Variable input delay CMOS logic for low power design Modern digital circuits consist of logic gates implemented in the complementary metal oxide semiconductor (CMOS) technology. The time taken for a logic gate output to change after one or more inputs have changed is called the delay of the gate. A conventional CMOS gate is designed to have the same input to output delay irrespective of which input caused the output to change. We propose a new gate design that has different delays along various input to output paths within the gate. This is accomplished by inserting selectively sized "permanently on" series transistors at the inputs of the logic gate. We demonstrate the use of the variable input delay CMOS gates for a totally glitch-free minimum dynamic power implementation of a digital circuit. Applying a previously described linear programming method to the c7552 benchmark circuit, we obtained a power saving of 58% over an unoptimized design. This power consumption was 18% lower than that for an alternative low power design using conventional CMOS gates. All circuits had the same overall delay. Since the overall delay was not allowed to increase, the glitch elimination with conventional gates required insertion of delay buffers on non-critical paths. The use of the variable input delay gates drastically reduced the required number of delay buffers. There are many ways of combining transistors to perform the logic functions such as NOT, NAND and NOR. We will describe the CMOS design style which is the most prominent in current day technologies. CMOS gates are constructed by a combination of MOSFETs to realize a logic function. But a MOS-FET is not an ideal switch. When open it provides a large but finite resistance between its source and drain terminals. When closed it provides a small non-zero resistance. For a CMOS gate the output signal change follows the input change with a certain delay. First, the closing and opening of MOSFETs in the gate depends upon the slope of input signals. Then, the output signal change requires charging or discharging of the output capacitance through a low resistance path provided by the "on" MOSFETs.. Gate Delay is the time taken for a signal at the output of a gate to reach 50% of Vdd (logic 1 level) after the signal at the input of the gate has reached 50% of Vdd.. Gate delay is a function of the amount of resistance and capacitance in the current path. A MOSFET when closed offers a finite resistance R on that is a function of the width and length of the device. Since gate delay is given by R on × C L (where C L is the load capacitance) it can be varied by changing the width and length of the transistor [15, 17] . For example, a NAND gate output rises due to current flow in its pFETs. Hence, the delay of the NAND gate for a rising transition, can be altered by changing the sizes of pFETs. To increase the delay, we increase the resistance of a transistor by increasing its length. Similarly the output delay for a falling transition can be varied by changing the length of the nFETs. The delay can also be reduced by increasing the width of the transistor. The delay is effectively changed by manipulating the width and length of the transistors in the gate. Note that it is possible only to manipulate the overall delay of a gate but not the individual delays along different paths through it. For instance, the delay of a gate when one input transitions cannot be independently controlled without altering the delay when the other input transitions. These delays are inter-related. This is a drawback in some applications.. Every signal transition consumes a finite amount of energy. For the correct functioning of the logic circuit, every signal net needs to transition at most one time in one clock cycle. But in reality, the gate outputs transition more than once and these unnecessary transitions are called glitches. These transitions consume energy and are quite unnecessary for the correct functioning of the circuit. Glitch power consumption can be as much as 40% (or higher) as compared to the overall power consumption and it is advantageous to eliminate the glitches in the circuit as power consumption is critical in today's chips. Glitches arise due to the differences in the arrival times of signal transitions at the inputs of the gate.. Differential Delay is the maximum difference in the signal arrival times at different inputs of a multi-input gate.. Consider the circuit shown in Figure 1 . The signal arrival at the lower input of the NAND gate is always The inverter has a delay of 2 and the NAND gate has a delay 1. Due to differing arrival times at the inputs of the NAND gate, the output produces a glitch consisting of two transitions.. 2 time units later than the signal arrival at the upper input due to the inverter in its path. Thus the differential delay at the NAND gate is 2. This differential delay makes the output of NAND gate transition twice when in reality, it should have no logic transition at all. These extra transitions are the glitches and they waste energy.. There have been many techniques proposed to eliminate the glitches. In delay balancing, the inputs are made to arrive at the same time by inserting extra delay buffers on selected paths [11-13, 18, 23] . In hazard filtering, the gate delay is made greater than the differential delay at the inputs of the gate to filter the glitch [1] . In gate sizing, every gate is assumed to be an equivalent inverter [3] [4] [5] [6] [7] [8] . Transistor sizing treats every transistor's size as a variable and tries to find a glitch-free design [14, 16, 24, 25, 27, 28] . However, these techniques are either greedy approaches or have nonlinear convergence problems [19] .. Some techniques use linear programming where the gate delays are treated as variables and the optimum delays are found by solving a linear program (LP) [2, 19, 21] . The problem with this technique is that it inserts delay buffers in the circuit. These extra inserted elements also consume power themselves and hence reduce the achievable power savings. In all of the above techniques, the problem of buffer insertion arises due to the conventional gate design. The conventional CMOS gates have a single delay, no matter which input of the gate causes the transition. A new technique by Raja et al. proposed a LP technique using a new gate delay model, where the input delay of the gate can also be varied [22] . This makes the gate delay different for different input-output paths through the gate. The advantage of this gate model is that the glitches can be completely eliminated in the circuit without the insertion of any delay buffers, thus achieving more power savings. A novel implementation of this technique is the focus of this paper. We have proposed a new variable input delay gate design, which has different delays along different input-output paths through the gate [20] . This new design has applications to low power design of digital CMOS circuits. Using the new gate design significant energy savings have been achieved. The delays of the gates tend to change due to process variations such as temperature, fabrication impurities, etc. These variations make the delay vary over a range rather than being a single static number. This can be accounted for in our technique during the linear program (LP) stage, where the constraints can be slightly modified to incorporate the maximum gate delay value in the latest time of arrival constraints and the minimum gate delay value in the earliest time arrival constraints. The future work should include the design of larger circuits using this technique and the application of the technique to newer fabrication technologies, especially in the environment of higher leakage. The use of multi-threshold transistors for reduced leakage may be incorporated in the LP for a simultaneous glitch elimination. The problem of glitch-free standard cell based design of appication-specific integrated circuits (ASIC) is also relevant [26] . In this section we present an application of the new gate design in implementing custom circuits for minimum dynamic power. An Unoptimized Example Circuit. Consider the simple example circuit of Figure 3 . Assume that the delays of all gates are the minimum allowed by the technology. We observe that the differential delay, at gates 5 and 6, exceeds the inertial delay and we expect these gates to glitch. The circuit was simulated for rising signals at all three inputs. The simulation was done using the Spectre analog simulator from Cadence. As expected, gates 5 and 6 transition 2 and 3 times, respectively. These are the glitches we wish to eliminate in the following designs. Buffer Optimized Circuit. The buffer optimization using conventional gates requires the use of one buffer for the circuit to operate at the same speed [2, 21] . The optimized circuit with the buffer is shown in Figure 4 . It is implemented using two CMOS inverters and has an overall delay of 2 units. The buffer optimized circuit was simulated for the same vector-pair as the unoptimized circuit. As expected, the optimization eliminated all glitches. Low-Power Design with Proposed Gate. When variable input-delay gates are used the optimized circuit is shown in Figure 5 . We have used the single nMOS transistor implementation here but any of the proposed designs could have been used. The circuitlevel simulation of the two vectors, 000 and 111, for the three circuits is shown in Figure 6 . The glitches at the outputs of gates 5 and 6 are eliminated in the optimized designs. However, the buffer optimization requires that the transition of input 1 should pass through the two inverters of the buffer. This increases the total transitions in that circuit as shown in Table 1.

O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Test data compression and decompression based on internal scan chains and Golomb coding Abstract-We present a data compression method and decompression architecture for testing embedded cores in a system-on-a-chip (SOC). The proposed approach makes effective use of Golomb coding and the internal scan chain(s) of the core under test and provides significantly better results than a recent compression method that uses Golomb coding and a separate cyclical scan register (CSR). The major advantages of Golomb coding of test data include very high compression, analytically predictable compression results, and a low-cost and scalable on-chip decoder. The use of the internal scan chain for decompression obviates the need for a CSR, thereby reducing hardware overhead considerably. In addition, the novel interleaving decompression architecture allows multiple cores in an SOC to be tested concurrently using a single ATE I/O channel. We demonstrate the effectiveness of the proposed approach by applying it to the ISCAS 89 benchmark circuits. Embedded cores are becoming commonplace in large system-on-a-chip (SOC) designs [1] . Along with the benefits of higher integration and shorter time to market, intellectual property (IP) cores pose several difficult test challenges. The volume of test data for an SOC is growing rapidly as IP cores become more complex and an increasing number of these cores are integrated in a chip. In order to effectively test these systems, each core must be adequately exercised with a set of precomputed test patterns provided by the core vendor. However, the input/output (I/O) channel capacity, speed and accuracy, and data memory of automatic test equipment (ATE) are severely limited.. The testing time for an SOC depends on the test data volume, the time required to transfer the data to the cores, and the rate at which it is transferred (measured by the cores test data bandwidth and ATE channel capacity). Lower testing time increases production capacity as well as reduces test cost and time to market for an SOC. New techniques are therefore needed for decreasing test data volume in order to overcome memory bottlenecks and to reduce testing time.. An attractive approach for reducing test data volume for SOCs is based on the use of data compression techniques [2] - [4] . In this approach, the precomputed test set T D provided by the core-vendor is compressed (encoded) to a much smaller test set T E and stored in the ATE memory. An on-chip decoder is used for pattern decompression to Publisher Item Identifier S 0278-0070(02)04700-0.. generate TD from TE during pattern application. Test data compression using statistical coding of test sequences for synchronous sequential (nonscan) circuits was presented in [2] and for full-scan circuits in [3] . While the compression method in [2] is restricted to sequential circuits with a large number of flip-flops and relatively few primary inputs, the work presented in [3] does not conclusively demonstrate that statistical coding provides greater compression than standard ATPG compaction methods for full-scan circuits [5] , [6] . Test data can be more efficiently compressed by taking advantage of the fact that the number of bits changing between successive test patterns in a test sequence is generally very small. This observation was used in [4] , where a "difference vector" sequence T di determined from T D was compressed using run-length coding. A drawback of the compression method described in [4] is that it relies on variable-tofixed-length codes, which are less efficient than more general variable-to-variable-length codes [7] , [8] . Furthermore, it is inefficient for cores with internal scan chains that are used to capture test responses; in these circuits, separate CSRs must be added to the SOC, thereby increasing hardware overhead. A more efficient compression and decompression method was used in [9] , where T di was compressed using variable-to-variable-length Golomb codes. However, this approach requires separate CSRs and is therefore also inefficient for cores that use the same internal scan chains for applying test patterns and capturing test responses.. In this companion paper to [9] , we present an improved test data compression and decompression method for IP cores in an SOC. The proposed approach makes effective use of Golomb codes and the internal scan chain(s) of the core under test. No separate CSR is required for pattern decompression. The difference sequence T R di is derived from the given precomputed test set T D using the fault-free responses R of the core under test to T D . Golomb coding is then applied to T R di .. The resulting encoded test set TE is much smaller than the original precomputed test set TD. We apply our compression approach to test sets for the ISCAS 89 benchmark circuits and show that T E is not only considerably smaller than the smallest test sets obtained using ATPG compaction [5] , but it is also significantly smaller than the compressed test sets obtained using Golomb coding in [9] .. The proposed compression approach for reducing test data volume is especially suitable for system-on-a-chip containing IP cores since it does not require gate-level models for the embedded cores. Precomputed test sets can be directly encoded without any fault simulation or subsequent test generation. This is in contrast to other recent techniques, such as LFSR-based reseeding for BIST [10] and scan broadcast [11] , which require structural models for fault simulation and test generation. The mixed-mode BIST technique in [10] relies on fault simulation for identifying hard faults and test generation to determine test cubes for these faults. The scan broadcast technique in [11] also requires test generation.. We extend the decompression architecture of [9] to an interleaving scheme that allows multiple cores to be tested in parallel with a single ATE I/O channel. We also present analytical results for test data compression and testing time. Finally, we show that test data compression not only reduces the volume of test data but it also allows a slower tester to be used without any penalty on testing time. We have presented a new test data compression and decompression method for testing embedded cores in an SOC. We have shown that the proposed scheme makes efficient use of Golomb codes and the internal scan chain(s) of the core under test to achieve high test data compression for SOCs and to save ATE memory and testing time.. We have also presented a novel interleaving decompression architecture that allows testing of multiple cores in parallel using a single ATE I/O channel. This reduces the testing time of an SOC further and increases the ATE I/O channel capacity. The additional logic for the SOC channel selector is small and easy to implement. In addition, it is independent of the multiple cores under test and their corresponding precomputed test sets. We also show that apart from reduction in the volume of test data, test data compression also allows a slower tester to be used without any reduction in testing time.. Experimental results for the ISCAS benchmarks show that the proposed scheme is very efficient for compressing test data. The results also show that ATPG compaction may not always be necessary for saving ATE memory and reducing testing time.

O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I I O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O B I O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I


The on-line shortest path problem under partial monitoring The on-line shortest path problem is considered under various models of partial monitoring. Given a weighted directed acyclic graph whose edge weights can change in an arbitrary (adversarial) way, a decision maker has to choose in each round of a game a path between two distinguished vertices such that the loss of the chosen path (defined as the sum of the weights of its composing edges) be as small as possible. In a setting generalizing the multi-armed bandit problem, after choosing a path, the decision maker learns only the weights of those edges that belong to the chosen path. For this problem, an algorithm is given whose average cumulative loss in n rounds exceeds that of the best path, matched off-line to the entire sequence of the edge weights, by a quantity that is proportional to 1/ √ n and depends only polynomially on the number of edges of the graph. The algorithm can be implemented with linear complexity in the number of rounds n and in the number of edges. An extension to the so-called label efficient setting is also given, in which the decision maker is informed about the weights of the edges corresponding to the chosen path at a total of m ≪ n time instances. Another extension is shown where the decision maker competes against a time-varying path, a generalization of the problem of tracking the best expert. A version of the multi-armed bandit setting for shortest path is also discussed where the decision maker learns only the total weight of the chosen path but not the weights of the individual edges on the path. Applications to routing in packet switched networks along with simulation results are also presented. In a sequential decision problem, a decision maker (or forecaster) performs a sequence of actions. After each action the decision maker suffers some loss, depending on the response (or state) of the environment, and its goal is to minimize its cumulative loss over a certain period of time. In the setting considered here, no probabilistic assumption is made on how the losses corresponding to different actions are generated. In particular, the losses may depend on the previous actions of the decision maker, whose goal is to perform well relative to a set of reference forecasters (the so-called "experts") for any possible behavior of the environment. More precisely, the aim of the decision maker is to achieve asymptotically the same average (per round) loss as the best expert.. Research into this problem started in the 1950s (see, for example, Blackwell [5] and Hannan [18] for some of the basic results) and gained new life in the 1990s following the work of Vovk [29] , Littlestone and Warmuth [24] , and Cesa-Bianchi et al. [7] . These results show that for any bounded loss function, if the decision maker has access to the past losses of all experts, then it is possible to construct on-line algorithms that perform, for any possible behavior of the environment, almost as well as the best of N experts. More precisely, the per round cumulative loss of these algorithms is at most as large as that of the best expert plus a quantity proportional to ln N/n for any bounded loss function, where n is the number of rounds in the decision game. The logarithmic dependence on the number of experts makes it possible to obtain meaningful bounds even if the pool of experts is very large.. In certain situations the decision maker has only limited knowledge about the losses of all possible actions. For example, it is often natural to assume that the decision maker gets to know only the loss corresponding to the action it has made, and has no information about the loss it would have suffered had it made a different decision. This setup is referred to as the multi-armed bandit problem, and was considered, in the adversarial setting, by Auer et al. [1] who gave an algorithm whose normalized regret (the difference of the algorithm's average loss and that of the best expert) is upper bounded by a quantity which is proportional to N ln N/n. Note that, compared to the full information case described above where the losses of all possible actions are revealed to the decision maker, there is an extra √ N factor in the performance bound, which seriously limits the usefulness of the bound if the number of experts is large.. Another interesting example for the limited information case is the so-called label efficient decision problem (see Helmbold and Panizza [22] ) in which it is too costly to observe the state of the environment, and so the decision maker can query the losses of all possible actions for only a limited number of times. A recent result of Cesa-Bianchi, Lugosi, and Stoltz [9] shows that in this case, if the decision maker can query the losses m times during a period of length n, then it can achieve O( ln N/m) average excess loss relative to the best expert.. In many applications the set of experts has a certain structure that may be exploited to construct efficient on-line decision algorithms. The construction of such algorithms has been of great interest in computational learning theory. A partial list of works dealing with this problem includes Herbster and Warmuth [19] , Vovk [30] , Bousquet and Warmuth [6] , Helmbold and Schapire [27] , Takimoto and Warmuth [28] , Kalai and Vempala [23] , György at al. [13, 14, 15] . For a more complete survey, we refer to Cesa-Bianchi and Lugosi [8, Chapter 5] .. In this paper we study the on-line shortest path problem, a representative example of structured expert classes that has received attention in the literature for its many applications, including, among others, routing in communication networks; see, e.g., Takimoto and Warmuth [28] , Awerbuch et al. [3] , or György and Ottucsák [17] , and adaptive quantizer design in zero-delay lossy source coding; see, György et al. [13, 14, 16] . In this problem, a weighted directed (acyclic) graph is given whose edge weights can change in an arbitrary manner, and the decision maker has to pick in each round a path between two given vertices, such that the weight of this path (the sum of the weights of its composing edges) be as small as possible.. Efficient solutions, with time and space complexity proportional to the number of edges rather than to the number of paths (the latter typically being exponential in the number of edges), have been given in the full information case, where in each round the weights of all the edges are revealed after a path has been chosen; see, for example, Mohri [26] , Takimoto and Warmuth [28] , Kalai and Vempala [23] , and György et al. [15] .. In the bandit setting only the weights of the edges or just the sum of the weights of the edges composing the chosen path are revealed to the decision maker. If one applies the general bandit algorithm of Auer et al. [1] , the resulting bound will be too large to be of practical use because of its square-root-type dependence on the number of paths N . On the other hand, using the special graph structure in the problem, Awerbuch and Kleinberg [4] and McMahan and Blum [25] managed to get rid of the exponential dependence on the number of edges in the performance bound. They achieved this by extending the exponentially weighted average predictor and the follow-theperturbed-leader algorithm of Hannan [18] to the generalization of the multi-armed bandit setting for shortest paths, when only the sum of the weights of the edges is available for the algorithm. However, the dependence of the bounds obtained in [4] and [25] on the number of rounds n is significantly worse than the O(1/ √ n) bound of Auer et al. [1] . Awerbuch and Kleinberg [4] consider the model of "non-oblivious" adversaries for shortest path (i.e., the losses assigned to the edges can depend on the previous actions of the forecaster) and prove an O(n −1/3 ) bound for the expected per-round regret. McMahan and Blum [25] give a simpler algorithm than in [4] however obtain a bound of the order of O(n −1/4 ) for the expected regret. In this paper we provide an extension of the bandit algorithm of Auer et al. [1] unifying the advantages of the above approaches, with a performance bound that is polynomial in the number of edges, and converges to zero at the right O(1/ √ n) rate as the number of rounds increases. We achieve this bound in a model which assumes that the losses of all edges on the path chosen by the forecaster are available separately after making the decision. We also discuss the case (considered by [4] and [25] ) in which only the total loss (i.e., the sum of the losses on the chosen path) is known to the decision maker. We exhibit a simple algorithm which achieves an O(n −1/3 ) per-round regret with high probability against "non-oblivious" adversary. In this case it remains an open problem to find an algorithm whose cumulative loss is polynomial in the number of edges of the graph and decreases as O(n −1/2 ) with the number of rounds. In Section 2 we formally define the on-line shortest path problem, which is extended to the multi-armed bandit setting in Section 3. Our new algorithm for the shortest path problem in the bandit setting is given in Section 4 together with its performance analysis. The algorithm is extended to solve the shortest path problem in a combined label efficient multi-armed bandit setting in Section 5. Another extension, when the algorithm competes against a time-varying path is studied in Section 6. An algorithm for the "restricted" multi-armed bandit setting (when only the sums of the losses of the edges are available) is given in Section 7. Simulation results are presented in Section 8. We considered different versions of the on-line shortest path problem with limited feedback. These problems are motivated by realistic scenarios, such as routing in communication networks, where the vertices do not have all the information about the state of the network. We have addressed the problem in the adversarial setting where the edge losses may vary in an arbitrary way; in particular, they may depend on previous routing decisions of the algorithm. Although this assumption may neglect natural correlation in the loss sequence, it suits applications in mobile ad-hoc networks, where the network topology changes dynamically in time, and also in certain secure networks that has to be able to handle denial of service attacks.. Efficient algorithms have been provided for the multi-armed bandit setting and in a combined label efficient multi-armed bandit setting, provided the individual edge losses along the chosen path are revealed to the algorithms. The normalized regrets of the algorithms, compared to the performance of the best fixed path, converge to zero at an O(1/ √ n) rate as the time horizon n grows to infinity, and increases only polynomially in the number of edges (and vertices) of the graph. Earlier methods for the multi-armed bandit problem either do not have the right O(1/ √ n). convergence rate, or their regret increase exponentially in the number of edges for typical graphs. The algorithm has also been extended so that it can compete with time varying paths, that is, to handle situations when the best path can change from time to time (for consistency, the number of changes must be sublinear in n).. In the restricted version of the shortest path problem, where only the losses of the whole paths are revealed, an algorithm with a worse O(n −1/3 ) normalized regret was provided. This algorithm has comparable performance to that of the best earlier algorithm for this problem [4] , however, our algorithm is significantly simpler. Simulation results are also given to assess the practical performance and compare it to the theoretical bounds as well as other competing algorithms.. It should be noted that the results are not entirely satisfactory in the restricted version of the problem, as it remains an open question whether the O(1/ √ n) regret can be achieved without the exponential dependence on the size of the graph. Although we expect that this is the case, we have not been able to construct an algorithm with such a proven performance bound.

O O B I I O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Efficient

online

monitoring

of

web-service

SLAs

If

an

organization

depends

on

the

service

quality

provided

by

another

organization

it

often

enters

into

a

bilateral

service

level

agreement

(SLA),

which

mitigates

outsourcing

risks

by

associating

penalty

payments

with

poor

service

quality.

Once

these

agreements

are

entered

into,

it

becomes

necessary

to

monitor

their

conditions,

which

will

commonly

relate

to

timeliness,

reliability

and

request

throughput,

at

runtime.

We

show

how

these

conditions

can

be

translated

into

timed

automata.

Acceptance

of

a

timed

word

by

a

timed

automaton

can

be

decided

in

quadratic

time

and

because

the

timed

automata

can

operate

while

messages

are

exchanged

at

runtime

there

is

effectively

only

a

linear

run-time

overhead.

We

present

an

implementation

to

derive

on-line

monitors

for

web

services

automatically

from

SLAs

using

an

Eclipse

plugin.

We

evaluate

the

efficiency

and

scalability

of

this

approach

using

a

large-scale

case

study

in

a

service-oriented

computational

grid.

There

is

a

growing

trend

for

IT

systems

to

be

integrated

across

organizational

boundaries.

Examples

include

supplychain

management

using

RosettaNet

or

the

Amazon

Storefront

web

services

that

enable

small

retailers

to

establish

and

operate

a

web

store-front

on

Amazon's

infrastructure.

These

services

are

frequently

implemented

using

webservice

technologies.

When

organizations

do

rely

on

the

web

services

provided

by

other

organizations

for

the

implementation

of

their

business

processes

they

usually

want

contractual

guarantees

on

service

quality.

Likewise,

the

providers

Permission

to

make

digital

or

hard

copies

of

all

or

part

of

this

work

for

personal

or

classroom

use

is

granted

without

fee

provided

that

copies

are

not

made

or

distributed

for

profit

or

commercial

advantage

and

that

copies

bear

this

notice

and

the

full

citation

on

the

first

page.

To

copy

otherwise,

to

republish,

to

post

on

servers

or

to

redistribute

to

lists,

requires

prior

specific

permission

and/or

a

fee.

want

assurances

that

their

clients

will

not

abuse

the

service.

These

quality

and

usage

constraints

are

often

defined

in

Service

Level

Agreements

(SLAs),

which

specify

required

Quality

of

Service

(QoS)

and

associate

penalty

payments

with

violations.

These

penalty

payments

can

be

seen

as

an

insurance

policy

against

poor

service

provision

and

over-use..

Testing

the

quality

of

provided

web

services

using,

for

example,

performance

and

reliability

tests

is

necessary

but

insufficient.

The

service

quality

fundamentally

depends

on

the

provision

of

computational

resources

that

the

service

provider

maintains

for

the

web

service

during

the

lifetime

of

the

service,

as

well

as

the

demand

on

those

resources

by

other

users

of

the

same

service.

In

order

to

police

a

service

level

agreement,

it

is

therefore

necessary

for

the

service

user

to

monitor

constantly,

or

at

least

in

statistically

significant

intervals,

the

service

quality

that

is

provided

at

run-time.

Likewise

the

service

provider

will

have

to

monitor

service

quality

at

run-time

in

order

to

detect

usages

that

exceed

the

utilization

levels

agreed

in

the

SLA.

The

service

provider

will

also

have

to

monitor

to

protect

itself

against

false

claims

of

poor

services.

The

service

provider

might

also

monitor

whether

the

service

quality

drops

below

certain

thresholds

in

order

to

determine

whether

to

increase

the

resource

provision

in

the

hardware

infrastructure

or

to

reconfigure

the

software

architecture

that

provides

the

service,

as

discussed

by

Service

monitoring

data

will

also

inform

the

service

provider

whether

there

is

sufficient

capacity

to

increase

service

provision

to

new

or

existing

clients..

In

we

have

delineated

how

systems

of

SLAs

between

a

web

service

provider,

an

Internet

Service

Provider

and

a

web

service

user

should

be

arranged

in

a

manner

that

they

can

be

monitored

in

principle.

By

carefully

considering

how

a

service

may

affect

a

client,

we

have

also

determined

what

conditions

relating

to

QoS

should

reasonably

be

included

in

an

electronic-service

SLA.

We

have

implemented

support

for

these

conditions

in

our

SLA

language,

SLAng

which

is

precisely

defined

using

standard

meta-modelling

languages

We

now

describe

a

method

for

online

monitoring

of

timeliness

conditions

that

can

be

described

in

SLAng.

We

distinguish

online

from

offline

monitoring.

Offline

monitoring

uses

sensors

that

are

woven

into

the

service

provisioning

infrastructure

to

collect

data

about

the

service

delivery.

Those

data

may

then

be

analyzed

at

certain

intervals

and

mined

for

service

quality

violations

to

determine

whether

penalty

payments

are

due.

This

is

contrasted

with

online

monitoring

where

the

data

about

service

delivery

is

analyzed

while

the

service

is

being

provided

and

alerts

are

generated

as

soon

as

a

service-quality

violation

is

detected..

Off-line

monitoring

has

a

number

of

disadvantages.

Firstly

it

requires

the

storage

of

possibly

large

volumes

of

data

about

the

service

provision.

Secondly,

for

triggering

software

architecture

reconfigurations

or

resource

allocation

decisions

in

data

centres

it

is

necessary

to

know

about

service

quality

violations

as

soon

as

they

happen.

We

therefore

focus

on

efficient

techniques

for

online

monitoring

in

this

paper..

The

contributions

of

this

paper

are

twofold:

firstly,

we

describe

how

timed

automata

can

be

used

as

a

formalism

to

support

efficient

online

monitoring

of

timeliness,

reliability

and

throughput

constraints

expressed

in

web-service

SLAs.

A

review

of

related

work

indicates

the

novelty

of

this

approach,

and

a

theoretical

analysis

reveals

its

significance:

in

particular,

we

are

able

to

reduce

the

question

of

whether

an

SLA

is

violated

to

the

acceptance

of

a

timed

word

by

a

timed

automaton.

We

show

that

this

is

decidable

in

quadratic

and

because

we

can

process

each

timed

letter

on

the

fly,

the

approach

introduces

only

a

linear

run-time

overhead

for

a

web

service

invocation.

Secondly,

we

present

an

implementation

of

this

technique

using

an

Eclipse

plug-in

and

Apache

AXIS

handlers.

We

have

evaluated

the

performance

overhead

and

scalability

of

this

implementation

using

a

case

study

that

monitors

SLAs

in

a

production

grid

system.

This

paper

is

further

structured

as

follows.

Section

reviews

the

theoretical

analysis

of

SLAs

presented

in

and

provides

an

overview

of

Timed

Automata.

Section

describes

a

set

of

SLA

temporal

patterns

and

their

translation

into

Timed

Automata.

A

methodology

for

monitoring

these

patterns

and

the

analysis

of

its

complexity

are

presented

in

Section

its

implementation

is

described

in

Section

An

example

application

and

experimental

evaluation

results

are

reported

in

Section

Section

discusses

related

work,

and

concluding

considerations

are

presented

in

Section

We

have

presented

a

methodology

for

online

monitoring

Web

Service

SLAs

based

on

timed

automata.

We

have

presented

a

Java

implementation

using

Eclipse,

Axis

and

Axis

handlers..

Our

methodology

is

non

intrusive:

there

is

no

need

to

instrument

existing

services

with

new

code.

Instead,

we

inject

handlers

in

the

message

chain

and

we

reason

on

the

kinds

of

messages

exchanged

(and

their

timestamp)

to

look

for

violations

of

the

agreements..

The

approach

presented

in

this

paper

can

be

deployed

quickly

even

without

knowledge

of

the

underlying

application:

the

case

study

presented

in

Section

involves

services

operating

on

complex

scientific

data

and

workflows.

Nevertheless,

monitoring

SLAs

between

participants

only

required

the

knowledge

of

the

level

of

service

required

and

the

location

of

the

services.

We

have

been

able

to

implement

our

solution

in

a

production

environment

in

less

than

a

day..

Differently

from

previous

approaches,

the

performance

of

our

acceptance

checker

does

not

depend

on

the

total

number

of

messages

in

the

system.

Moreover,

each

SLA

checker

is

very

small

(the

.class

file

is

typically

less

than

By

using

an

on-the-fly

verification

technique

we

have

been

able

to

handle

a

few

hundreds

of

events

per

second

and

obtain

average

verification

times

of

under

a

millisecond..

Our

aim

here

was

to

provide

an

efficient

methodology

and

to

prove

its

feasibility,

and

thus

various

extensions

remain

to

be

investigated.

For

instance,

in

the

scope

of

this

paper

we

considered

only

time

attributes

of

events.

Therefore,

we

considered

only

SLAs

dealing

with

timeliness

issues

of

services,

but

SLAs

may

also

impose

requirements

on

nontemporal

properties.

Additionally,

in

our

implementation

we

did

not

consider

scheduled

SLAs,

i.e.,

SLAs

varying

over

time.

For

instance,

one

could

think

of

SLAs

changing

with

the

day

of

the

week,

or

with

other

contextual

parameters.

To

this

end,

we

are

currently

working

with

the

industrial

and

academic

partners

of

the

European

project

PLASTIC

and

of

the

UK

EPSRC

project

Divergent

Grid

to

extend

our

methodology.

We

first

review

the

analysis

of

SLAs

monitorability

presented

in

and

the

discussion

of

requirements

for

electronic

service

SLAs

given

in

Under

a

specified

set

of

assumptions,

these

analyses

identify

both

the

kinds

of

conditions

that

are

likely

to

be

required

in

SLAs,

and

the

locations

in

the

service

provisioning

infrastructure

in

which

monitoring

will

be

required

to

determine

compliance

with

the

SLAs..

We

then

summarise

the

theory

of

timed

automata,

which

in

the

remainder

of

the

paper

we

show

to

be

capable

of

efficiently

checking

compliance

for

the

kinds

of

conditions

identified

in

the

foregoing

analysis.

We

have

implemented

an

Eclipse

plug-in

to

create,

edit,

and

check

the

correctness

of

SLAs

written

in

SLAng.

This

plugin

is

available

from

For

the

purposes

of

this

work

(see

Figure

we

have

created

a

new

plug-in

which

works

in

parallel

with

the

editor

for

SLAng.

This

plug-in

can

generate

automatically

the

automata

encoding

violations

of

SLAng

terms

for

latency,

reliability,

and

throughput.

The

automata

are

stand-alone

Java

checkers

for

the

patterns

presented

in

Section

implementing

the

ideas

of

Section

Additionally,

our

tool

produces

a

Java

handler

which

is

used

to

analyse

and

dispatch

messages

to

the

checkers:

in

our

framework

we

use

the

open

source

AXIS

engine

from

Apache

to

process

SOAP

messages

and

use

its

handler

mechanism

to

invoke

the

automatically

generated

checkers.

A

sample

screenshot

of

the

plug-in

is

shown

in

Figure

A

preliminary

version

of

the

plug-in

is

available

from

The

automatically

generated

Java

code

can

be

compiled

and

installed

both

at

the

client

and

at

the

server

side.

In

particular:.

Handlers

are

probes

in

the

SOAP

message

chain.

In

our

implementation

these

handlers

are

AXIS

handlers;

on

the

server

side,

they

are

installed

in

a

standard

way

as

handlers

in

the

message

chains

for

requests

and

responses

for

the

service

to

be

monitored

(notice

that

this

approach

does

not

require

any

interaction

with

the

existing

deployment

of

the

service).

Handlers

can

also

be

installed

outside

of

an

AXIS

server,

by

using

the

system

property

axis.ClientConfigFile

for

AXIS

clients..

Checkers

are

added

at

the

client

or

server

side.

On

the

server

side,

a

checker

is

installed

for

every

client

that

should

be

monitored.

A

checker

is

a

simple

Java

class

invoked

by

the

handler;

the

checker

implements

the

verification

methodology

presented

in

Section

Figure

depicts

the

structure

of

the

deployed

monitors.

As

mentioned

above,

the

Java

code

for

handlers

and

checkers

is

generated

automatically.

Theorem

gives

a

quadratic

Figure

listing

the

transition

step

for

the

automaton)

we

are

able

to

achieve

in

most

of

the

cases

a

linear-only

overhead

by

observing

that,

if

a

violation

occurs,

then

the

violation

is

very

likely

to

be

caused

by

the

last

observed

event,

and

so

the

automaton's

evolution

should

start

from

the

event

that

occurred

n

steps

before

the

current

one,

where

n

is

the

number

of

states

of

the

automaton.

In

the

code

of

Figure

states

is

a

list

of

events

occurred

(each

event

correspond

to

a

state

of

the

automaton)

and

MakeTrans

is

a

function

to

generate

transition

steps

in

the

checker.

If

the

value

returned

by

this

function

is

then

a

final

(accepting)

state

has

been

reached,

corresponding

to

a

violation

of

the

constraint

to

be

checked..

A

further

improvement

in

performance

can

be

achieved

when

verifying

latency:

instead

of

storing

a

table

of

message

IDs

with

the

time

of

request,

we

use

SOAP

attachments

to

add

a

timestamp

to

the

messages

which

should

be

checked

against

latency.

This

is

done

by

the

automatically

generated

handler,

using

a

code

similar

to

the

one

reported

in

Figure

where

"msg"

is

the

actual

SOAP

message

obtained

from

the

handler..

The

timestamp

can

be

read

from

the

message

context

returned

by

AXIS

with

the

response

message.

Thus,

the

check

for

latency

can

be

performed

by

using

the

information

found

in

the

response

message

context

only.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


CATRA: interactive measuring and modeling of cataracts We introduce an interactive method to assess cataracts in the human eye by crafting an optical solution that measures the perceptual impact of forward scattering on the foveal region. Current solutions rely on highly-trained clinicians to check the back scattering in the crystallin lens and test their predictions on visual acuity tests. Close-range parallax barriers create collimated beams of light to scan through sub-apertures, scattering light as it strikes a cataract. User feedback generates maps for opacity, attenuation, contrast and sub-aperture point-spread functions. The goal is to allow a general audience to operate a portable high-contrast light-field display to gain a meaningful understanding of their own visual conditions. User evaluations and validation with modified camera optics are performed. Compiled data is used to reconstruct the individual's cataract-affected view, offering a novel approach for capturing information for screening, diagnostic, and clinical analysis. Cataracts are the leading cause of avoidable blindness worldwide. A cataract-affected eye scatters and refracts light before it reaches the retina. This is caused by a fogging or clouding of the crystallin. We measure this scattering by allowing one to compare a good light path with a path attenuated by the cataract. Our interactive and compact solution (called CATRA: http://eyecatra.com) goes beyond traditional cataract evaluation procedures by taking advantage of forward scattering to compute quantitative maps for opacity, attenuation, contrast, and point-spread function (PSF) of cataracts. The dissemination of devices with the ability to estimate intrinsic parameters of the eye may drive the development of future user-sensible technology for displays, rendering techniques, and improve our understanding of the human visual experience.. Cataracts are generally detected subjectively by locating a white reflex during a slit lamp examination. Research tools range from high-end Shack-Hartmann [Donnelly et al. 2004 ] and femtosecond optical coherence tomography systems [Palanker et al. 2010] , to retro-illuminated image processing techniques [Camparini et al. 2000] . CATRA uses modified parallax barriers to create collimated beams of light to scan the crystallin lens (Figure 1 ). Placed close to the viewers' eye, the device ensures the beams are projected onto Figure 1 : Can we create a device that makes people aware of their early cataract condition? Using a light-field display, our method projects time-dependent patterns onto the fovea. Subject matches these alternating patterns that have passed through scattering (green) and clear (red) regions of the lens. An interactive software measures the attenuation and point-spread function across sub-apertures of the eye. Cataracts size, position, density, and scattering profile are then estimated.. the fovea. Our patient-centric interactive approach, coupled with a simple optical setup, creates four comprehensive measurement maps. To verify their accuracy and precision, we cross-reference our results utilizing user studies and modified camera optics with partially masked diffusers. We go a step further reconstructing the individual experience of a cataract-affected view, previously unexplored by the graphics and vision communities. We presented an interactive method coupled with an optical design to detect early cataracts in the human eye using view-dependent high-contrast displays. Early cataracts are a relevant global health problem that previously required highly-trained technicians and cumbersome equipment to be detected. This innovation measures the forward scattering profile and creates the PSF of the crystallin with no need of a coherent light source and no mechanical apparatus. CATRA ensures the projection of pattern directly onto the fovea to avoid gazing issues. Users look through an eyepiece and interact with a keypad based on what they see. Our interactive method scans the subject's crystallin lens to estimate opacities, attenuation levels, contrast-sensitivity, and sub-aperture point-spread functions. Section 5.1 validates the optics of the device and the implemented mathematical models. Small variations in attenuation (1%), contrast (3%) and PSF (3%) maps indicate the consistency of our technique. User-driven validation experiments attested the precision of the method (maximum σ = 0.2mm 2 in size, ≈ 2% of the pupil area), the forward scattering feature (estimated attenuations on ≈ 140%), the gaze control mechanism of the optical design (maximum σ = 0.7mm in position, ≈ 20% of the pupil diameter), and the stability of the foveal projection on early cataractaffected elderly subjects (Section 5.2). We believe the quantitative results of our new patient-centric interaction-based method are first of its kind, with no currently available device producing comparable data. Reasonable repeatability rate and the complete absence of false positives, required for screening tools, are incentives to continue this investigative research.. We go a step further creating tools to understand a cataract-affected visual experience, that remained unexplored by the graphics and vision communities. Simple presence of opacities might already indicate glare issues, but a complete contrast, or PSF map, can give a more detailed profile of the effects on scenes with high dynamic ranges. A PSF mapping tool provides a new opportunity for doctors and patients. Renderings help to mitigate this relationship through a shared visual experience, opening a dialogue to further assess and aid the diagnosis of developing cataracts.. Limitations: Since CATRA requires active user participation, we are limited by the subject's ability to follow instructions. By using perceptual judgement and pattern matching, the technique does not work if a uniform-scattering cataract covers all the visible crystallin, as in advanced cases of the disease. Such uniformity could offset the attenuation and PSF maps. For the opacity map, subjects would see dim patterns at all times, being challenging to mark scattering regions. The contrast map, however, should remain accurate, since the measured low contrast would be all over the lens.. Pupil size may vary during the test, but these variations are estimated to be very small since the patient's eye is covered by an eyecup. Retinal diseases may augment the results. Just like standardwavefront-aberration maps of the eye, our maps do not reveal aberration's depth. It's acceptable, however, that a screening tool find conditions other than the target one. Although the method is sensitive to refractive aberrations, this can be solved by taking these aberrations into account and pre-warping light rays. Further clinical studies with wavefront aberration maps are required to precisely estimate their impact. According to our experience, a few degrees of myopia moves the projection in circles.. The dual-stacked-LCD shares some limitations of other similar designs such as decrease in brightness, and predefined viewing zones [Dodgson 2009 ]. The time-dependent nature of the solution removes crosstalk. The map resolution is a function of pixel density, distance between LCDs screens, and the distance from the display to the eye. Current effective static contrast on LCDs may influence the ability to discern the projected patterns and measure the PSF. These limitations still allow the user to obtain reliable, repeatable results using our technology.. Experiences shared on the user tests: Many volunteers were fascinated by their opacity map on the screen of a smart-phone. One of the cataract-affected subjects has reported difficulty in explaining the visual effects to his family. A simple rendering tool may address these communication issues between them. Response from the local community has been very positive. Our data shows a reasonable repeatability, but some users found the alignment task using reference points difficult to understand. According to Don Yansen, CEO of Click Diagnostics that provides affordable health care in developing countries, "Village health workers will be able to cheaply and quickly flag early stage cataracts and macular degeneration in order to refer individuals to hospitals, where their vision can be restored before they effectively become blind". During our research, one of the authors was able to self-diagnose his cataract that went undetected during his eye-exam a few months before the submission and was confirmed afterwards.. Reactions from ophthalmologists: Several researchers and local practicing ophthalmologists have been in collaboration with this project, and are enthusiastic about its quantitative outcomes. Many of them have experimented with the device, and the general response has reinforced that reliable quantitative measurements for cataracts are already very helpful for screening purposes. One of them commented on their experience that the Shack-Hartmann wavefront sensor to measure high-order optical distortions of the human eye had no practical application twenty years ago. Today, the high accuracy of these devices provide the only reliable data for the LASIK surgery. Widespread availability of devices like ours, which generate quantitative data about cataracts, may benefit the future of diagnostic and surgical practice. Since cataracts are correlated with macular degeneration [Liu et al. 1989 ], many doctors have suggested the use of this device as a side screening tool for other visual impairments. A few ophthalmologists we have been discussing with, reported strong concerns about the complete absence of a glare disability test in order to obtain a driver's license. For instance, visual acuity tests, in general, do not assess for glare and night driving effects, while simple and cheap tests such as ours, would reveal currently unchecked impairments. Our overall goal is to create tools that empower self-awareness about commonly unscreened health condition of the eye. We stress that this device does not directly diagnose or treat for cataracts, but in the future, methods like this might be able to give a complete summary of visual performance. Our hope is that these results encourage more people to design and develop interactive tools which will augment the understanding of the human visual experience.

O O O O O O B O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Dependability evaluation of an air traffic control computing system As air traffic over France is growing rapidly, the existing Air Traffic Control (ATC) system has to evolve to satisfy the increasing demand. The selection of the new automated computing system (denoted CAUTRA) is based, among other things, on dependability evaluation. This paper is devoted to the dependability evaluation of a subset of the CAUTRA, the Regional Control Center (RCC). Starting from the analysis of the impact of CAUTRA failures on air traffic safety, five levels of service degradation are defined for the global system grading the effects of these failures on the service delivered to the controllers to ensure traffic safety. The RCC failure modes leading to these degradation levels are then defined and evaluated using stochastic Petri nets. The modeling approach consists in modeling the system as a set of modules interconnected via coupling mechanisms. The system model is constructed in several steps according to an incremental approach. Each step integrates the failure and recovery assumptions of an additional component and updates the model of the previous step by accounting for the impact of the new component on the behavior of those already included in the model. The application of this approach to the CAUTRA allowed us to analyze several configurations of the CAUTRA architecture and to identify improvement areas to minimize the impact of CAUTRA failures on air traffic safety. The French Air Traffic Control (ATC) is based on an automated system (the CAUTRA), implemented on a distributed fault-tolerant computing system composed of five Regional en-route air traffic Control Centers (RCC) and one Centralized Operating Center (COC), connected through a dedicated telecommunication network. The same computer architecture is implemented in each RCC. The CAUTRA design has been in a continuous evolution during the last few years in order to face the growth of air traffic volume, to improve the dependability of the CAUTRA and to include additional functionality to the controller. The defini-* Nicolae Fota was at LAAS-CNRS when this work was performed. tion of the new CAUTRA architecture is supported by quantitative evaluation techniques. In this context, our work focuses on the analysis and evaluation of the impact of CAUTRA failures on the service delivered to the controller to ensure air traffic safety.. The analysis and evaluation of this impact has been performed in three successive phases. The first one, aimed at a preliminary Failure Modes Effects and Criticality Analysis of the CAUTRA, led us to define five levels of ATC service degradation and to identify the main subsystems providing vital services for air traffic safety. The second phase focused on the dependability modeling and evaluation of each of these subsystems. The third phase was devoted to the combination of the dependability measures evaluated for each subsystem to: 1) obtain global measures for each service degradation level, 2) analyze the contribution of each subsystem to these degradation levels, and 3) identify improvement areas of the CAUTRA architecture to reduce the effects of failures. In this paper, we outline the results of the first phase, then we focus on the RCC system (one part of the second phase).. The complexity of the RCC and COC systems, and the necessity for a detailed modeling of failure and recovery scenarios (to evaluate the system with respect to different levels of degradation) lead to handle a large set of failure and recovery assumptions of a system constituted of components having multiple interactions. State-of-the-art modeling techniques are difficult to use in this context if they are not supported by a systematic and structured modeling approach. In [9] , we presented a modeling approach based on stochastic Petri nets that assists the users in the construction and validation of complex dependability models of several thousands of Markov states. The system is modeled as a set of modules interconnected via coupling mechanisms. The model is constructed in successive steps according to an incremental approach. Each step integrates the failure and recovery assumptions of an additional component and updates the model built in the previous step by accounting for the impact of the new component on the behavior of those already considered by the model. Construction guidelines are defined to assist the users in the modeling process. In this paper, we illustrate the applica-tion of the approach defined in [9] to a real complex system, the RCC. The system model is composed of seventeen modules with multiple interactions between them. A number of possible configurations of the RCC architecture are discussed and evaluated. The results show that the distribution of the software replicas on the hardware, the communication between them and the software reliability of the most critical replicas are the most critical parameters that need to be monitored during the design.. This paper is composed of seven sections. Section 2 positions our work with respect to the state-of-the art. Section 3 presents the CAUTRA, the service degradation levels and the RCC architecture. Section 4 summarizes the modeling approach used to describe the RCC behavior and evaluate its dependability measures. The RCC modeling assumptions and the corresponding model are presented in Section 5, while Section 6 comments the results. Finally, Section 7 concludes the paper. This paper summarizes the results of a case study dealing with the analysis and evaluation of the impact of CAUTRA failures on air traffic safety and presents some results of the analysis. The effects of these failures on the service delivered to the controllers to ensure traffic safety are grouped into five degradation levels. To be able to evaluate the system dependability with respect to these levels and to master the model complexity, we have applied a GSPN-based modeling approach presented in [9] which consists in modeling the system as a set of modules interconnected via coupling mechanisms describing interactions between components. The model is constructed in several steps following an incremental approach. Each step integrates the failure and recovery assumptions of an additional component and updates the model obtained in the previous step by modeling the impact of the new component on the behavior of those already considered by the model.. Thanks to this approach, we were able to build and validate complex models of several thousands of Markov states for the CAUTRA. The results allowed us to analyze several configurations of the CAUTRA architecture and to identify improvement areas to reduce the impact of CAUTRA failures on air traffic safety. The architecture was modeled at a level of detail that made it possible to assess the impact of software and hardware failures, considering different levels of service degradation. Sensitivity analyses with respect to dependability parameters were also performed. Only some results concerning the RCC subsystem could be discussed in the paper. They show that the main variation in dependability measures is related to 1) communication failures between Radar Data processing and Flight Plan processing replicas, and 2) software failure rate of Radar Data processing replicas. The impact of communication failures is minimized when these replicas run on the same cluster compared to the case where communication is performed via an external network. This result is in agreement with the previous study we have done on a former architecture of the CAUTRA where only service unavailability was analyzed without considering different levels of service degradation [18] . Moreover, the measures derived from our models compare well with those observed on the CAUTRA system which is currently in operation.. On one hand, our study allowed us to provide feedback to the CAUTRA development and operation teams. On the other hand, it gave us the opportunity to experiment the applicability of the modeling approach presented in [9] to a complex real-life system. One possible extension of this work is to analyze the impact of CAUTRA failures on air traffic performance. Indeed, the occurrence of CAUTRA failures leads, in some situations, to air traffic limitations and delays. The same modeling framework could be used by including reward parameters characterizing performance degradation for different failure and recovery scenarios. Using the Markov chain generated at the final step of the incremental modeling approach (i.e., step 18), measures UA(X) and W(X) -defined in Section 2 related to the failure modes X identified in Table 2 -have been evaluated. These measures allow comparison of different fault tolerance strategies of the RCC system as well as the comparison of various strategies for FP and RD replicas distribution on the DG computers (i.e., the configuration strategies), to identify an optimal solution.. Sensitivity analyses with respect to the most significant reliability parameters (considering different parameter values) are then performed for the optimal architecture, to identify: 1) the components which reliability improvement have the most important impact on air traffic safety or 2) the parameters on which operational reliability data collection should focus in the future. For the evaluation purpose, the hardware reliability parameters were obtained from the equipment providers, while some of the software reliability data items were collected during the RCC operation . When the numerical values of the parameters were not available, they have been evaluated using data available on similar systems [4, 15, 19] . The uncertainty was accounted for by performing sensitivity analysis with respect to the main reliability parameters.. We illustrate the RCC system evaluation results by presenting the influence of configuration strategies and the impact of the RD fault tolerance strategies on the RCC measures. Additionally, we give an example of result concerning the CAUTRA, showing the influence of RCC system configuration strategies on the global measures. Several papers dealt with ATC systems dependability. Papers [1, 2, 6] focus on the specification and the design of fault tolerance procedures, while the work presented in [12, 23] addresses the qualitative evaluation of ATC system dependability. Most of the papers dealing with the modeling and quantitative evaluation of ATC architectures can be found in our previous work on the CAUTRA system. The work presented in [11] is devoted to the dependability of the COC. Our earlier work presented in [18] dealt with former architectures of the RCC where the only dependability measure considered was availability without taking into account different levels of service degradation. The work presented in this paper, and related to RCC, considers a new generation of the RCC and refines the dependability measures to account for several service degradation levels. To evaluate these dependability measures, we used the incremental and modular modeling approach based on Stochastic Petri Nets (SPN) which is summarized in [9] . In that paper, guidelines are presented to assist the user in the construction and validation of complex dependability models. Petri nets are well suited to model the interactions between hardware and software components resulting from the occurrence of failure and recovery events. Other approaches for system dependability evaluation are also available, either based on analytical modeling (e.g. [7, 20] ) or on simulation (e.g., [13] ). The discussion about which one is the best is out of the scope of this paper. A review of some these methods can be found in [21] .. Considering the modular construction of quantitative evaluation models, several methods have been proposed, either based on SPNs or their offspring's (see e.g. [17, 22] ) or based on Markov chains [14] . Other techniques based on SPN decomposition are also proposed, e.g., in [5] . Some of these methods are efficient when the sub-models are loosely coupled, others become hard to implement when interactions are too complex. For the dependability modeling of fault-tolerant systems, multiple and complex interactions between system components have to be explicitly considered because of the dependencies induced by component failures and repairs. When the number of components is not very high and the number of interactions is limited, the model can be obtained by composition of the component models with their interactions as in [17, 22] . When these numbers increase, alternative approaches, such as the incremental approach proposed in [9] , are needed to handle progressively the complexity of the resulting model. The main principles of this method are summarized in Section 4, and its application in the context of the CAUTRA is illustrated in Section 5.2.

O O O O B I I O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O B I I O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Point-based projective invariants The paper deals with features of a 2-D point set which are invariant with respect to a projective transform. First, projective invariants for "ve-point sets, which are simultaneously invariant to the projective transform and to permutation of the points, are derived. They are expressed as functions of "ve-point cross-ratios. Then, the invariants for more than "ve points are derived. The algorithm for searching the correspondence between the points of two 2-D point sets is presented. The algorithm is based on the comparison of two projective and permutation invariants of "ve-tuples of the points. The best-matched "ve tuples are then used for the computation of the projective transformation and that with the maximum of corresponding points is used. Stability and discriminability of the features and behavior of the searching algorithm are demonstrated by numerical experiments. One of the important tasks in image processing and computer vision is a recognition of objects on images captured under di!erent viewing angles. However, this problem cannot be solved in a general case [1] . Nevertheless, if we restrict ourselves to planar objects only, then the distortion between two frames can be described by projective transform (sometimes called perspective projection). x"(a #a x#a y)/(1#c x#c y),. where x and y are the coordinates in the "rst frame and x and y are the coordinates in the second one. Feature-based recognition of such objects requires features invariant to projective transform (1) . Several di!erent approaches to this problem have been published in recent works. One of them is based on the assumption that the non-linear term of the perspective projection is relatively small and thus the projective transform can be approximated by an a$ne transform. This assumption is true, if the distance from the sensor to the object is much greater than the size of the object. In such cases, various a$ne invariants can be applied such as moment invariants [2, 3] or Fourier descriptors [4, 5] .. However, in some cases the projection cannot be approximated by the a$ne transform and therefore the use of exact projective invariants is required. The invariants, which have been developed for this purpose, can be categorized into two groups: di!erential invariants and point-based ones.. Di!erential invariants are applicable only if the object boundary is a smooth continuous curve. A set of invariants based on boundary derivatives up to the sixth order was presented by Weiss [6] . Unfortunately, these invariants are not de"ned for such important curves as straight lines or conics. Weiss's invariants are numerically unstable because of the high-order derivatives. To overcome this di$culty, several improvements were presented [7}9].. The second group of invariants is de"ned on point sets [10] , on sets composed both from points and straight lines [11, 12] and on triangle pairs [13] . A detailed survey of the point-based methods can be found [14] .. Another problem to be solved is to establish the correspondence between two point sets, which are projectively deformed. To calculate the invariants, we have to order those sets somehow. The solution when the points are vertices of a polygon has been published [15] . Another solution is to use features also invariant to the order or labeling of the points. Five-point projective and permutation invariants are presented [2, 16] . This approach is also used in this paper.. The plane transformed by projective transform (1) contains a straight line. which is not mapped into the second plane (more precisely it is mapped into in"nity) and which divides the plane into two parts. If all elements of our point set lie in one half-plane, then some additional theorems about topology of the set hold for the transform, e.g. the convex hull is preserved during the transform in that case. This fact can be used to derive invariants with lower computational complexity [17] . This paper deals with a general case of the projective transform, when the points can lie in both parts of the plane. The convex hull is not preserved under the transform and all possibilities of the positions of the points must be taken into account. The only assumption is that the points do not lie directly on straight line (2) .. A projective invariant can be de"ned for at least "ve points. The simplest one is a "ve-point cross-ratio. where P(A, B, C) is the area of the triangle with vertices A, B and C. The point No. 1 is included in all four triangles and it is called the common point of the cross-ratio.. Reiss [2] proposes to use the median of all possible values of . A more precise description of the relations between various cross-ratio values under permutations of the given points can be found [16] .. After the correspondence between the individual points in both sets has been established, we use them as the control points for image-to-image registration. However, there are often some points having no counterpart in the other image. An approach to solve this problem can be found [18] , but that method becomes unstable if the number of the`wronga points increases.. The goal of this paper is to derive projective and permutation invariants of point sets. Five-point projective and permutation invariants are derived in Section 2, they are generalized for more than "ve points in Section 3 and the sets with wrong points are discussed in Section 4. Experiments showing the numerical properties of the invariants as well as their usage for image registration are shown in Section 5. The roots of the polynomials in the "ve-point projective and permutation invariants have one degree of freedom. We can choose one of them and the others must lie symmetrically on certain curves. The normalization of these invariants is suitable for improving numerical stability of following computations with them. The normalization of the invariants for more than "ve points is also suitable, because then they can be used for recognition in Euclidean feature space without any additional weights. The normalization by the Gaussian distribution function is suitable in case of less noise for better distinguishing of the sets.. We can use the invariants also for registration of the images by means of control points. If the a$ne and simpler transforms can be used for approximation of the distortion between the images, other methods are suitable. In case of strong projective distortion between the images, the described algorithm is one of the possible solutions of the task. The minimum number of corresponding pairs is six and correspondence between point sets with less pairs of points cannot be found principally. In case of six corresponding pairs only once the wrong correspondence was found during tens of experiments, in case of more than six corresponding pairs no error was found. It means that in case of more than six corresponding pairs the hope of a successful result is very high. The paper deals with features of a point set which are invariant with respect to a projective transform. First, projective invariants for "ve-point sets, which are simultaneously invariant to the projective transform and to permutation of the points, are derived. They are expressed as functions of "ve-point cross-ratios. The roots of the polynomials in the "ve-point projective and permutation invariants have one degree of freedom. We can choose one of them and the others must lie symmetrically on certain curves. The normalization of these invariants is suitable for improving the numerical stability of following computations with them.. The invariants for more than "ve points are derived. The normalization of the invariants for more than "ve points is also suitable, because then they can be used for recognition in Euclidean feature space without any additional weights. The normalization by the Gaussian distribution function is suitable in case of less noise for better distinguishing of the sets else the normalization by the average and the root should be used.. The algorithm for searching the correspondence between the points of two 2-D point sets is presented. The algorithm is based on the comparison of two projective and permutation invariants of "ve-tuples of the points. The best-matched "ve-tuples are then used for the computation of the projective transformation and that with the maximum of corresponding points is used. Stability and discriminability of the features and behavior of the searching algorithm are demonstrated by numerical experiments.

O B I O O O O O O O O O O O O O O O O O B I O B I O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O B I O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O