Further properties of random orthogonal matrix simulation Random orthogonal matrix (ROM) simulation is a very fast procedure for generating multivariate random samples that always have exactly the same mean, covariance and Mardia multivariate skewness and kurtosis. This paper investigates how the properties of parametric, data-specific and deterministic ROM simulations are influenced by the choice of orthogonal matrix. Specifically, we consider how cyclic and general permutation matrices alter their time-series properties, and how three classes of rotation matrices -upper Hessenberg, Cayley, and exponential -influence both the unconditional moments of the marginal distributions and the behaviour of skewness when samples are concatenated. We also perform an experiment which demonstrates that parametric ROM simulation can be hundreds of times faster than equivalent Monte Carlo simulation. Crown Many real-world prediction problems are resolved with reference to a single, observed multivariate sample. For instance, the sample may be used to estimate model parameters as in the ensemble simulation models that are used for climate, flood and biodiversity predictions -see [30, 20] and many others since. Or, an observed sample of historical values might simply be used to build a non-parametric, empirical distribution which is then assumed to represent a distribution for future values. This approach is typically applied to resolve financial prediction problems, where it is commonly termed 'historical simulation'. For instance, despite the limitations discussed in [32] , the survey of [31] shows that about three-quarters of large commercial banks estimate their minimum regulatory capital using historical simulation.. Random orthogonal matrix (ROM) simulation is a new procedure, introduced by [22] , that can generate any number of multivariate random samples with mean, covariance and Mardia [26] higher moments exactly the same as those of an observed sample. This way, ROM simulation overcomes the standard criticism of historical simulation, i.e. the implicit assumption that only what is historically observed can determine the future. The multivariate moments are often regarded as the salient characteristics of a system, and every ROM simulation will have exactly the same mean, covariance matrix and Mardia skewness and kurtosis as those of the historically observed sample. But randomness is introduced to each simulation via the application of a random orthogonal matrix. This type of ROM simulation is called data-specific ROM simulation.. In other practical applications it is common to resolve prediction problems using parametric Monte Carlo simulation. In this context specific values are assigned to the parameters of an assumed form of multivariate distribution, such as the mean vector and covariance matrix of a multivariate normal (MVN) simulation. Parametric ROM simulation is based on a preliminary Monte Carlo simulated sample. Each ROM simulation will have exactly the same sample mean and covariance as the theoretical mean and covariance, and their higher Mardia moments will be identical but equal to those of the preliminary sample. Hence, although ROM simulations have no sampling error in the mean and covariance, the Monte Carlo sampling error in higher moments will be inherited by the ROM simulations.. In fact, ROM simulation does not need to be based on a sample at all, either empirically observed or simulated from a parametric distribution. Deterministic ROM simulation is only based on some pre-specified 'target' multivariate moments, without any parametric or non-parametric distribution. In this case some integer parameters, including the sample size, m, of the ROM simulations, are first calibrated to match the target skewness and kurtosis. The ROM simulations again have exactly the target mean and covariance matrix, and they all have the same skewness and kurtosis as the moments based on the calibrated parameter values (typically, a small calibration error arises from the integer parameter constraints).. If the calibrated value of m is small then concatenation may be used to increase the sample size of deterministic ROM simulations. 1 [22] prove that the mean, covariance and kurtosis are invariant under sample concatenation, but the skewness is not. However, once the number of concatenations is fixed, the repeated (concatenated) ROM simulations all have identical skewness.. The aim of this paper is to introduce further statistical, algebraic and computational properties of ROM simulation beyond those introduced in [22] . We investigate how the unconditional moments of the marginal distributions are affected by the choice of rotation matrix which has different random elements in each ROM simulation. We examine the time-series characteristics of ROM simulations, and provide a linear algebraic description of the effect of concatenation on the multivariate skewness, with empirical examples. We also perform a computational experiment which demonstrates that ROM simulation can be hundreds of times faster than equivalent Monte Carlo simulations with exact mean and covariance matrix.. Simulations on multivariate distributions are fundamental to numerous problems in finance. Portfolio returns forecasting methods are commonly based on a parametric model, e.g. from the class of multivariate generalized autoregressive conditional heteroscedasticity (GARCH) models, which capture the volatility and correlation clustering which is usually present in financial risk factor returns, but nevertheless requires time-consuming simulations for forecasting -see [37, 10, 38] and many others. Even in problems where only the terminal distribution is modelled (as it is when pricing European options, for example) simulation is still required under non-affine continuous-time models: see [33] for advanced simulation methods and see [4, 21] for the evaluation of various non-affine models.. Simulation is also the resolution method of choice for many financial institutions employing pricing models with nonstandard distributions, see [19] -or for pricing options with exotic or path-dependent pay-offs, see [8, 11] . Multivariate simulations are applied in many other areas of finance, for instance to the design of algorithmic trading algorithms as in [35] and to the assessment of portfolio Value-at-Risk (VaR) for which the academic literature is prolific -see [3, 6, 28] and many others. When VaR models are extended to stress testing, a typical approach is to target values of multivariate moments which reflect increased volatilities, correlations, skewness and kurtosis. Deterministic ROM simulation clearly has a natural application in this context.. Given the wealth of potential applications to finance, our empirical examples on calibration and time-series properties will be based on financial data, and on a simulation from the Markov-switching model, introduced by [14] , with two asymmetric GARCH components. In the following: Section 2 provides an overview of the ROM simulation methodology; Section 3 explains the methods we use to generate random rotation matrices; Section 4 investigates the higher multivariate moments of concatenated ROM simulations, which can be used to generate random samples with arbitrarily large size using small-sample data-specific L matrices, or deterministic L matrices; Section 5 examines the time-series properties of ROM simulations; Section 6 explores the effect that different rotation matrices have on the marginal properties of parametric ROM simulation and Section 7 examines the robustness of those results to the choice of correlation matrix; Section 8 compares the computational efficiency of rotational parametric ROM with Monte Carlo simulations and Section 9 summarizes and concludes. An Appendix A illustrates the calibration of deterministic L matrices. ROM simulation is a new technique for generating random samples, which encompasses Monte Carlo and historical simulation as special cases. The fundamental idea is to capture the characteristics of simulations via an L matrix, and to multiply this matrix by random permutation, reflection and/or rotation matrices. It has the advantage of producing very fast simulations with exact mean and covariance. In data-specific and parametric ROM simulation the higher multivariate moments are identical to those of an observed sample (empirically observed or parametrically simulated). In deterministic ROM simulation the L matrix is constructed without reference to an observed sample. Instead, the matrix has parameters that are chosen to target some pre-assigned values for skewness and kurtosis. Exact matching to skewness and kurtosis is not always possible due to integer parameter constraints, but calibration errors are very small. This paper provides further insight to the properties of ROM simulation, beyond those introduced in [22] . When the sample size parameter of deterministic ROM simulation is small, or when there are only a few historical observations in the variables, the ROM simulations may be concatenated to obtain much larger samples. We demonstrate algebraically and empirically that the Mardia skewness will decrease at a rate approximately inversely proportional to the number of concatenations. However, the mean, covariance and kurtosis are left invariant by concatenation.. We investigate the time-series properties of data-specific ROM simulations using real financial data, and of parametric ROM simulations derived from a Markov-switching GARCH model. Here the pre-multiplication of the L matrix by a cyclic permutation matrix plays a critical role. Cyclic ROM simulations may have useful applications to the reduction of data-snooping bias, amongst other econometric problems.. We then explore how different types of random rotations produce samples with different marginal characteristics, and we also demonstrate that ROM simulation is very much faster than parametric Monte Carlo simulation particularly when exact means and covariance matrices are required for each simulation. Upper Hessenberg ROM simulation is the fastest in small dimensional systems, but in large systems exponential ROM simulation is almost equally fast. The choice of rotational matrix then depends on the sample characteristics that are required. Exponential, Cayley and Hessenberg rotation matrices produce ROM simulations that are far from normal, except when a normal parametric L matrix is used. The exponential ROM simulation has the lowest kurtosis, but still it is significantly greater than three. Hessenberg and exponential ROM simulated samples have opposite skewness characteristics: with Type I or Type II L matrices, Hessenberg ROM simulations have negative skew and exponential ROM simulations have positive skew; the opposite is the case with Type III L matrices. Cayley ROM simulation is slower than Hessenberg or exponential ROM simulation, but it is still about 100 times faster than Student-t Monte Carlo. The kurtosis characteristics of Cayley ROM simulations are similar to those of Hessenberg ROM simulations. The main advantage of using Cayley ROM simulation is that they produce large values for the sample skewness, which is positive with Type I or Type II L matrices, and negative with Type III L matrices.. An Appendix A explains how to calibrate deterministic L matrices to target any values for skewness and kurtosis that we choose. An illustration of the calibration of Type I L matrices to time series of data on the 45 Morgan Stanley Country Indices shows that calibration errors are small. ROM simulation has great potential for financial applications. Interesting problems might include: the application of data-specific ROM simulation to assess model risk for problems that are typically resolved using a single historically observed sample, such as Value-at-Risk; stress testing portfolios using deterministic ROM simulation, where L matrices target extreme values for skewness and kurtosis; performance evaluation of optimal portfolios, and/or of econometric models, where cyclic ROM simulations are applied to reduce the data-snooping bias; and speeding up option pricing and hedging computations in the non-affine model class, and/or for risk-neutral valuation of path-dependent pay-offs under affine as well as non-affine models. ROM simulation can be applied to resolve any problem where Monte Carlo simulation is typically applied, but it is much faster than Monte Carlo. Hence, ROM simulation might also be applied to data-prediction problems in econometrics, climate, hydrology and other non-financial disciplines. A special rectangular orthogonal matrix called an L matrix, introduced by [22] , is fundamental to ROM simulation. The methodology produces random samples X mn , of size m on n linearly independent random variables, each with the same sample mean vector μ n and covariance matrix S n . If the L matrix is generated by orthogonalizing an empirically observed or Monte Carlo simulated sample, then the Mardia [26] higher moments of each ROM simulation are identical to the corresponding moments of the sample. Alternatively, a deterministic L matrix may be used. Such a matrix has one or more integer parameters that are calibrated to target some pre-assigned values for Mardia skewness and kurtosis. The integer parameter constraints can lead to some error between the skewness and kurtosis of the ROM simulations and the target values, but typically this error is small.. ROM simulation is most easily introduced by considering the MVN case. Monte Carlo simulation produces a sample with mean vector and covariance matrix different from the population (theoretical) parameters, due to sampling error. This is one of the reasons why a very large number of simulations is usually employed. However, it is possible to perform a simple affine transform on each simulation so that it has sample mean vector and sample covariance matrix that exactly match the theoretical parameters, μ n and S n , as follows. Assuming there is no exact linear relation between the n random variables in the system (in which case one or more variables could be eliminated) their covariance matrix S n will be positive definite. Hence, we can always find a decomposition of the form S n = A n A n , where A n is a Cholesky matrix, for example. 2 We can therefore apply the following transformation to any Monte Carlo simulation X mn of size m on the n random variables:. n . The inverse transform is. It is now straightforward to show that X mn will have mean μ n and covariance matrix S n if, and only if, the matrix L mn satisfies the following conditions:. Any matrix L mn satisfying (1) is called an L matrix. That is, an L matrix is a special type of rectangular orthogonal matrix -one whose columns sum to zero. Since the columns of L mn are linearly independent by definition, and the nullity of L mn is at least one, the rank-nullity theorem implies that, for any L matrix, m > n. L matrices can be found by orthogonalizing any linearly independent set of contrasts, i.e. subsets H ⊆ R m , defined by:. In other words, a contrast is a column vector whose elements sum to zero. Typically, L matrices are constructed by taking a pair (m, n) ∈ Z 2 + with n < m, picking N(m) linearly independent vectors in H, where n ≤ N(m) < m, and using these vectors to form the columns of a matrix The properties of an L matrix are inherited from the contrasts that are used in its construction. For instance, dataspecific L matrices L mn are formed from mean deviations of an empirically observed sample matrix X mn , representing 2 Another alternative would be to set S n = Q n Λ n Q n where Λ n is the diagonal matrix of eigenvalues, and Q n is the orthogonal matrix of eigenvectors of S n , so that A n = Λ 1 2 n Q n . m observations on n linearly independent random variables. Parametric L matrices are formed from a sample X mn on a given multivariate distribution. For instance, suppose X mn ∼ D(μ n , S n ), where D is an elliptical distribution. In each case the columns of X mn usually do not have zero sample mean, hence define. Deterministic L matrices are not constructed with reference to a sample. Instead, we directly specify a set of deterministic vectors satisfying (1) . For instance, L mn = ( 1 , . . ., n ), where. for 1 ≤ j ≤ n. 3 Following [22] , Ledermann matrices L mn consist of any n columns of the matrix defined by (2) . Since n is fixed to be the number of variables, the number of observations m becomes a parameter which could be calibrated so that ROM simulations derived from these matrices target some pre-specified Mardia higher moments as closely as possible. Note that, since all L matrices must satisfy (1), the mean and covariance of every ROM simulation will always match the target mean vector μ n covariance matrix S n exactly. Introducing a further, positive integer parameter, k, allows ROM simulations based on deterministic L matrices to target the Mardia moments more precisely. This parameter may be introduced in different ways, thus defining three other types of deterministic L matrices, denoted L k mn . To construct a Type I deterministic L matrix we set N(m) = m + 1 −2k and, to ensure that n ≤ N(m), we require 2k. A Type II matrix is defined by requiring . In each case the columns of V mn form a linearly independent set in H and the L k mn matrix of each type is any n columns of the GS image of V m,m+1−2k (Type I), V m,m−k (Type II) or V m,m−2 (Type III). The numbers of variables n is fixed but the parameters m and k of Type I, II and III deterministic L matrices can be set to any integer values such that: m + 1 −2k ≥ n (Type I), m − k ≥ n (Type II) and m − 2 ≥ n (Type III), with each of these conditions following from the rank-nullity theorem. In Appendix A we give an empirical example of the calibration of m and k for a Type I L matrix to target some pre-specified values for the Mardia skewness and kurtosis. Now let Q m be an m × m permutation matrix and R n be any n × n orthogonal matrix. Then, given any L matrix L mn it is easy to show that Q m L mn R n is also an L matrix. The fundamental idea of ROM simulation is to use randomly generated elements in the matrices Q m and R n . That is, starting with any (data-specific, parametric or deterministic) L matrix, the corresponding ROM simulation generates random samples X mn via the equation:. where Q m is a random permutation matrix, R n is any random orthogonal matrix and A n A n = S n . The ROM simulation properties of different classes of L matrices were discussed in [22] . This paper focuses on the ROM simulation properties of the random orthogonal matrices, Q m and R n . We consider cyclic and general permutation matrices for Q m and three different types of rotation matrices for R n . Note that permutation matrices are only applied to permute the rows of the L matrix (i.e. to change the ordering of observations in a time-series sample) because there is usually no point to randomly permute the columns (i.e. to change order of the variables). Hence permutation matrices only affect the time-series properties of ROM simulations, whereas the random rotation matrices primarily influence the unconditional moments of the marginal distributions.

O O O O O O B B I I I B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B I I I B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O B O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O B O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O O O B O O O B O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O B I O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B I O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Designing and Optimizing a Healthcare Kiosk for the Community . Designing and optimizing a healthcare kiosk for the community.Applied Ergonomics, 47, Investigating new ways to deliver care, such as the use of self-service kiosks to collect and monitor signs of wellness, supports healthcare efficiency and inclusivity. Selfservice kiosks offer this potential, but there is a need for solutions to meet acceptable standards, e.g., provision of accurate measurements. This study investigates the design and optimization of a prototype healthcare kiosk to collect vital signs measures. The design problem was decomposed, formalized, focused and used to generate multiple solutions. Systematic implementation and evaluation allowed for the optimization of measurement accuracy, first for individuals and then for a population. The optimized solution was tested independently to check the suitability of the methods, and quality of the solution. The process resulted in a reduction of measurement noise and an optimal fit, in terms of the positioning of measurement devices. This guaranteed the accuracy of the solution and provides a general methodology for similar design problems.We developed an interactive self-service kiosk for healthcare. The aim was to apply a formal design methodology, to optimize positioning of vital signs monitors, and facilitate measurement accuracy. The contribution is two-fold in outlining a generalizable and rigorous approach to design, and showing how it guarantees optimality for certain properties. Worldwide, there are both immediate and far-reaching challenges to the provision of healthcare. For many countries, changes in demographic, growth in Long Term Conditions (LTCs) and changes in the ratio of caregivers to cared for is forcing a rethink in the way that healthcare is provided. Recently, a new kind of healthcare technology has emerged, based upon the use of self-service kiosks (PK, 2013; SoloHealth, 2013) . These systems can be used to take physiological measures such as blood pressure, in order to provide healthcare advice.. When it comes to the design of such technology, the Human Factors and Ergonomics literature provides many classic and applicable design rules, relating to the physical characteristics of technology. Designers can also apply data relating to the statistical characteristics of the target population in order to fit a proposed solution to the characteristics of the user population. There are also guidelines relating to design methods (AAMI, 2009; Maguire, 2001; Salvendy, 1997; Vincent et al., 2012) , and user interfaces (Borchers et al., 1995; Johnson et al., 2005; Maguire, 1999) . All of the above can help match the design of healthcare kiosks with the properties of both users and environments, but doesn't necessarily guarantee accuracy of measurement. Although a design kiosk design solution was achieved (based on the three devices), there was a need for compromise in creating a general solution. We know that different users had different optimal solutions (e.g. according to the populationfitting functions , based upon the blood pressure results). It was hard to provide both a general and optimal solution when different users had different heights, shoulder widths and genders. There are two ways to resolve the issue: one is to provide a design that adapts for different users, the other is to use (published) data relating to population level anthropometry, biomechanics or ergonomics. In this study, we collected our own data from our target population. The anthropometric characteristics were as follows: height 169.31cm, arm length 54.43 and the shoulder length 43.42cm. Our blood pressure monitor was located at x = 33.74, y =56.66 and z = 58.76 (cms). The prototype design and the corresponding implementation based on the anthropometric data are shown in Figure 11 . Based on the population-fitting functions of the optimal device configuration, an automatic device adaption could be realized for any specific user. However, addressing the practicality of both obtaining . the user parameters and automatically configuring the devices requires additional work. This study proposes a methodology that allows for both the development and optimization of a self-service physiological kiosk. For this domain, very few design studies provide a formalization of the problem, means to optimize it, and demonstration using a general, and compelling design problem. The use of a dedicated design model and corresponding design and optimization methodology helps guarantee the accuracy of the implementation.. Accurate physiological measurements in ubiquitous scenarios are a challenging issue; we provide a demonstration of how formal mathematical proofs can be applied to support them. To extend these methods we need formulations with additional variables that take into account more factors. In future work there may be ways to decrease the testing burden by "smartly" controlling noise. For example, deciding whether to accept or reject multiple measurements based on variability in the data. Given a generalizable and sufficiently accurate solution, the self-service healthcare kiosk could offer accurate physiological measurements that meet medical standards and serve large populations efficiently. The system could allow users to engage with the system over a period of time, to help support long-term monitoring. Before this can be realised, there are still a few practical issues to resolve. They form the basis for future work: 1) Population adaption. We implemented the design based on a restricted population (e.g. the training and testing groups were recruited in a university campus). A more general solution would require additional testing. We need to find an appropriate balance between the generalizability of the solution and the cost of involving multiple user groups during the testing. 2) The Graphical User Interface (GUI). Irrespective of the device configuration presented in this paper, the GUI needs to be optimized separately. We considered some factors for controlling the measurement noise, but a welldesigned GUI also plays a role in guiding the user to complete operations correctly (e.g. providing video based instruction on how to attach the sensors). The role of the GUI is important when it comes to preparing users (e.g. calming them prior to a measurement being taken). It can also be used to provide educational instructions e.g. tutoring on lifestyle options and healthy living. 3) Maintenance. We need to consider the mechanisms for supporting the kiosk (e.g. training, cleaning, hardware and software support). 3.1 Kiosk design 3.1.1 Designing for a population As the kiosk was designed for public use, we needed to generalize a solution (i.e. design for a population), based on our formulation (section 2). Applying the optimization process for an entire population was not practical, but applying it for an individual and then generalizing to a population was. Validation was achieved using an inferential approach, whereby we checked that our generalized solution, met the needs of individuals, within a predefined "error tolerance" (Figure 2 ):. Firstly, our population sample (the potential users of the kiosk) was divided into two groups; the training group and the testing group. For everyone in the training group, the optimized HMI design was achieved using the problem formulation (section 2), e.g. in the "individual optimization" stage in We then took the sets of optimization parameters and balanced them for use across the population (population fitting). The process of population fitting needed to keep the individual measurement errors within a given significance. This was measured during the "testing group phase" that occurred after the population fitting had occurred. It provided an independent check of the fitting results. Each individual in the "testing group" was asked to try the design and measurement errors were recorded. We either accepted (submitted) the design solution, or repeated the overall process, (based on a 5% significance test) (Figure 2 ).

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Nonlinear random effects mixture models: Maximum likelihood estimation via the EM algorithm Nonlinear random effects models with finite mixture structures are used to identify polymorphism in pharmacokinetic/ pharmacodynamic (PK/PD) phenotypes. An EM algorithm for maximum likelihood estimation approach is developed and uses sampling-based methods to implement the expectation step, that results in an analytically tractable maximization step. A benefit of the approach is that no model linearization is performed and the estimation precision can be arbitrarily controlled by the sampling process. A detailed simulation study illustrates the feasibility of the estimation approach and evaluates its performance. Applications of the proposed nonlinear random effects mixture model approach to other population PK/PD problems will be of interest for future investigation. There is substantial variability in the way individuals respond to medications, in both treatment efficacy and toxicity. The sources of a drug's underlying pharmacokinetic (PK) and pharmacodynamic (PD) variability can include demographic factors (such as age, sex, weight), physiological status (such as renal, liver, cardiovascular function), disease states, genetic differences, interactions with other drugs and environmental factors. In their seminal work, Sheiner et al. (1972) proposed a parametric nonlinear mixed-effects modeling framework for quantifying both within and between subject variability in a drug's PKs, and developed an approximate maximum likelihood solution to the problem. Since the introduction by Beal and Sheiner (1979) of the general purpose software package NONMEM implementing this approach, other approximate maximum likelihood algorithms have been introduced to solve the nonlinear random and mixed effects modeling problem (see Davidian and Giltinan, 1995 for an extensive review). An exact maximum likelihood (i.e., no linearization) solution to the parametric population modeling problem based on the EM algorithm has also been proposed by Schumitzky (1995) and fully developed and implemented by Walker (1996) . The population modeling framework has had a significant impact on how PK (and PD) variability is quantified and studied during drug development, and on the identification of important covariates associated with a drug's inter-individual kinetic/dynamic variability.. While population models incorporating measured covariates have proven to be useful in drug development, it is recognized that genetic polymorphisms in drug metabolism and in the molecular targets of drug therapy, for example, can also have a significance influence on the efficacy and toxicity of medications (Evans and Relling, 1999) . There is, therefore, a need for population modeling approaches that can extract and model important subpopulations using PK/PD data collected in the course of drug development trials and other clinical studies, in order to help identify otherwise unknown genetic determinants of observed PK/PD phenotypes. The nonparametric maximum likelihood approach for nonlinear random effects modeling developed by Mallet (1986) , as well as the nonparametric Bayesian approaches of Wakefield and Walker (1997) and Rosner and Muller (1997) , and the smoothed nonparametric maximum likelihood method of Davidian and Gallant (1993) all address this important problem. In this paper we propose a parametric approach using finite mixture models to identify subpopulations with distinct PK/PD properties.. An EM algorithm for exact maximum likelihood estimation of nonlinear random effects finite mixture models is introduced, extending the previous work of Schumitzky (1995) and Walker (1996) . The EM algorithm has been used extensively for linear mixture model applications (see McLachlan and Peel, 2000 for a review). The algorithm for nonlinear mixture models presented below has an analytically tractable M step, and uses sampling-based methods to implement the E step. Section 2 of this paper describes the finite mixture model within a nonlinear random effects modeling framework. Section 3 gives the EM algorithm for the maximum likelihood estimation of the model. Section 4 addresses individual subject classification, while an error analysis is presented in Section 5. A detailed simulation study of a PK model is presented in Section 6. Section 7 contains a discussion. In this paper, an EM algorithm for maximum likelihood estimation of nonlinear random effects mixture models is presented that has application in pharmacokinetic/pharmacodynamic population modeling studies. It extends the previous work on the use of the EM algorithm for MLE of nonlinear random effects models, to the case of finite mixture models, and reinforces the practicability of using exact (no linearizing approximation) MLE estimation in PK/PD modeling studies (see also, Kuhn and Lavielle, 2005 for a stochastic EM variation). The parametric mixture model MLE approach presented also complements previous work on nonparametric Bayesian and smoothed nonparametric MLE, in addressing the increasingly important problem of identifying subpopulations with distinct PK/PD properties in drug development trials. We note that approximate maximum likelihood methods using mixture models are also available in NONMEM.. The EM algorithm has been used extensively for fitting linear mixture models in numerous applications in diverse fields of study. Even for linear problems involving mixture of normal components, a number of challenges attend the use of the EM algorithm for maximum likelihood estimation (McLachlan and Peel, 2000) that are also relevant to the nonlinear random effects problem. These include: potential unboundness of the likelihood for heteroscedastic covariance components; local maxima of the likelihood function; and choice of the number of mixing components. Application of the algorithm for nonlinear random effects mixture models presented here can be guided by the extensive work related to these issues for linear mixture modeling.. We have investigated the possible unboundness of the likelihood for the example considered in this paper. If, for example, in the first component of the mixture, μ 1 satisfies h i (μ 1 ) = Y i for any i and 1 → 0, then the likelihood will tend to infinity, and the global maximizer will not exist. By restricting the covariance matrices k , k = 1, . . . , K to be equal (homoscedastic components), as is often done in mixture modeling, the unboundness of the likelihood will be eliminated. In our example with heteroscedastic variance components, each individual has five error-associated observations, while the parameter space is of dimension two. The condition for likelihood singularity is therefore very unlikely to be satisfied.. Future work is also needed to extend the algorithm to include important practical cases involving more general error variance models and random effects covariates. The updates for {w k , 1 k K} and 2 are the same as in Section 3.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Nonhuman Primate Neuroimaging and the Neurobiology of Psychostimulant Addiction Neuroimaging techniques have lead to significant advances in our understanding of the neurobiology and treatment of drug addiction in humans. The capability to conduct parallel studies in nonhuman primates and human subjects provides a powerful translational approach to link findings in human and animal research. A significant advantage of nonhuman primate models is the ability to use drug-naïve subjects in longitudinal designs that document the neurobiological changes that are associated with chronic drug use. Moreover, experimental therapeutics can be evaluated in subjects with well-documented histories of drug exposure. The in vivo distribution and pharmacokinetics of drug binding in brain have been related to the time-course of behavioral effects associated with the addictive properties of stimulants. Importantly, the characterization of drug interactions with specific protein targets in brain has identified potential targets for medication development. Neuroimaging has proven especially useful in studying the dynamic changes in neuronal function that may be associated with environmental variables. Lastly, neuroimaging has been used effectively in nonhuman primates to characterize both transient and long-lasting changes in brain chemistry associated with chronic drug exposure. Although there is some evidence to suggest neurotoxicity in humans with long histories of stimulant use, parallel studies in nonhuman primates have not identified consistent long-term changes in such neurochemical markers. Collectively, the results of these studies of nonhuman primates have enhanced our understanding of the neurobiological basis of stimulant addiction and should have a significant impact on efforts to develop medications to treat stimulant abuse. Noninvasive neuroimaging techniques have lead to significant advances in our current understanding of the neurobiology and treatment of drug addiction in humans. Nuclear imaging with positron emission tomography (PET) and single photon emission computed tomography (SPECT) has defined the pharmacokinetics of abused stimulants in vivo in the human brain and related these findings to the time-course of behavioral effects associated with their addictive properties. With support from work that has provided new radiotracers and enhanced the resolution of imaging systems, nuclear medicine techniques have also been employed to characterize drug interactions in vivo with specific protein targets in brain, including neurotransmitter receptors and transporters. Moreover, documentation of the longterm neurobiological consequences of chronic drug use and potential neurotoxicity has lead to novel insights regarding of the pathology and treatment of stimulant addiction. Lastly, recent advances in functional magnetic resonance imaging (fMRI) have begun to localize brain circuits implicated in the acute effects of Ann. N.Y. Acad. Sci. xxxx: 1-19 (2008 Recent advances in nonhuman primate neuroimaging have documented drug-induced functional changes in brain activity under physiologically relevant conditions. Neuroimaging of cerebral blood flow changes coupled to cerebral metabolism measured with PET and fMRI is particularly well suited to define the neuronal circuitry that underlies drug effects on behavior. The ability to study drug interactions with specific protein targets in vivo has supported medication development efforts that have focused primarily on behavioral models of drug abuse. For example, neuroimaging has been used in nonhuman primates to study the relationship between drug occupancy at monoamine transporters and the behavioral effects of cocaine and cocaine-like agonist medications. Similar approaches have proven especially useful in studying dynamic changes in brain chemistry that may be associated with environmental variables. For example, differences in social status have been linked to dopamine receptor availability and propensity to use cocaine in nonhuman primates. The ability to conduct within-subject, longitudinal assessments of brain chemistry and neuronal function should enhance our efforts to document longterm changes due to chronic drug exposure and to elucidate recovery during prolonged

O O B O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O B O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O B O O O O O O O O O O O B O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Discrete techniques applied to low-energy mobile human activity recognition. A new approach Human activity recognition systems are currently implemented by hundreds of applications and, in recent years, several technology manufacturers have introduced new wearable devices for this purpose. Battery consumption constitutes a critical point in these systems since most are provided with a rechargeable battery. In this paper, by using discrete techniques based on the Ameva algorithm, an innovative approach for human activity recognition systems on mobile devices is presented. Furthermore, unlike other systems in current use, this proposal enables recognition of high granularity activities by using accelerometer sensors. Hence, the accuracy of activity recognition systems can be increased without sacrificing efficiency. A comparative is carried out between the proposed approach and an approach based on the well-known neural networks. In recent years, thanks largely to the growing interest in monitoring certain sectors of the population, such as elderly people with dementia and people in rehabilitation, activity recognition systems have experienced an increase in both number and quality of results. However, most of these results incur high computational costs, and hence cannot be applied on a general-purpose mobile device due to their excessive energy consumption.. Although, the calculation of the physical activity of a user, based on data obtained from an accelerometer, remains a current research topic, numerous limitations have been identified that make these systems uncomfortable for users in general.. The first difference observed between the many systems developed is the type of sensor used. There are systems using specific hardware (Ravi, Dandekar, Mysore, & Littman, 2005) , while others use general-purpose hardware (Hong, Kim, Ahn, & Kim, 2008) . Obviously, the use of generic hardware constitutes a benefit for users, since their availability, low cost, and versatility are points greatly in their favour; not to mention the reduction in the risk of loss, since these devices have already been integrated into everyday objects, such as users' smartphones. However, general purpose devices are used for other purposes, such as making phone calls, surfing the Internet, and listening to music. For this reason, the physical activity recognition system must be executed in background mode and cause the least impact on the system as possible, in terms of complexity and energy consumption.. Another difference found between the proposals surveyed is the number and position of the sensors. In Brezmes, Gorricho, and Cotrina (2009) , it can be observed that the accelerometer sensor is placed in a glove and a multitude of activities are recognized depending on the movement of the hand. In contrast, other studies use either various sensors placed on many parts of the body (Bicocchi, Mamei, & Zambonelli, 2010; Lepri, Mana, Cappelletti, Pianesi, & Zancanaro, 2010) or a wearable wireless sensor node with a static wireless non-intrusive sensory infrastructure (Paoli, Fernández-Luque, & Zapata, 2011) to recognize these activities. According to certain comparative studies and previous research based on multiple sensors, these last two types of sensors provide greater accuracy.. However, in studies, such as Hong et al. (2008) , a sensor is kept in a user's pocket or worn on the hip, which is more wearable on the monitored person, and requires much lower infrastructure.. Once the most comfortable alternative for users is determined, some device sensors could be chosen to perform the activity monitoring. Some research uses data not only from accelerometers and a gyroscope (Dernbach, Das, Krishnan, Thomas, & Cook, 2012) , but also from other sources, such as microphones, light sensors and voice recognition to determine the context of the user (Kwapisz, Weiss, & Moore, 2011) and ECG sensors (Li et al., 2010; Pawar, Chaudhuri, & Duttagupta, 2007; Ward, Lukowicz, Troster, & Starner, 2006) for this purpose.. The first example, which incorporates microphone and bluetooth devices, helps to obtain contextual information about the user environments and would be appropriate to perform a more in-depth analysis of the activity, for instance, whether the user is walking in a disco or at home, or whether s/he is alone or with someone. However, high-level activity recognition (walking, playing, running or standing up) is carried out using other sensors. On the other hand, ECG can help determine high-level activities by means of heart-rate processing. In this sense, certain activities (walking or running) could be discerned based on the effort exerted. However, the problem here is that ECG sensors are both expensive and uncomfortable for the user.. Thus, the present work is focused on the recognition of physical activities carried out by users by means of their mobile devices, and hence special attention must be paid to energy consumption and the computational cost of the methods used.. There are related studies where data for activity recognition is obtained through mobile devices where this data is sent to a server to process the information (Altun, Barshan, & Tunçel, 2010) . In these cases, computational cost is no limitation and hence methods of a more complex nature can be used. In contrast, efficiency is a crucial issue when processing is carried out within the mobile device itself (Fuentes, Gonzalez-Abril, Angulo, & Ortega, 2012; Reddy et al., 2010) .. Taking previous works into account, physical activity monitoring through smartphones presents the following challenges:. To decrease, as far as possible, the risk of forgetting the processing device so that continuous monitoring can be performed anywhere and any time.. To reduce the drain of energy on the smartphone, by developing an accurate and efficient system. To integrate learning and monitoring on the device itself, in realtime and without sharing server information.. In order to reduce the cost associated to accelerometer and gyroscope signal analysis, this paper opts for an innovative approach based on a discretization method that uses only accelerometer sensors since with these good results can be achieved and a lot energy can be saved (the more sensors used, the greater the consumption). Furthermore, the data is processed in the mobile itself, and therefore the efficiency is better than if data were sent to a server, and the result is obtained in real time. Thanks to this discretization process, the classification cost is much lower than it would be with continuous variables, and therefore the life of the battery is longer. It is therefore possible not only to eliminate the correlation between variables during the recognition process, but also to minimize the energy consumption of the process.. The remainder of the paper is organized as follows: Section 2 describes the method of data capture through the mobile device using an accelerometer sensor, and outlines all the physical activities that can be recognized by the system described. In Section 3, a new process, that discretizes continuous variables and provides classification, is presented. Section 4 shows a comparison between the new method and other methods used previously in the literature. Finally, in Section 5, a discussion is given on the various advantages of the proposed algorithm as well as on certain challenges and tasks that are currently being developed for the described recognition system. As mentioned in Section 1, the number of research studies into activity recognition has increased in numerous domains in recent years. The insightful practical implications include, for example in elderly care the estimation of the quality of self-care and the monitoring of activities of daily living. Furthermore, activity recognition enables obesity to be better fought and improvements to be made toward a more active life in proactive healthcare and can also obtain the correlation of activities with moods, mood swings, and manic depression in psychiatry.. In the workplace, it enables maintenance staff and crowds to be tracked; and accountability in security/workflow monitoring to be managed; activity information to be shared in groups; and diaries and auto-filling journals to be managed for later accounting in memory support.. Efficiency and accuracy are two elements that must be taken into account when any activity recognition system is implemented on a mobile device. In this work, a recognition system based on discrete variables is presented whereby the Ameva discretization algorithm and a new classification system, based on this algorithm, are used.. By using this process to increase the recognition frequency, if has been possible to obtain a physical activity reading every 5 s and to publish these readings in the user activity log (Alvarez-Garcia, Ortega, Gonzalez-Abril, & Velasco, 2010). This classification algorithm is in a simple unified form for multi-class cases, and in general has equal performance or outperforms RNA in terms of accuracy, recall, specificity, precision, and Fmeasure (F 1 ). It is also very fast because it is based on the Ameva discretization algorithm and a majority voting system which both have a very low processing time.. Furthermore, although it has yet to be tested with other datasets, the core of this algorithm remains free of dependence on the features of any recognition activity dataset, and is therefore applicable to any dataset.. The strengths of the system are: the high success rate for which it has been possible to achieve an average accuracy of 98% for the recognition of 8 different types of activities; and, the reduced computational cost associated to the processing of data during the recognition process, thanks to the inclusion of discrete variables.. However, the main problem of this system based on statistical learning lies in the number of activities that can be recognized. Working solely with accelerometer sensors reduces the number of detected activities and there is occasionally a strong correlation between the variables, as can be observed with the Immobile and Drive activities in Table 2 . Moreover, the position of the mobile device is a weakness of the developed system since it must be placed at the hip which it is not a natural position (sometimes a belt is necessary). Other positions have been tested, but have not achieved good results.. This system is currently focused on the detection of falls in elderly people, so that it can transmit an alarm signal to the family and/or medical centre. It complements existing telecare services, such as those as offered by the Andalusian Regional Ministry of Equality, Health and Social Policy.. To this end, a new system that can recognize basic activities, such as immobile, walk, run, climb and descend, no matter where the mobile device is located is currently under development. This is expected to provide a major improvement in that the user will not have to worry that the mobile device is placed in the right position for the activities to be detected correctly, and therefore the user can move in a more natural way. To the best of our knowledge, our proposal, which involves working in the domain of discrete variables to perform learning and recognition of activities, constitutes a totally innovative approach. This concept arose largely due to the need for a reduction in the high computational cost required for learning algorithms based on continuous variables, which have been used for this purpose over the years.. In Gonzalez-Abril, Velasco, Ortega, and Cuberos (2009), a labelling process, similar to a discretization process, is used to obtain a Qualitative Similarity Index (QSI), and hence it can be said that a transformation of the continuous domain to the discrete domain of values of the variables is beneficial in certain aspects. Therefore, the Ameva discretization (Gonzalez-Abril, Cuberos, Velasco, & Ortega, 2009) is used, which is unsupervised and fast. The most notable feature of these two processes is the small number of intervals generated, which facilitates and reduces the computational cost of the recognition process.. Let us briefly examine these algorithms.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


ADDING PROBABILITIES AND RULES TO OWL LITE SUBSETS BASED ON PROBABILISTIC DATALOG This paper proposes two probabilistic extensions of variants of the OWL Lite description language, which are essential for advanced applications like information retrieval. The first step follows the axiomatic approach of combining description logics and Horn clauses: Subsets of OWL Lite are mapped in a sound and complete way onto Horn predicate logics (Datalog variants). Compared to earlier approaches, a larger fraction of OWL Lite can be transformed by switching to Datalog with equality in the head; however, some OWL Lite constructs cannot be transformed completely into Datalog. By using probabilistic Datalog, the new probabilistic OWL Lite subsets (both with support for Horn rules) are defined, and the semantics are given by the semantics of the corresponding probabilistic Datalog program. As inference engines for probabilistic Datalog are available, description logics and information retrieval systems can easily be combined. In contrast to traditional (relational) databases, unstructured or semi-structured documents (e.g. in XML) with an uncertain content representation are searched in information retrieval (IR) with respect to (w. r. t.) a vague user information need. Typically, the output is a list of documents ranked w. r. t. numeral weights. Probabilistic models become more and more popular, as optimum retrieval has only been defined precisely for them: The Probability Ranking Principle 26 says that optimum retrieval quality is achieved if documents are ranked with decreasing probability that the document is relevant to a user. The combination of probability theory and a logical framework bears additional opportunities for information retrieval: queries, documents and retrieval approaches can be presented in a clear way, and it is straight-forward to incorporate external knowledge like a thesaurus, hyper-links between documents or ontologies. Examples are PLBR (propositional logic and belief revision) 18 as well as probabilistic Datalog 7 , which is based on Horn predicate logics with recursion and negation and allows for computing point probabilities (in contrast to intervals as for other approaches). The latter has been successfully employed for information retrieval 22 and for the problem of mapping between different schemas or ontologies 24 .. A new and challenging problem is information retrieval in the context of the Semantic Web, where information is structured and presented employing the OWL ontology language 21, 25 . This work is based on restricted versions of OWL Lite a . Like other description logic languages, the OWL language suffers from two significant restrictions when using it for information retrieval:. (1) OWL does not support general rules yet, and the rule extension SWRL 12 is still under development. Rules could be used as a powerful IR query language, for defining mappings between ontologies, or for intelligent Semantic Web Services. (2) OWL is only able to specify and infer deterministic knowledge. Uncertain knowledge is required, however, e.g. for query answering in IR, or when wrappers are used to derive ontology instances from HTML pages (where e.g. misspelling, synonyms or page irregularities lead to some errors).. In this paper, OWL Lite is restricted to two subsets, called OWL Lite − and OWL Lite EQ : / 0 ⊆ OWL Lite − ⊂ OWL Lite EQ ⊂ OWL Lite ⊆ OWL DL ⊆ OWL Full. Due to space limitations, we only describe a few approaches related to our work.. Two approaches are distinguished when description logics are combined with predicate logics: the DL-log approach, where description logics concepts and roles can be used in the body of Datalog programs to infer new Datalog facts (but not new description logic knowledge), and the axiomatic approach (like the one in this paper), where description logics are mapped onto Datalog programs.. e Actual classification schemes would be more complex, of course.. The DL-log approach has been introduced by AL − Log 3 , which integrates the ALC description logics into Datalog programs. Datalog rule bodies can contain concepts which constrain a variable to run over the set of instances of that concept. The rule heads can only contain Datalog predicates, so that it is not able to infer new instances or role fillers. SLD-resolution in combination with an inference method for the description logic part is used for query answering. A more powerful approach is presented by Eiter et.al. 6 , where the expressive SH I F (D) (i.e., OWL Lite) and SH OI N (D) (i.e., OWL DL) description logics are combined with logic programming under the answer set semantics. In contrast to AL − Log, this approach does not only provide an information flow from the description logics to the logic program, but also a limited flow back. Straccia 28 proposes to combine the ALC description logics with disjunctive logic programs, where (in contrast to other approaches) concepts and roles are also allowed in the rule head. The resulting description logic program language is then extended by uncertainty, following the Generalised Annotated Logic Programming paradigm; thus, probabilities are given as intervals.. Hustadt et.al. 14 follow the axiomatic approach and transform the SH I Q description logic into a Disjunctive Datalog 5 program, which can be used for query answering. In a first step, the knowledge base is transformed into first-order clauses. Then, basic superposition is applied, and the resulting clauses are converted into Disjunctive Datalog. Alternatively, conceptual Logic Programs have been proposed for converting description logic knowledge bases into logical programs using answer set programming 11 .. Grosof et.al.'s 10 proposes a simple mapping a restricted version of SH OI Q onto Datalog; OWL Lite − and its mapping onto Datalog has been introduced by de Bruijn et.al 2 . In a very similar way, Nottelmann and Fuhr 23 partially mapped DAML+OIL, the predecessor of OWL, onto four-valued probabilistic Datalog.. P-log 1 is a probabilistic extension of answer set programming. P-log provides probabilistic facts and rules, and employes possible world semantics with an independence assumption (as probabilistic Datalog does). P-S H OQ (D) is a direct probabilistic extension to description logics 9 . Similar to our approach, it allows to state the probability that an instance of one concept is also an instance of another concept, that individuals are instances of concepts or related to other individuals by roles; in addition, it is possible to specify that an instance of one concept is related to an individual by a given role. Probabilities are specified as intervals. P-Classic 16 , in contrast, employes Bayesian networks in combination with an independence assumption for inference and computing point probabilities. Jaeger 15 also allows for probabilistic assertions and terminological knowledge, but employes cross-entropy for defining the semantics, and also derives probability intervals.. Recently, Lukasiewicz 20 introduced probabilistic description logic programs. These programs can use description logic concepts and roles in rule bodies only, but allow for specifying intervals for conditional probabilities. Choice sets, based on a similar idea as possible worlds, are employed together with an independence assumption for defining the semantics of probabilistic description logic programs.

O O O B O B I O O O B I O O O O O O O O O O B I O O O O O O O O O B I O O O O O O O O O O B O O O O O B I O O O O O O O O O O O B O O O O O O O O O O B I O O O O O O O O O O O O O O B I O O O O O O O O O B I O O O B I O O O O O O B O O O O O O O O O O O O O B I O O O O O B I O O O B O B I O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O B I O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O B I O O B I O O O O O B I O O B I O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O B O O O O O O O O O O B I O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Gaining insight through case-based explanation Abstract Traditional explanation strategies in machine learning have been dominated by rule and decision tree based approaches. Case-based explanations represent an alternative approach which has inherent advantages in terms of transparency and user acceptability. Case-based explanations are based on a strategy of presenting similar past examples in support of and as justification for recommendations made. The traditional approach to such explanations, of simply supplying the nearest neighbour as an explanation, has been found to have shortcomings. Cases should be selected based on their utility in forming useful explanations. However, the relevance of the explanation case may not be clear to the end user as it is retrieved using domain knowledge which they themselves may not have. In this paper the focus is on a knowledge-light approach to case-based explanations that works by selecting cases based on explanation utility and offering insights into the effects of featurevalue differences. In this paper we examine to two such knowledge-light frameworks for case-based explanation. We look at explanation oriented retrieval (EOR) a strategy which explicitly models explanation utility and also at the knowledge-light explanation framework (KLEF) that uses local logistic regression to support casebased explanation. It is useful to divide work on explanation in case-based reasoning (CBR) into two categories (Cunningham et al. 2003) . There is the knowledge intensive approach where explanations are produced using explanation patterns that have been encoded in cases (Kass and Leake 1988; Armengol et al. 2001) and there is the knowledge light approach where explanation is achieved by revealing the case descriptions to the user (Evans-Romaine and Marling 2003; Leake 1996a; Lenz and Burkhard 1996) . These two very different strategies represent two quite different paradigms that have coexisted in CBR research since the beginning. The work described here belongs to the knowledge-light paradigm where CBR is viewed as a strategy for avoiding knowledge engineering effort by implicitly encoding knowledge in case chunks (Kriegsman and Barletta 1993) . In this paper we examine two frameworks for explanation in CBR that can be implemented with very little knowledge engineering effort.. We examine explanation oriented retrieval (EOR), a utility-based approach to explanation that is appropriate for weak-theory domains where the details of the causal interactions are not well understood, where all experts can provide is a sense of the direction of causal interactions (Doyle et al. 2006) . We also look at the knowledge-light explanation framework (KLEF) an approach to case-based explanation based on local logistic regression models .. The structure of the paper is as follows. In the next section we provide an overview of case-based explanation and outline the advantages. In Section 3 we present an explanation-oriented framework for case-retrieval. In Section 4 we show how the details of these cases can be assessed and selected for highlighting in explanation. An evaluation of KLEF is presented in Section 5 and the paper concludes with a summary in Section 6. Because CBR is a transparent process it is possible to explain the output of a CBR system by simply showing the retrieved cases to the user. The EOR framework described here elaborates on this idea by selecting cases that form a fortiori arguments. These explanation cases are selected based on knowledge about the direction of the effect of features on outcomes. This knowledge is expressed in the explanation utility framework that was described in Section 3.. We have also discussed a framework called KLEF that uses local logistic regression to identify suitable explanation cases and produces a dialog to tease out the difference between the query case and the explanation case. This is done by highlighting case features and showing how they influence outcomes. We have shown how such a knowledge-light approach to explanation can provide insight into a problem domain by presenting similar matching and un-matching cases to the user.

O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Security Primitives for Reconfigurable Hardware-Based Systems Computing systems designed using reconfigurable hardware are increasingly composed using a number of different Intellectual Property (IP) cores, which are often provided by third-party vendors that may have different levels of trust. Unlike traditional software where hardware resources are mediated using an operating system, IP cores have fine-grain control over the underlying reconfigurable hardware. To address this problem, the embedded systems community requires novel security primitives that address the realities of modern reconfigurable hardware. In this work, we propose security primitives using ideas centered around the notion of "moats and drawbridges." The primitives encompass four design properties: logical isolation, interconnect traceability, secure reconfigurable broadcast, and configuration scrubbing. Each of these is a fundamental This research was funded in part by National Science Foundation Grant CNS-0524771, NSF Career Grant CCF-0448654, and the SMART Defense Scholarship for Service. Authors' addresses: T. Huffmire, T. Levin, T. Nguyen, and C. Irvine, Department of Computer Science, Naval Postgraduate School, Monterey, CA 93943; email: {tdhuffmi, televin, tdnguyen, irvine}@nps.edu; B. Brotherton, Special Technologies Laboratory, Santa Barbara, CA 93111; email: brett.brotherton@gmail.com; G. Wang, Intuit, San Diego, CA 92122; email: Gang Wang@ intuit.com; T. Sherwood, Department of Computer Science, University of California, Santa Barbara, CA 93106; email: sherwood@cs.ucsb.edu; R. Kastner, Department of Computer Science and Engineering, University of California, San Diego, La Jolla, CA 92093; email: kastner@cs.ucsd.edu. c 2010 Association for Computing Machinery. ACM acknowledges that this contribution was authored or co-authored by a contractor or affiliate of the [U.S.] Government. As such, the Government retains a nonexclusive, royalty-free right to publish or reproduce this article, or to allow others to do so, for Government purposes only. Permission to make digital or hard copies of part or all of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or direct commercial advantage and that copies show this notice on the first page or initial screen of a display along with the full citation. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, to republish, to post on servers, to redistribute to lists, or to use any component of this work in other works requires prior specific permission and/or a fee. Permissions may be requested from Publications Dept., ACM, Inc., 2 Penn Plaza, Suite 701, New York, NY 10121-0701 USA, fax +1 (212) operation with easily understood formal properties, yet they map cleanly and efficiently to a wide variety of reconfigurable devices. We carefully quantify the required overheads of the security techniques on modern FPGA architectures across a number of different applications. While the economics of the semiconductor industry has helped to drive the widespread adoption of reconfigurable devices in a variety of critical systems, it is not yet clear that such devices and the design flows used to configure them are trustworthy. Reconfigurable systems are typically designed using a collection of Intellectual Property (IP) cores in order to save both time and money. Ideally each of these cores would be formally specified, tested, and verified by a highly trusted party. However, in reality, this is rarely the case. Unlike uniprocessor software development, where the programming model remains fixed as transistor densities increase, FPGA developers must explicitly take advantage of denser devices through changes in their design. Given that embedded design is driven in large part by the demand for new features and the desire to exploit technological scaling trends, there is a constant pressure to mix everything on a single chip: from the most critical functionality to the latest fad. Each of these cores has explicit control of the reconfigurable device (i.e., without the benefit of an operating system or other intermediate layer), and it is possible that this mixing of trust levels could be exploited by an adversary with access to any point in the design flow (including design tools or implemented cores). In an unrestricted design flow, even answering the question: "Are these two cores capable of communication?" is not simple.. Consider a more concrete example, a cryptographic system that performs local authentication to encrypt and decrypt network traffic. This system is designed using two soft-processor cores-one to interface with an authentication device (e.g., fingerprint reader), the other to control the ethernet IP core-and an AES encryption engine used by both of the processor cores. These cores are all implemented using a single FPGA. Further details about this system can be found in Huffmire et al. [2008] , and in Section 4.3.1. Each of three cores · 10: 3 requires access to off-chip memory to store and retrieve data. How can we ensure that the encryption key for one of the processors cannot be obtained by the other processor by either reading the key from external memory or directly from the encryption core itself? There is no virtual memory on these systems, and after being run through an optimizing CAD tool the resulting circuit is an obfuscated network of gates and wires. To prevent the key from being read directly from the encryption core itself, we must find some way to isolate the encryption engine from the other cores at the gate level. To protect the key in external memory, we need to implement a memory protection module, we need to ensure that each and every memory access goes through this monitor, and we need to guarantee that all cores are communicating only through their specified interfaces. To confirm that these properties hold at even the lowest levels of implementation (after all the design tools have finished their transformations), we argue that slight modifications in the design methods and tools can enable the rapid static verification of finished FPGA bitstreams. The techniques presented in this article are steps towards a cohesive reconfigurable system design methodology that explicitly supports cores with varying levels of trust and criticality, all sharing a single physical device.. Specifically, we present the idea of moats and drawbridges, a statically verifiable method to provide isolation and physical interface compliance for multiple cores on a single reconfigurable chip. The key idea of the moat is to provide logical and physical isolation by separating cores into different areas of the chip such that this separation can be easily verified. Given that we need to interconnect our cores at the proper interfaces (drawbridges), we introduce interconnect tracing as a method for verifying that interfaces carrying sensitive data have not been tapped or routed improperly to other cores or I/O pads. Furthermore, we present a technique, configuration scrubbing, for ensuring that remnants of a prior core do not linger following a partial reconfiguration of the system. Once we have a set of drawbridges, we need to enable legal intercore communication. We describe two secure reconfigurable communication architectures, and we quantify the implementation trade-offs between them in terms of complexity of analysis and performance.. In this article, we extend our preliminary work [Huffmire et al. 2007 ] to incorporate an alternative form of moats that does not require "dead" areas or the disabling of longer routing segments. Rather than using physical/spatial separation, this improved form of moats uses logical separation. We compare these two versions of moats to determine which is optimal. The design of reconfigurable systems is a complex process, consisting of multiple software tool chains that may have different trust levels. Composing a trustworthy system from untrusted components remains an open challenge in computer security. The tools necessary for high-assurance FPGA system development do not yet exist. Our methods represent an initial attempt at verifying security properties of FPGA designs. In particular, we described a set of primitives that can be used to isolate trusted cores from the effects of the subversion or failure of other cores in the system.. We have presented a protection scheme called moats and drawbridges that provides separation of multiple cores on an FPGA. Moats isolate the cores, and drawbridges facilitate their controlled interaction. We have presented two alternative methods of implementing moats. The gap method uses physical/spatial isolation and restricts the use of longer routing segments, while the inspection method uses logical isolation and static checking instead. We have shown that the inspection method results in better performance than the gap method. We have also described how moats and drawbridges can be used in conjunction with a reference monitor to provide memory protection.. There are many opportunities for future work. To provide for heterogeneous provisioning of bandwidth for our TDMA bus architecture, we plan to investigate the application of lattice scheduling [Hu 1992 ], in which a core can "donate" its unused time to a core with a higher security label in a roundrobin fashion.. Some of our security techniques are applicable to other kinds of devices besides FPGAs, such as Chip Multi-Processors (CMPs). For example, we would like to extend our drawbridge model to support Networks-on-Chip (NoCs) to provide efficient and secure communication among many cores. There are several open research questions in the design of NoCs, and techniques for incorporating security into the design of NoCs by enhancing the network interface are starting to emerge [Diguet et al. 2007; Florin et al. 2007a; 2007b] . There has always been an important relationship between the hardware a system runs on and the security of that system, and reconfigurable systems are no different. In addition to the related work we have already mentioned, we build on the ideas of reconfigurable security, IP protection, secure update, covert channels, direct channels, and trap doors. While a full description of all prior work in these areas is not possible, we highlight some of the most relevant.

B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O B O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Generalized vector version of Minty's lemma and applications Abstract-In this paper, we consider a generalized vector version of Minty's lemma, and then show the existence of solutions to generalized vector variational-type inequality problems for setvalued mappings as an application. showed the linearization lemma for the scalar case, which have played useful roles in variational inequalities.. In fact, the classical Minty's inequality and Minty's lemma have been shown to be important tools in the regularity results of the solution for a generalized nonhomogeneous boundary value problem [2] and, when the operator is a gradient, also a minimum principle for convex optimization problems [3] . And Behera and Panda [4] obtained a nonlinear generalization of Minty's lemma. E'urthermore, they applied the result to obtain a solution of a certain variational-like inequality. Kassay and Kolumban [5] considered the following Minty-type problem for set-valued mappings with two variables for the scalar case; find an element z E K such that:. sup (.&y-z) LO,. for y E K,

B I I I I I O O O O O O O O B I I I I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O