach cannot be adopted, we would recommend using PROMETHEE and GAIA, which are supported by a user-friendly software system.

O O O B I O B O B O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O B O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B O O O O O O O O O O O O O O O O O O O O O B I O B O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O B O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B O O O O O O O O O O O O O O O O O O O O B O B O O O O O O O O


Programs with Lists are Counter Automata We address the verification problem of programs manipulating oneselector linked data structures. We propose a new automated approach for checking safety and termination for these programs. Our approach is based on using counter automata as accurate abstract models: control states correspond to abstract heap graphs where list segments without sharing are collapsed, and counters are used to keep track of the number of elements in these segments. This allows to apply automatic analysis techniques and tools for counter automata in order to verify list programs. We show the effectiveness of our approach, in particular by verifying automatically termination of some sorting programs. The design of automatic verification methods for programs manipulating dynamic linked data structures is a challenging problem. Indeed, the analysis of the behaviour of such programs requires reasoning about complex transformations of data structures involving both creation and deletion of objects as well as modifications of the links between them (pointer manipulations). The heap of such programs may have in fact an arbitrary size and shape (a graph structure). There are several approaches for tackling this problem addressing different subclasses of programs and using different kinds of formalisms for representing and reasoning about infinite sets of heap structures, e.g., [18, 16, 20, 7] .. We consider in this paper the class of programs manipulating linked data structures with a single data-field selector. It corresponds to programs manipulating linked lists with the possibility of sharing and circularities. We propose a new approach for the automatic verification of such programs which is mainly based on using counter automata as accurate abstract (infinite-state) models. These models can be used for checking both safety properties and termination of the considered programs using techniques such as (abstract) symbolic reachability analysis (for safety and invariance checking) and automatic generation of decreasing ranking functions (for termination checking).. Let us present in more details the proposed approach. We start from the observation that if we do not consider garbage (parts of the heap not reachable from the pointer variables of the program), the heap graph is always a finite collection of graphs of a special form close to a tree: it is either a tree (where edges are directed towards the root) or a set of trees having all their roots connected to a simple cycle. The number of such graphs is infinite, but it can be proved that for each of them, the number of vertices where sharing occurs is bounded by the number of pointer variables of the program.. Then, for data-insensitive programs (i.e., programs not accessing nor modifying the data stored in lists as, e.g., a list reversal program), a natural abstraction consists in mapping each sequence of elements between two sharing points into an abstract sequence of some (fixed) bounded size. However, for each given value of the bound, this abstraction is obviously not precise in general. In order to define a precise abstraction, we need in fact to reason about the size of each sequence between two sharing points. This leads to the idea of using counters in order to keep this information in the abstract model (and therefore to use counter automata as abstract models).. In fact, considering counter automata-based models has several advantages. Not only does it allow to define accurate abstractions, it allows us also to handle quantitative properties depending on the sizes of some parts of the heap. Thus, we can handle programs with integer variables whose value is somehow related to the contents of the lists (e.g., to their length). Moreover, it provides a powerful way for checking termination which typically requires reasoning about decreasing values (e.g., the size of the part of the list to be treated).. A first contribution of the paper is to define an abstraction mapping from data-insensitive programs to counter automata for which we prove that the (concrete) program and its abstraction are bisimilar. This result is interesting since it means that our abstraction preserves all properties of the class of data-insensitive programs. The control states of the built automaton correspond to abstract shapes (heap graphs where sequences between shared points are reduced to single vertices), and each transition corresponds to the execution of a program statement. It represents a modification in the shape together with a modification on the counters (attached to vertices abstracting sequences between sharing nodes).. The control structure of the built counter automata can be arbitrary in general. However, it turns out that these automata have an important property: we prove that if we consider the evolution of the sum of all counters, the effect of executing any control loop is to increment this sum by a constant which depends on the program. We use this fact to establish a new decidability result for list programs: for every given (datainsensitive) list program, if the control structure of the generated counter automaton has no nested loops, the verification problems of safety properties and termination are both decidable.. Subsequently, we go further by considering the issue of data-sensitivity. We consider the class of programs manipulating objects ranging over a potentially infinite data domain supplied with an ordering relation, and we assume that the only allowed operation on these data values is the comparison w.r.t. this ordering relation. This class of programs includes, for instance, sorting programs. We extend our previous abstraction principle to the heap graphs of these programs by taking into account (in addition to the size) some information about the order of the elements in the abstracted sequences between sharing points, and we provide a construction which associates with each program a counter automaton-based abstract model. We show that this abstraction is sound w.r.t. the choice of ordering predicates.. Finally, we show the application of our approach on three examples of programs (list reversal, insertion sort, and bubble sort). We have derived systematically their counter automata models, and then we used (1) our ARMC tool [8] (and some compile-time techniques) for checking safety properties, and (2) the Terminator tool based on [11] for termination.. Related Work. Programs manipulating singly-linked lists have gained a lot of attention within the past two years, as shown by the fairly large number of recent publications on the subject [4, 6, 17, 3, 7] . Interestingly, the idea of abstracting away all the list segments with no incoming edges is common to many of these works, even though they are independent and use different approaches and frameworks (e.g., static analysis [17] , predicate abstraction [3] symbolic reachability analysis [4] and proof search [6] ). The fact that the number of sharing points in abstract heap structures is bounded by the number of variables in the program is also behind the techniques proposed in [17, 7] .. In [9] , the authors use an abstract shape model with counters, but their concerns are mostly related to the decidability of a specification logic. The approach that is the closest to ours is [4] . However, it is rather pointed towards showing particular properties such as absence of segmentation faults and memory leak errors, than checking general safety properties, and the work does not address the problem of verifying termination. Moreover, the work reported in [4] offers less automation of the verification than ours. Recently, the same authors have started independently a work [14] on automatic construction of models based on counter automata similar to our approach. The use of ordering predicates in order to handle sorting programs is similar to the one considered in [13, 20] based on the shape analysis approach. Termination is tackled by works such as [21, 3] . In all of these works, ranking functions must be given manually, whereas our approach is fully automated. We have presented an approach for automatic verification of programs with 1-selector dynamic linked structures. It is based on using counter automata as accurate abstract models for such programs. These infinite-state models can be handled using various advanced techniques and tools which have been designed recently for their automatic analysis (e.g., [1, 2, 5]), and in particular concerning checking termination and liveness properties (e.g., [11, 10] ). Indeed, using counters referring to the sizes of parts of the heap structure (e.g., list segments) of a program is a powerful means for dealing with quantitative reasoning about programs, and in particular about their termination. Our future work naturally includes extending this approach to more general linked structures such as doubly linked lists, tree-like structures, etc.

O O O O B I O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


On the matching polynomial of subdivision graphs Let G be a simple graph and let S(G) be the subdivision graph of G, which is obtained from G by replacing each edge of G by a path of length two. In this paper, by the Principle of Inclusion and Exclusion we express the matching polynomial and Hosoya index of S(G) in terms of the matchings of G. Particularly, if G is a regular graph or a semi-regular bipartite graph, then the closed formulae of the matching polynomial and Hosoya index of S(G) are obtained. As an application, we prove a combinatorial identity. Throughout this paper, we suppose that G is a simple graph with the vertex set V (G) = {v 1 , v 2 , . . . , v n } and the edge set E(G) = {e 1 , e 2 , . . . , e m }, if not specified. Let A be a subset of the vertex set V (G). By G − A we denote the induced subgraph of G by deleting all vertices in A and the incident edges from G. For any arbitrary v i ∈ V (G), we use d G (i) (or d i ) to denote the degree of v i . A set M of edges in G is a matching if every vertex of G is incident with at most one edge in M; it is a perfect matching if every vertex of G is incident with exactly one edge in M. Let M i (G) denote the set of matchings of G with i edges.. (G) is the set of matchings of G. For an edge subset S of G, denote by V (S) the set of vertices of G each of which is incident with at least one edge in S. Denote by φ k (G) the number of matchings of G with k edges, that is, φ k (G) = |M k (G)|. We set φ 0 (G) = 1 by convention. Thus, if n is even, then φ n 2 (G) is the number of perfect matchings of G. The number of matchings of G is called the Hosoya index (see Hosoya [6] ) and will be denoted. k=0 φ k (G). The following two polynomials m(G, x) and g(G, x) are called the matching polynomial and the matching generating function of G, respectively (see [9] ):. Hence we have. (1) Obviously, the matching polynomial can be uniquely determined by the matching generating function, and vice versa. The matching polynomial (or matching generating function) is a crucial concept in the topological theory of aromaticity [10] . The matching polynomial is also named the acyclic polynomial in [4, 6, 10] . Sometimes, the matching polynomial is also referred to as the reference polynomial [1] . It takes no great imagination to consider the idea of representing a molecule by a graph, with the atoms as vertices and the bonds as edges, but it is surprising that there can be an excellent correlation between the chemical properties of the molecule and suitably chosen parameters of the associated graph. One such parameter is the sum of the absolute values of the zeros of the matching polynomial of the graph, and this has been related to properties of aromatic hydrocarbons. The roots of the matching polynomial correspond to energy levels of a molecule and a reference structure. A new application in Hückel theory was discussed in detail in Trinajstić [11] . Hosoya [6] used the Hosoya polynomial in chemical thermodynamics. For further applications of the matching polynomial (or matching generating function) in chemistry, see for example the book [10] by Trinajstić. The computation of Z (G) and m(G, x) is NPComplete [7] . For some related results see also [2, 5, 8, [12] [13] [14] [15] [16] [17] [18] [19] .. Suppose G is a simple graph with the vertex set V (G) = {v 1 , v 2 , . . . , v n } and the edge set E(G) = {e 1 , e 2 , . . . , e m }.

O O B I O B O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O B I O O B I I O O O O O O O O O O O O B I O O O O O O B I I O O O O B I O B I I O O O O O O O O O O O O O B I O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Minimization of circuit registers: retiming revisited In this paper, we address the following problem: given a synchronous digital circuit, is it possible to construct a new circuit computing the same function as the original one but using a minimal number of registers? The construction of such a circuit can be done in polynomial time and is based on a result of Orlin for one periodic bi-infinite graphs showing that the cardinality maximum flow is equal to the size of a minimum cut. The idea is to view such a graph as the unfolding of the dependences in a digital circuit. Digital circuits can be seen as a rather accurate model of computer hardware. Their design and optimization is a long lasting challenge on several viewpoints. For instance the problems of layout compaction [4] , verification [5] , placement and partitioning [4] have been intensively studied in the VLSI literature, see for instance [8] .. On an abstract point of view, synchronous digital circuits are often seen as finite graphs constituted by functional gates, wires and registers. At each clock tick, functional elements transform input data into output data which are transmitted on the wires to the next nodes. A register is a storage facility, or a memory cell, of finite size.. Several optimizations are possible at that level. One may want to accelerate the clock frequency ( [7] ) or reduce the number of nodes in the circuit. In this paper we show how to minimize the number of registers. This problem has already been considered by Leiserson and Saxe in a seminal paper [7] , where they show how to retime (this will be defined later) the circuit in order to reduce the number of registers. They also provide an algorithm computing the best possible retiming. One question remains: is it possible to do better? In other words, can one modify a circuit so that the number of registers is smaller than what the optimal retiming does, while keeping the original functional behavior?. The answer is yes and no. For many circuits retiming is indeed optimal. In those where it is not, the gain in the number of registers comes at the expense of additional functional nodes.. More precisely, the contribution of that paper is as follows: (i) we show that retiming is not always optimal; (ii) we provide an algorithm providing a circuit with the minimal number of registers; (iii) and we characterize those circuits where retiming is indeed optimal.. A preliminary paper on that subject [3] considered a particular class of circuits, namely recycled one. Here, general circuits are considered and the proof is different and based on a result of Orlin [9] on one-periodic bi-infinite graphs, which is a "max-flow min-cut" theorem. Such graphs have mainly been used in scheduling applications [10] , Uniform Recurrence Equations or PRAM program loops [1, 6] , where the weights on the arcs represent time and where the flow is a crucial quantity. Here instead, we view weights as memory resources and the cut becomes the central notion.. The paper is organized as follows. Section 2 contains basic definitions and notation and formulates the above-mentioned "max-flow min-cut" theorem. Section 3 discusses how the obtained results can be used in design of digital circuits to minimize the number of registers and Section 4 illustrates the complete construction over an example.. 2 One-periodic bi-infinite graphs and Orlin's Theorem. The sets of nonnegative and non-positive integers are denoted by Z + and Z − , respectively. By a bi-infinite graph we mean an infinite directed graph D = (V, A) with node set V = (V × Z) and arc set A ⊂ V × V, assuming throughout that V is a finite set and that D is locally finite, i.e., each node is incident with a finite number of arcs.. For u ∈ V and i ∈ Z, the u-th line in D is formed by the nodes (u, j) for all j ∈ Z, and the i-th column by the nodes (w, i) for all w ∈ V . For brevity, for a node v = (u, i) and an integer k, the node (u, i + k) is denoted by v + k, and similarly for a set of nodes. A set S of nodes is called consecutive (in each line) if (u, i) ∈ S and (u, i + k) ∈ S with k > 0 imply (u, i + h) ∈ S for each h = 0, . . . , k.. A path in D is an alternating sequence P of (not necessarily distinct) nodes v i (i ∈ I) and arcs (v i , v i+1 ) (when i + 1 ∈ I). Here I is either {0, . . . , n} for n ∈ Z + (yielding a finite path) or I = Z + or I = Z − or I = Z (a bi-infinite path). We also use notation · · · → v i → v i+1 → · · · for P and, depending on the context, may consider a path as a subgraph of D. For two nodes u and v, we write u * → v if there exists a (finite) path from u to v.. Two additional conditions on the bi-infinite graphs we deal with are imposed. A bi-infinite graph D is said to be one-periodic if (OP) for any two nodes v and v ′ of D, (v, v ′ ) ∈ A if and only if (v + 1, v ′ + 1) ∈ A, and causal if (C) for any infinite path P indexed by Z + , the set P ∩ (V × Z − ) is finite.. Note that properties (OP) and (C) imply that D is acyclic.. The result presented below is analogous to the classical Menger theorem for usual finite graphs. A flow F is a set of pairwise (node-)disjoint bi-infinite paths. It is one-periodic for each path P in F, the path P + 1 belongs to F as well. A cut a set of nodes that intersects every bi-infinite path. Clearly the size of a flow cannot exceed the size of a cut. Also if D is one-periodic and causal, then the set V × {0, . . . , k} forms a cut, where k := max{|i − j| | ((u, i), (w, j)) ∈ A} (k is finite since D is locally finite and one-periodic). Therefore, the maximum cardinality of a flow is finite. Theorem 2.1 (Orlin [9] ). Let D be a bi-infinite graph satisfying (OP) and (C). The maximum cardinality of a flow is equal to the minimum cardinality of a cut. Moreover, the maximum is attained by a one-periodic flow and the minimum is attained by a consecutive cut.. Theorem 2.1 can be seen as a special case of Theorem 4 in [9] . Getting the above statement requires one transformation. Each node in D is replaced by a triple (node-arc-node) on the same column. Now, Theorem 4 in [9] with upper and lower capacities on all the arcs set to 1 and 0 respectively, is exactly Theorem 2.1.. An example illustrating a maximum one-periodic flow and a minimum consecutive cut is drawn in Figure 1 . . Since D is locally finite and one-periodic, the number of classes under this similarity relation is finite, and each class, with a representative ((u, i), (w, j)), generates one arc e in G with tail t(e) := u, head h(e) := w and weight ∆(e) := j − i. We call G the folded graph associated with D (it is called a dynamic graph by Orlin) In Section 3 we use the reverse construction. Given a finite directed (multi)graph R = (V, E, ∆) with ∆ ∈ Z E , its unfolding is the one-periodic bi-infinite graph D = (V × Z, A) in which ((u, i), (w, j)) ∈ A if and only if there is an arc e ∈ E with t(e) = u, h(e) = w and j − i = ∆(e). We say that R is causal if D is such, i.e., if ∆(C) > 0 for each cycle C of R.. Splinters. Let D be causal and one-periodic. For a subset S ⊆ V, define. We assume that each node of D is contained in an infinite path (indexed by Z + or Z − ). Then, given a consecutive cut C, one can partition the nodes into three sets in a natural way: the set P (C) of nodes "before" C, the set S(C) of nodes "after" C, and C itself. Note that the sets pred * (C), C and succ * (C) are pairwise disjoint because of causality but they need not cover the whole graph.. We extend pred * (C) and succ * (C) into the desired sets P (C) and S(C), respectively, by examining D line by line and acting as follows. Three cases are possible.. 1. No bi-infinite path goes through line u but some infinite path indexed by Z + does. Then there exists a path from u to C and succ * (C)∩u is empty. On u, we assign the nodes of pred * (C). to P (C), and the other nodes to S(C).. 2. No bi-infinite path goes through line u but some infinite path indexed by Z − does. On u, we assign the nodes of succ * (C) to S(C), and the other nodes to P (C).. 3. There is a bi-infinite path intersecting u. Then succ * (C), C, and pred * (C) do partition line u. We make S(C) and P (C) coinciding with succ * (C) and with pred * (C) on u, respectively.. It is easy to check that the sets P (C) and S(C) are consecutive, using that the graph D is one-periodic. Also one can see that pred(S(C)) = C and succ(P (C)) = C.. The sets P (C) and S(C) are called, respectively, the negative and positive splinters associated with C. These sets are used in the next section.

O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Stabilized SQP revisited The stabilized version of the sequential quadratic programming algorithm (sSQP) had been developed in order to achieve superlinear convergence in situations when the Lagrange multipliers associated to a solution are not unique. Within the framework of Fischer (Math Program 94:91-124, 2002), the key to local superlinear convergence of sSQP are the following two properties: upper Lipschitzian behavior of solutions of the Karush-Kuhn-Tucker (KKT) system under canonical perturbations and local solvability of sSQP subproblems with the associated primal-dual step being of the order of the distance from the current iterate to the solution set of the unperturbed KKT system. According to Fernández and Solodov (Math Program 125:47-73, 2010), both of these properties are ensured by the second-order sufficient optimality condition (SOSC) without any constraint qualification assumptions. In this paper, we state precise relationships between the upper Lipschitzian property of solutions of KKT systems, error bounds for KKT systems, the notion of critical Lagrange multipliers (a subclass of multipliers that violate SOSC in a very special way), the second-order necessary condition for optimality, and solvability of sSQP subproblems. Moreover, for the problem with equality constraints only, we prove superlinear convergence of sSQP under the assumption that the dual starting point is close to a noncritical multiplier. Since noncritical multipliers include all those satisfying SOSC but are not limited to them, we believe this gives the first superlinear convergence result for any Newtonian method for constrained optimization under assumptions that do not include any constraint qualifications and are weaker than SOSC. In the general case when inequality constraints are present, we show that such a relaxation of assumptions is not possible. We also consider applying sSQP to the problem where inequality constraints are reformulated into equalities using slack variables, and discuss the assumptions needed for convergence in this approach. We conclude with consequences for local regularization methods proposed in (Izmailov and Solodov SIAM J Optim 16:210-228, 2004; Wright SIAM J. Optim. 15:673-676, 2005). In particular, we show that these methods are still locally superlinearly convergent under the noncritical multiplier assumption, weaker than SOSC employed originally. Consider the mathematical programming (MP) problem minimize x f (x) subject to h(x) = 0, g(x) ≤ 0,. where f : R n → R is a smooth function and h : R n → R l and g : R n → R m are smooth mappings. Specifically, we assume that f, h and g are twice differentiable near the point of interestx ∈ R n , and their second derivatives are continuous atx.. Stationary points of problem (1) and the associated Lagrange multipliers are characterized by the Karush-Kuhn-Tucker (KKT) optimality system. where L : R n × R l × R m → R is the Lagrangian of problem (1), i.e., We have put together precise relationships between upper Lipschitzian behavior of solutions of KKT systems under canonical perturbations, error bounds for KKT systems, critical Lagrange multipliers, second-order optimality conditions, and solvability of sSQP subproblems. It has been shown that for problems where inequality constraints are present, the second-order sufficient optimality condition in [9, Theorem 5] cannot be replaced by the weaker assumption that the Lagrange multiplier is noncritical for proving superlinear convergence of sSQP iterations. However, this relaxation of assumptions is possible for problems with equality constraints only. We have also established that noncriticality of the multiplier can be used instead of second-order sufficiency in the regularization methods of [16, 27] for achieving superlinear convergence despite nonuniqueness of multipliers. An interesting open question concerns primal (rather than primal-dual) convergence rate of sSQP iterates; see [8] for details.

B I O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O


Inapproximability of the Tutte polynomial The Tutte polynomial of a graph G is a two-variable polynomial T (G; x, y) that encodes many interesting properties of the graph. We study the complexity of the following problem, for rationals x and y: take as input a graph G, and output a value which is a good approximation to T (G; x, y). We are interested in determining for which points (x, y) there is a fully polynomial randomised approximation scheme (FPRAS) for T (G; x, y). Our main contribution is a substantial widening of the region known to be non-FPRASable. Jaeger, Vertigan and Welsh [9] have completely mapped the complexity of exactly computing the Tutte polynomial. They have observed that TUTTE(x, y) is in FP for any point (x, y) on the hyperbola H1. This can be seen from the definition (1), since terms involving κ(A) cancel. Also, TUTTE(x, y) is in FP when (x, y) is one of the special points (1, 1), (0, −1), (−1, 0), and (−1, −1). As noted in Section 1, T (G; 1, 1) is the number of spanning trees of a connected graph G, T (G; 0, −1) is the number of 2-flows of G (up to a factor of plus or minus one), and T (G; −1, 0) is the number of 2-colourings of G (up to an easily computable factor). T (G; −1, −1) has an interpretation in terms of the "bicycle space" of G. See [9, (2.8) ]. Intriguingly, Jaeger, Vertigan and Welsh managed to show that TUTTE(x, y) is #P-hard for every other pair of rationals (x, y). They also investigated the complexity of evaluating the Tutte polynomial when x and y are real or complex numbers, but that is beyond the scope of this paper.. The only FPRAS for approximating the Tutte polynomial that we know of is the Ferromagnetic Ising FPRAS of Jerrum and Sinclair [10] . This gives an FPRAS for TUTTE(x, y) for every point (x, y) on H2 with y > 1. The connection between the Ising model and the Tutte polynomial along the hyperbola H2 is elaborated in the full version. We know of no other FPRASes for approximating the Tutte polynomial for an arbitrary input graph G. There is some related work, however, for example, Karger [12] gives an FPRAS for non-reliability, which is not the same thing as an FPRAS for reliability, but is somewhat related.. There are also FPRASes known for special cases in which restrictions are placed on G. For example, [1] gives an FPRAS for points (x, y) with x ≥ 1 and y ≥ 1 for the restricted case in which the input graph G is "dense", meaning that the n-vertex graph G has minimum degree Ω(n). As another example, there is a huge literature on approximately counting proper colourings of degreebounded graphs.. Several negative results are known for approximating the Tutte polynomial. First, note that if T (G; x, y) is the number of solutions to an NP-complete decision problem, then there can be no FPRAS for TUTTE(x, y) unless RP = NP. So, for example, if λ > 2 is a positive integer, then by the chromatic polynomial specialisation mentioned in Section 1, there is no FPRAS for T (G; 1 − λ, 0).. Jerrum and Sinclair [10, Theorem 14] showed that there is no FPRAS for (antiferromagnetic) Ising unless RP = NP. This implies that, unless RP = NP, there is no FPRAS for the function whose input is a graph G and a point (x, y) on H2 with 0 < y < 1 and whose output is T (G; x, y).. Welsh [19] extended this result. Specifically, he showed the following, assuming RP = NP.. • Suppose q ≥ 2 is a positive integer. Then there is no FPRAS for the function whose input is a graph G and a point (x, y) on Hq with x < 0, y > 0 and whose output is T (G; x, y). Furthermore, there is no FPRAS for the function whose input is a graph G and a point (x, y) on Hq with x < 0, y < 0 and whose output is T (G; x, y).. • There is no FPRAS for the function whose input is a graph G and a point (x, y) on H3 with 0 < x < 1 and whose output is T (G; x, y).

O O O B I O B I O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O B I O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


OPTIMIZATION OF COMPOSITE STRUCTURES SUBJECT TO LOCAL STRESS CONSTRAINTS Abstract. An extension of current methodologies is introduced for optimization of graded microstructure subject to local stress criteria. The method is based on new multiscale stress criteria given by macrostress modulation functions. The modulation functions quantify the intensity of local stress fluctuations at the scale of the microstructure due to the imposed macroscopic stress. The methodology is illustrated for long cylindrical shafts reinforced with stiff cylindrical elastic fibers with generators parallel to the shaft. Examples are presented for shaft cross sections that possess reentrant corners typically seen in lap joints and junctions of struts. It is shown that the computational methodology delivers graded fiber microgeometries that provide overall structural rigidity while at the same time tempering the influence of stress concentrations near reentrant corners. The high specific stiffness of composite materials makes them attractive structural materials for use in aerospace applications. These materials are increasingly being used in geometries that involve abrupt dimensional changes within structural components, such as skins connected to ribs, panel reinforcements and junctions of struts. These geometries contain stress concentrations and thus present potential sources for structural failure. In this paper we present a computational design method for grading the microstructure in order to control local stress in the vicinity of stress concentrations. The method is based upon new rigorous multiscale stress criteria that connect the macroscopic or homogenized stress to local stress fluctuations at the scale of the microstructure [25, 26, 27] .. It is now well known that effective constitutive properties relating average stress to average strain can be employed in the numerical design of composite structures for optimal structural compliance and natural frequency. This type of design problem has received significant attention from both the applied mathematics and structural optimization communities in the 1980s and 1990s [1, 4, 7, 10, 11, 12, 14, 17, 18, 31, 32, 35] . This list of references is by no means complete and the reader is referred to the reviews and manuscripts [2, 5, 8, 9, 19, 30, 33, 37] . The associated body of methods are referred to as the homogenization approach to structural optimization. These treatments have focused on the design problem in the absence of stress or strain constraints. Recent efforts have initiated the development of numerical methods for structural optimization in the presence of stress constraints. The investigation given in [13] provides a numerical method for the stress constrained minimum volume design problem. The method is carried out using an empirical model that is an extension of the power penalized stiffness model also known as the Solid Isotropic Microstructure with Penalization (SIMP) model [5] . The choice of local stress constraints proposed in [13] is motivated by the explicit form of the corrector tensors associated with rank two orthogonal laminar microstructures. Other work has extended the numerical methodology providing the opportunity for design of composites and topology in the presence of mean square stress constraints. The problem of mean square stress constrained structural optimization for fiber reinforced shafts is taken up in [20] . In that work a numerical algorithm is developed based on a suitable homogenized quantity (the covariance tensor) that accurately encodes the mean square stress constraints. The work of [3] introduces a partial relaxation for topology optimization for minimum mean square stress using finite rank laminates. The rigorous theoretical context behind the homogenization approach to mean square stress (or gradient) constrained structural optimization has been worked out in [23] , [24] . Other recent theoretical and numerical developments have addressed problems of minimizing objective functions depending explicitly on the mean square norm of the gradients of the state variable [15, 22, 34, 36, 38] .. In this treatment we consider design problems that require point wise constraints on the local stress. Suitable multiscale quantities beyond effective constitutive laws are used to accurately enforce local stress criteria. These quantities dubbed macrostress modulation functions are introduced in [25, 26, 27] . The design formulation given here is expressed in terms of a homogenized design problem that satisfies two requirements: The first is that the homogenized design problem is computationally tractable. The second is that the solution of the homogenized design problem provides the means to identify graded microstructures that deliver the required structural response while at the same time provide local stress control. The approach put forth in this paper is in essence an inverse method that uses new tools from homogenization theory to identify optimal graded microgeometries. Because of this we will refer to it as an inverse homogenization design method. The rigorous theoretical basis for this approach is given in [21] and [29] .. To illustrate the ideas this article treats the problem of reinforcement of a long shaft with constant cross section subjected to torsion loading. The microstructure within the shaft consists of long reinforcement fibers of constant cross section with isotropic shear modulus G f embedded in a more compliant material with shear modulus G m . The shaft together with the fibers are right cylinders with generators along the x 3 axis. The cross section of the reinforced shaft is specified by the region Ω in the x 1 − x 2 plane. In the neighborhood of any point x = (x 1 , x 2 ) the local microgeometry is given by a periodic geometry with period cell filled with the Hashin Shtrikman coated cylinder assemblage [16] , see Figure 1 . The characteristic length scale of the period relative to the size of the design domain is taken to be small and is denoted by ε. The coated cylinder assemblage corresponds to stiff fibers of circular cross section separated by compliant matrix material. The local area fraction of the fiber phase is given by θ f and the matrix area fraction is given by θ m with θ f + θ m = 1. The graded material properties of the shaft are obtained by changing the local area fraction of fibers across the cross section of the shaft see Figure 1 .. In what follows a constraint is placed on the total cross-sectional area occupied by the fibers. The goal of the design problem is to identify a graded distribution of fibers across 2 the cross section such that the following requirements are met:. I. The reinforced shaft has a torsional rigidity that is acceptable. II. The magnitude of the local point wise stress inside the composite is controlled over a designated subset of the cross section.. In Section 2 we describe a suitably formulated homogenized design problem that allows for the easy identification of fiber reinforced designs satisfying requirements (I) and (II). The homogenized formulation makes use of a multiscale stress criterion given in terms of the macrostress modulation function. The physical motivation for the multiscale stress criterion is presented in Section 2. The local effective properties and macrostress modulation function used to formulate the stress criterion are computed explicitly for the Hashin Shtrikman coated cylinder assemblage in [26] . These are given in terms of the elastic moduli of the matrix and fibers and the local area fraction of fibers. We point out that the coated cylinder assemblage gives the minimum amount of stress amplification among all periodic fiber microstructures with isotropic effective shear compliance [28] . A gradient based numerical implementation of the inverse homogenization design method is described in Section 3. In Section 4 computational results are given for the "X" shaped shaft cross section. This geometry typifies the junctions between composite substructures and possesses reentrant corners seen in lap joints and junctions of struts. We conclude by noting that the theoretical basis for the approach given here has been established for three dimensional structural design using multiphase locally periodic composites in the presence of point wise stress constraints see ( [21] , Theorems 5.1 and 5.2). For locally layered microstructures the corresponding theory is presented in [29] .. The inverse homogenization design method is a top down design approach. First a well posed homogenized design problem is developed. This design problem is given in terms of design variables that reflect the local microgeometry inside the composite. For the problem treated here the design variable for the homogenized design problem is given by the density function θ f (x). The homogenized design problem is then solved to obtain an optimal density function. With the optimal density in hand we use it to recover an explicit graded fiber design that has structural properties close to that of the optimal homogenized design and satisfies prescribed point wise stress constraints. The homogenized design problem is described in the first subsection. The explicit link between homogenized designs and graded fiber reinforced designs that satisfy point wise stress constraints is provided in the second subsection.

O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O


Integrated Solar Energy Harvesting and Storage Abstract-To explore integrated solar energy harvesting as a power source for low power systems, an array of energy scavenging photodiodes based on a passive-pixel architecture for CMOS imagers has been fabricated together with storage capacitors implemented using on-chip interconnect in a 0.35-m bulk process. Integrated vertical plate capacitors enable dense energy storage without limiting optical efficiency. Tests were conducted with both a white light source and a green laser. Measurements indicate that 225 W/mm 2 output power may be generated by white light with an intensity of 20 kLUX. T HE emerging application of wireless sensor networks continues to drive the need for ultra low power system design. Wireless sensors can enable a variety of applications including interactive environments for medicine, environmental monitoring networks, military target tracking, and detection of chemical and biological weapons. In many of these wireless systems, the power source is a bottleneck that limits system lifetime and performance, adds manufacturing cost, and increases system volume and maintenance expenditures. Delivering power to wireless sensor network nodes is a significant system design challenge. Solar energy harvesting has been proposed to extend the lifetime of these networks beyond the limitations which have been previously imposed by batteries [1] . Prior works have successfully demonstrated powering wireless systems through discrete photovoltaic cells together with separate energy storage devices using board level designs [2] , [3] . To reduce system cost and volume it is desirable to integrate energy harvesting and storage with data acquisition, data processing, and communication circuits. Recent advances in very low power signal processing architectures for sensors [4] has created the opportunity to use CMOS photodiodes, similar to those used in digital cameras, for solar energy harvesting. Moreover, the increase in interconnect capacitance as CMOS processes scale provides an opportunity to store the harvested energy without requiring battery materials to be integrated on-chip. This paper describes an array of photodiodes, modeled after a passive-pixel imager, integrated together with storage capacitors in a commodity CMOS process. Also described is the potential of this approach to increase the lifetime of wireless sensor nodes. Fig. 1 shows a block diagram of a typical wireless sensor node, which is powered by a combination of energy scavenging and battery technology. The system consists of sensors that can observe the environment, an analog-to-digital converter (ADC) that can quantize the analog signal from the sensors, a digital signal processing (DSP) core that can analyze and encode the quantized data and a transceiver (RF) so that the node can transmit and receive information. Light energy is converted to electrical energy through a photodiode and mechanical vibrations are converted to electrical energy by an electromechanical transducer [4] . A multiplexer (mux) is used to switch between energy sources. The system's energy gathering ability will depend on environmental conditions, which can change over time. Hence, the scavenged energy needs to be regulated before being used by these functional blocks.. In general, these types of systems work on very low duty cycles, where the sensor node will be in a rest state for the majority of the time. Periodically, the sensor node will wake up, take a snapshot of the environment measured by its sensors, perform its computations, and transmit any data before returning back to the rest state. Each of the functional blocks shown in Fig. 1 has its own power requirement. Previous work has shown that efficient ADCs and DSPs can achieve average power levels in the sub-milliwatt range [5] , [6] . However, low power ADCs usually suffer from diminished power supply rejection [5] . Minimizing the voltage ripple on the power supply for the ADC is important for maintaining accuracy. The RF block typically requires significantly more peak power than the other system blocks, and the DSP has the most relaxed supply ripple requirements due to the robustness (large noise margin) of the digital circuitry. For low duty cycles, the average power for the system (estimated from the literature [4] - [7] ) can be under 5 W.. In Section II, we illustrate the design of photodiodes for energy scavenging. Section III describes how interconnect capacitance can be exploited for storing the scavenged energy. Section IV reports experimental integrated photodiode test results while Section V discusses trends in integrated energy storage. Finally, Section VI provides conclusions from this research. Based on these results, design D3 with area 150 m 150 m can deliver 5 W to power the system described in Section I above. D1 needs 184 m 184 m and D2 needs 164 m 164 m to deliver 5 W. Without illumination, the system energy must be supplied by the integrated storage capacitors. For a 25 mm total photodiode area consisting of 3 diodes in series with the metal storage capacitances for each diode connected in parallel, D1, D2, and D3 can supply enough energy for the DSP in [4] to produce 687, 745, and 903 output samples respectively. The energy density of fully integrated storage capacitors is not competitive with system-in-package solutions such as ultracapacitors or printable batteries, even with scaling to the end of the ITRS roadmap. However, for applications with very low energy storage requirements or cost constraints which limit system-inpackage integration, exploiting interconnect parasitic capacitance for storage may be a viable solution. The combination of integrated solar energy scavenging and storage can enable a new generation of low cost, long lifetime, small volume systems for future wireless sensor networks or RFID applications.

O O B I O O O O O O B I O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Approximately Fair Cost Allocation in Metric Traveling Salesman Games with D satisfying triangle inequality, the problem of testing whether Core(G) is empty or not is NP-hard. We prove that this conjecture is true. This result directly implies the NP-hardness for the general case when D is asymmetric. We also study approximately fair cost allocations for these games. For this, we introduce the cycle cover games and show that the core of a cycle cover game is non-empty by finding a fair cost allocation vector in polynomial time. For a traveling salesman game, let -Core(G) = {x ∈ |N | : x(N) ≥ c D (N ) and ∀S ⊆ N, x(S) ≤ · c D (S)} be an -approximate core, for a given > 1. By viewing an approximate fair cost allocation vector for this game as a sum of exact fair cost allocation vectors of several related cycle cover games, we provide a polynomial time algorithm demonstrating the non-emptiness of the log 2 (|N| − 1)-approximate core by exhibiting a vector in this approximate core for the asymmetric traveling salesman game. We improve it further by finding a ( polynomial time for some constant c. We also show that there exists an 0 > 1 such that it is NP-hard to decide whether 0 -Core(G) is empty or not. A cooperative game is characterized by a set of players (or agents) and a cost function that is defined for any coalition of these players. The cooperative game related with the traveling salesman problem is very well studied. In a traveling salesman game, the players are the cities which a salesman has to visit. The cost function is intuitively the cost incurred by visiting a given subset of the cities and returning to the home city.. Several problems can be posed with respect to a given combinatorial optimization game. One prominent question is to test the non-emptiness of the core of a game. Probably [18] is the first paper that studied a cooperative game, namely, the assignment game. The underlying combinatorial optimization problem is the assignment problem (or equivalently, the maximum weighted matching problem on bipartite graphs). Testing the core non-emptiness of this game is essentially the same as the polynomial solvability of the optimization problem by the Hungarian method [13] . Another example is the minimum spanning tree game where the core was shown to be non-empty by an explicit construction of a vector in the core [2, 9, 14] . In these examples and some more, a clear relationship exists between the polynomial solvability of the underlying optimization problem and testing the non-emptiness of the core of the game.. Another characterization of the core non-emptiness of a game is from linear programming. A result of Deng et al. [3] states that a necessary and sufficient condition for the core of a maximum packing game and a minimum covering game to be non-empty is that the linear programming relaxations of these problems have integral optimal solutions. Note that the underlying optimization problems in this case are NPhard. Other characterizations in this direction are for the facility location games [12] , partition games [5] , and delivery games [10] to mention a few.. On the other hand, several papers deal with the intractability of the core nonemptiness of certain games. For example, Deng et al. [3] , showed that testing the nonemptiness of the core of the minimum coloring game is NP-complete. The underlying combinatorial optimization problem in the case is also NP-hard. Thus, this reinstates again the relationship between these two problems. Goemans and Skutella [8] showed the NP-completeness of the core non-emptiness of a facility location game.. In this paper, we study traveling salesman games, introduced by Potters et al. [17] . More formally, a cooperative game is given by the tuple (N, f ), where N = {1, 2, . . . , n} and f : 2 N → is a characteristic function. In the case of a traveling salesman game, N = {1, 2, . . . , n} (the cities) with a given symmetric distance matrix D (referred to as a cost function defined on all pairs of cities) on the set of cities and for a subset S ⊆ N , we have the characteristic function c D (S) defined to be the cost of a minimum cost Hamiltonian tour which visits all the cities in S ∪ {0} where 0 ∈ N is called the home city or home node. Note that the cost matrix D is defined over all pairs (i, j ) where i, j ∈ N ∪ {0}. The core of a game (N, f ) is defined to be the following:. ..,n . The interpretation of this definition for the traveling salesman game can be motivated as follows. Consider home node 0 as the home city of a professor who has to give talks at the universities located in vertices 1, . . . , n. The total travel cost is c D (N ) . So, the problem is to find a fair cost allocation (a vector in the core) such that no coalition S will split off because they pay more than the actual cost of an optimal subtour through S ∪ {0} and invite the professor to visit only the universities i ∈ S. Various aspects of traveling salesman games have already been covered in the literature. Tamir [19] showed that a metric (i.e., satisfying triangle inequality) traveling salesman game with at most four players always has a non-empty core and also the existence of a game with six players whose core is empty. Furthermore, Faigle et al. [6] designed an instance of a 2-dimensional Euclidean game with six players such that the core is empty. More recently, Okamoto [15] showed that the problem of deciding whether a general traveling salesman game has an empty core or not, is NP-hard. But for the special case of metric traveling salesman games, the same question was left open and conjectured to be NP-hard. In this paper, we show that this is indeed the case. In fact, we prove that testing the core-emptiness of a {1, 2} traveling salesman game where the costs on any pair of cities is either one or two and the costs are symmetric (i.e., cost on a pair (i, j ) is the same as that on (j, i)) is NP-hard. This also proves that it is NP-hard to decide if the core of an asymmetric traveling salesman game with triangle inequality is empty or not. Note that an asymmetric traveling salesman game is a generalization of the symmetric game.. We then consider approximately fair cost allocations, i.e., find a cost allocation vector x ∈ |N | such that ∀S ⊆ N , x(S) ≤ · c D (S) and x(N) ≥ c D (N ), for some > 1. Our reduction also shows that it is NP-hard to find an 0 -approximate cost allocation vector for some 0 > 1 for the (a)symmetric traveling salesman game, using a result of Berman et al. [1] .. We introduce cycle cover games on the same underlying complete directed graph, where the characteristic function is the cost of a minimum cost cycle cover. Note that a cycle cover game on a complete directed graph is equivalent to an assignment game on a bipartite graph (complete bipartite except for a perfect matching). We show that the core is always non-empty for such a game and provide a O(|N| 3 ) time algorithm for finding a fair cost allocation vector. This follows easily from known results on assignment games, but we present a proof, too, since we need the notations. We also show that an approximately fair cost allocation vector for an asymmetric traveling salesman game is the sum of exact fair cost allocation vectors of several related cycle cover games.. The question of finding an approximately fair cost allocation vector has already been considered for several cooperative games where testing the core non-emptiness problem is NP-hard. Faigle et al. [6] find a 1.5-approximately fair cost allocation vector for symmetric traveling salesman game. For this, they make use of Christofides' well-known approximation algorithm for the symmetric traveling salesman optimization problem. In this paper, we provide a polynomial time algorithm that finds a log 2 (|N| − 1)-approximate cost allocation vector for the asymmetric traveling salesman game. We make use of an approximation algorithm for the minimum asymmetric traveling salesman problem (Min ATSP) of Frieze et al. [7] . By adapting a polynomial time 4 3 log 3 (n)-approximation algorithm for Min ATSP by Kaplan et al. [11] , we find a ( We denote the problem as Core-TS or the problem of testing the core nonemptiness of a metric traveling salesman game. A special case of this problem is Core-(1, 2)-TS where the costs on the edges are either one or two. We show that Core-TS is NP-hard by a polynomial time reduction from the following SAT problem (3SAT4) to Core-(1, 2)-TS. 3SAT4 is also called the Bounded Occurrence Satisfiability problem:

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O B I I O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


SMT-Based Bounded Model Checking for Embedded ANSI-C Software Propositional bounded model checking has been applied successfully to verify embedded software but is limited by the increasing propositional formula size and the loss of structure during the translation. These limitations can be reduced by encoding word-level information in theories richer than propositional logic and using SMT solvers for the generated verification conditions. Here, we investigate the application of different SMT solvers to the verification of embedded software written in ANSI-C. We have extended the encodings from previous SMT-based bounded model checkers to provide more accurate support for variables of finite bit width, bit-vector operations, arrays, structures, unions and pointers. We have integrated the CVC3, Boolector, and Z3 solvers with the CBMC front-end and evaluated them using both standard software model checking benchmarks and typical embedded software applications from telecommunications, control systems, and medical devices. The experiments show that our approach can analyze larger problems and substantially reduce the verification time. Bounded Model Checking (BMC) based on Boolean Satisfiability (SAT) has been introduced as a complementary technique to Binary Decision Diagrams (BDD's) for alleviating the state explosion problem [1] . The basic idea of BMC is to check (the negation of) a given property at a given depth: given a transition system M, a property φ, and a bound k, BMC unrolls the system k times and translates it into a verification condition ψ such that ψ is satisfiable if and only if φ has a counterexample of depth less than or equal to k. Standard SAT checkers can be used to check if ψ is satisfiable. In order to cope with increasing system complexity, SMT (Satisfiability Modulo Theories) solvers can be used as back-ends for solving the verification conditions generated from the BMC instances [2] , [3] , [4] , [5] . In SMT, predicates from various (decidable) theories are not encoded by propositional variables as in SAT, but remain in the problem formulation. These theories are handled by dedicated decision procedures. Thus, in SMT-based BMC, ψ is a quantifier-free formula in a decidable subset of firstorder logic which is then checked for satisfiability by an SMT solver.. In order to reason about embedded software accurately, an SMT-based BMC must consider a number of issues that are not easily mapped into the theories supported by SMT solvers. In previous work on SMT-based BMC for software [2] , [3] , [5] only the theories of uninterpreted functions, arrays and linear arithmetic were considered, but no encoding was provided for ANSI-C [7] constructs such as bit operations, floating-point arithmetic, pointers (e.g., pointer arithmetic and comparisons) and unions. This limits its usefulness for analyzing and verifying embedded software written in ANSI-C. In addition to that, the SMTbased BMC approach proposed by Armando et al. [2] , [5] does not support the checking of arithmetic overflow and does not make use of high-level information to simplify the unrolled formula. We address these limitations by exploiting the different background theories of SMT solvers to build an SMT-based BMC tool that precisely translates program expressions into quantifier-free formulae and applies a set of optimization techniques to prevent overburdening the solver. This way we achieve significant performance improvements over SAT-based BMC and previous work on SMT-based BMC.. This work makes two major novel contributions. First, we provide details of an accurate translation from ANSI-C programs into quantifier-free formulae. Second, we demonstrate that the new approach improves the performance of software model checking for a wide range of embedded software systems. Additionally, we show that our encoding allows us to reason about arithmetic overflow and to verify programs that make use of bit-level, pointers, unions and floating-point arithmetic. We also use three different SMT solvers (CVC3, Boolector, and Z3) in order to check the effectiveness of our encoding techniques. To the best of our knowledge, this is the first work that reasons accurately about ANSI-C constructs commonly found in embedded software and extensively applies SMT solvers to check the verification conditions emerging from the BMC of embedded software industrial applications. We describe the ESBMC 1 (Efficient SMT-Based Bounded Model Checker) tool that extends the C Bounded Model Checker (CBMC) [8] to support different SMT solvers in the back-end and to make use of high-level information to simplify and reduce the unrolled formula size. Experimental results obtained with ESBMC show that our approach scales significantly better than both the CBMC model checker [8] and SMT-CBMC, a bounded model checker for C programs that is based on the SMT solvers CVC3 and Yices [2] , [5] . In this work, we have investigated SMT-based verification of ANSI-C programs, in particular embedded software. We have described a new set of encodings that allow us to reason accurately about bit operations, unions, float-point arithmetic, pointers and pointer arithmetic and we have also improved the performance of SMT-based BMC for embedded software by making use of high-level information to simplify the unrolled formula. Our experiments constitute, to the best of our knowledge, the first substantial evaluation of this approach over industrial applications. The results show that our approach outperforms CBMC [8] and SMT-CBMC [2] if we consider the verification of embedded software. SMT-CBMC still has limitations not only in the verification time (due to the lack of simplification based on high-level information), but also in the encodings of important ANSI-C constructs used in embedded software. CBMC is a bounded model checker for full ANSI-C, but it has limitations due to the fact that the size of the propositional formulae increases significantly in the presence of large data-paths and high-level information is lost when the verification conditions are converted into propositional logic (preventing potential optimizations to reduce the state space to be explored). For future work, we intend to investigate the application of termination analysis [30] and incorporate reduction methods to simplify the k-model. SMT-based BMC is gaining popularity in the formal verification community due to the advent of sophisticated SMT solvers built over efficient SAT solvers [11] , [12] , [13] . Previous work related to SMT-based BMC [2] , [3] , [4] , [5] combined decision procedures for the theories of uninterpreted functions, arrays and linear arithmetic only, but did not encode key constructs of the ANSI-C programming language such as bit operations, floating-point arithmetic and pointers. Ganai for BMC which extracts high-level design information from an extended finite state machine (EFSM) and applies several techniques to simplify the BMC problem [3] , [15] . However, the authors flatten structures and arrays into scalar variables in such a way that they use only the theory of integer and real arithmetic in order to solve the verification problems that come out in BMC.. Armando et al. also propose a BMC approach using SMT solvers for C programs [2] , [5] . However, they only make use of linear arithmetic (i.e., addition and multiplication by constants), arrays, records and bit-vectors in order to solve the verification problems. As a consequence, their SMT-CBMC prototype does not address important constructs of the ANSI-C programming language such as non-linear arithmetic and bit-shift operations. Xu proposes the use of SMT-based BMC to verify real-time systems by using TCTL to specify the properties [4] . The author considers an informal specification (written in English) of the real-time system and then models the variables using integers and reals and represents the clock constraints using linear arithmetic expressions.. De Moura et al. present a bounded model checker that combines propositional SAT solvers with domain-specific theorem provers over infinite domains [26] . Differently from other related work, the authors abstract the Boolean formula and then apply a lazy approach to refine it in an incremental way. This approach is applied to verify timed automata and RTL level descriptions. Jackson et al. [27] discharge several verification conditions from programs written in the Spark language to the SMT solvers CVC3 and Yices as well as to the theorem prover Simplify. The idea of this work is to replace the Praxis prover by CVC3, Yices and Simplify in order to generate counter-example witnesses to verification conditions that are not valid. This is an ongoing project and several improvements are planned to be integrated into their tool.. Recently, a number of static checkers have been developed in order to trade off scalability and precision. Calysto is an efficient static checker that is able to verify VCs related to arithmetic overflow, null-pointer dereferences and assertions specified by the user [28] . The VCs are passed to the SMT solver SPEAR which supports boolean logic, bit-vector arithmetic and is highly customized for the VCs generated by Calysto. However, Calysto does not support float-point operations and unsoundly approximates loops by unrolling them only once. As a consequence, soundness is relinquished for performance. Saturn is another efficient static checker that scales to larger systems, but with the drawback of losing precision by supporting only the most common integer operators and performing at most two unwindings of each loop [29] . ESBMC uses the front-end of CBMC to generate the verification conditions (VCs) for a given ANSI-C program. However, instead of passing the VCs to a propositional SAT solver, we convert them using different background theories and pass them to an SMT solver. In this section, we describe the main features of CBMC and present the background theories used in the rest of the paper.

O O B I O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O