A new approximation algorithm for the multilevel facility location problem In this paper we propose a new integer programming formulation for the multilevel facility location problem and a novel 3-approximation algorithm based on LP rounding. The linear program we are using has a polynomial number of variables and constraints, being thus more efficient than the one commonly used in the approximation algorithms for this type of problems. Facility location problems have been extensively studied in the OR and theoretical computer science literature ( [10] , [20] ). In a facility location problem the following data are given: a set of demand points D, a set of locations F where facilities may be opened, the costs of opening facilities and the transportation costs from demand points to facilities. One has to decide where to open facilities and how to assign the demand points to them, such that the total cost (of opening facilities and transportation) is minimized.. In this paper, we study the multilevel facility location problem, (MFLP) where facilities are organized on n levels F = V 1 ∪ . . . ∪ V n and each demand point k ∈ D has to be assigned to a path p ∈ V 1 × . . . × V n of open facilities passing each level. The cost of opening a facility i ∈ F is f i and the cost of transporting one unit of demand from facility i to facility j is c ij . The cost of transporting a unit of demand from a demand point k to a facility i ∈ V 1 is c ki . We assume that each facility can serve an unlimited demand and that the transportation costs form a metric. One has to decide where to open facilities and how to assign a demand point to a path of open facilities such that the total cost is minimized. The metric MFLP is encountered in supply chains and the placement of servers in internet [11] .. For n = 1, the MFLP reduces to the classical uncapacitated facility location problem (UFLP). Since the UFLP is NP-hard, the MFLP is NP-hard as well. The focus of our paper will be on approximation algorithms for the metric MFLP. We call a ρ -approximation algorithm a polynomial time algorithm which gives a solution of cost at most ρ times the cost of an optimal solution. ρ is called the approximation guarantee (factor) of the algorithm. For the metric UFLP, a series of approximation algorithms have been developed in the recent years, encompassing a broad range of techniques, such as: LP-rounding ( [21] , [9] ), greedy algorithms [12] , local search ( [16] , [5] ), primal-dual [14] and dual fitting ( [17] , [15] ). Until recently, the best approximation ratio for the UFLP has been 1.517 and it is attained by the algorithm proposed by Mahdian, Ye and Zhang [17] . In [7] , Byrka modifies the approximation algorithm proposed by Chudak and Shmoys in [9] and improves the approximation guarantee to 1.5. Guha and Khuller proved in [12] that there is no ρ-approximation algorithm with ρ < 1.463, unless N P ⊆ DT IM E(n loglogn ).. For the MFLP with n = 2, the first constant approximation algorithm was developed by Shmoys, Tardos and Aardal in [21] and was based on LP-rounding. In [2] , Aardal, Chudak and Shmoys extend the algorithm proposed in [21] to an arbitrary number of levels and improve the approximation guarantee to 3. Although it has the best known approximation guarantee, their algorithm has the drawback of having to solve a linear program with an exponential number of variables. In the search of more efficient algorithms, several combinatorial algorithms have been developed in the recent years. The first such algorithm was developed by Meyerson, Munagala and Plotkin ( [18] ) and had an approximation guarantee of O(ln(|D|)). Subsequently, Guha, Meyerson and Munagala [13] improved the approximation guarantee to 9.2. Bumb and Kern ( [6] ) used the primal-dual technique to improve the approximation factor to 6. In [3] , Ageev proves an important result for the development of approximation algorithms for the MFLP, namely that any ρ -approximation algorithm for the UFLP leads to a 3ρ -approximation algorithm for the MFLP. The reduction used by Ageev is similar to the one proposed by Edwards in [11] . By improving the reduction procedure, Ageev, Ye and Zhang [4] obtain a performance guarantee of 3.27, the best known performance guarantee obtained by a combinatorial algorithm for the metric MFLP. Zhang shows in [22] that for n = 2, a 1.77-approximation algorithm can be obtained by combining techniques such as randomized rounding, dual fitting and a greedy procedure.. The first contribution of this paper is a new integer programming formulation for the MFLP. Our integer program can be seen as an extension to more levels of the integer program introduced in [1] for the maximization version of the two level facility location problems. The difference between the integer program we are using and the commonly used integer program in the approximation algorithms for MFLP, is that instead of assigning demand points to paths, we assign them to adjacent edges between consecutive levels. The integer program thus preserves the "level structure" of the MFLP. As a consequence, the number of variables in its linear programming relaxation is decreased from an exponential one ( |D||V 1 | × . . . × |V n | + |F |, as in [2] , [6] ) to a polynomial one. The number of constraints is however higher, but still polynomial: [6] . The second contribution of the paper is a novel 3-approximation algorithm based on randomized rounding. For n = 1, our algorithm reduces to the 3 -approximation algorithm of Chudak and Shmoys described in [9] . For n > 1, the algorithm is more elaborated, due to the fact that for each demand point, one has to insure a path of open facilities passing all levels. The algorithm exploits the "level structure" preserved by the integer program: if one knows which facilities to open on the lowest m-levels (m ≥ 1) in order to insure optimality, the problem is reduced to a facility level problem on n − m levels. In each level, facilities are opened according to a procedure similar to the one used in [9] for the one level problem. Due to the fact that the integer program formulated in this paper allows the decomposition of MFLP on levels, we hope that it could be useful in designing an algorithm with an approximation ratio les than 3.. The paper is organized as follows: Section 2 contains the new integer program and some properties of its LP-relaxation. Section 3 contains the algorithm and its analysis. In Section 4 we present conclusions and further research ideas. In this paper we have proposed a new integer programming formulation for the MFLP, which has an LP-relaxation with a polynomial number of constraints and variables. We have also shown how one can use this formulation to design a 3-approximation algorithm for the MFLP. Since many algorithms for facility location problems use LP based techniques, (LP-rounding, primal-dual, dual fitting), it would be interesting to further investigate if the new LP relaxation may be used in decreasing the approximation guarantee for the MFLP.

O O O O O O O B I O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O B I O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Domain-dependent knowledge in answer set planning In this article we consider three different kinds of domain-dependent control knowledge (temporal, procedural and HTN-based) that are useful in planning. Our approach is declarative and relies on the language of logic programming with answer set semantics (AnsProlog*). AnsProlog* is designed to plan without control knowledge. We show how temporal, procedural and HTN-based control knowledge can be incorporated into AnsProlog* by the modular addition of a small number of domain-dependent rules, without the need to modify the planner. We formally prove the correctness of our planner, both in the absence and presence of the control knowledge. Finally, we perform some initial experimentation that demonstrates the potential reduction in planning time that can be achieved when procedural domain knowledge is used to solve planning problems with large plan length. In this article, we considered three different kinds of domain-dependent control knowledge (temporal, procedural and HTN-based) that are useful in planning. Our approach is declarative and relies on the language of logic programming with answer set semantics. We showed that the addition of these three kinds of control knowledge only involves adding a few more rules to a planner written in AnsProlog that can plan without any control knowledge. We formally proved the correctness of our planner, both in the absence and presence of the control knowledge. Finally, we did some initial experimentation that illustrates the reduction in planning time when procedural domain knowledge is used and the plan length is big. In the past, temporal domain knowledge has been used in planning in Bacchus and Kabanza [2000] and Doherty and Kvarnstom [1999] . In both cases, the planners are written in a procedural language, and there is no correctness proof of the planners. On the other hand the performance of these planners is much better 14 than our implementation using AnsProlog. In comparison, our focus in this article is on the "knowledge representation" aspects of planning with domain dependent control knowledge and demonstration of relative performance gains when such control knowledge is used. Thus, we present correctness proofs of our planners and stress the ease of adding the control knowledge to the planner. In this regard, an interesting observation is that it is straightforward to add control knowledge from multiple sources or angles. Thus, say two • T. C. Son et al. different general programs can be added to the planner, and any resulting plan must then satisfy the two sketches dictated by the two general programs.. As mentioned earlier, our use of HTN-based constraints in planning is very different from HTN-planning and the recent HTN-based planner [Nau et al. 1999] . Unlike our approach in this article, these planners cannot be separated into two parts: one doing planning that can plan even in the absence of the knowledge encoded as HTN and the other encoding the knowledge as an HTN. In other words, these planners are not extended classical planners that allow the use of domain knowledge in the form of HTN on top of a classical planner. The timings of the planner [Nau et al. 1999] on AIPS 2000 planning domains are very good though. To convince ourselves of the usefulness of procedural constraints we used their methodology with respect to procedural domain knowledge and wrote general programs for planning with blocks world and the package delivery domain and as in Nau et al. [1999] we wrote planners in a procedural language (the language C to be specific) for these domains and also observed similar performance. We plan to report this result in a future work. With our focus on the knowledge representation aspects, we do not further discuss these experiments here.. Although we explored the use of each of the different kinds of domain knowledge separately, the declarative nature of our approach allows us to use the different kinds of domain knowledge for the same planning problem. For example, for a particular planning problem we may have both temporal domain knowledge and a mixture of procedural and hierarchical domain knowledge given as a general program. In such a case, planning will involve finding an action sequence that follows the sketch dictated by the general program and at the same time obeys the temporal domain knowledge. This distinguishes our work from other related work [Huang et al. 1999; Kautz and Selman 1998b; Baral and Son 1999; McIlraith 2000] , where the domain knowledge allowed was much more restricted.. A byproduct of the way we deal with procedural knowledge is that, in a propositional environment, our approach to planning with procedural knowledge can be viewed as an off-line interpreter for a GOLOG program. Because of the declarative nature of AnsProlog the correctness of this interpreter is easier to prove than the earlier interpreters which were mostly written in Prolog.

O O O O O B O O O O O O O O O O B I O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O B O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B I O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O B I O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O B I O O O O O O O O B I O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O B O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Question classification using support vector machines Question classification is very important for question answering. This paper presents our research work on automatic question classification through machine learning approaches. We have experimented with five machine learning algorithms: Nearest Neighbors (NN), Naïve Bayes (NB), Decision Tree (DT), Sparse Network of Winnows (SNoW), and Support Vector Machines (SVM) using two kinds of features: bag-of-words and bag-ofngrams. The experiment results show that with only surface text features the SVM outperforms the other four methods for this task. Further, we propose to use a special kernel function called the tree kernel to enable the SVM to take advantage of the syntactic structures of questions. We describe how the tree kernel can be computed efficiently by dynamic programming. The performance of our approach is promising, when tested on the questions from the TREC QA track. What a current information retrieval system or search engine can do is just "document retrieval", i.e., given some keywords it only returns the relevant documents that contain the keywords.. However, what a user really wants is often a precise answer to a question. For instance, given the question "Who was the first American in space?", what a user really wants is the answer "Alan Shepard", but not to read through lots of documents that contain the words "first", "American" and "space" etc.. The Text Retrieval Conference, TREC (http://trec.nist.gov/), has launched a QA track to support the competitive research on question answering, from 1999 (TREC8). The focus of the TREC QA track is to build a fully automatic open-domain question answering system, which can answer factual questions based on very large document sets. Today, the TREC QA track [18] [19] [20] is the major large-scale evaluation environment for open-domain question answering systems.. In order to correctly answer a question, usually one needs to understand what the question asks for. Question Classification, i.e., putting the questions into several semantic categories, can not only impose some constraints on the plausible answers but also suggest different processing strategies. For instance, if the system understands that the question "Who was the first American in space?" asks for a person name, the search space of plausible answers will be significantly reduced. In fact, almost all the opendomain question answering systems include a question classification module. The accuracy of question classification is very important to the overall performance of the question answering system. While document classification has been intensively studied [22] , question classification is still a rather new research issue. There appears to be nontrivial differences between these two problems. For example, the common words like 'what', 'is', etc. should be neglected for document classification, but these "stop-words" are actually very important for question classification.. Although it is possible to manually write some heuristic rules for question classification, it usually requires tremendous amount of tedious work. One has to correctly figure out various forms of each specific type of questions in order to achieve reasonable accuracy for a manually constructed classification program. In contrast, a machine learning approach can automatically construct a high performance question classification program which leverages thousands or more features of questions. Given more training data, the performance of a learned classification program usually improves. Moreover, a learned classification program is more flexible than a manual one since it can be easily adapted to a new domain. However, there are only a few papers describing machine learning approaches to question classification, and some of them such as [17] are pessimistic. This paper presents our research work on automatic question classification through machine learning approaches, especially the Support Vector Machines. It is organized as follows: Section 2 presents the question classification problem; Section 3 compares several machine learning approaches to question classification with conventional surface text features; Section 4 describes a special kernel function called tree kernel to enable the Support Vector Machines to take advantage of the syntactic structures of questions; Section 5 is the related work; and Section 6 concludes the paper. This paper presents our research work on automatic question classification through machine learning approaches.. The main contributions of this paper are as follows.. (1) We show that with only surface text features SVM outperforms four other machine learning methods (NN, NB, DT, SNoW) for question classification.. (2) We found that the syntactic structures of questions are really helpful to question classification.. (3) We propose to use a special kernel function called tree kernel to enable the SVM to take advantage of the syntactic structures of questions. And we describe how the tree kernel can be computed efficiently by dynamic programming.. The main future direction of our research is to exploit semantic knowledge (such as WordNet) for question classification. It is also worth investigating other types of machine learning algorithms. Most question answering systems [18] [19] [20] do question classification using handcrafted rules. Consequently there are only a few papers describing machine learning approaches to question classification. In [17] , the machine learning tool Ripper has been utilized for question classification. They defined 17 question categories, trained their question classification system on labeled TREC8 and TREC9 dataset, and tested it on TREC10 dataset. The reported accuracy of their system is 70%, which is discouraging. In [12] , the SNoW method has been utilized for question classification. However, the good performance of their system depends heavily on the features called "RelWords" (related words) which are constructed semi-automatically but not automatically. In contrast, our approach only uses automatically constructed features. Since syntactic structure and related words carry different information, it is possible that including related words will further improve the result of our tree kernel SVM approach.. The convolution kernels (string kernels, sequence kernels, tree kernels, etc.) recently emerged in bioinformatics area [8] [21] . Such kernels have been successfully applied to some natural language processing tasks like parsing [1] . Today there are more research works on kernels for structured data, for example in [7] .. The tree kernel SVM approach to question classification relies on a parser to get the syntactic trees. However, most off-the-shelf parsers, including the one we used in above experiments, are not targeted to parse questions. Those parsers are usually trained on the Penn Treebank corpus, which is composed of manually labeled newswire text. Therefore it's not surprising that those parsers can not achieve a high accuracy in parsing questions, because there are only very few questions in the training corpus. In [9] , the accuracy of question parsing dramatically improves when complementing the Penn Treebank corpus with additional 1153 labeled questions for training. We believe that a better parser is beneficial to our approach.

O B O O O O O B O O O O B I O B O O B O O O O B O B I O O O O O O B I O O O O O O O B I O O B O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O B O O O O B O O O O O O B O O O O O O O O O O O O O O O O O O B O O O O O O B I O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O B O B I O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O B O O O O O B O O O O O O B O O B I O O O B O O O O O O O B O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B I O O O O O O B O B O O O O O O O O O O O O O O B O O O B O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O B O O O O O O O O O O B O O B O O O O B O B I O O O O O O O O O O O O O O O O B O O O O O B I O O O B O O B B O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B O O B O O O O B O B I O O O O O O B O O O O O O O O O B B O O O O O B I O O O O O O O B O O O O O O O O O O O O O O B O O O O B O O O O O B O O O O O O O O O O O O O O O O O O O B O O O O O O B I O O O O O O B O O O O O O O O O O B O O O O O O O O B I O O B I O O O O O O B O O O O O O O O O O O B I O O O B O O O O B I O O O O O O O B O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O B O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O B O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Increasing the flexibility of the herding attack Chosen-target-forced-prefix (CTFP) preimage resistance is a hash function security property guaranteeing the inability of an attacker to commit to a hash function outcome h without knowing the prefix of the message to be hashed in advance. At EUROCRYPT 2006, Kelsey and Kohno described the herding attack against the Merkle-Damgård design that results in a CTFP-preimage of length about n/3 blocks in approximately √ n · 2 2n/3 compression function calls. Using an additional parameter , the attack can be sped-up at the cost of exponentially large preimages (the elongated herding attack). In this work, we re-investigate speed vs. message length tradeoffs for the herding attack. Using a third parameter d, we introduce the generalized elongated multidimensional herding attack. The parameters and d allow for full control over the efficiency of the attack versus the length of the preimages: increasing results in faster attacks with longer messages, while increasing d results in shorter messages with higher attack complexity. Using advanced methods in graph theory we analyze the complexity of the generalized attack, and we describe several variants for different values of , d. On the extreme, a CTFP-preimage of 2 n/2 blocks can be found in n · 2 n/2 queries. One can find a CTFP-preimage of length about n/8 blocks in 3 √ n · 2 3n/4 work. Practical hash functions are traditionally built according to the Merkle-Damgård (MD) iterated design principle [9, 23] . Given a fixed-input-length compression function f : {0, 1} n × {0, 1} m → {0, 1} n , and an initial state value iv of n bits, a variable-input-length hash function hash is constructed as follows: an input message M is first injectively padded into message blocks of length m bits, and then these message blocks are compressed iteratively with the state using f . Although this design is adequate for collision and preimage resistance, second preimage resistance cannot be guaranteed [5, 10, 20] . Additionally, multicollisions can be found much faster than expected [18] , and the design does not resist the length extension attack [8] .. In 2006, Kelsey and Kohno [19] considered the chosentarget-forced-prefix (CTFP) preimage resistance of hash functions: an attacker commits to a digest h, and upon being challenged on a message prefix P (throughout, P is of length one message block, but the same results hold for larger prefixes P ), he returns a preimage M = P S for h, for some string S. Many hash function applications, most prominently commitment and signature schemes, rely on CTFP-preimage resistance of hash functions [24] .. Ideally, if the hash function outputs strings of n bits, an attacker needs about 2 n hash function calls to obtain. Email address: bmennink@esat.kuleuven.be (Bart Mennink) a CTFP-preimage. However, Kelsey and Kohno [19] introduced the herding attack that allows finding CTFPpreimages for the MD iterative design in approximately √ k · 2 (n+k)/2 offline (we follow the complexity analysis by Blackburn et al. [6] ) and 2 n−k online compression function calls, and the attack results in preimages of length approximately k blocks. Here, the parameter k ensures a tradeoff between the offline and online complexity of the attack, with an optimal amount of work of √ n · 2 2n/3 calls achieved for k = n/3. It has been shown by Andreeva et al. [2] and Gauravaram et al. [14, 15] that many modes of operation derived from the classical MD construction suffer this herding attack or a variant of it. In [4] , Andreeva and Mennink confirmed optimality of the herding attack by [19] and of most of the attacks by [2, 14, 15] .. The herding attack of Kelsey and Kohno can be described as follows. Let k ≥ 0 be any integer. . where M pad includes the length strengthening of the message; 3. A receives a challenge P , and computes. Here, k provides a tradeoff between the offline complexity (step 1) and the online complexity (step 4). The resulting CTFP-preimage is of length k + 3 message blocks (and the forged suffix is of length k + 2). Kelsey and Kohno introduce also a generalization, the elongated herding attack, that allows to speed up the attack at the cost of larger preimages [19] . Let ≥ 0 be an integer. In step 1, the attacker appends a sequence of 2 compression function executions to each starting state value h. k ), and the attack succeeds in step 4 if the attacker hits any of the 2. k+ state values 1 . This attack results in a preimage of length slightly larger than 2 blocks. At EUROCRYPT 2006, Kelsey and Kohno described a herding attack for the MD iterated hash function design that requires approximately √ n · 2 2n/3 compression function calls, as well as an elongated herding attack that using a parameter allows for increasing efficiency at the cost of exponentially large messages. In this paper, we re-analyzed and generalized these findings to allow for a bidirectional tradeoff between the efficiency of the attack and the length of its preimages. Together with an additional parameters d, the attack allows for a full tradeoff between the efficiency and the length of the messages.. In the attack with shorter messages, the multidimensional herding attack, the diamond consists of d-way collisions only. Consequently, the construction of such diamond of k levels results in d k state values that eventually render a collision. An approach to improve the flexibility may be to allow for more variation within the diamond: for instance, the first part of the diamond layers consists of d 1 -way collisions, while the second part consists of d 2 -way collisions. We leave it as a further research question to analyze whether this generalized diamond renders interesting complexity results. n/3 + log(n) + 2 Table 2 : The multidimensional herding attack (Sect. 5.2) and various variants. Here, d is chosen in order to adjust the message length, and k is set so as to obtain an equal amount of work in both phases of the protocol. Negligible terms are removed for clarity. 0.048n + log(n)

O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Disjunctive Logic Programs with Inheritance The paper proposes a new knowledge representation language, called DLP < , which extends disjunctive logic programming (with strong negation) by inheritance. The addition of inheritance enhances the knowledge modeling features of the language providing a natural representation of default reasoning with exceptions. A declarative model-theoretic semantics of DLP < is provided, which is shown to generalize the Answer Set Semantics of disjunctive logic programs. The knowledge modeling features of the language are illustrated by encoding classical nonmonotonic problems in DLP < . The complexity of DLP < is analyzed, proving that inheritance does not cause any computational overhead, as reasoning in DLP < has exactly the same complexity as reasoning in disjunctive logic programming. This is confirmed by the existence of an efficient translation from DLP < to plain disjunctive logic programming. Using this translation, an advanced KR system supporting the DLP < language has been implemented on top of the DLV system and has subsequently been integrated into DLV. Disjunctive logic programs are logic programs where disjunction is allowed in the heads of the rules and negation as failure (NAF) may occur in the bodies of the rules. Such programs are now widely recognized as a valuable tool for knowledge representation and commonsense reasoning (Baral and Gelfond 1994 , Lobo, Minker and Rajasekar 1992 , Gelfond and Lifschitz 1991 . One of the attractions of disjunctive logic programming is its ability to naturally model incomplete knowledge (Baral and Gelfond 1994, Lobo et al. 1992) . The need to differentiate between atoms which are false because of the failure to prove them true (NAF, or CWA negation) and atoms the falsity of which is explicitly provable led to extend disjunctive logic programs by strong negation (Gelfond and Lifschitz 1991) . Strong negation, permitted also in the heads of rules, further enhances the knowledge modeling features of the language, and its usefulness is widely acknowledged in the literature (Alferes and Pereira 1992 , Baral and Gelfond 1994 , Kowalski and Sadri 1990 , Alferes, Pereira and Przymusinski 1996 , Sakama and Inoue 1996 , Alferes, Pereira and Przymusinski 1998b . However, it does not allow to represent default reasoning with exceptions in a direct and natural way. Indeed, to render a default rule r defeasible, r must at least be equipped with an extra negative literal, which "blocks" inferences from r for abnormal instances (Gelfond and Son 1997) . For instance, to encode the famous nonmonotonic reasoning (NMR) example stating that birds normally fly while penguins do not fly, one should write 1 the rule fly(X) ← bird(X), not ¬fly(X). We have presented a new language, named DLP < , resulting from the extension of (functionfree) disjunctive logic programming with inheritance. DLP < comes with a declarative model-theoretic semantics, where possible conflicts are solved in favor of more specific rules (according to the inheritance hierarchy). DLP < is a consistent generalization of the Answer Set Semantics of disjunctive logic programs, it respects some fundamental inheritance principles, and it seems to be suitable also to give a semantics to updates in logic programs.. While inheritance enhances the knowledge representation modeling features of disjunctive logic programming, the addition of inheritance does not increase its computational complexity. Thus, inheritance "comes for free": the user can take profit of its knowledge modeling ability, without paying any extra cost in terms of computational load. It was therefore possible to implement a DLP < system on top of the disjunctive logic programming system DLV. The system is freely available on the web (Faber 1999) and ready-to-use for experimenting with the use of inheritance in KR applications.

O O O O B O O O O O B I O O O O O O O B I I O O O O B O O O B O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O B O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O B I O O O B I I O O O B O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O B O O O


Interactive Problem Solving Support in the Adaptive Educational Hypermedia System MATHEMA Abstract-This paper describes the interactive problem solving support offered by our adaptive educational hypermedia system called MATHEMA. The general goal of the MATHEMA is the support of senior high school students or the beginners of higher education, through an interactive and constructivist environment, in learning physics (electromagnetism) individually and/or collaboratively, and to overcome their possible misconceptions and learning difficulties. Initially, a review of related work about the implemented AEHS/ITS and the didactic design principles of the MATHEMA are presented. Through the interactive problem solving, the system supports the students in solving electromagnetism problems, individually and/or collaboratively, by following an activity that is based on the experimentation with simulations, explorations, guided discovery, and collaboration didactic approaches. An experimental study with senior high school students showed that they improve their performances when following this activity. A questionnaire that we gave to the students to express their opinion about our system helped us to improve the quality of the courses.

B I I O O O B I I O O O O O O B I I O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


The encoding complexity of network coding Abstract-In the multicast network coding problem, a source needs to deliver packets to a set of terminals over an underlying communication network . The nodes of the multicast network can be broadly categorized into two groups. The first group incudes encoding nodes, i.e., nodes that generate new packets by combining data received from two or more incoming links. The second group includes forwarding nodes that can only duplicate and forward the incoming packets. Encoding nodes are, in general, more expensive due to the need to equip them with encoding capabilities. In addition, encoding nodes incur delay and increase the overall complexity of the network. Accordingly, in this paper, we study the design of multicast coding networks with a limited number of encoding nodes. We prove that in a directed acyclic coding network, the number of encoding nodes required to achieve the capacity of the network is bounded by 3 2 . Namely, we present (efficiently constructible) network codes that achieve capacity in which the total number of encoding nodes is independent of the size of the network and is bounded by 3 2 . We show that the number of encoding nodes may depend both on and by presenting acyclic coding networks that require ( 2 ) encoding nodes. In the general case of coding networks with cycles, we show that the number of encoding nodes is limited by the size of the minimum feedback link set, i.e., the minimum number of links that must be removed from the network in order to eliminate cycles. We prove that the number of encoding nodes is bounded by (2 + 1) 3 2 , where is the minimum size of a feedback link set. Finally, we observe that determining or even crudely approximating the minimum number of required encoding nodes is an -hard problem. T HE goal of communication networks is to transfer information between source and destination nodes. Accordingly, the fundamental question that arises in network design is how to increase the amount of information transferred by the network. Recently, it has been shown that the ability of the network to transfer information can be significantly improved by employing the novel technique of network coding [1] - [3] . The idea is to allow the intermediate network nodes to combine data received over different incoming links. Nodes with coding capabilities are referred to as encoding nodes, in contrast to forwarding nodes that can only forward and duplicate incoming packets. The network coding approach extends traditional routing schemes, which include only forwarding nodes. The concept of network coding was introduced in a seminal paper by Ahlswede et al. [1] and immediately attracted significant attention from the research community. A large body of research focused on the multicast network coding problem where a source needs to deliver packets to a set of terminals over an underlying communication network . It was shown in [1] that the capacity of the network, i.e., the maximum number of packets that can be sent between and , is bounded by the size of the minimum cut 1 that separates the source and a terminal . Namely, a source can transmit at rate to a set of terminals only if the size of the minimum cut separating and any one of the terminals is at least . This combinatorial condition was shown to be sufficient by Li, Yeung, and Cai [2] , and achievable by using linear network codes, i.e., codes in which each packet sent over the network is a linear combination of the original packets. In a subsequent work, Koetter and Médard [3] developed an algebraic framework for network coding and investigated linear network codes for directed graphs with cycles. This framework was used by Ho et al. [4] to show that linear network codes can be efficiently constructed by employing a randomized algorithm. Jaggi et al. [5] proposed a deterministic polynomial-time algorithm for finding feasible network codes for multicast networks.. Earlier work on network coding established a tight upper bound on the capacity of multicast networks and provided tools for constructing network codes that achieve capacity. However, optimization issues in network coding have received little attention from the research community. In general, the goal of network optimization is to minimize the amount of resources consumed by network connections. In this study, we focus on minimizing the total number of encoding nodes in multicast coding networks. More specifically, our goal is to find, for a given instance of the network coding problem, a feasible network code that requires as few encoding nodes as possible.. The problem of minimizing the number of encoding nodes is important for both theoretical and practical reasons. First, encoding nodes are, in general, more expensive than forwarding nodes, mostly because of the need to equip them with encoding capabilities. In addition, encoding nodes incur delay and increase the overall complexity of the network. We consider the design of network codes which enable the source to transmit at rate to terminals and include a bounded number of encoding nodes. For acyclic networks, we present an efficient and simple procedure which finds a network code in which the number of encoding nodes is independent of the size of the network and is bounded by . We show that our bound on the number of required encoding nodes may depend both on and as we present networks in which any feasible network code has at least encoding nodes. The gap of between our lower and upper bounds remains an open problem.. For general (cyclic) networks we present results of similar nature. Namely, we present an upper bound of , which depends on the size of the minimum feedback link set of the network. We also present a lower bound of , where is the total number of nodes in the network. The problem of minimizing the number of encoding nodes in coding networks is partially addressed in the works of Fragouli et al. [6] , [7] and Tavory et al. [8] . The works of Fragouli et al. study the special case of transmitting two packets over an acyclic network (i.e., ). They show that in this special case the number of encoding nodes is bounded by the number of terminals . The proof techniques used in [6] , [7] rely on a certain combinatorial decomposition of the underlying network and do not generalize to the case in which the number of packets is larger than two. The problem of minimizing the number of required encoding nodes is also studied by Tavory et al. [8] . They obtain partial results of nature similar to those of [6] and [7] , mentioned above. Namely, they prove, for the case of , that the number of required encoding nodes is independent of the size of the underlying graph . For general values of , [8] conjectures that the number of encoding nodes required by an acyclic coding network is independent of its size and depends only on the number of packets and the number of terminals . In our study we prove this conjecture.. Finally, the issue of encoding versus forwarding nodes in the solution of network coding problems was also studied by Wu et al. [9] . They show the existence (and efficient construction) of network codes in which only nodes which are not directly connected to a terminal perform encoding. The results in [9] do not imply bounds on the number of required encoding nodes.

O O O O B I O O B B I O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O B B I O O O O O B I O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O B I O O O O O B I O O O O O B I O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O B I O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B I O O O O O O O O O B O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O B B I O O O O O O O O O O O O O B I O O O O O O O O O B I O O O O O O O O O B I O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I


Designing adaptive feedback for improving data entry accuracy Data quality is critical for many information-intensive applications. One of the best opportunities to improve data quality is during entry. USHER provides a theoretical, data-driven foundation for improving data quality during entry. Based on prior data, USHER learns a probabilistic model of the dependencies between form questions and values. Using this information, USHER maximizes information gain. By asking the most unpredictable questions first, USHER is better able to predict answers for the remaining questions. In this paper, we use USHER's predictive ability to design a number of intelligent user interface adaptations that improve data entry accuracy and efficiency. Based on an underlying cognitive model of data entry, we apply these modifications before, during and after committing an answer. We evaluated these mechanisms with professional data entry clerks working with real patient data from six clinics in rural Uganda. The results show that our adaptations have the potential to reduce error (by up to 78%), with limited effect on entry time (varying between -14% and +6%). We believe this approach has wide applicability for improving the quality and availability of data, which is increasingly important for decision-making and resource allocation. In today's world, says Carl Malamud, "information is a form of infrastructure; no less important to our modern life than our roads, electrical grid or water systems" [7] . As such, we should be as concerned about the quality of our information, as we are about our roads, water and power. Data quality is especially important for critical applications like health care, Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. where even a single error can have drastic consequences. One of the best opportunities to improve data quality is during entry. Data entry is ubiquitous -organizations all over the world rely on clerks to transcribe information from paper forms into supposedly authoritative databases. However, many smaller organizations, particularly those operating in the developing world, struggle with maintaining high quality during transcription. Part of the reason is because they lack expertise in form design, failing to correctly specify field constraints and other validation logic. They also lack the resources needed for performing double entry -the standard practice of entering data twice to validate the results; or even for doing post hoc data cleaning. For low-resource organizations, data entry is the first and best opportunity to address data quality.. USHER provides a theoretical, data-driven foundation for improving data quality during entry [10] . Based on prior data, USHER learns a probabilistic model of the dependencies between form questions and values. Using this information, USHER reorders questions to maximize information gain. By asking the most unpredictable questions first, USHER is better able to predict answers for the remaining questions.. The theoretical basis for USHER's multivariate predictive model is discussed in [10] , along with a set of simulation results demonstrating its accuracy on two sample data sets. In this paper, we use USHER's predictive ability to design a number of intelligent user interface adaptations that can directly improve data entry accuracy and efficiency. We evaluated each of these mechanisms with professional data entry clerks working with real patient data from six clinics in rural Uganda. The results show that our adaptations have the potential to improve entry accuracy: for radio buttons, the error rates decreased by 54-78%; for other widget types, error rates fell in a pattern of improvement, but were not statistically significant. The impact of our adaptations on entry cost (time) varied between -14% to +6%.. The specific adaptations we tested include: 1) setting defaults corresponding to highly likely answers, 2) dynamically reordering and highlighting other likely options, and 3) providing automatic warnings when the user has entered an unlikely value. The first technique changes an entry task to a confirmation task, which we show has the potential to significantly improve accuracy and efficiency. The second approach guides the user towards more likely values, and away from unlikely ones, which we show further improves accuracy. Finally, by warning the user about particularly unlikely values, we approximate double entry at a fraction of the cost.. The rest of this paper is organized as follows. In the next section, we discuss related work. Next, we introduce USHER -the probabilistic foundation of this work. In the fourth section, we provide a cognitive model of data entry based on our contextual inquiry, and in the fifth section we use that to motivate a number of specific intelligent user interface adaptations. In the sixth section we present the experimental setup for our evaluation, and in the seventh section we describe the results. Lastly, we conclude and discuss future work. We have presented a set of dynamic user interface adaptation for improving data entry and efficiency, driven by a principled probabilistic approach. We evaluated these techniques with real forms and data, entered by professional data entry clerks in Ruhiira, Uganda. Our results show that these mechanisms can significantly improve data entry accuracy and efficiency. Our next step is to develop a version of this system that can work with existing data collection software on mobile phones. We expect that a large number of ongoing mobile data collection projects in the developing world [3, 4, 5] will benefit from this approach. Early discussions confirm this intuition.. Next, we plan to adapt this approach to the related problem of conducting online surveys. Here, we will have to deal explicitly with potential for user bias resulting from adaptive feedback. This concern is mitigated for intermediated entry, where the person doing the entry is typically not the same as who provides the data. We also plan to explore how USHER's predictive model can be used to detect problematic user behaviors, including detecting user fatigue and satisficing, where a respondent does just enough to satisfy form requirements, but nothing more [17] . In general, we believe this approach has wide applicability for improving the quality and availability of all kinds of data, as it is becoming increasingly important for decision-making and resource allocation. We look forward to exploring more such applications in future research. In total, we collected 14,630 question answers from 408 form instances. The 4 feedback types were randomly assigned across form instances, with the Widgets type receiving double weighting: the sample sizes were plain 84, defaults 79, warnings 88, and widgets 157. In this section, we present the results of this evaluation. In this section we summarize the major areas of related work: managing data quality, improving data entry efficiency, and designing dynamic, adaptive user interface widgets.

O O O O O B I O B I O O O O O O O O O O O O O B I O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O B I O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O B I O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O B I O O O O O O O O


Hierarchical mesh segmentation based on fitting primitives Abstract In this paper, we describe a hierarchical face clustering algorithm for triangle meshes based on fitting primitives belonging to an arbitrary set. The method proposed is completely automatic, and generates a binary tree of clusters, each of which is fitted by one of the primitives employed. Initially, each triangle represents a single cluster; at every iteration, all the pairs of adjacent clusters are considered, and the one that can be better approximated by one of the primitives forms a new single cluster. The approximation error is evaluated using the same metric for all the primitives, so that it makes sense to choose which is the most suitable primitive to approximate the set of triangles in a cluster.Based on this approach, we have implemented a prototype that uses planes, spheres and cylinders, and have experimented that for meshes made of 100 K faces, the whole binary tree of clusters can be built in about 8 s on a standard PC. The framework described here has natural application in reverse engineering processes, but it has also been tested for surface denoising, feature recovery and character skinning. Modern industry is spending more and more effort in the exploitation of 3D acquisition devices for diverse applications, including reverse engineering and medical imaging, while producers of precise acquisition tools, such as recent laser scanners, are focusing on improving the quality and flexibility of their products. As a consequence, we can now deal with huge volumes of rather precise data representing 3D shapes. In many contexts, however, it is important to understand the data acquired in order to fully exploit its potential. Unfortunately, in most cases the process of associating high level information to raw 3D data is hard to automate, and timeconsuming manual annotation work is required. In a reverse engineering scenario, for example, the user is typically required to track lines on the surface to subdivide it into simple regions that will eventually be approximated by fitting primitives. Sometimes such features can be detected automatically or semi-automatically [21, 26] , but in most cases the user is required to manually post-process the results to fill gaps or track features missed by the algorithm [29] . In the case of free-form 3D models, the approximating primitives are typically NURBs whose parameters are determined through an automatic fitting procedure. When the model is built by a given set of primitives, these primitives are typically fitted to the data. Models belonging to this latter class are also referred to as regular models [28] and include CSG generated shapes, assemblies of physical primitive objects, and so on.. While a person looking at a rendered 3D model can easily perceive a decomposition of the surface into interesting sub-parts, such as primitive shapes, it turns out to be a rather hard task for a computer and this forms the basis of several recent research works categorized under the term surface segmentation. This field of investigation is becoming more and more important as a support to methods for shape reasoning and understanding [2, 4] , in which the identification of a high-level structure, or signature, is often required to perform the difficult task of abstracting a class of similar shapes.. Broadly speaking, segmentation algorithms attempt to exploit geometric information to infer a decomposition of the surface that corresponds to the one that experts would produce manually. The concept of good segmentation, however, strongly depends on the context in which it will be used. In the broadest scenario of supporting the process of shape understanding, methods based on intrinsic characteristics of the shape, such as curvature and topology, tend to group together parts of the model having a kind of coherence and/or uniformity. In [2] and [4] , for example, Morse theory is used to partition a two-manifold in regions having a prescibed topology; once such a partitioning has been determined, regions are connected together to form an extended Reeb graph structure representing the signature of the shape. The identification of regions of constant curvature has been addressed in [16] , where a multi-scale method to evaluate the surface curvature has been introduced. Being a multi-scale approach, the algorithm produces several segmentations (one for each scale), so that a more complete interpretation of the shape is supported.. In some particular contexts, such as the one addressed in this article, more specific and effective methods may be used that exploit an a-priori knowledge of the shape. We tackle the problem of decomposing a triangulated surface into areas with prescribed characteristics. Specifically, we present a framework to compute a hierarchical segmentation of a given shape into connected regions approximated by primitives belonging to a given set. The set of primitives to be used is arbitrary and does not influence the validity of the framework. The remainder of the paper is organized as follows. In Sect. 2, previous work on mesh segmentation is classified and discussed. In Sect. 3, the hierarchical face clustering method, which is the basis of our work, is described. Section 4 provides an overview of our framework, while in Sect. 5 the computation of the parameters of some fitting primitives is explained. Besides the mathematical foundations described in Sect. 5, we provide some suggestions for an efficient implementation in Sect. 6. Finally, Sect. 7 reviews some application contexts in which our framework is particularly useful, and we conclude the paper in Sect. 8 by discussing potential improvements of the method, extensions and future research directions. The hierarchical segmentation presented in this paper is fast (see Table 1 ), robust to noise, and suitable for producing useful segmentations of irregularly sampled models (Fig. 9 ). Due to its greedy nature, however, it is worth discussing how it behaves when compared to variational approaches.. We have tested a variational version of the method that, starting from a given clustering resolution, attempts to improve the quality of the segmentation using Lloyd's partitioning approach [13] , as previously done for fitting planes in [7] . We have concluded, however, that in practical cases, the level of improvement is far too limited to justify such an expensive post-processing. In our experiments, in fact, the variational approach required nearly 20 times longer than the corresponding greedy version with comparable results. A method using such a variational approach is described in a very recent work by Wu and Kobbelt [31] , where the authors report nearly three minutes to process models up to 100k faces.. There are cases, however, in which the globally best fitting n primitives need to be found for an object; in these cases, a greedy hierarchical approach such as ours is not appropriate, and well-designed variational methods pro-

O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Learning Graph Matching Abstract-As a fundamental problem in pattern recognition, graph matching has applications in a variety of fields, from computer vision to computational biology. In graph matching, patterns are modeled as graphs and pattern recognition amounts to finding a correspondence between the nodes of different graphs. Many formulations of this problem can be cast in general as a quadratic assignment problem, where a linear term in the objective function encodes node compatibility and a quadratic term encodes edge compatibility. The main research focus in this theme is about designing efficient algorithms for approximately solving the quadratic assignment problem since it is NP-hard. In this paper, we turn our attention to a different question: how to estimate compatibility functions such that the solution of the resulting graph matching problem best matches the expected solution that a human would manually provide. We present a method for learning graph matching: The training examples are pairs of graphs and the "labels" are matches between them. Our experimental results reveal that learning can substantially improve the performance of standard graph matching algorithms. In particular, we find that simple linear assignment with such a learning scheme outperforms Graduated Assignment with bistochastic normalization, a state-of-the-art quadratic assignment relaxation algorithm. G RAPHS are commonly used as abstract representations for complex structures, including DNA sequences, documents, text, and images. In particular they are extensively used in the field of computer vision, where many problems can be formulated as an attributed graph matching problem. Here the nodes of the graphs correspond to local features of the image and edges correspond to relational aspects between features (both nodes and edges can be attributed, i.e., they can encode feature vectors). Graph matching then consists of finding a correspondence between nodes of the two graphs such that they "look most similar" when the vertices are labeled according to such a correspondence.. Typically, the problem is mathematically formulated as a quadratic assignment problem, which consists of finding the assignment that maximizes an objective function encoding local compatibilities (a linear term) and structural compatibilities (a quadratic term). The main body of research in graph matching has then been focused on devising more accurate and/or faster algorithms to solve the problem approximately (since it is NP-hard); the compatibility functions used in graph matching are typically handcrafted.. An interesting question arises in this context: If we are given two attributed graphs to match, G and G 0 , should the optimal match be uniquely determined? For example, assume first that G and G 0 come from two images acquired by a surveillance camera in an airport's lounge; now, assume that the same G and G 0 instead come from two images in a photographer's image database; should the optimal match be the same in both situations? If the algorithm takes into account exclusively the graphs to be matched, the optimal solutions will be the same 1 since the graph pair is the same in both cases. This is the standard way graph matching is approached today.. In this paper, we address what we believe to be a limitation of this approach. We argue that if we know the "conditions" under which a pair of graphs has been extracted, then we should take into account how graphs arising in those conditions are typically matched. However, we do not take the information on the conditions explicitly into account, since this would obviously be impractical. Instead, we approach the problem purely from a statistical inference perspective. First, we extract graphs from a number of images acquired under the same conditions as those for which we want to solve, whatever the word "conditions" means (e.g., from the surveillance camera or the photographer's database). We then manually provide what we understand to be the optimal matches between the resulting graphs. This information is then used in a learning algorithm which learns a map from the space of pairs of graphs to the space of matches.. In terms of the quadratic assignment problem, this learning algorithm amounts to (in loose language) adjusting the node and edge compatibility functions such that the expected optimal match in a test pair of graphs agrees with the expected match they would have had had they been in the training set. In this formulation, the learning problem consists of a convex, quadratic program which is readily solvable by means of a column generation procedure.. We provide experimental evidence that applying learning to standard graph matching algorithms significantly improves their performance. In fact, we show that learning improves upon nonlearning results so dramatically that linear assignment with learning outperforms Graduated Assignment with bistochastic normalization, a state-of-theart quadratic assignment relaxation algorithm. Also, by introducing learning in Graduated Assignment itself, we obtain results that improve both in accuracy and speed over the state-of-the-art relaxation.. A preliminary version of this paper appeared in [1] .

B B I O O O O O O O B I O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O B B I O O O O O O O O O O O O O O O O O O O B O O O O O O O B I O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B O O B I O O O O O O O O O O B O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Verifying Sequential Consistency on Shared-Memory Multiprocessors by Model Checking The memory model of a shared-memory multiprocessor is a contract between the designer and programmer of the multiprocessor. The sequential consistency memory model specifies a total order among the memory (read and write) events performed at each processor. A trace of a memory system satisfies sequential consistency if there exists a total order of all memory events in the trace that is both consistent with the total order at each processor and has the property that every read event to a location returns the value of the last write to that location.Descriptions of shared-memory systems are typically parameterized by the number of processors, the number of memory locations, and the number of data values. It has been shown that even for finite parameter values, verifying sequential consistency on general shared-memory systems is undecidable. We observe that, in practice, shared-memory systems satisfy the properties of causality and data independence. Causality is the property that values of read events flow from values of write events. Data independence is the property that all traces can be generated by renaming data values from traces where the written values are distinct from each other. If a causal and data independent system also has the property that the logical order of write events to each location is identical to their temporal order, then sequential consistency can be verified algorithmically. Specifically, we present a model checking algorithm to verify sequential consistency on such systems for a finite number of processors and memory locations and an arbitrary number of data values. Shared-memory multiprocessors are very complex computer systems. Multithreaded programs running on shared-memory multiprocessors use an abstract view of the shared memory that is specified by a memory model. Examples of memory models for multiprocessors include sequential consistency [Lam79] , partial store ordering [WG99] , and the Alpha memory model [Com98] . The implementation of the memory model, achieved by a protocol running either in hardware or software, is one of the most complex aspects of multiprocessor design. These protocols are commonly referred to as cache-coherence protocols. Since parallel programs running on such systems rely on the memory model for their correctness, it is important to implement the protocols correctly. However, since efficiency is important for the commercial viability of these systems, the protocols are heavily optimized, making them prone to design errors. Formal verification of cache-coherence protocols can detect these errors effectively.. Descriptions of cache-coherence protocols are typically parameterized by the number of processors, the number of memory locations, and the number of data values. Verifying parameterized systems for arbitrary values of these parameters is undecidable for nontrivial systems. Interactive theorem proving is one approach to parameterized verification. This approach is not automated and is typically expensive in terms of the required human effort. Another approach is to model check a parameterized system for small values of the parameters. This is a good debugging technique that can find a number of errors prior to the more time-consuming effort of verification for arbitrary parameter values. In this paper, we present an automatic method based on model checking to verify that a cache-coherence protocol with fixed parameter values is correct with respect to the sequential consistency memory model.. The sequential consistency memory model [Lam79] specifies a total order among the memory events (reads and writes) performed locally at each processor. This total order at a processor is the order in which memory events occur at that processor. A trace of a memory system satisfies sequential consistency if there exists a total order of all memory events that is both consistent with the local total order at each processor, and has the property that every read to a location returns the latest (according to the total order) value written to that location. Surprisingly, verifying sequential consistency, even for fixed parameter values, is undecidable [AMP96] . Intuitively, this is because the witness total order could be quite different from the global temporal order of events for some systems. An event might need to be logically ordered after an event that occurs much later in a run. Hence any algorithm needs to keep track of a potentially unbounded history of a run.. In this paper, we consider the problem of verifying that a shared-memory system S(n, m, v) with n processors, m locations and v data values is sequentially consistent. We present a method that can check sequential consistency for any fixed n and m and for arbitrary v. The correctness of our method depends on two assumptions -causality and data independence. The property of causality arises from the observation that protocols do not conjure up data values; data is injected into the system by the initial values stored in the memory and by the writes performed by the processors. Therefore every read operation r to location l is associated with either the initial value of l or some write operation w to l that wrote the value read by r. The property of data independence arises from the observation that protocols do not examine data values; they just forward the data from one component of the system (cache or memory) to another. Since protocol behavior is not affected by the data values, we can restrict our attention, without loss of generality, to unambiguous runs in which the written data values to a location are distinct from each other and from the initial value. We have observed that these two assumptions are true of shared-memory systems that occur in practice [LLG + 90, KOH + 94, BDH + 99, BGM + 00]. For a causal and unambiguous run, we can deduce the association between a read and the associated write just by looking at their data values. This leads to a vast simplification in the task of specifying the witness total order for sequential consistency. It suffices to specify for each location, a total order on the writes to that location. By virtue of the association of write events and read events, the total order on the write events can be extended to a partial order on all memory events (both reads and writes) to that location. If a read event r reads the value written by the write event w, the partial order puts r after w and all write events preceding w, and before all write events succeeding w. As described before, sequential consistency specifies a total order on the memory events for each processor. Thus, there are n total orders, one for each processor, and m partial orders, one for each location, imposed on the graph of memory events of a run. A necessary and sufficient condition for the run to be sequentially consistent is that this graph is acyclic. We further show that existence of a cycle in this graph implies the existence of a nice cycle in which no two processor edges (imposed by the memory model) are for the same processor and no two location edges (imposed by the write order) are for the same location. This implies that a nice cycle can have at most 2 × min({n, m}) edges; we call a nice cycle with 2 × k edges a k-nice cycle. Further if the memory system is symmetric with respect to processor and location ids, then processor and location edges occur in a certain canonical order in the nice cycle. These two observations drastically reduce the number of cycles for any search.. We finally argue that a number of causal and data independent sharedmemory systems occurring in practice also have the property that the witness write order at each location is simply the temporal order of the write events. In other words, a write event w is ordered before w ′ if w occurs before w ′ . We call this a simple write order, and it is in fact the correct witness for a number of shared-memory systems. For cache-based shared-memory systems, the intuitive explanation is that at any time there is at most one cache with write privilege to a location. The write privilege moves from one cache to another with time. Hence, the logical timestamps [Lam78] of the writes to a location order them exactly according to their global temporal order. We show that the proof that a simple write order is a correct witness for a memory system can be performed by model checking [CE81, QS81] . Specifically, the proof for the memory system S(n, m, v) for fixed n and m and arbitrary v is broken into min({n, m}) model checking lemmas, where the k-th lemma checks for the existence of canonical k-nice cycles.. The rest of the paper is organized as follows. Sections 2 and 3 formalize shared-memory systems and our assumptions of causality and data indepen-dence about them. Section 4 defines the sequential consistency memory model. Section 5 defines the notions of a witness and a constraint graph for an unambiguous and causal run. Section 6 and 7 show that it is sufficient to search for canonical nice cycles in the constraint graph. Section 8 shows how to use model checking to detect canonical nice cycles in the constraint graphs of the runs of a memory system. Finally, we discuss related work in Section 9 and conclude in Section 10. The sequential consistency memory model M is a function that maps every sequence of memory events τ ∈ E (n, m, v) * and processor 1 ≤ i ≤ n to a total order M (τ, i) on P (τ, i) defined as follows: for all u, v ∈ P (τ, i), we have u, v ∈ M (τ, i) iff u < v. A sequence τ is sequentially consistent if there is a permutation f on N |τ | such that the following conditions are satisfied.. Intuitively, the sequence τ ′ is a permutation of the sequence τ such that the event at index u in τ is moved to index f (u) in τ ′ . According to C1, this permutation must respect the total order M (τ, i) for all 1 ≤ i ≤ n. According to C2, the permuted sequence must be serial. A run σ ∈ S(n, m, v) is sequentially consistent if σ satisfies M . The memory system S(n, m, v) is sequentially consistent iff every run of S(n, m, v) is sequentially consistent.. The memory system in Figure 1 is supposed to be sequentially consistent.. Here is an example of a sequentially consistent run σ of that memory system, the corresponding trace τ of σ, and the sequence τ ′ obtained by permuting τ .. Sequential consistency orders the event τ (2) before the event τ (3) at processor 2. Let f be the permutation on N 3 defined by f (1) = 2, f (2) = 1, and f (3) = 3.. The sequence τ ′ is the permutation of τ under f . It is easy to check that both conditions C1 and C2 mentioned above are satisfied.. In order to prove that a run of a memory system is sequentially consistent, one needs to provide a reordering of the memory events of the run. This reordering should be serial and should respect the total orders imposed by sequential consistency at each processor. Since the memory systems we consider in this paper are data independent, we only need to show sequential consistency for the unambiguous runs of the memory system. This reduction is stated formally in the following theorem. Proof: The ⇒ case is trivial.. (⇐) Let τ be a trace of S(n, m, v) for some v ≥ 1. From Assumption 2 there is an unambiguous trace τ ′ of S(n, m) and a renaming function λ :. Since τ ′ is sequentially consistent, we know that conditions C1 and C2 are satisfied by τ ′ . It is not difficult to see that both conditions C1 and C2 are satisfied by λ d (τ ′ ) as well. Therefore τ is sequentially consistent. We now put the results of this paper in perspective. Assumption 1 about causality and Assumption 2 about data independence are critical to our result that reduces the problem of verifying sequential consistency to model checking. Assumption 3 about processor symmetry and Assumption 4 about location symmetry are used to reduce the number of model checking lemmas to min({n, m}) rather than exponential in n and m.. In this paper, the read and write events have been modeled as atomic events. In most real machines, each read or write event is broken into two separate events -a request from the processor to the cache, and a response from the cache to the processor. Any memory model including sequential consistency naturally specifies a partial order on the requests. If the memory system services processor requests in order then the order of requests is the same as the order of responses. In this case, the method described in this paper can be used by identifying the atomic read and write events with the responses. The case when the memory system services requests out of order is not handled by this paper.. The model checking algorithm described in the paper is sound and complete with respect to a simple witness for the memory system. In some protocols, for example the lazy caching protocol [ABM93], the correct witness is not simple. But the basic method described in the paper where data values of writes are constrained by automata can still be used if ordering decisions about writes can be made before the written values are read. The lazy caching protocol has this property and extending the methods described in the paper to handle it is part of our future work. We would also like to extend our work to handle other memory models. Descriptions of shared-memory systems are parameterized by the number of processors, the number of memory locations, and the number of data values. The specification for such a system can be either an invariant or a sharedmemory model. These specifications can be verified for some fixed values of the parameters or for arbitrary values of the parameters. The contribution of this paper is to provide a completely automatic method based on model checking to verify the sequential consistency memory model for fixed parameter values. We now describe the related work on verification of shared-memory systems along the two axes mentioned above.. A A limitation of all these approaches is that they do not explicate the formal connection between the verified invariants and shared-memory model for the protocol.. There are some papers that have looked at verification of shared-memory models. Systematic manual proof methods [LLOR99, PSCH98] and theorem proving [Aro01] have been used to verify sequential consistency for arbitrary parameter values. These approaches require a significant amount of effort on the part of the verifier. Our method is completely automatic and is a good debugging technique which can be applied before using these methods. The approach of Henzinger et al. [HQR99] and Condon and Hu [CH01] requires a manually constructed finite state machine called the serializer. The serializer generates the witness total order for each run of the protocol. By model checking the system composed of the protocol and the serializer, it can be easily checked that the witness total order for every run is a trace of serial memory. This idea is a particular instance of the more general "convenient computations" approach of Katz and Peled [KP92] . In general, the manual construction of the serializer can be tedious and infeasible in the case when unbounded storage is required. Our work is an improvement since the witness total order is deduced automatically from the simple write order. Moreover, the amount of state we add to the cachecoherence protocol in order to perform the model checking is significantly less than that added by the serializer approach. The "test model checking" approach of Nalumasu et al. [NGMG98] can check a variety of memory models and is automatic. Their tests are sound but incomplete for sequential consistency. On the other hand, our method offers sound and complete verification for a large class of cache-coherence protocols.. Recently Glusman and Katz [GK01] have shown that, in general, interpreting sequential consistency over finite traces is not equivalent to interpreting it over infinite traces. They have proposed conditions on shared-memory systems under which the two are equivalent. Their work is orthogonal to ours and a combination of the two will allow verification of sequential consistency over infinite traces for finite parameter values.

O O O O O B O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O