Hierarchy and equivalence of multi-letter quantum finite automata Multi-letter quantum finite automata (QFAs) were a new one-way QFA model proposed recently by Belovs, Rosmanis, and Smotrovs (LNCS, Vol. 4588, Springer, Berlin, 2007, pp. 60-71), and they showed that multi-letter QFAs can accept with no error some regular languages ((a + b) * b) that are unacceptable by the one-way QFAs. In this paper, we continue to study multi-letter QFAs. We mainly focus on two issues: (1) we show that (k + 1)-letter QFAs are computationally more powerful than k-letter QFAs, that is, (k + 1)-letter QFAs can accept some regular languages that are unacceptable by any k-letter QFA. A comparison with the one-way QFAs is made by some examples; (2) we prove that a k 1 -letter QFA A 1 and another k 2 -letter QFA A 2 are equivalent if and only if they are (n 1 + n 2 ) 4 + k − 1-equivalent, and the time complexity of determining the equivalence of two multi-letter QFAs using this method is O(n 12 + k 2 n 4 + kn 8 ), where n 1 and n 2 are the numbers of states of A 1 and A 2 , respectively, and k = max(k 1 , k 2 ). Some other issues are addressed for further consideration. namely, multi-letter QFAs, that can be thought of as a quantum counterpart of more restricted classical one-way multi-head finite automata (see, for example, [20] ). Roughly speaking, a k-letter QFA is not limited to seeing only one, the just-incoming input letter, but can see several earlier received letters as well. That is, the quantum state transition which the automaton performs at each step depends on the last k letters received. For the other computing principle, it is similar to the usual MO-1QFAs as described above. Indeed, when k = 1, it reduces to an MO-1QFA. Any given k-letter QFA can be simulated by some k + 1-letter QFA. However, we will prove that the contrary does not hold. Belovs et al. [6] have already showed that (a + b) * b can be accepted by a 2-letter QFA but, as proved in [24] , it cannot be accepted by any MM-1QFA with bounded error. By L(QF A k ) we denote the class of languages accepted with bounded error by k-letter QFAs. In this paper, we will prove that L(QF A k ) ⊂ L(QF A k+1 ) for k = 1, 2, ..., where the inclusion ⊂ is proper. Therefore, (k + 1)-letter QFAs are computationally more powerful than k-letter QFAs.. As we know, determining the equivalence for computing models is a very important issue in the theory of classical computation (see, e.g., [28, 34, 32, 9, 22, 21] ). Concerning the problem of determining the equivalence for QFAs, there exists some work [5] that deals with the simplest case-MO-1QFAs. For quantum sequential machines (QSMs), Qiu [29] gave a negative outcome for determining the equivalence of QSMs, and then Li and Qiu [25] further gave a method for determining whether or not any two given QSMs are equivalent. This method applies to determining the equivalence between any two MO-1QFAs and also is different from the previous ones. For the equivalence problem of MM-1QFAs, inspired by the work of [35] and [4] , Li and Qiu [26] presented a polynomial-time algorithm for determining whether or not any two given MM-1QFAs are equivalent.. In this paper, we will give a polynomial-time algorithm for determining whether or not any two given k 1 -letter QFA A 1 and k 2 -letter QFA A 2 for accepting unary languages are equivalent. More specifically, we prove that two multi-letter QFAs A 1 and A 2 , are equivalent if and only if they are (n 1 + n 2 ) 4 + k − 1-equivalent, where n 1 and n 2 are the numbers of states of A 1 and A 2 , respectively, k = max(k 1 , k 2 ), and two multi-letter QFAs over the same input alphabet Σ are n-equivalent if and only if the accepting probabilities of A 1 and A 2 are equal for the input strings of length not more than n. This method, generalized appropriately, may apply to dealing with more general cases.. The remainder of the paper is organized as follows. In Section 2, we recall the definition of multi-letter QFAs and other related definitions, and some related results are reviewed. In Section 3, we prove that L(QF A k ) ⊂ L(QF A k+1 ) for k = 1, 2, ..., where the inclusion ⊂ is proper. More precisely, we show that, for k ≥ 2, regular language (a 1 + a 2 + . . . + a k ) * a 1 a 2 · · · a k−1 cannot be accepted with bounded error by (k − 1)-letter QFAs but can be exactly accepted by some k-letter QFAs. In addition, we present a number of examples to show the relation between multi-letter QFAs and the usual one-way QFAs.. In Section 4, we concentrate on the equivalence issue. After proving some useful lemmas, we prove that a k 1 -letter QFA A 1 and another k 2 -letter QFA A 2 for accepting unary languages are equivalent if and only if they are (n 1 + n 2 ) 4 + k − 1-equivalent, and the time complexity of determining the equivalence of two multi-letter DFAs using this method is O(n 12 +k 2 n 4 +kn 8 ), where n = n 1 + n 2 , n 1 and n 2 are the numbers of states of A 1 and A 2 , respectively, and k = max(k 1 , k 2 ). Finally, in Section 5 we address some related issues for further consideration.. In general, symbols will be explained when they first appear. In this paper, we have considered several issues concerning multi-letter QFAs. Our technical contributions mainly contain the following two aspects: (1) we have shown that (k + 1)-letter QFAs are strictly more powerful than k-letter QFAs, that is, (k + 1)-letter QFAs can accept some regular languages unacceptable by any k-letter QFA, and some examples of regular languages unacceptable by multi-letter QFAs have been provided. We have known that multi-letter QFAs are strictly more powerful than MO-1QFAs [27] , but they are not comparable to MM-1QFAs [24, 1] since the language a * b * can be accepted with bounded error by MM-1QFAs but cannot be accepted by multi-letter QFAs, and the language (a + b) * b shows the opposite direction. Moreover, a * b(a 2 ) * a cannot be accepted by MM-1QFAs and by multi-letter QFAs with bounded error. (2) We have proved that a k 1 -letter QFA A 1 and another k 2 -letter QFA A 2 for accepting unary languages are equivalent if and only if they are (n 1 + n 2 ) 4 + k − 1-equivalent, and the time complexity of this computing method is O(n 12 + k 2 n 4 + kn 8 ), where n = n 1 + n 2 , n 1 and n 2 are the numbers of states of A 1 and A 2 , respectively, and k = max(k 1 , k 2 ).. The method presented in the paper may be generalized to deal with more general cases. Another issue worthy of consideration is concerning the state complexity of multi-letter QFAs compared with the usual 1QFAs for accepting some languages (for example, unary regular languages [37, 32] ). Also, the power of measure-many multi-letter QFAs, as the relation between MM-1QFAs and MO-1QFAs, is worth being clarified. Whether or not measuremany multi-letter QFAs can recognize non-regular languages may also be considered in the future.

B O B O O B I I O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


A generic library of problem solving methods for scheduling applications In this paper we describe a generic library of problemsolving methods (PSMs) for scheduling applications. Although, some attempts have been made in the past at developing libraries of scheduling methods, these only provide limited coverage: in some cases they are specific to a particular scheduling domain; in other cases they simply implement a particular scheduling technique; in other cases they fail to provide the required degree of depth and precision. Our library is based on a structured approach, whereby we first develop a scheduling task ontology, and then construct a task-specific but domain independent model of scheduling problem-solving, which generalises from specific approaches to scheduling problem-solving. Different PSMs are then constructed uniformly by specialising the generic model of scheduling problem-solving. Our library has been evaluated on a number of real-life and benchmark applications to demonstrate its generic and comprehensive nature. Scheduling is a hard problem both in theory and in practice. As a first approximation, we can say that scheduling deals with the assignment of jobs and activities to resources within a specific time window. Theoretical approaches to scheduling strive to search for an optimal solution; however, these approaches suffer from combinatorial complexity that can be proved NP-hard [5] . The complex nature of the scheduling task has attracted attention from researchers in artificial intelligence for many years and several intelligent scheduling systems were developed in the 80s and 90s [13] . However, these systems tend to be domain specific and not easily reusable across scheduling domains.. In this paper we describe a comprehensive library of problem-solving components for scheduling, which aims both at providing practical, engineering support to build scheduling applications, as well as a principled framework to analyse and compare alternative approaches to scheduling. This work is based on the knowledge modelling paradigm [10] [17] that moves away from implementation-level analysis of knowledge-based systems (e.g., forward-chaining vs. backward-chaining behaviours of rule-based systems) to focus on the knowledge embodied by a performance system (e.g., how a diagnostic system discriminates between hypotheses on the basis of clinical tests). In parallel with this attention to knowledge-level reasoning, knowledge modelling has traditionally focused on generic knowledge components [1] [3] [10] [17] , in an attempt to provide a more robust basis to the analysis and engineering of knowledgebased systems. The generic reasoning methods defined by knowledge modelling researchers are often called ProblemSolving Methods (PSMs) [1] [10] . A PSM can be seen as the abstract reasoning process underlying a KBS, and can be used to provide model-based templates to direct the knowledge acquisition (KA) process [18] and to support robust and maintainable applications by reuse [9] [10]. PSMs are usually categorised into the following two types: taskspecific PSMs, which tackle specific classes of generic tasks like diagnosis, design, parametric design, etc. [1] [3] [10] ; and task-independent PSMs, which do not subscribe to any particular task, but rather provide reasoning steps in terms of a generic paradigm, such as search [12] . The scheduling library proposed in this paper subscribes to the Task-Method-Domain-Application (TMDA) [10] knowledge modelling framework. This can be seen as a fourtier architecture, whereby we first formalise the scheduling task by means of the appropriate task ontology, and then we develop a generic model of scheduling problem-solving (henceforth gen-model), by instantiating the search paradigm and in terms of the appropriate concepts in the task ontology. In total, seven knowledge-intensive PSMs were developed in our library by reusing the high-level tasks from gen-model. These are meant to cover all the validation activities carried Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. out during scheduling problem-solving, such as completion, constraint violation, requirement violation, and optimisation. Our library has been validated on a various real-life and benchmark applications to confirm its generic nature and its practical utility. The content of the paper is organised as follows. The next section describes the main components in the scheduling task ontology. Then in the subsequent two sections, we describe the construction of gen-model and various PSMs in our library. Then we describe an evaluation of our library in a particular application from space scheduling domain. Finally, we compare our work with existing approaches and re-iterate the main results from our research. In this paper we have proposed a generic library of PSMs for the scheduling task. It is based on the TMDA knowledge modelling framework and follows a top-down approach. Because our library has drawn from the various KBS technologies, like ontologies, PSMs, search, and KA, our organisation not only allows construction of different PSMs quickly, but also provides a way to compare and contrast their knowledge requirements. Our work is important for scheduling research both from theoretical and engineering perspectives. Theoretically, it exhibits a nice integration of the various techniques that have been developed in the scheduling research and also provides an insight into the various components which can be used in scheduling. From the engineering perspective, our library offers a support for the rapid construction of scheduling applications from different domains. Because our library provides a comprehensive repertoire of seven different PSMs, it allows us to cover and reason about all the validation areas that are crucial to the scheduling task, such as completion, constraint violation, requirement violation, and optimization. Finally, our library now has hundreds of reusable definitions, and it has been validated on a number of real-life and benchmark applications to confirm its generic nature.

O O O O O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O B O O O O O O O B O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O B O O O O O O O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Relative neighborhood graphs in three dimensions The relative neighborhood graph (RNG) of a set S of n points in II!d is a graph (S, E), where Let S be a set of n points in E%d. and Q c z + Cone(u, a) for some CY < 7r/6 (see Figure 1 ). The edges of RNG(P U Q) of the form (P, L') G P x Q will be referred to as cross ed~ges. A point q E Q is called a hi-chromatic closest neigh- Figure 2 ). Let PI (resp. p2) denote the ray emanating from p and passing through q (resp. s). II.

O O O O O O O O O B O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


A fine-grained arc-consistency algorithm for non-normalized constraint satisfaction problems Constraint programming is a powerful software technology for solving numerous real-life problems. Many of these problems can be modeled as Constraint Satisfaction Problems (CSPs) and solved using constraint programming techniques. However, solving a CSP is NP-complete so filtering techniques to reduce the search space are still necessary. Arcconsistency algorithms are widely used to prune the search space. The concept of arc-consistency is bidirectional, i.e., it must be ensured in both directions of the constraint (direct and inverse constraints). Two of the most well-known and frequently used arc-consistency algorithms for filtering CSPs are AC3 and AC4. These algorithms repeatedly carry out revisions and require support checks for identifying and deleting all unsupported values from the domains. Nevertheless, many revisions are ineffective, i.e., they cannot delete any value and consume a lot of checks and time. In this paper, we present AC4-OP, an optimized version of AC4 that manages the binary and non-normalized constraints in only one direction, storing the inverse founded supports for their later evaluation. Thus, it reduces the propagation phase avoiding unnecessary or ineffective checking. The use of AC4-OP reduces the number of constraint checks by 50% while pruning the same search space as AC4. The evaluation section shows the improvement of AC4-OP over AC4, AC6 and AC7 in random and non-normalized instances. Over the last few years, many real problems have involved constraints that the solution must satisfy (Królikowski and Jerzy, 2001; Sikora, 2003) . These problems come from different areas of computer sciences such as planning (Barták et al., 2010) , scheduling (Brdyś and Littler, 2002; Mesghouni et al., 2004) , control (Deng et al., 2009) , etc. To this end, many algorithms and heuristic techniques have been developed to manage these problems. Constraint programming is a software technology for description and effective solving of large and complex problems, particularly combinatorial problems in many areas of real life (Dechter, 2003; Barták, 1999) .. The basic idea of a Constrained Satisfaction Problem (CSP) is to model the problem as a set of variables with finite domains (the values for the variables) and a set of constraints that impose a limitation on the values that a variable, or a combination of variables, may be assigned. The task is to find an assignment of values to the variables that satisfy all the constraints. In general, the tasks posed in the CSP paradigm are computationally intractable (NP-complete) so filtering techniques to simplify the search space are still necessary.. The consistency-enforcing algorithm performs any partial solution of a small sub-network that is extensible to a surrounding network. The number of possible combinations can be huge, while only very few may be consistent. By eliminating redundant values from the problem definition, the size of the solution space decreases. If any domain becomes empty as a result of reduction, then it is immediately known that the problem has no solution (Ruttkay, 1998) .. In this paper, we focus our attention on arcconsistency. It is the basic propagation mechanism that is probably used in all solvers (Bessiere, 2006) . Arcconsistency algorithms are based on the notion of a support. These algorithms ensure that each value in the domain of each variable is supported by some value in the domain of each variable by which it is constrained. Arcconsistency algorithms are a major component of many in-dustrial and academic CSP solvers. Sitting at the heart of a CSP solver, arc-consistency algorithms consume a large portion of the time that is required to solve the input CSP (van Dongen et al., 2008) .. Proposing efficient algorithms for enforcing arcconsistency has always been considered a central question in the constraint reasoning community. Thus, there are many arc-consistency algorithms such as AC1, AC2, and AC3 (Mackworth, 1977) , AC4 (Mohr and Henderson, 1986 ), AC5 (Perlin, 1992; Hentenryck et al., 1992) , AC6 (Bessiere and Cordier, 1993; Bessiere, 1994) , AC7 (Bessiere et al., 1999) , AC8 (Chmeiss and Jegou, 1998) , AC2001 (Bessiere et al., 2005) , AC2001-OP (Arangu et al., 2010) , and more. However, AC3 (Mackworth, 1977) and AC4 (Mohr and Henderson, 1986) are most widely used (Barták, 2005) .. Algorithms that perform arc-consistency have focused their improvements on time-complexity and spacecomplexity. Main improvements have been achieved by changing the way of propagation: from arcs to values (i.e., changing the granularity: coarse-grained to fine-grained), appending new structures, performing bidirectional searches (AC7), changing the support search: searching for all supports (AC4) or searching for only the necessary supports (AC6, AC7, AC2001), improving the propagation (i.e., it performs propagation only when necessary, AC7 and AC-2001), etc. However, main arcconsistency techniques are focused on normalized CSPs, that is, those where any pair of variables can be restricted to no more than one constraint. Nevertheless, many real problems are modeled with constraints that involve the same set of variables (non-normalized CSPs), so it is necessary to develop filtering techniques to manage these resultant CSPs.. AC4 is the first fine-grained algorithm where the propagation is value oriented. AC4 is the only algorithm that confirms the existence of a support by not identifying it throughout search (Mehta, 2008) . To do this, AC4 stores lots of information about all the supports for each value in the auxiliary data structures. The main reasons for studying AC4 are the following:. 1. It has optimal time-complexity (Bessiere, 2006; Mohr and Henderson, 1986) .. 2. It is one of the most widely and frequently used algorithms for maintaining arc-consistency (Barták, 2005) .. Despite maintaining huge data structures during search, we have detected inefficiencies when these data structures are updated:. (a) It is not necessary to check each constraint in both directions when the checking of the constraint in one direction can store all the information.. (b) There are propagations of the pruned tuples that are ineffective because the variables do not store any variable support.. (c) In non-normalized problems the way that these structures are updated changes.. We propose an optimized version of AC4 by means of the management of the constraints in only one direction rather than in both directions. Furthermore, our algorithm allows the processing of non-normalized CSPs. Thus, this paper is organized as follows. In the next section, we provide the necessary definitions to understand the rest of the paper. Then, we explain the AC4 algorithm in detail, and we present our AC4-OP algorithm. In the experimental results section, we evaluate AC4 and AC4-OP empirically and, finally, we present our conclusions. Constraint programming is a powerful technology for solving many real-life problems modeled as constraint satisfaction problems. Since solving a CSP is NP-complete, filtering techniques are widely used to prune the search space of CSPs. AC4 is one of the most well-known arcconsistency algorithms. In this paper, we present a reformulated version of AC4, called AC4-OP, for binary and non-normalized CSPs. This algorithm improves the efficiency of previous versions by reducing the number of constraint checks. This algorithm prunes the same search space as AC4, but its efficiency is provided by both the initialization strategy and the propagation strategy. AC4-OP checks the binary constraints in only one direction and it only propagates when it is necessary. Thus, it avoids unnecessary checking. In the evaluation section, it can be observed that AC4-OP is competitive in random instances. It had better behavior than AC6, AC7 and AC4 in nonconsistent instances. In consistent instances, AC4-OP was competitive and stored all supports so that they could be used during the search process.

O O O O O O B I I O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Constructing Invariants for Hybrid Systems Abstract. We present a new method for generating algebraic invariants of hybrid systems. The method reduces the invariant generation problem to a constraint solving problem using techniques from the theory of ideals over polynomial rings. Starting with a template invariant -a polynomial equality over the system variables with unknown coefficients -constraints are generated on the coefficients guaranteeing that the solutions are inductive invariants. To control the complexity of the constraint solving, several stronger conditions that imply inductiveness are proposed, thus allowing a trade-off between the complexity of the invariant generation process and the strength of the resulting invariants. Hybrid systems are reactive systems that combine discrete mode changes with the continuous evolution of the system variables, specified in the form of differential equations. The analysis of hybrid systems is an important problem that has been studied extensively both by the control theory, and the formal verification community for over a decade. Among the most important analysis questions for hybrid systems are those of safety, i.e, deciding whether a given property ψ holds in all the reachable states, and the dual problem of reachability, i.e, deciding if a state satisfying the given property ψ is reachable. Both these problems are computationally hard -intractable even for the simplest subclasses, and undecidable for the general case.. In this paper, we provide techniques to generate invariants for hybrid systems. An invariant of a hybrid system is a property ψ that holds in all the reachable states of the system. An inductive assertion of a hybrid system is an assertion ψ that holds at the initial states of the system, and is preserved by all discrete and continuous state changes. Therefore, any inductive assertion is also an invariant assertion. Furthermore, the standard technique for proving a given assertion ϕ invariant is to generate an inductive assertion ψ that implies ϕ. Therefore, the problem of invariant generation is also one of inductive assertion generation. This problem has received wide attention in the 2 program analysis community [18, 9, 10, 34, 28, 8, 4] . The generation of linear inductive assertions for the special case of linear hybrid systems has also been studied [14] . Many other approaches that compute the exact or the approximate reach-set of a given hybrid system can also be shown to compute inductive assertions [15, 32, 19] .. In this paper, we extend our previous work on non-linear inductive assertion generation [28] for discrete systems to generate invariants for hybrid systems. We use the theory of ideals over polynomials along with standard computational techniques in algebraic geometry involving Gröbner bases to provide a technique for computing inductive assertions for hybrid systems.. The key idea behind our technique is that given a template assertion, i.e, a parametric polynomial with unknown coefficients and of bounded degree in the system variables, we derive constraints on the unknown coefficients so that any solution to these constraints is an inductive assertion. To keep these constraints tractable, we consider several useful restrictions on the nature of an invariant. In particular, we consider stronger conditions for inductiveness than the traditional requirements [20] . Also, we provide conceptually simpler techniques to handle the continuous evolution; these techniques require neither a closed form solution to the differential equations nor an approximation thereof.. Our technique can construct inductive assertions using less time and space than traditional techniques. Depending on the nature of the consecution condition chosen, our constraint generation technique is linear in the number of modes and discrete transitions, and polynomial in the number of system variables. Furthermore, the constraints generated can range in complexity from the more intractable non-linear constraints requiring quantifier elimination to simple constraints involving only linear equalities. Of course, the more complex constraints potentially yield stronger invariants than the simpler constraints. This trade-off is useful in practice, and contributes to making the method scale. We have presented a constraint-based technique for generating inductive assertions of hybrid systems. One of the main features of this technique is that it generates constraints without solving the differential equations. These differential equations may be hard to solve symbolically in practice, and may also involve exponentials lying outside the chosen assertion domain. We also avoid the use of over-approximations to these equations, relying instead on the conceptually simpler constant value and constant scale consecutions.. The technique is not guaranteed to generate the exact solution to the reachability problem, because of the relaxations made to maintain tractability. It also requires a degree bound to be specified a priori, the choice of which may be arbitrary. We are investigating strategies for guessing optimal degree bounds. A more serious shortcoming is that, at present, the technique does not handle inequalities. Inequalities frequently occur in the guards and location conditions, and not being able to use them in the constraint generation process may weaken the resulting invariants considerably. We are investigating strategies for extending the results in this paper to generate inequality invariants of hybrid systems.. Proof. The proof is by induction over the length of the minimal sequence of reductions from f to f = nf(f ). For zero length derivations, f = nf(f ), we have that α(f ) is a normal form. Hence, α(nf(f )) = α(f ) = nf(α(f )).. Assuming that the theorem holds for templates which have a length n or less derivation to their normal forms, let f G −→ f 1 G n nf(f ). Hence, by Theorem 5, we have that α(f ) = α(f 1 ) or α(f ) G −→ α(f 1 ). In either case nf(α(f 1 )) = nf(α(f )). Applying the induction to f 1 , we have that α(nf(f 1 )) = nf(α(f 1 )). Hence α(nf(f )) = α(nf(f 1 )) = nf(α(f 1 )) = nf(α(f )) Theorem 10 (Template Membership). Let f be a template and G be a Gröbner basis, such that I = ((G)). Let f = nf G (f ). For each environment α, α(f ) ∈ I iff α(f ) is identically zero.. Proof. Given f, G such that f = nf G (f ), for any environment α, we have that α(f ) = α(nf(f )) = nf(α(f )). Hence, if α(f ) is identically zero, then nf(α(f )) is identically zero, and therefore, α(f ) ∈ (G).. Let α(f ) ∈ (G), hence nf G (α(f )) is identically zero. However, α(f ) = α(nf(f )) = nf(α(f )) ≡ 0, and hence, α(nf(f )) = α(f ) is identically zero. The verification of safety (invariance and reachability) properties of timed and hybrid automata has been the subject of numerous papers, and has lead to popular verification systems such as Kronos [36] , Uppaal [3] , Hytech [17] , d/dt [1] , and CheckMate [31] . Most of this work deals with hybrid systems with piecewise-linear dynamics, although some tools, notably CheckMate, can handle more general dynamics. Non-linear systems have been traditionally dealt with by using finite-state, or linear infinite-state abstractions [15] . Techniques using template properties with undetermined coefficients along with constraint solving have appeared intermittently both in the computer science, and the control theory literature. Techniques for automatic generation of linear equality invariants for Petri-nets are a classic example [23] . Our earlier work on discrete linear systems handles the generation of linear inequality invariants using Farkas' Lemma [8, 29] . The work of Forsman et al. [12] uses Gröbner bases and parameterized polynomials to construct Lyapunov functions to prove local stability of continuous systems. Their approach works by fixing the form of the desired Lyapunov function, and computing a maximal region over which a function of the given form can establish local stability.. Invariant-generation methods for discrete programs based on algebraic geometry have appeared recently. The work of Müller-Olm and Seidl, presents a backward propagation-based method for nonlinear programs without branch conditions [22] . In [7] , Colón presents a method that uses forward propagation in the lattice of pseudo ideals of a given degree, to generate invariants of a bounded degree. In [27] , Rodriguez-Carbonell and Kapur present a method to generate polynomial invariants for programs that contain only a special class of assignments called solvable assignments. In [26] , a forward-propagationbased technique is presented, in which statements are represented as transformations on ideals. A widening operator that limits invariants to a given degree is used.. The work of Parillo et al. [24] presents a powerful framework based on real-algebraic geometry and semi-definite programming. Conceptually, this framework can be made to play the same role as that of Gröbner bases in this work. This has already been applied to some aspects of the safety-verification problem by the recent work of Prajna and Jadbabaie using the idea of barrier certificates [25] . Ideas similar to the ones contained in this work have appeared independently in the work of Tiwari and Khanna [33] .. The rest of the paper is organized as follows: Section 2 presents our computational model and the basic theory behind ideals and Gröbner bases. Section 3 presents the constraint generation process. The nature of these constraints and their solution techniques are discussed in Section 4. In Section 5, we present some examples demonstrating the application of our techniques. Section 6 concludes with a discussion of the pros and cons.

O B O B I O O O O O O O O O B O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B I O O O O O O O O O O O O O O O O O O O O O O O O B O B I O O O O O O O O O O O O O O O O O B O O O O O O O O O B O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B I O O O O O O O B O O O O O O B I O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Shapes of RNA pseudoknot structures In this paper we study abstract shapes of k-noncrossing, σ-canonical RNA pseudoknot structures. We consider lv Pseudoknots have long been known as important structural elements [33] , see Fig. 1 . They represent cross-serial interactions between RNA nucleotides and are an important functionally in tRNAs, RNaseP [15] , telomerase RNA [25] , and ribosomal RNAs [14] . Pseudoknots in plant virus RNAs mimic tRNA structures, and in vitro selection experiments have produced pseudoknotted RNA families that bind to the HIV-1 reverse transcriptase [27] . Import general mechanism, such as ribosomal frame shifting, are dependent upon pseudoknots [1] . Despite their biological importance, pseudoknots are typically excluded from large-scale computational studies. Although the problem has attracted considerable attention in the last decade, and several software tools [8, 23] have become available, the required resources have remained prohibitive for applications beyond individual molecules.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Precise pointer reasoning for dynamic test generation Dynamic test generation consists of executing a program while gathering symbolic constraints on inputs from predicates encountered in branch statements, and of using a constraint solver to infer new program inputs from previous constraints in order to steer next executions towards new program paths. Variants of this technique have recently been adopted in several bug detection tools, including our whitebox fuzzer SAGE, which has found dozens of new expensive security-related bugs in many Windows applications and is now routinely used in various Microsoft groups.In this paper, we discuss how to perform precise symbolic pointer reasoning in the context of dynamic test generation. We present a new memory model for representing arbitrary symbolic pointer dereferences to memory regions accessible by a program during its execution, and show that this memory model is the most precise one can hope for in our context, under some realistic assumptions. We also describe how the symbolic constraints generated by our model can be solved using modern SMT solvers, which provide powerful constructs for reasoning about bit-vectors and arrays. This new memory model has been implemented in SAGE, and we present results of experiments with several large Windows applications showing that an increase in precision can often be obtained at a reasonable cost. Better precision in symbolic pointer reasoning means more relevant constraints and fewer imprecise ones, hence better test coverage, more bugs found and fewer redundant test cases. Systematic dynamic test generation [7] consists of executing a program while gathering symbolic constraints on inputs from predicates encountered in branch statements, and of using a constraint solver to infer new program inputs from previous constraints in order to steer next executions towards some new program paths. This technique is now the foundation of several bug detection tools (see [3, 13, 11] among others), including our whitebox fuzzer SAGE [9] . SAGE can handle large applications and is optimized for handling long symbolic executions at the x86 binary level. Over the last 18 months, it has detected dozens of new expensive security bugs in many Windows applications. SAGE is so effective in finding bugs missed by other techniques like static analysis or blackbox random fuzzing that it is now used daily in various Microsoft groups.. Dynamic test generation tools vary by the type of programs they can analyze, the type of constraints their symbolic execution can generate and by the constraint solver they use. Whenever symbolic execution does not know how to generate a symbolic constraint for a program statement depending on some program inputs, the concrete values of those inputs can be used to simplify the constraint as a fallback [7] . However, these concretizations can result in failing to exercise program branches and paths, hence in missing bugs, and also in increasing the number of redundant test cases which diverge from their expected program path.. To illustrate this, consider generating test inputs for the method single_array in Figure 1 starting with the input tuple {x = 0, y = 1}. When the execution encounters the conditional statement a[x] == a[y] + 2 involving the program inputs x and y, symbolically evaluating this constraint requires comparing the values at the symbolic memory addresses &a [x] and &a [y] . (Adopting C notation, &v denotes the memory location of program variable v.) If the symbolic execution is not able to reason about symbolic addresses, the concrete values &a [0] (since 0 is the concrete value of x) and &a [1] (since 1 is the concrete value of y) of those addresses can be used instead, and the constraint a[x] == a [y] void s i n g l e a r r a y (BYTE x , BYTE y ) { BYTE * a = new BYTE [ 4 ] ; + 2 is then simplified into (x != 2), which is stored in the path constraint symbolically representing the current execution. Solving the new path constraint (x == 2) obtained by negating this constraint results in a new input tuple {x = 2, y = 1} which is expected to exercise the other branch of the conditional statement and reach the assert(false) statement. However, executing single_array with inputs {x = 2, y = 1} actually results instead in taking the same program path as the previous one: we call this a divergence. Note that concretizing the symbolic addresses resulted in changing the semantics of the condition from trying to find two elements in the array that differ by 2, to assigning the value 2 to the input variable x; this imprecision resulted in both generating a redundant test input and missing a reachable statement.. In this paper, we discuss how to precisely reason about symbolic pointer dereferences in the context of dynamic test generation, in order to handle programs with constraints as in the previous example. A symbolic pointer dereference is a pointer dereference at an address whose value depends on the evaluation of a symbolic expression, i.e., depends on some (untrusted) inputs. For instance, a[x] is a symbolic pointer dereference at the symbolic address &a [x] (equivalently &a + x) depending on the value of input x. Unfortunately, a symbolic address &a [x] can potentially point to any memory location within its range of possible values (say 2 32 if x is a 32-bit value), and considering all these possible values for each symbolic address dereference would be highly expensive and impractical. In contrast, the concrete address M (e) of symbolic address e either points to a specific memory location that lies within a valid, well-defined region in memory, or points to an unallocated memory region, which is a memory-access violation.. Therefore, we propose a practical yet precise memory model based on the following insight. For each symbolic address e, we split the entire universe of possible addresses that e may take into two disjoint sets defined by the current concrete value M (e) of that address: the set of concrete addresses contained in the valid memory region including the concrete address M (e), and the rest of the universe. If the concrete address M (e) does not point to a valid memory region, then a memory-access violation is reported. Otherwise, we consider two cases separately: we assume that the symbolic address e is confined within its valid memory region by forcing its value to be between the known concrete bounds defining the memory region; moreover, we also assert that the symbolic address e is confined within its valid memory region by checking separately whether its value could overflow or underflow the valid memory region, hence leading to a possible memory-access violation. This model can also be extended to deal with multiple pointer dereferences, where a single pointer may point to multiple valid memory regions.. The rest of the paper is organized as follows. In Section 2, we recall the basics of dynamic test generation and define under which assumptions it can be sound and complete. In Section 3, we present our new memory model and the steps necessary to implement it in conjunction with symbolic execution. In Section 4, we show that this memory model is the most precise one can hope for in our context, under some realistic assumptions. We then discuss related work in Section 5 and results of experiments in Section 6. In Section 7, we present an example of bug in a packet decoder which requires the precise symbolic pointer reasoning developed in this paper in order to be detected using dynamic test generation. We conclude in Section 8. This paper presents a memory model for precise pointer reasoning in dynamic test generation. Although more complex than closely related work and nontrivial to implement, our new memory model is still conceptually simple. Given any symbolic pointer, we determine the valid memory region its concrete address points to. If the pointer points to no such region, we report a memory-safety violation. Otherwise, we force the symbolic address to be confined within this valid memory region and take a snapshot of the content of that region; separately, we also check whether the symbolic address could possibly overflow or underflow the valid memory region. For chains of symbolic pointer dereferences, the model is extended to sets of memory regions.. Compared to memory models used for static program analysis, our memory model is unique in that it leverages concrete values available at run-time, an approach that would not be possible with static analysis. This feature is key to achieve high precision. Another contribution of this paper is the maximum precision theorem: the memory model we develop is the most precise there is, under the assumptions specified in Section 4. This result settles the discussion of precise memory models for pointer reasoning in the context of dynamic test generation under those assumptions.. Overall, dynamic test generation, and testing in general, are of course complementary to other defect detection techniques, like static program analysis. In practice, static analysis of large programs is less computationally expensive, but is usually both unsound (may generate false alarms) and incomplete (may miss bugs) from a bug-finding perspective. In contrast, dynamic test generation for large programs is expensive and typically incomplete (may miss bugs), but it is precise and sound from a bug-finding perspective: each bug found can be reproduced with a concrete execution trace. This property is key to the rapidly increasing popularity of dynamic test generation, which is now used daily at Microsoft for checking security properties of software, in addition to static analysis and blackbox fuzz testing. This section presents results of preliminary experiments with our SAGE implementation of the precise memory model introduced in this paper. The goal of these experiments is to estimate the benefit and cost of this memory model. Specifically, we evaluate two configurations: (Old) no symbolic pointer handling and (New) symbolic read operations with single and multi pointer dereferences.. Experiments were performed with the following applications: a GIF image processor, a PDF reader, an animated icons (ANI) parser, a cryptographic (Crypto) certificate processor, and a ZIP file decompressor. For each application, the symbolic inputs are defined as the contents of a single input file. We used the single generation (Gen1) mode of SAGE in which the target application is executed concretely and symbolically on one well-formed seed input file, all the constraints in the path constraint for that execution are negated and solved one-by-one in conjunction with the corresponding prefix of the path constraint (see [9] ), and all the resulting new test cases obtained from each satisfiable constraint are executed concretely to measure code coverage and see whether they exhibit a bug. We measured the total running time of each SAGE session including testing the new generated test inputs, the time it took to perform the single symbolic execution, the time taken by the constraint solver, the number of constraints that were successfully negated and solved to yield a new test case, the total number of constraints in the path constraint generated by the symbolic execution, the (rounded) initial instruction coverage obtained by running the target program with the seed input, and the (rounded) total (Gen1) instruction coverage obtained after also running the target program with all the new test inputs generated.. Results are summarized in Figure 8 . The ANI and ZIP programs do not use any input in any indirect memory accesses. As a result, there were no symbolic dereference constraints: the new memory model did not have any effect on these programs. The new GIF run generated more constraints than the old run, but the same number of constraints were successfully inverted in both runs. Apparently, some of the constraints that were inverted in the old run become unsatisfiable and are not inverted in the new run due to increased precision. As a result SAGE generates fewer divergences and the overall quality of the generated tests is better in the new run as witnessed by the marginally better coverage produced by the new run. Note that the symbolic execution and constraint solving times are not affected by the overhead of the new memory model in those three experiments.. The new PDF run generates more constraints and more tests. Although overall coverage is a little better as a result, this comes at a cost: the running time is slightly higher both because there are more tests to evaluate and because of the overhead in symbolic execution and constraint solving.. In the Crypto example, we see that although almost no additional constraints are added by the new run, a significant number of constraints are no longer satisfiable because they contain additional symbolic pointer expressions. Although symbolic execution and constraint solving incur an overhead with the new memory model, this time is made up overall because there are fewer new tests to run and evaluate. The marginal decrease in coverage for the new run is caused by divergences arising from symbolic-execution imprecision that is unrelated to the memory model. Indeed, increased precision in symbolic pointer reasoning can discover more inter-connections between individual constraints, but solutions to larger constraints tend to set new values to more inputs. Perturbing more inputs may then cause more divergences because of other hidden constraints not captured by symbolic execution.. Overall, these results are promising in that we do not observe a drastic total time increase as a result of introducing the new memory model. Therefore, even a small chance of finding a new bug thanks to increased precision justifies the memory model presented here.. We also performed longer 24-hours searches with the GIF and Crypto benchmarks, but those did not uncover new bugs in those programs.. Over the past few months, our new memory model has been deployed and used on a large scale in a fuzzing lab with hundreds of dedicated machines running SAGE for weeks at a time, each on a different Windows application. These longer searches were able to discover new bugs in several of those applications, but it is hard to attribute those results to the new memory model alone. Indeed, SAGE is a complex system with many features and parameters influencing its effectiveness, and it is hard to single out the effect of any single feature, like our new memory model, in the "production testing" fuzzing lab owned by the Microsoft Windows organization, where research experiments and precise data collection are not possible due to various reasons.

O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Modeling of 2D and 3D Assemblies Taking Into Account Form Errors of Plane Surfaces ABSTRACT. The tolerancing process links the virtual and the real worlds. From the former, tolerances define a variational geometrical language (geometric parameters Assembly simulations are needed to analyze deviation influences on the functional requirements. We have presented how this goal can be reached taking into account form errors on a static mechanism. Surface form errors are defined by the modal method. The natural mode shapes of the theoretical feature automatically build a geometric basis with several interesting properties as automaticity, exhaustiveness and natural sorting of shape complexity. Any form error can be decomposed in this geometric basis. The modal coefficients are used as shape parameters of 2D or 3D features. Keeping the most important coefficients makes a filtering operation. In order to compute the assembly of two surfaces, we define a filtered equivalent form error. Contact points must be on their convex hull. The set of corresponding facets define all the possible contact configurations. Assembly determination is solved by a static method. The use of the force assembly axis intersecting the convex hull of the filtered equivalent form error selects the contact facet. Then SDT model is used to transport this contact deviation to the functional requirement surface. By the domain method, this result is compared to the functional requirement domain. A simulation of a pilot production shows Non Conformity Rate with or without taking into account form errors. The supplier can use this approach in order to better answer the customer needs (NCR mastering at a good cost). We are making routines in order to analyse several type of contact surfaces. Libraries of modal shapes are made in this aim.

O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Convergence of a residual based artificial viscosity finite element method We present a residual based artificial viscosity finite element method to solve conservation laws. The Galerkin approximation is stabilized by only residual based artificial viscosity, without any least-squares, SUPG, or streamline diffusion terms. We prove convergence of the method, applied to a scalar conservation law in two space dimensions, toward an unique entropy solution for implicit time stepping schemes. The purpose of this paper is to study the convergence properties of a stabilized finite element method for solving nonlinear scalar conservation equations. The method is a stripped-down version of the Streamline-Diffusion-ShockCapturing (SDSC) method analyzed in [15, 16] . The novelty of the present approach is that the streamline diffusion part of the method is entirely disregarded; the only stabilizing mechanism present in the algorithm is a residual-based nonlinear viscous regularization. The main result of the paper is that the method is convergent, i.e. the sequence of approximate solutions converges to the entropy solution under grid refinement. The analysis is based on the convergence theory of measure-valued solutions by DiPerna [5] . The three ingredients of the proof are as follows: (1) uniform boundedness in L ∞ ; (2) weak consistency with every entropy inequalities; (3) strong consistency with the initial data. That the streamline diffusion method augmented with a residual-based shock-capturing mechanism is convergent has been known since the groundbreaking work of Szepessy et al. [20, 19, 16, 21] . The novel idea defended in the present paper is that Streamline Diffusion [13] , and more generally linear stabilization, [2, 4, 8] , is not necessary to guaranty convergence to the entropy solution; the residual-based viscous regularization is actually the key ingredient of the method.. The idea of constructing a residual-based stabilization is not new, see e.g. the early work of Hughes and Tezduyar [1, 12, 22] and Johnson, Hansbo and Szepessy [13, 15, 11] . These so-called shock-capturing techniques were initially introduced with the sole purpose of correcting some defects of the streamline diffusion and SUPG methods as it was observed soon after their introduction that these techniques could not suppress the Gibbs phenomenon. That shock-capturing techniques do not need linear stabilization to work properly is an idea that has gained momentum only recently, see e.g. [18] . For instance Guermond et. al. [9, 10] used an entropy residual to construct an artificial viscosity, and the resulting method has been shown numerically to work properly on nonlinear conservation equations, including the compressible Euler equations, without invoking any linear stabilization mechanism. It has even been shown in [6] that some linear stabilization techniques have adverse effects on nonlinear conservation equations with nonconvex fluxes. More specifically, it is shown in [6] that by adding some linear stabilization to a convergent shockcapturing technique one can obtain a method that converges to a weak solution that is not the entropy solution, i.e. the action of linear stabilization is counter-productive.. The paper is organized as follows. In Section 2 we introduce some definitions, and we give a short description of scalar conservation equations and entropy inequalities. The discrete scheme under consideration in the present paper is also introduced in this section. The time stepping is implicit and the space is approximated using continuous finite elements. Well-posedness of the discrete problem is established by using Brouwer's fixed point theorem. The main convergence result of the paper is presented in Section 3. It is proved therein that the finite element approximation described in Section 2 converges strongly in L p loc (R d ×R + ), 1 ≤ p < ∞, to the unique solution as the meshsize and time step tend to zero. This convergence result is established by proving that the sequence of approximations is uniformly bounded in L ∞ (R d ×R + ), weakly consistent with all entropy inequalities, and strongly consistent with the initial data. Some concluding remarks are reported in Section 4. We have introduced a stripped-down version of the Streamline-Diffusion-Shock-Capturing (SDSC) method analyzed in [15, 16] . The only stabilizing mechanism present in our algorithm is a residual-based nonlinear viscous regularization. The main result of the paper is that the method is convergent, i.e. the sequence of approximate solutions converges to the entropy solution under grid refinement. The idea defended in the present paper is that Streamline Diffusion, and more generally linear stabilization, is not necessary to guaranty convergence to the entropy solution; the residual-based viscous regularization is actually the key ingredient of the method. In that sense, our conclusion is similar in spirit to that in [6] .. The analysis is done for the implicit Euler time stepping. We are currently extending the methodology presented in this paper to explicit time stepping of first-and second-order accuracy.

B O O O O B I B I I O O O O O B I B I I O O O O O O O O O O O O O B I O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Data Consistency in Intermittently Connected Distributed Systems connectivity also applies to computing using portable laptops. In this paradigm, clients operate disconnected most of the time and occasionally connect through a wired telephone line or upon returning to their working environment.Private or corporate databases will be stored at mobile as well as static hosts and mobile users will query and update these databases over wired and wireless networks. These databases, for reasons of reliability, performance, and cost will be distributed and replicated over many sites. In this paper, we propose a replication scheme that supports weak connectivity and disconnected operation by balancing network availability against consistency guarantees.In the proposed scheme, data located at strongly connccted sites are grouped together to form clusters. Mutual consistency is required for copies located at the same cluster, while degrees of inconsistency are tolerated for copies at different clusters. The interface offered by the database management system is enhanccd with operations providing weaker consistency guarantees. Such weak operations allow access to locally, i.c., in a cluster, availablc data. Weak reads access bounded inconsistent copies and weak writes make conditional updates. The usual operations, called strict in this paper, are also supported. They offer access to consistent data and perform permanent updates.The scheme supports disconnected operation since users can operate even when disconnected by using only weak operations. In cases of weak connectivity, a balanced use of both weak and strict operations provides for better bandwidth utilization, latency and cost. hi cases of strong connectivity, using only strict operations makes the scheme reduce to the usual one-copy semantics. Additional support 1041-4347/99/5100Ot~ 1999 IEEE To overcome bandwidth, cost, and latency barriers, clients of mobile information systems switch between connected and discolinccted modes of operation. In this paper, we propose a replication scheme appropriate for such operation. Data located a t strongly connected sites arc grouped in clusters. Bounded inconsistency is defined by requiring mutual consistency among copies located at the same cluster and controlled deviation among copies at different clusters. The database interface is extended with weak oPeratiol1s. Weak operations query local, potentially inconsistent copies and perform tentative updates. The usual operations, called strict in this framework in contradistinction to weak, are also supported. Strict operations access col1sistent data and perform permanent updates.. Clients may operate disconnected by employing only wreak operatious. To accommodate weak connectivity, a mobile client selects an appropriate combinatioll of weak and strict transactions based on the consistency requirements of its applications and on the prevailing networking conditions. Adjusting the degree of divergence provides an additional support for adaptability. The idea of providing weak operations can be applied to other types of intercluster integrity constraints besides replication, Such coilStraints can be vertical and horizontal partitions or arithmetic constraints 1311. Another way of defining the semantics of weak operations is by exploiting the semantics of data. In [371, data are fragmented and later merged based 011 their object semantics. The service time of the combined flow, T, is no longer exponentially distributed but its means and second moments are.. Then, the wait time by using the Pollaczek-I<hinchin (P-K formula) 141 is:. Note that the above analysis as well as the following analysis on network links arc worst cases. In practice, when a locking method is used for concurrency control, a number of transactions is waiting to acquire lucks and not competing for system resources. T l i~ the rate of arrival of operations at the resource queues and the waiting time at each queue may be less than the valuc assumed in this section. Example 1 (Cooperative cnvironment). Consider the case of users working o n a common project using mobile hosts. Groups are formed that consist of users who work on similar topics of the project. Physical clusters correspond to data used by people in the same group who need to maintain consistency among their interactions. We consider data that are most frequently accessed by a group as data belonging to this group. At each physical cluster (group), the copies of data items belonging to the group are corc copies, while the copies of data items belonging to other groups are quasi. A data item may belong to more than one group, if more than one group frequently accesses it. In this case, core copies of that data item exist in all such physical clusters. In cach physical clustcr, operatinns on items that do not belong to the group arc weak, while operations on data that belong to the group are strict. Weak updates on a data item arc accepted only when they do not conflict with updates by the owners of that data item.. (Caching). Clustering can be used to model caching in a client/server architecture. In such a setting, a mobile host acts as a client interacting with a server at a fixed host. Data are cached at the client for performance and availability. The cached data arc considered quasi copies. The data at the fixed host are corc copies. Transactions initiated by the server are always strict. Transactions initiated by the client that invoke updates are always weak, while read-only client transactions can be strict when strict consistency is required and weak otherwise. At reconciliation, weak writes are accepted only if they do not conflict with strict transactions at the server. The frequency of reconciliation depends on the user consistency requirements and on networking conditions. Example 3 (Caching Location Data). In mobile computing, data representing the location of a mobile user arc fastchanging. Such data are frequently accesscd to locate a host. Thus, location data must be replicated at many sites to reduce the overhead of searching. Most of the location copies should be considered quasi. Only a few core copies are always updated to reflect changes in location. One-copy serializahility [3] hides from the user the fact that there can be multiple copics of a data itcm and ensures strict consistency. Whereas one-copy serializability may he an acceptable criterion for strict transactions, it is too restrictive for applications that tolerate hounded inconsistency and also causes unbearable overhcads in cases of weak connectivity. Thc weak transaction model described in this paper was first introduced in 12. 61, while preliminary performancc results were prcsented in [24] .

O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B I O O O O O B O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Optimal Two-Stage Algorithms for Group Testing Problems Abstract. Group testing refers to the situation in which one is given a set of objects O, an unknown subset P ⊆ O, and the task of determining P by asking queries of the type "does P intersect Q?", where Q is a subset of O. Group testing is a basic search paradigm that occurs in a variety of situations such as quality control testing, searching in storage systems, multiple access communications, and data compression, among others. Group testing procedures have been recently applied in computational molecular biology, where they are used for screening libraries of clones with hybridization probes and sequencing by hybridization.Motivated by particular features of group testing algorithms used in biological screening, we study the efficiency of two-stage group testing procedures. Our main result is the first optimal twostage algorithm that uses a number of tests of the same order as the information-theoretic lower bound on the problem. We also provide efficient algorithms for the case in which there is a Bernoulli probability distribution on the possible sets P, and an optimal algorithm for the case in which the outcome of tests may be unreliable because of the presence of "inhibitory" items in O. Our results depend on a combinatorial structure introduced in this paper. We believe that it will prove useful in other contexts, too.Key words. group testing, cover-free families AMS subject classifications. 68Q25, 68P10, 68R05, 05D051. Introduction and contributions. In group testing, the task is to determine the positive members of a set of objects O by asking subset queries of the form "does the subset Q ⊆ O contain a positive object?" The answer to each query informs the tester whether or not the subset Q (in common parlance called a pool) has a nonempty intersection with the subset of positive members denoted by P. A negative answer to this question informs the tester that all the items belonging to pool Q are negative, i.e., nonpositive. The aim of group testing is to identify the unknown subset P using as few queries as possible.Group testing was originally introduced as a potential approach to economical mass blood testing [23] . However, due to its basic nature, it has been proven to be applicable in a surprising variety of situations, including quality control in product testing [52] , searching files in storage systems [36] , sequential screening of experimental variables [40] , efficient contention resolution algorithms for multiple-access communication [36, 55] , data compression [31] , and computation in the data stream model [16] . Group testing has also exhibited strong relationships with several disciplines such as coding theory, information theory, complexity, computational geometry, and computational learning theory, among others.

O O O O B I O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I B I O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O