Auxiliary object knowledge influences visually-guided interception behavior This work investigated how humans integrate visual information with object knowledge for interception behavior. When attempting to intercept a moving object using only monocular visual information, the optimal interception position may be ambiguous-the observer may be viewing a small object that is near or a large object that is far away. Regardless, humans are quite adept at monocular interception so it is likely that additional information is incorporated to disambiguate the visual information. We hypothesize that object size information is integrated to accomplish this disambiguation. This sort of auxiliary information integration is well-defined by a Bayesian model of information propagation. We derived a Bayesian model that represents scene attributes relevant to intercepting an object and relations among these attributes. Our model combines sensory measurements with prior scene knowledge to infer an object's position. To test our model we asked participants to intercept a moving ball in virtual reality. In some trials participants were able to see and touch the ball before intercepting it, in others they were only able to see it. When allowed to touch the ball, participants showed improved interception performance. Effectively, they discounted the variation in image size that was caused by variation in object size to obtain more accurate knowledge of object distance. This discounting is consistent with Bayesian information propagation and confirms our hypothesis that human participants use Bayesian inference to estimate an object's distance for interception.

O O O O O B O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B


Iterative Inversion of Fuzzified Neural Networks Abstract-The inversion of a neural network is a process of computing inputs that produce a given target when fed into the neural network. The inversion algorithm of crisp neural networks is based on the gradient descent search in which a candidate inverse is iteratively refined to decrease the error between its output and the target. In this paper, we derive an inversion algorithm of fuzzified neural networks from that of crisp neural networks. First, we present a framework of learning algorithms of fuzzified neural networks and introduce the idea of adjusting schemes for fuzzy variables. Next, we derive the inversion algorithm of fuzzified neural networks by applying the adjusting scheme for fuzzy variables to total inputs in the input layer. Finally, we make three experiments on the parity-three problem; we examine the effect of the size of training sets on the inversion and investigate how the fuzziness of inputs and targets of training sets affects the inversion.Index Terms-Fuzzified neural network, inversion algorithm, learning algorithm. Consider a fuzzified neural network in Fig. 1 . After it learns the rules in a training set a sufficient number of times so as to reach a stable state, it approximates a fuzzy function F , which complies with the rules. The inversion is a process of computing the inverse of a target T T T on the function F. In other words, it computes an input X X X which produces the desired target T when fed into the fuzzified neural network. If the fuzzified neural network simulates a many-to-one function, the target T may have more than one inverse. Furthermore, it requires a large computational cost to find the exact inverse of T even on fuzzified neural networks of moderate size. For these reasons, we instead find an estimate inverse X, which approximates the inverse of T to a certain degree as follows:. Linden and Kindermann [17] introduce the inversion algorithm of crisp neural networks. It is based on the gradient descent search in which a candidate inverse is iteratively refined to decrease the error between its output and the target; it adjusts repeatedly the candidate inverse using error signals backpropagated from the output layer. The error signals are backpropagated to the input layer in the same way as in the learning algorithm. The inversion of crisp neural networks has been used in several applications (Hoskins et al. [18] , Davis et al. [19] , Hwang and Chan [20] , and Hwang et al. [21] ).. As with crisp neural networks, the inversion algorithm of fuzzified neural networks is based on the gradient descent search. Since we do not have the calculus for fuzzy numbers, the inversion algorithm of crisp neural networks cannot be directly fuzzified. Therefore, the inversion algorithm of fuzzified neural networks uses adjusting schemes for fuzzy variables to adjust estimate inverses, which is explained in the next subsection. We described the architecture of fuzzified neural networks with fuzzy input signals and fuzzy weight factors. We presented a general framework of learning algorithms of fuzzified neural networks and derived adjusting schemes for fuzzy variables from existing learning algorithms which fit into this framework. We formulated the inversion algorithm of fuzzified neural networks which applies the adjusting scheme for fuzzy variables to the total inputs in the input layer. We compared three adjusting schemes for fuzzy variables with respect to their effect on the learning and inversion of fuzzified neural networks. Experimental results showed that the quality of estimate inverses depends on adjusting schemes. We showed that the size of training sets does not determine the quality of estimate inverses on average even if they have no contradictory rules, but that we may obtain more accurate estimate inverses in best cases if we extend a training set with new rules which refine on the existing rules. We showed that the quality of estimate inverses is more strongly affected by the fuzziness of the targets than by the difference of fuzziness between the inputs and the targets of the training set.. A crisp or fuzzified neural network can be viewed as a mathematical model for brain-like systems. The learning process increases the sum of knowledge of the neural network by improving the configuration of weight factors. In this point of view, the inversion may be compared to retrieving the knowledge accumulated in an artificial brain.. The inversion of fuzzified neural networks has several applications. For example, a fuzzy controller system implemented with fuzzified neural networks can benefit from the inversion in finding control signals for desired operations. The reliability of fuzzy systems based on fuzzified neural networks can also be examined by the inversion; we can measure indirectly how much knowledge they have or how much amount of learning they have performed. In future works, we investigate the applicability of the inversion of fuzzified neural networks to practical problems. . The calculation of partial derivatives and depends on . We consider two cases of , one for the output layer and the other for hidden layers.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I B I O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Convergence of distributed asynchronous learning vector quantization algorithms Motivated by the problem of effectively executing clustering algorithms on very large data sets, we address a model for large scale distributed clustering methods. To this end, we briefly recall some standards on the quantization problem and some results on the almost sure convergence of the Competitive Learning Vector Quantization (CLVQ) procedure. A general model for linear distributed asynchronous algorithms well adapted to several parallel computing architectures is also discussed. Our approach brings together this scalable model and the CLVQ algorithm, and we call the resulting technique the Distributed Asynchronous Learning Vector Quantization algorithm (DALVQ). An in-depth analysis of the almost sure convergence of the DALVQ algorithm is performed. A striking result is that we prove that the multiple versions of the quantizers distributed among the processors in the parallel architecture asymptotically reach a consensus almost surely. Furthermore, we also show that these versions converge almost surely towards the same nearly optimal value for the quantization criterion. Distributed algorithms arise in a wide range of applications, including telecommunications, distributed information processing, scientific computing, real time process control and many others. Parallelization is one of the most promising ways to harness greater computing resources, whereas building faster serial computers is increasingly expensive and also faces some physical limits such as transmission speeds and miniaturization. One of the challenges proposed for Machine Learning is to build scalable applications that quickly process large amounts of data in sophisticated ways. Building such large scale algorithms attacks several problems in a distributed framework, such as communication delays in the network or numerous problems caused by the lack of shared memory.. Clustering algorithms are one of the primary tools of unsupervised learning. From a practical perspective, clustering plays an outstanding role in data mining applications such as text mining, web analysis, marketing, medical diagnostics, computational biology and many others. Clustering is a separation of data into groups of similar objects. As clustering represents the data with fewer clusters, there is a necessary loss of certain fine details, but simplification is achieved. The popular Competitive Learning Vector Quantization (CLVQ) algorithm (see Gersho and Gray [22] ) provides a technique for building reliable clusters characterized by their prototypes. As pointed out by Bottou in [11] , the CLVQ algorithm can also be viewed as the on-line version of the widespread Lloyd's method (see Lloyd's [29] for the definition) which is referred to as batch k-means in [11] . The CLVQ also belongs to the class of stochastic gradient descent algorithms (for more information on stochastic gradient descent procedures we refer the reader to Benveniste et al. [5] ).. The analysis of parallel stochastic gradient procedures in a Machine Learning context has recently received a great deal of attention (see for instance Zinkevich et al. [42] and Mac Donald et al. [31] ). In the present paper, we go further by introducing a model that brings together the original CLVQ algorithm and the comprehensive theory of asynchronous parallel linear algorithms developed by Tsitsiklis [41] , Tsitsiklis et al. [40] and Bertsekas and Tsitsiklis [6] .. The resulting model will be called Distributed Asynchronous Learning Vector Quantization (DALVQ for short). At a high level, the DALVQ algorithm parallelizes several executions of the CLVQ method concurrently on different processors while the results of these algorithms are broadcast through the distributed framework asynchronously and efficiently. Here, the term processor refers to any computing instance in a distributed architecture (see Bullo et al. [13, Chapter 1] for more details). Let us remark that there is a series of publications similar in spirit to this paper. Indeed in Frasca et al. [21] and in Durham et al. [17] , a coverage control problem is formulated as an optimization problem where the functional cost to be minimized is the same of the quantization problem stated in this manuscript.. Let us provide a brief mathematical introduction to the CLVQ technique and DALVQ algorithms. The first technique computes quantization scheme for d dimensional samples z 1 , z 2 , . . . using the following iterations on a R d κ vector, w(t + 1) = w(t) − ε t+1 H (z t+1 , w(t)) , t ≥ 0.. In the equation above, w(0) ∈ R d κ and the ε t are positive reals. The vector H(z, w) is the opposite of the difference between the sample z and its nearest component in w. Assume that there are M computing entities, the data are split among the memory of these machines: z i ∈ {1, . . . , M} and t ≥ 0. The time instants τ i,j (t) ≥ 0 are deterministic but unknown and the delays satisfy t − τ i,j (t) ≥ 0. The families {a i,j (t)} Let µ be a probability measure on R d with finite second-order moment. The quantization problem consists in finding a "good approximation" of µ by a set of κ vectors of R d called quantizer. Throughout the document the κ quantization points (or prototypes) will be seen as the components of a R d κ -dimensional vector w = (w 1 , . . . , w κ ). To measure the correctness of a quantization scheme given by w, one introduces a cost function called distortion, defined by. Under some minimal assumptions, the existence of an optimal quantizer vector w In a statistical context, the distribution µ is only known through n independent random observations z 1 , . . . , z n drawn according to µ. Denote by µ n the empirical distribution based on z 1 , . . . , z n , that is, for every Borel subset. Much attention has been devoted to the convergence study of the quantization scheme provided by the empirical minimizers. The almost sure convergence of C µ (w. was proved by Pollard in [34, 35] and Abaya and Wise in [2] . Rates of convergence and nonasymptotic performance bounds have been considered by Pollard [36] , Chou [14] , Linder et al. [28] , Bartlett et al. [4] , Linder [27, 39] , Antos [1] and Antos et al. [3] . Convergence results have been established by Biau et al. in [7] where µ is a measure on a Hilbert space. It turns out that the minimization of the empirical distortion is a computationally hard problem. As shown by Inaba et al. in [24] , the computational complexity of this minimization problem is exponential in the number of quantizers κ and the dimension of the data d. Therefore, exact computations are untractable for most of the practical applications.. Based on this, our goal in this document is to investigate effective methods that produce accurate quantizations with data samples. One of the most popular procedure is Lloyd's algorithm (see Lloyd [29] ) sometimes refereed to as batch k-means. A convergence theorem for this algorithm is provided by Sabin and Gray in [38] . Another celebrated quantization algorithm is the Competitive Learning Vector Quantization (CLVQ), also called on-line kmeans. The latter acronym outlines the fact that data arrive over time while the execution of the algorithm and their characteristics are unknown until their arrival times. The main difference between the CLVQ and the Lloyd's algorithm is that the latter run in batch training mode. This means that the whole training set is presented before performing an update, whereas the CLVQ algorithm uses each item of the training sequence at each update.. The CLVQ procedure can be seen as a stochastic gradient descent algorithm. In the more general context of gradient descent methods, one cannot hope for the convergence of the procedure towards global minimizers with a non convex objective function (see for instance Benveniste et al. [5] ). In our quantization context, the distortion mapping C µ is not convex (see for instance Graf and Luschgy [23] ). Thus, just as in Lloyd's method, the iterations provided by the CLVQ algorithm converge towards local minima of C µ .. Assuming that the distribution µ has a compact support and a bounded density with respect to the Lebesgue measure, Pagès states in [33] a result regarding the almost sure consistency of the CLVQ algorithm towards critical points of the distortion C µ . The author shows that the set of critical points necessarily contains the global and local optimal quantizers. The main difficulties in the proof arise from the fact that the gradient of the distortion is singular on κ-tuples having equal components and the distortion function C µ is not convex. This explains why standard theories for stochastic gradient algorithm do not apply in this context.

O O B B O B I O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B B O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Deciding security of protocols against off-line guessing attacks We provide an effective procedure for deciding the existence of off-line guessing attacks on security protocols, for a bounded number of sessions.The procedure consists of a constraint solving algorithm for determining satisfiability and equivalence of a class of second-order E-unification problems, where the equational theory E is presented by a convergent subterm rewriting system.To the best of our knowledge, this is the first decidability result to use the generic definition of off-line guessing attacks due to Corin et al. based on static equivalence in the applied pi calculus. Guessing attacks (a.k.a. dictionary attacks or brute-force attacks) occur in cryptography when an attacker is able to guess a secret by just trying every possible value for it. In practice this is feasible only when the number of those values (the "dictionary") is small-say 2 32 for a (poor) password or even less for a vote in an election protocol. In this case the secret is called a weak secret.. Fortunately not all weak secrets can be broken. As pointed out by Lowe [18] the attacker must still be able to test whether one of his guesses is correct or not, typically by exploiting redundancy between messages.. Among guessing attacks, by definition, off-line guessing attacks are those for which the attacker does not need to participate in any communication during the guessing phase (but he may have interacted with the honest agents before).. When the size of the dictionary becomes significant, off-line guessing attacks are more feasible in practice than on-line ones and thus are more crucial to detect. On-line guessing attacks may need to send as many requests to the network as the size of the dictionary.. Several attempts have been made, based on the initial work of Lowe [18] , to characterize off-line guessing attacks from a logical point of view and derive formal methods for detecting them [9, 11, 13] . The attempts for a "good" definition currently culminate with Corin et al. [10] . Using the notion of static equivalence from the applied pi calculus [3] , they give a simple and intuitive definition of off-line guessing attacks for an arbitrary set of primitives, modeled by an equational theory. However no automatic procedure is given in [10] and the mentioned examples only deal with passive adversaries.. In this paper we address the question whether the general definition of Corin et al. [10] is suitable for automatic reasoning. We show that the problem of finding off-line guessing attacks is decidable in the case of a bounded number of sessions, for protocols whose set of primitives is described by a convergent subterm rewriting system (see Section 2 for a definition). In particular our class of protocols encompasses the initial Dolev-Yao model [14] and subsequent extensions as in [19, 12, 3, 6, 1] with symmetric encryption, ciphers, compound keys, signatures and hashes.. Our algorithm is based on a procedure for solving a class of second-order E-unification problems. We show that the satisfiability of those constraint systems is decidable, and more remarkably, that the equivalence between two systems (i.e. the equality of their sets of solutions) is decidable.. The purpose of our constraint systems is here to represent symbolic traces of protocols (see e.g. [19, 20, 8, 12] ). We use the equivalence of systems to specify the absence of off-line guessing attacks, by expressing the fact that the intruder cannot distinguish between two versions of the same symbolic trace: one corresponding to a good guess and the other one to a bad guess of the secret.. To our knowledge, this is the first decision procedure for finding such off-line guessing attacks. It is fair to mention, though, that recent releases of Blanchet's tool Proverif [5] do support off-line guessing attacks based on Corin et al.'s definition. In case of success, Blanchet's (non-terminating, approximate) procedure for proving strong secrecy [6] , later refined by [7] , rules out the possibility of on-line/off-line guessing attacks, for an unbounded number of sessions. Our concern is different here, as we look for an exact answer, given by a terminating algorithm, to the security problem for a bounded number of sessions.. Further related work. Delaune and Jacquemard [12] give an NP procedure for verifying trace properties, for a bounded number of sessions, on protocols with explicit destructors. Our algorithm deals with a more general class of security properties, including resistance to off-line guessing attacks. We also relax (and somewhat simplify) the syntactic conditions on the equational theory, by considering convergent subterm rewriting systems instead of convergent public-collapsing rewriting ones (see Section 2).. Abadi and Cortier [1] present an algorithm for deciding static equivalence between closed frames in polynomial time, when the equational theory is given by a convergent subterm rewriting system. Recently, this result has been extended to a more general class of equational theories comprising associative and commutative symbols [2] . This work corresponds to passive adversaries, i.e. pure eavesdroppers. Our procedure can be seen as an extension of [1] to the general case of active adversaries.. Outline of the paper. Section 2 begins with preliminary definitions. We describe our class of constraint systems, called (standard) intruder constraint systems. These correspond to second-order E-unification problems with a number of regularity conditions. Compared to usual unification, though, we allow distinguishing between private and public symbols. Private symbols typically account for secret values not directly available to the intruder. Our main theorem is that: if the equational theory E is presented by a convergent subterm rewriting system and the signature contains an infinite number of public constants, the satisfiability of intruder constraint systems is decidable, and so is the equivalence between standard intruder constraint systems.. We apply this result in Section 3 for deciding trace properties and, more remarkably, the existence of off-line guessing attacks on cryptographic protocols, for a bounded number of sessions.. Section 4 is devoted to the proof of the main theorem. The heart of our decision procedure is a sound and complete set of transformation rules together with a (nondeterministic) terminating strategy, so as to bring any intruder constraint system into a solved form. As such solved forms are always satisfiable, this gives a procedure to decide satisfiability. In order to decide the equivalence of systems, we provide an algorithm for testing whether the set of solutions corresponding to a solved system is included in that of a standard intruder constraint system. We conclude in Section 5. In this work we described a class of second-order E-unification problems and provided a terminating procedure to decide their satisfiability and their equivalence, in the case where the equational theory E is presented by a convergent subterm rewriting system. This decision result is interesting by itself as it is not implied by previous work in the area, e.g. [16, 21, 17] .. A major application, for which these constraint systems were intended, is the security of cryptographic protocols against off-line guessing attacks. No previous decision results existed for such properties, in any case, not using the recent general definition of Corin et al. [10] . Using our main result, we recovered the decidability of trace properties, and proved the decidability of security against of off-line guessing attacks for a bounded number of sessions.. As future work, we foresee to apply our notion of equivalence between symbolic traces to other security properties, such as strong secrecy and resistance to on-line guessing attacks. On the long term an interesting avenue would be to extend our result to equational theories involving algebraic properties such as associativity-commutativity, XOR or homomorphism. Each of the last five rules additionally requires its left-hand constraint system to be pre-solved, that is, saturated for the first three rules. The five rules from Narrowing-1 to Relate additionally require their left-hand constraint systems to be pre-solved and saturated for the last four rules. Each of the last four rules requires its left-hand constraint system to be pre-solved and saturated for the higher rules in this group.

O O O O O O B I O O O O O O O O O O O B I O B I O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


An Overview of Local Capacity in Wireless Networks This article introduces a metric for performance evaluation of medium access schemes in wireless ad hoc networks known as local capacity. Although deriving the end-to-end capacity of wireless ad hoc networks is a difficult problem, the local capacity framework allows us to quantify the average information rate received by a receiver node randomly located in the network. In this article, the basic network model and analytical tools are first discussed and applied to a simple network to derive the local capacity of various medium access schemes. Our goal is to identify the most optimal scheme and also to see how does it compare with more practical medium access schemes. We analyzed grid pattern schemes where simultaneous transmitters are positioned in a regular grid pattern, ALOHA schemes where simultaneous transmitters are dispatched according to a uniform Poisson distribution and exclusion schemes where simultaneous transmitters are dispatched according to an exclusion rule such as node coloring and carrier sense schemes. Our analysis shows that local capacity is optimal when simultaneous transmitters are positioned in a grid pattern based on equilateral triangles and our results show that this optimal local capacity is at most double the local capacity of ALOHA based scheme. Our results also show that node coloring and carrier sense schemes approach the optimal local capacity by an almost negligible difference. At the end, we also discuss the shortcomings in our model as well as future research directions. This article presents the framework for deriving the local capacity in a wireless ad hoc network with various medium access schemes. The local capacity is defined as the average information rate received by a node randomly located in the network. The seminal work of Gupta & Kumar [1] and the later studies, e.g., [2] [3] [4] quantify the capacity in wireless networks in terms of scaling laws or bounds. These results are very important but they may not provide a deeper insight into the interrelationship between the performances of various medium access schemes in the network (e.g., the exact achievable capacity) and the possible network and protocol design issues (e.g., trade-offs involving protocol overhead versus performance of various medium access schemes) and network parameters. Apart from being of general interest, an additional advantage of local capacity, as compared to the results on scaling laws, is that it can be derived accurately. Therefore, the local capacity framework can be used to get better insights into the designing of medium access schemes for wireless ad hoc networks.. Medium access schemes in wireless ad hoc networks can be broadly classified into two main classes: continuous time access and slotted access. In this article, our main focus is on slotted medium access although many of our results can also be applied to continuous time medium access. Within slotted medium access category, we distinguish grid pattern, node coloring, carrier sense multiple access (CSMA) and slotted ALOHA schemes. In §2, we will briefly summarize our motivation and related works. In the following sections, we will concisely describe the analytical methods we have developed to derive the local capacity of the above mentioned medium access schemes in a wireless ad hoc network. Because these methods are developed independently, depending on the underlying design of each medium access scheme, §3 will first give a brief overview of our network model and mathematical background of our parameters of interest. In sections 4, 5 and 6, we will discuss grid pattern, node coloring, CSMA and slotted ALOHA schemes respectively. First we will give a brief overview of the protocol overheads associated with each scheme and later, in each case, we will discuss the methods we used to evaluate local capacity of wireless ad hoc networks. In §7, we will discuss the evaluation of these schemes and our results. The shortcomings and future extensions to our work and concluding remarks can be found in sections 8 and 9 respectively. We evaluated the performance of wireless ad hoc networks under the framework of local capacity. We used analytical tools, based on realistic interference model, to evaluate the performance of slotted ALOHA and grid pattern based medium access schemes and we used Monte Carlo simulation to evaluate node coloring and CSMA based schemes. Our analysis implies that maximum local capacity in wireless ad hoc networks can be achieved with grid pattern based schemes and our results show that triangular grid pattern outperforms square and hexagonal grids. Moreover, compared to slotted ALOHA, which does not use any significant protocol overhead, triangular grid pattern can only increase the capacity by a factor of 2 or less whereas CSMA and node coloring can achieve almost similar capacity as the triangular grid pattern based medium access scheme.. The conclusion of this work is that improvements above ALOHA are limited in performance and may be costly in terms of protocol overheads and that CSMA or node coloring can be very good candidates. Therefore, attention should be focused on optimizing existing medium access schemes and designing efficient routing strategies in case of multi-hop networks. Note that, our results are also relevant when nodes move according to an i.i.d. mobility process such that, at any time, distribution of nodes in the network is homogeneous. In one of the first analyses on capacity of medium access schemes in wireless networks, [5] studied slotted ALOHA and despite using a very simple geometric propagation model, the result is similar to what can be obtained under a realistic SIR based interference model (non-fading, SIR threshold of 10.0 and attenuation coefficient of 4.0). Under a similar propagation model and assuming that all nodes are within range of each other, [6] evaluated CSMA scheme and compared it with slotted ALOHA in terms of throughput. [7] used simulations to analyze CSMA under a realistic SIR based interference model and compared it with ALOHA (slotted and un-slotted). For simulations, [7] assumed Poisson distributed transmitters with density λ. Each transmitter sends packets to an assigned receiver located at a fixed distance of a √ λ, for some a > 0. [8, 9] studied the transmission capacity, which is defined as the maximum number of successful transmissions per unit area at a specified outage probability, of ALOHA and code division multiple access (CDMA) medium access schemes. They assumed that simultaneous transmitters form a homogeneous Poisson point process (PPP) and used the same model for locations of receivers as in [7] . The fact that the receivers are not a part of the network (node distribution) model and are located at a fixed distance from the transmitters is a simplification. An accurate model of wireless networks should consider that the transmitters, transmit to receivers which are randomly located in their neighborhood or, in other words, their reception areas. Although, [8] analyzed the case where receivers are located at a random distance but it was assumed that a transmitter employs transmit power control such that signal power at its intended receiver is some fixed value.. PPP only accurately models an ALOHA based scheme where transmitters are independently and uniformly distributed over the network area. However, under exclusion schemes, like node coloring or CSMA, modeling simultaneous transmitters as PPP leads to an inaccurate representation of interference distribution. On the other hand, the correlation between the location of simultaneous transmitters makes it extremely difficult to develop a tractable analytical model and derive the closed-form expression for the probability distribution of interference. Some of the proposed approaches are as follows. [10] (Chapter 18) used a Matérn point process for CSMA based schemes whereas [11] proposed to use Simple Sequential Inhibition (SSI) or an extension of SSI called SSI k point process. In [12, 13] , interferers are modeled as PPP and outage probability is obtained by excluding or suppressing some of the interferers in the guard zone around a receiver. [14] analyzed transmission capacity in networks with general node distributions under a restrictive hypothesis that density of interferers is very low and, asymptotically, approaches zero. They derived bounds of high-SIR transmission capacity with ALOHA, using PPP, and CSMA using Matérn point process.. Other related works include the analysis of local (single-hop) throughput and capacity with slotted ALOHA in networks with random and deterministic node placement, and TDMA, in 1D linenetworks only [15] . [16] determined the optimum transmission range under the assumption that interferers are distributed according to PPP whereas [17] gave a detailed analysis on the optimal probability of transmission for ALOHA which optimizes the product of simultaneously successful transmissions per unit of space by the average range of each transmission. [18] develops an analytical model for analysis of saturation throughput of un-slotted CSMA with collision avoidance (CSMA/CA) in wireless networks. The numerical results of the analytical model are also verified using an event driven simulator. [19] uses queueing analysis to perform a comprehensive throughput and delay analysis of IEEE 802.11 MAC protocol.

O O O O B O B I O O O O O O O O O O O O O O O O O O O O B O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B O O O O O O O O O B I O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O B O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I B O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O B I O B O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O B O O O O O O O O B O B I O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O B I O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O B I O O O B O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O B O O O O O O O O O O O O O B O B O B I O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O B O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B O


Some Approaches to a Conjecture on Short Cycles in Digraphs We consider the following special case of a conjecture due to Caccetta and Haggkvist: Let D be a digraph on n vertices that all have in-degree and out-degree at least n/3. Then, D contains a directed cycle of length 2 or 3. We discuss several necessary conditions for possible counterexamples to this conjecture, in terms of cycle structure, diameter, maximum degree, clique number, toughness, and local structure. These conditions have not enabled us to prove or refute the conjecture, but they lead to proofs of special instances of the conjecture.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Algorithms for data migration with cloning Our work is motivated by the problem of managing data on storage devices, typically a set of disks. Such high demand storage servers are used as web servers, or multimedia servers for handling high demand for data. As the system is running, it needs to dynamically respond to changes in demand for different data items. In this work we study the data migration problem, which arises when we need to quickly change one storage configuration into another. We show that this problem is NP-hard. In addition, we develop polynomial-time approximation algorithms for this problem and prove a worst case bound of 9.5 on the approximation factor achieved by our algorithm. We also compare the algorithm to several heuristics for this problem. To handle high demand, especially for multimedia data, a common approach is to replicate data objects within the storage system. Typically, a large storage server consists of several disks connected using a dedicated network, called a Storage Area Network. Disks typically have constraints on storage as well as the number of clients that can access data from a single disk simultaneously. With the recent interest in autonomic computing 1 , a relevant goal is to have the system automatically respond to changes in demand patterns and to recompute data layouts.. Approximation algorithms have been developed [23, 24, 9, 16] to map known demand for data to a specific data layout pattern to maximize utilization 2 . In the layout, we compute not only how many copies of each item we need, but also a layout pattern that specifies the precise subset of items on each disk. The problem is NP -hard, but there are polynomial-time approximation schemes [9, 24, 16] . Given the relative demand for data, the algorithm computes an almost optimal layout.. Over time as the demand for data changes, the system needs to create new data layouts. The problem we are interested in is the problem of computing a data migration plan for the set of disks to convert an initial layout to a target layout. We assume that data objects have the same size (these could be data blocks, or files) and that it takes the same amount of time to migrate any data item from one disk to another disk. The crucial constraint is that each disk can participate in the transfer of only one item -either as a sender or as a receiver. Our goal is to find a migration schedule to minimize the time taken to complete the migration (makespan).. A special case of this was studied by Hall et al. [10] -they compute a movement schedule, but this does not allow the creation of new copies of any data object. It addresses only the data movement problem. (So for example, one cannot create extra copies of any data item, but can just change which disks they are stored on.) The problem they studied is formally defined as follows: given a set of disks, with each storing a subset of items and a specified set of move operations (each move operation specifies which data object needs to be moved from one disk to another), how do we schedule these move operations? If there are no storage constraints, then this is exactly the problem of edge-coloring the following multi-graph. Create a graph that has a node corresponding to each disk, and a directed edge corresponding to each move operation that is specified. Algorithms for edge-coloring multigraphs can now be applied to produce a migration schedule since each color class represents a matching in the graph that can be scheduled simultaneously. Computing a solution with the minimum number of rounds is NP-hard, but several good approximation algorithms are available for edge coloring. With space constraints on the disk, the problem becomes challenging. Hall et al. [10] showed that with the assumption that each disk has one spare unit of storage, very good constant factor approximations can be developed. The algorithms use at most 4 ∆/4 colors with at most n/3 bypass nodes, or at most 6 ∆/4 colors without bypass nodes 3 . On the other hand, to handle high demand for popular objects, new copies will have to be dynamically created and stored on different disks. This means that we crucially need the ability to have a "copy" operation in addition to "move" operations. In fact, one of the crucial lower bounds used in the work on data migration [10] is based on a degree property of the multi-graph. For example, if the degree of a node is ∆, then this is a lower bound on the number of rounds that are required, since in each round at most one transfer operation involving this node may be done. For copying operations, clearly this lower bound is not valid. For example, suppose we have a single copy of a data item on a disk. Suppose we wish to create ∆ copies of this data item on ∆ distinct disks. Using the transfer graph approach, we could specify a "copy" operation from the source disk to each of the ∆ disks. Notice that this would take at least ∆ rounds. However, by using newly created copies as additional sources we can create ∆ copies in log(∆ + 1) rounds, as in the classic problem of broadcasting by using newly created copies as sources for the data object. (Essentially each copy spawns a new copy in each round.). The most general problem of interest is the data migration problem with cloning when data item i resides in a specified (source) subset Si of disks, and needs to be moved to a (destination) subset Di. In other words, each data item that initially belongs to a subset of disks, needs to be moved to another subset of disks. (We might need to create new copies of this data item and store it on an additional set of disks.) See Figure 1 for an example. If each disk had exactly one data item, and needs to copy this data item to every other disk, then it is exactly the problem of gossiping. We show that this problem is NP-hard by reduction from edge coloring and develop a polynomial-time 9.5-approximation algorithm for it. The algorithm has been implemented by Svetlana Shargorodskaya [26] and we are comparing its performance to several other heuristics for the problem. For all our algorithms, we move data only to disks that need the data. Thus we use no bypass nodes. The total number of data transfers performed is thus the minimum possible.. Different communication models can be considered based on how the disks are connected. We use the same model as in the work by Hall et al. [10, 1] where the disks may communicate on any matching; in other words, the underlying communication graph allows for communication between any pair of devices via a matching (a switched storage network with unbounded backplane bandwidth). Later we will also discuss a restricted model where the devices may communicate on a matching, but the size of the matching is constrained (we call this the bounded-matching model).. One interesting generalization would be for the situation when clusters of disks are connected in a wide area network.. The time required to transfer one unit of data between a pair of disks in different clusters may be an order of magnitude higher than the time required to transfer data between a pair of disks in the same cluster. We can model this by a communication graph model where the number of rounds required to transfer one unit of data between a pair of disks in different clusters is a certain number of rounds, and one round is required to transfer one unit of data between a pair of disks in the same cluster. The paper by Liben-Nowell [20] considers a problem very similar to multi-source multicast which is exactly the data migration problem with restrictions that each disk contains at most one source item and each item has at most one source. However, the model that he uses is different than the one that we use. In his model, in each telephone call, a pair of users can exchange all the items of gossip that they know. The objective is to simply minimize the total number of phone calls required to convey item i of gossip to set Di of users. In our case, since each item of gossip is a data item that might take considerable time to transfer between two disks, we cannot assume that an arbitrary number of data items can be exchanged in a single round. Several other papers use the same telephone call model [2, 6, 11, 15, 28] .. Other related problems that have been studied are the set-to-set gossiping problem [19, 22] where we are given two possibly intersecting sets A and B of gossipers and the goal is to minimize the number of calls required to inform all gossipers in A of all the gossip known to members in B. Liben-Nowell [20] generalizes this work by defining for each gossiper i the set of relevant gossip that they need to learn. This is just like our multi-source multicast problem when the number of items is equal to the number of disks, except that the communication model is different, as well as the objective function.. We have also studied several special cases of the data migration problem with cloning, where each data item has only one copy initially, and developed algorithms with better performance guarantees [17] . One special case we studied is the Multi-source multicast problem, when ∆ data items, each having only one copy, are stored in ∆ different disks, and data item i needs to be sent to a specified subset Di of disks. We showed this problem is NP-hard by a reduction from a restricted version of 3SAT, and gave a polynomial-time algorithm with approximation ratio of 4 using a simplified version of the algorithm developed in this paper. Allowing bypass nodes, we improved the approximation ratio to 3. Another special case is the Multi-source broadcast problem, which is the same as the Multi-source multicast problem except that all disks demand all items, i.e., Di is all the disks minus its source. We developed a polynomial-time algorithm using at most 3 more rounds that the optimal. The last special case we studied is the Single-source multicast problem, when ∆ data items, each having only one copy, are all stored on the same disk, and data item i needs to be sent to a specified subset Di of disks. We developed a polynomial-time algorithm using at most ∆ more rounds that the optimal.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


A generalized bi-criteria fuzzy integer flow sharing problem The flow sharing problem is a class of techniques that can be used to find the optimal flow in a capacitated network, which realizes an equitable distribution of flows. This paper extends the integer flow sharing problem by considering fuzzy capacities and fuzzy weights such that the flux received at each sink node and the flow value through each arc are restricted to be multiples of some block unit. Fuzzy capacity describes the flexibility of the upper limit of flow value through each arc. Fuzzy weight represents the degree of satisfaction of the flux to a sink node. Our model has the two following criteria: to maximize the minimal degree of satisfaction among all of the fuzzy capacity constraints and to maximize the minimal degree of satisfaction among the fluxes to all of the sink nodes. Because an optimal flow pattern that simultaneously maximizes the two objectives is usually not feasible, we define non-domination in this setting and propose a pseudo-polynomial algorithm that finds some non-dominated flow patterns. Finally, a numerical example is presented to demonstrate how our algorithm works. The network flow problem, which is an important problem in combinatorial optimization, has a wide range of applications in different areas, such as transportation, telecommunication, agriculture, finance, marketing and warehousing. In a standard setting, the data are fixed and certain. However, in many actual problems, some parameters (e.g., costs, capacities, supplies and demands) may be imprecise. Impreciseness can be captured by applying fuzzy quantities. Kim and Roush [1] developed fuzzy flow theory and presented the conditions to obtain an optimal flow by means of definitions on fuzzy matrices. Ignizio and Daniels [2] considered a fuzzy multicriteria integer programming via fuzzy generalized networks. With respect to the crisp capacitated network, Khang and Fujiwara [3] proposed some approximate methods to solve capacitated fixed-charge network problems, and Zhou et al. [4] studied a flow distribution optimization problem for a capacitated logistics network based on concave costs with the objective of minimizing the total logistics costs of the network. Furthermore, some maximum flow problems on fuzzy capacitated networks have been considered [5] [6] [7] . Chanas and Kolodziejczyk [5] considered a fuzzy version of the maximum integer flow problem by introducing the notion of fuzzy one-sided (upper) capacity constraints; they derived an efficient algorithm for this problem by showing that the max-flow min-cut theorem also holds in this case. Furthermore, they extended this model to the real-valued flow case with one-sided and two-sided capacity constraints [6] ; they also extended the integer flow case with two-sided capacity constraints [7] . Recently, Takahashi [8] proposed a new algorithm based on the work of [6] ; this algorithm also uses the technique of minimum cuts. Hernandes et al. [9] proposed an algorithm for the fuzzy maximum flow problem based on the classical Ford-Fulkerson algorithm, which uses the technique of incremental graphs. Ghatee and Hashemi [10] presented three models of the fuzzy minimum-cost flow problem (MCFP) that utilize a total order and nominal flows: MCFP with fuzzy costs, MCFP with fuzzy supply-demand and a combination of the two cases. Furthermore, they investigated a fully fuzzified MCFP by considering a large variety of ranking functions by fuzzy costs, capacities, supplies and demands [11] .. In this paper, we address a generalized bi-criteria fuzzy integer flow sharing problem, which is a different type of network flow problem. The flow sharing problem, which was first studied by Brown [12] , is a class of techniques that can be used to find the optimal flow in a capacitated network, which realizes an equitable distribution of flows. An equitable distribution is defined in terms of the weights assigned to the sink nodes, which represent the relative importance. To formulate the problem, Brown [12] introduced a tradeoff function defined as the quotient of the flux to the weight of a sink node and addressed a flow sharing problem with the objective of maximizing the smallest value among all of the tradeoff values.. In the classical formulation of the flow sharing problem, Brown [12] assumed that the weights assume constant and precise values. However, in real situations, these values may not be known exactly, and it may, therefore, be more suitable to specify them in an imprecise manner. For instance, a sink node may be satisfied with a share that is less than the precise optimal value because the requirements of sink nodes are usually stated in a fuzzy manner, and accordingly, a single value of each weight may not fit the corresponding requirement. To address this issue, Tada et al. [13] introduced fuzzy weights and considered a fuzzy flow sharing problem. In some situations, the equitable distribution should be computed under the constraint that the flux received at each sink node is a multiple of some block unit. Associated with this constraint, the authors [13] considered a generalized fuzzy flow sharing problem. Creating another model involving fuzzy weights, Itoh and Ishii [14] addressed a fuzzy flow sharing problem using a possibility measure, with the aim of maximizing the minimal possibility of the fuzzy goal among all of the sink nodes. To deal with the case in which some violation of the capacity constraints of the distribution network arcs is acceptable in a certain range, Ishii and Itoh [15] considered a fuzzy integer flow sharing problem with fuzzy capacity constraints.. The motivation for our generalized bi-criteria fuzzy integer flow sharing problem is provided by the following kind of example. After a disaster, we need to determine an equitable distribution of the limited food resources among the shelters. The weight associated with each shelter is the number of victims in that shelter. The information about the number of victims in each shelter is vague because of the emergency; therefore, fuzzy weights should be considered for each shelter. Additionally, violation of the capacity constraints of the distribution system is acceptable in a certain range during this particular situation. The quantities in the distribution system are multiples of some block unit. To our knowledge, this general problem has not been solved until now. To deal with this general case, we need to determine a distribution method that ensures the "largest possible degree of satisfaction of the demander"and that simultaneously satisfies the capacity constraints in the best possible way. Based on this, we consider a generalized integer flow sharing problem with fuzzy capacities and fuzzy weights such that the flux received at each sink node and the flow value through each arc are restricted to be multiples of some block unit.. The rest of this paper is organized as follows. First, a review of related works is presented in Section 2. Our problem is then formulated in Sections 3, and 4, we present a pseudo-polynomial algorithm for our problem. Section 5 shows how our algorithm works using a numerical example. Finally, Section 6 concludes this paper and discusses further research problems. In this paper, we have investigated a generalized bi-criteria integer flow sharing problem with fuzzy capacities and fuzzy weights such that the flux received at each sink node and the flow value through each arc are restricted to be multiples of some block unit. Further, we have proposed a pseudo-polynomial algorithm that finds some non-dominated flow patterns of our problem and illustrated it using a numerical example. Although our algorithm is not fully efficient, the nature of the algorithm differs from that of other optimization techniques. As a future research problem, we will evaluate other optimization techniques and use some of them to improve our algorithm.. There are many possible extensions of this work. First, we could consider the more general case in which the flow value is restricted to be a multiple of some block unit specific to each arc. Another interesting problem is to extend it by introducing a fuzzy goal possibility measure for each sink node. Additionally, the min-max type objective should be considered and solved.

O O O O O B I O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O B I O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Arbology: trees and pushdown automata Trees are (data) structures used in many areas of human activity. Tree as the formal notion has been introduced in the theory of graphs. Nevertheless, trees have been used a long time before the foundation of the graph theory. An example is the notion of a genealogical tree. The area of family relationships was an origin of some terminology in the area of the tree theory (parent, child, sibling, ...) in addition to the terms originating from the area of the dendrology (root, branch, leaf, ...). Trees are (data) structures used in many areas of human activity. Tree as the formal notion has been introduced in the theory of graphs. Nevertheless, trees have been used a long time before the foundation of the graph theory. An example is the notion of a genealogical tree. The area of family relationships was an origin of some terminology in the area of the tree theory (parent, child, sibling, . . .) in addition to the terms originating from the area of the dendrology (root, branch, leaf, . . .).. There are many applications of trees not only in the area of Computer Science. It seems that the reason for this is the ability of trees to express a hierarchical structure. The reader can find many applications of trees in his own area of interest.. Many algorithms were developed for operations on trees used in many applications. A number of them uses some way of traversing the tree. Such operations need a data structure to keep track on the possible continuation of the traversing. In many cases we can identify that the suitable data structure for this role is a pushdown store. The typical structure of these algorithms is based on the set of recursive procedures, where the pushdown store is used for saving return addresses.. Theory of tree automata has been developed as a tool for description of sets of trees (tree languages) and, moreover, for formal description of some operations with trees. Models of computation of this theory are various kinds of tree automata. The most researched kind of tree automata are finite tree automata, which recognize regular tree languages and their implementation is based on recursive procedures.. Some algorithms for operations on trees assume a linear notation (for example prefix, suffix, or Euler notations) of the input tree. We note that the linear notation can be obtained by the corresponding recursive traversing of the tree. It can be shown that the linear notation of a tree can be generated by a contextfree grammar. Therefore, the pushdown automaton can be an appropriate model for algorithms processing linear notations of trees.. In [9] it is proved that the class of regular tree languages in postfix notation is a proper subclass of deterministic context-free string languages. Given a finite tree automaton it is proved that an equivalent LR(0) grammar can be constructed, which means that also an equivalent deterministic pushdown automaton can be constructed. Moreover, it is proved that deterministic pushdown automata are more powerful than finite tree automata: the class of tree languages whose linear notation can be accepted by deterministic pushdown automata is a proper superclass of regular tree languages.. These ways of reasoning led us to the decision to use pushdown automata and the corresponding underlying theory as a model of computation of tree processing algorithms. We call this branch of algorithmic study arbology [3] from the Spanish word arbol, meaning tree. The model and inspiration for building arbology can be found in stringology, which is an algorithmic discipline in the area of string processing. Stringology uses finite automata theory as a very useful tool. In arbology we try to apply the stringology principles to trees so that effective tree algorithms using pushdown automata would be created.. There are some differences between finite and pushdown automata theories. For every nondeterministic finite automaton there exists an equivalent deterministic finite automaton which can be constructed using well known algorithm. This does not hold generally for the case of pushdown automata -for some nondeterministic pushdown automata their equivalent deterministic versions do not exist. Examples of such pushdown automata are pushdown automata accepting palindromes of the form like ww R . The reason is that an automaton reading the palindrome from left to right is not able to find the centre of it. Generally, it is not known how to decide for a given nondeterministic pushdown automaton whether there exists a deterministic equivalent or not. Nevertheless, we have identified three classes of pushdown automata for which such a determinisation is possible. These classes are called input-driven, visible [2] and heigth-deterministic pushdown automata [14] .. Without regard to the above-mentioned problems some results have been achieved and are presented in the subsequent sections in brief. Section 2 contains basic definitions. Section 3 deals with linear notations of trees and some important properties of these notations are discussed in Section 4. Section 5 deals with determinisation of pushdown automata. Section 6 presents exact subtree matching. A complete index of subtrees and tree templates in the form of subtree and tree pattern pushdown automata is presented in Section 7. An application of these pushdown automata is shown in Section 8 where the way how to find repeats of subtrees is shown.

B B O B I B O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O B O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O B I O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O B I O O O O O O O O O O B I O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O B I O O O O O O O O O O O O O O O O


Simulation-Verification: Biting at the State Explosion Problem AbstractÐSimulation and verification are the two conventional techniques for the analysis of specifications of real-time systems. While simulation is relatively inexpensive in terms of execution time, it only validates the behavior of a system for one particular computation path. On the other hand, verification provides guarantees over the entire set of computation paths of a system, but is, in general, very expensive due to the state-space explosion problem. In this paper, we introduce a new technique: Simulation-verification combines the best of both worlds by synthesizing an intermediate analysis method. This method uses simulation to limit the generation of a computation graph to that set of computations consistent with the simulation. This limited computation graph, called a simulationverification graph, can be one or more orders of magnitude smaller than the full computation graph. A tool, XSVT, is described which implements simulation-verification graphs. Three paradigms for using the new technique are proposed. The paper illustrates the application of the proposed technique via an example of a robot controller for a manufacturing assembly line. S IMULATION and verification are two conventional techniques for analysis of specifications of real-time systems. While simulation is relatively inexpensive in terms of execution time, it only validates the behavior of a system for one particular computation path. On the other hand, verification provides guarantees over the entire set of computation paths of a system, but is, in general, very expensive due to the state space explosion problem. These two techniques, then can be viewed as opposite ends of a continuum, trading guarantees for cost in moving from verification to simulation. In this sense, there may be techniques which lie between the two which provide more guarantees than simulation, but at lower cost than verification. In this paper, we introduce a new technique: Simulation-verification combines the best of both worlds by synthesizing an intermediate analysis method.. Simulation-verification is a technique that combines simulation with verification and can be used as a basis for new paradigms for the development of correct specifications. This paper presents several techniques for using simulation-verification. Simulation-verification can be used as an aid to specification understanding by allowing a user or designer to navigate through behaviors of a specification. Simulation-verification can also be used to verify properties which can be cast in CTL-like forms such as:. i pth e property frontierX (This property states that there is some computation that follows path until some point where all computations agree with property until frontier is satisfied.) This can be particularly valuable if full verification is impractical due to state-space explosion, and path can be used to restrict the portion of the computation graph being generated. Simulation-verification has been developed in the context of the Modechart [24] specification language and uses simulation to limit generation of a simulation-verification graph to that set of computations starting with the simulation path. It has been implemented by augmenting the existing specification and analysis tools of the MT toolset for Modechart.. Modechart is a graphical specification language and represents a system as a collection of modes, representing the state of the system, and transitions, representing the control flow of the system. The MT toolset for Modechart consists of a user interface tool, a simulator, and a modelchecking-based verification tool which represents all of the behaviors of a modechart specification by a computation graph. The approach taken by the simulation-verification technique is to use the simulator to generate a prefix of a computation of a specification and, then use the verifier to extend the prefix into a fragment of a computation graph with a fixed frontier. This combination of techniques uses simulation to narrow the focus of the verification effort to a subset of the computations of the specification, while using verification to examine all of the possible behaviors that could follow. Fixing a frontier limiting the generation of the resulting computation graph fragment further reduces the cost of the technique by limiting the generated fragment to that portion that is of interest in the context of the particular computation prefix.. The remainder of this paper will present this technique in more detail. Section 2 provides an overview of the Modechart language and introduces an example that will be used to illustrate the simulation-verification approach. Section 3 provides the details of the technique, while Section 4 introduces the XSVT tool which implements the technique as part of the MT toolset. Section 5 provides several contexts in which simulation-verification might be used. The applications of this technique are illustrated via a robot controller for a manufacturing assembly line. Section 6 describes related work, while Section 7 indicates some areas of current and future work. This paper has introduced a new analysis technique for specifications of real-time systems, simulation-verification, that combines the advantages of simulation and verification. Simulation-verification synthesizes simulation and verification by using simulation to generate a computation prefix, which is used to restrict the scope of verification to those computations which agree with the prefix. While simulation is relatively inexpensive in terms of execution time, it only validates system behavior for a single computation prefix. In contrast, full verification can be prohibitively expensive since the state-space explosion problem is exponential. This approach provides an intuitive way to verify a meaningful subset of the computation space with the potential to achieve dramatic savings in computation time. However, the drawback is that since only a portion of the state space is examined, a property may not hold for an implementation of the specification.. A tool, XSVT, for generating and querying simulationverification graphs has also been introduced, as well as three paradigms for the use of the technique. Several examples demonstrating reductions of several orders of magnitude in computation time have been presented.. The current version of XSVT only allows information to be passed from the simulator to the verifier. A session using the XSVT, thus, consists of using simulation to generate a computation prefix, building and examining the corresponding simulation-verification graph and, then using the simulator to produce a new prefix, or perhaps building a simulation-verification graph for a different termination condition. It would also be desirable to use the simulationverification graph as a means to select the next simulation. Given a particular simulation-verification graph, the user could then select a particular path in the computation graph fragment of the simulation-verification graph to extend the computation prefix and use that extended prefix as the starting point for future simulation. This type of directed simulation could prove particularly useful in the scenariooriented design paradigm for using simulation-verification. At present, this technique is allowed by the toolset, through the simulator's interactive transition selection facility, but must be done by hand. Future versions of XSVT will mechanize this process. Other current and future work on improving the simulation-verification technique includes implementing alternate query semantics, developing a suitable interface to allow the user to select from among the available semantics at query time, and evaluation of the merits and utility of the various different query semantics, as discussed in Section 3. At this point, it is possible to make a few more observations on the position of the methods and tools presented in this paper in comparison to other approaches in the literature. The last few years have seen considerable progress in the development of formal methods for representing and reasoning about time-critical systems. Two principal types of languages, automata-theoretic and process-algebraic, have been developed for describing systems and their behavior. Each of these two types of languages have augmented existing models of untimed systems with temporal constructs to capture the timing behavior of systems. Some representative examples of automata-theoretic languages for real-time systems are those of [1] , [2] , [14] , [26] , [27] , [29] , [31] . Some representative examples of process-algebraic languages for real-time systems are those of [16] , [28] , [35] . Also, several researchers [25] , [32] , have devised dual language approaches. Such an approach provides a frontend language, sometimes graphical, that is intuitive and easily understood by developers. Specifications written in the front-end language are translated to another language (usually state-machine-based) that is more amenable to formal analysis. The approach described in this paper is a dual language approach. Considerable progress has also been made in the past few years in the development of formal methods for verifying real-time system correctness. In model checking methods, all of the reachable system states (i.e., those that can arise in an execution) are checked for violations of specified safety properties. Since real-time systems typically have infinite states, clever ways of aggregating state information are needed to enable exploration of all possible execution paths. Extension of model checking methods to real-time systems have been proposed in [2] , [19] , [22] , [32] , [37] , including a report on an earlier version of the verification method employed in the Modechart Toolset [25] . More recently, model checking has been extended to hybrid systems that are modeled as linear hybrid automata [3] .. Even using BDD-based techniques, all such techniques must eventually confront the state-explosion problem. Simulation-verification provides an additional mechanism for mitigating this problem. In [21] , a parallel approach to the idea of simulation-verification is taken which focuses on simulation as the heart of the technique rather than verification. Rather than using simulation to restrict verification, verification is used to expand simulation, so that rather than building a simulation-verification graph, a tableau-simulation is performed, in which the idea of a computation graph is used to represent a family of simulations of a modechart as a graph. The advantage of the tableau-simulation approach is that it is more closely related to simulation and allows easier migration to simulation. The disadvantage is that it is more expensive to expand a simulation than reduce a computation graph.. Proof methods based on process algebras rely on descriptions of systems and requirements as algebraic expressions. The proof method relies heavily on algebraic identities to prove equivalence between algebraic expressions. Development of mechanical proof methods for for process algebras is still preliminary. In order to evaluate the effectiveness of these reasoning techniques, prototype tools have been developed, such as those in [7] , [8] .. While we have seen considerable progress in the development of formal specification and analysis methods for real-time computing, wide-spread application of these methods is unlikely without appropriate software tools. A recent independent study of 12 cases in which formal methods were applied to the construction of industrial systems concluded that, ªwhile still immature in certain respects, [formal methods] are beginning to be used seriously and successfully by industry to design and develop computer or computerized systemsº [11] , [12] . 1 The same study also pointed out the lack of robust tools for formal methods and, in particular, support for specification and analysis of timing requirements.. The SMV symbolic model checker supports the automated verification of real-time systems modeled as labeled state-transition graphs, where each path corresponds to an execution trace of the system. A state-transition graph is represented internally using binary decision diagrams (BDDs), which generally provide a more compact representation of the system behavior. The SMV symbolic model checker has been shown to handle very large state-spaces efficiently. In a recent work [6] , algorithms for computing quantitative information about finite-state real-time system have been incorporated into the SMV model checker. HyTech is another symbolic model checker intended for automatic verification of hybrid systems. In this approach, systems are modeled as linear hybrid automata [3] , machines with finite control and real-valued variables modeling continuous environment parameters. System properties specified in a real-time temporal logic are verified by symbolic computation. A recent report [20] describes a more portable implementation of HyTech which is shown to be significantly more efficient than the initial prototype implementation.. As mentioned earlier, proof methods based on process algebras rely on descriptions of systems and requirements in a process algebraic language. The Concurrency Workbench [8] is an automatic verification tool for finite-state processes specified in Temporal CCS. A recent case study [13] illustrated how the Modechart specification of a distributed real-time system for active structural control can be translated to Temporal CCS and then verified using the Concurrency Workbench. VERSA [7] is another prototype toolkit which has been developed to support reasoning about real-time systems modeled as ACSR processes. 2 It is intended to provide support for checking syntax and carrying out analysis automatically. In particular, the VERSA toolkit has three major functions: rewriting, equivalence testing, and interactive execution. To facilitate the use of ACSR by novice programmers, the graphical specification language GCSR [4] , with semantics defined in ACSR, has been developed and has been incorporated into the VERSA toolkit.. Interactive proof-developing approaches, such as those supported by HOL [18] , Isabelle [34] , PVS [33] , and the Boyer-Moore theorem-prover [5] are noteworthy since, like the approach described here, they involve user participation. Often, when developing a proof, the users of these tools exploit knowledge of the domain and of the specification to focus their efforts to a case that can be generalized to prove a property for the entire specification or to narrow attention to behavior where a counter example is likely. This is similar to the way a user of the simulationverification approach might approach the problem of deciding what portion of the state-space to examine.

O O O O O O O O O B O O O O O O O O O O O B I O B O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O B I O B O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B O O O O O O O O O O O O O O O O O B O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B O O O B O O O O O O O O O O O O O O O B O O O O O O O O O B O O O O O O O O B B O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B O O O O O O O O O B O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O B O B O O B O B O O B O O O O O O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O B O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O B O O B B O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O B O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O B O O O O O O O O O O O O O B O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O