Symbolic computation with finite quandles Algorithms are described and Maple implementations are provided for finding all quandles of order n, as well as computing all homomorphisms between two finite quandles or from a finitely presented quandle (e.g., a knot quandle) to a finite quandle, computing the automorphism group of a finite quandle, etc. Several of these programs work for arbitrary binary operation tables and hence algebraic structures other than quandles. We also include a stand-alone C program which finds quandles of order n and provide URLs for files containing the results for n = 6, 7 and 8. In 1980, David Joyce introduced a new algebraic structure dubbed the quandle. Quandles are tailor-made for defining invariants of knots since the quandle axioms are essentially the Reidemeister moves written in algebra. Associated to any knot diagram, there is a quandle called the knot quandle which is a complete invariant of knot type up to homeomorphism of topological pairs.. The history of quandle theory is a story of rediscovery and reinvention. Quandles and their generalization, racks, have been independently invented and studied by numerous authors (Brieskorn, 1988; Fenn and Rourke, 1992; Joyce, 1982; Mateev, 1982, etc.) and classification results for various subcategories of quandles have been obtained by various authors (Graña, 2004; Nelson, 2003) . In Ho and Nelson (2005) , the third listed author and a coauthor described a way of representing finite quandles as matrices and implemented algorithms for finding all finite quandles, removing isomorphic quandles from the list, and computing the automorphism group of each quandle. As we later learned, some of our work has duplicated the efforts of others (Ryder, 1992; Lopes and Roseman, 0000; Carter et al., 2004) . This paper is intended to reduce future duplication of effort by describing the algorithms for computation with finite quandles implemented in Ho and Nelson (2005) and other recent projects, as well as an improved algorithm for finding quandle matrices. The C source for our implementation of this algorithm as well as Maple implementations of algorithms for computing with finite quandles and the lists of quandle matrices of order 6, 7 and 8 are available for download at http://www.esotericka.org/quandles. Additional Maple code corresponding to current and future projects will be made available at the same site, such as an algorithm for finding all Alexander presentations of a quandle when such exist (Murillo et al., 0000) .

B I O B I O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Voting power in the European Union enlargement Abstract. The Shapley-Shubik power index in a voting situation depends on the number of orderings in which each player is pivotal. The Banzhaf power index depends on the number of ways in which each voter can e¤ect a swing. If there are n players in a voting situation, then the function which measures the worst case running time for computing these indices is in O (n2 n ) : We present a combinatorial method based in generating functions to compute these power indices e¢ciently in weighted double or triple majority games and we study the time complexity of the algorithms. Moreover, we calculate these power indices for the countries in the Council of Ministers of the European Union under the new decision rules prescribed by the Treaty of Nice. A simple game is a con ‡ict in which the only objective is winning and the only rule is an algorithm to decide which coalitions are winning. These games have been used to study the distribution of power in voting situations. Two power indices have received the most theoretical attention as well as application to political structures. The …rst such power index was proposed by Shapley and Shubik [8] who apply the Shapley value [7] to the case of simple games. The second power index was introduced by Banzhaf [1] and has been used in arguments in various legal proceedings.. The computation of these power indices is complex in practice because the algorithms have exponential complexity. However, using generating functions, Cantor (1962) (see Lucas [5] ) and Brams and A¤uso [3] have obtained signi…cative results for computing the Shapley-Shubik and the Banzhaf indices in weighted voting games. Starting from these ideas we de…ne algorithms to compute these indices in weighted double or triple majority games.. In section 2 we introduce the concept of generating function to solve the problem of counting the coalitions that have certain properties. Sections 3 and 4 are devoted to describe the computation of the normalized Banzhaf and the Shapley-Shubik indices of weighted m-majority games by using generating functions. The starting point of this approach are in works due to Cantor, Brams and A¤uso. Taking into account that the two decision rules approved in the Treaty of Nice are triple majority voting games, in section 5 we calculate the Banzhaf and Shapley-Shubik indices for the European Union enlargement under the Nice rules.. ¤ E-mail: mbilbao@cica.es y This research has been partially supported by the Spanish Ministery of Science and Technology, under grant SEC2000-1243

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


A Random Digit Search (RDS) Method for Sampling of Blogs and Other User-Generated Content Blogs are arguably the most popular genre of user-generated content (UGC), which make blogs a gold mine for social science research. However, existing research on blogs has suffered from non probability samples collected either manually or by computerized crawling based on random walks method. The current article presents a probability sampling method for blogs, called random digit search (RDS), that is modified from the popular "random digit dialing" (ROD) method used in telephone surveys. The RDS method was tested in a study of Sina Blog, a popular blog service provider (BSP) in China. The results show that, while "random walks" sampling tends to oversample popular/active blogs, probability samples generated by RDS yield consistent and precise estimates of population parameters. Although the RDS takes advantage of the numeric identification (I D) system used on Sina Blog, the general principles may be applicable to other BSPs and many other genres of UGC. Keywords random walks, random digit search, web sampling, web crawlingThe current article introduces a probability sampling design, called random digit search (RDS), which we have devised for a large-scale study on the sustainability ofblogging behavior. "Sustainability" refers to the continuation of publishing blog posts (posts) by blog authors (bloggers) regularly for a substantially long period after the initial uptake. The substantiality ofblogging (or activities of other user-generated content, or lJ GC) is closely related to the feasibility and desirability of division of labor in the mass media industries in the era of new information and communication technology (ICT). The modem media emerged and have since operated based on the classic economic principle of division of labor, by which full-time professionals with pre-/on-job training, are employed by media organizations, supported by the latest ICT of the time, and sometimes (or frequently) facilitated by institutionalized intonnants, to collect, edit, and disseminate materials of information, entertainment, or persuasiOn. The division of labor has enhanced the efficiency of media production as well as facilitated ownership concentration and content homogenization. The century-old model has, however, been challenged by the new genres of UGC in general and blogs in particular because billions of Internet users act as reporters, editors, producers, and distributors of media content in massive quantity and varying quality, with little or no fmancial and technical resources. Of various genres ofUGC, blogs are arguably the most popular given the low technical and financial barriers for ently. If the trend is sustainable, then the domination of media organizations, especially those conglomerates, on the marketplaces of ideas would be seriously undermined or even completely replaced. However, the promising potentials of the UGC movement need to be Ciitically examined. Our research on the sustainability of blogging is a first attempt in the direction.We have met a munber of methodological challenges ranging from sampling to measurement and analysis. Of these, sampling is the most fonnidable because there has been little guidance in the existing literature on how to generate random samples of web content in general and blogs in particular that are representative of the web universe under study. We have, thus, divided our research into two phases, focusing on sampling in the first phase and then moving to the substantive issues of sustainability in the second phase. This article reports exclusively the design and test results of our RDS scheme.

O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I B I I B I O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Sweep Synchronization as a Global Propagation Mechanism Abstract. This paper presents a new generic filtering algori thm that simultaneously considers n conjunctions of constraints as well as those constraints mentioning some variables Y k of the pairs X,Y k (1 ≤k≤n) occurring in these conjunctions. The main benefit of this new te chnique comes from the fact that, for adjusting the bounds of a variable X according to n conjunctions, we do not perform n sweeps in an independent way but rather synchroniz e them. We then specializes this technique to the non-overl apping rectangles constraint where we consider the case where several rectangles of height one have the same X coordinate for their origin as well as the same le ngth. For this specific constraint we come up with an incremental bipartite matching algorithm which is triggered while we sweep over the time axis. We illustrate the usefulness of this new pruning method on a timetabling problem, w here each task can't be interrupted and requires the simultaneous availability of n distinct persons. Each person has its own periods of unavailability a nd can only perform one task at a time.Keywords: Constraint Programming, Non-overlapping, Sweep, Timetabling. (1 ≤k≤n) occurring in these conjunctions. The main benefit of this new te chnique comes from the fact that, for adjusting the bounds of a variable X according to n conjunctions, we do not perform n sweeps in an independent way but rather synchroniz e them. We then specializes this technique to the non-overl apping rectangles constraint where we consider the case where several rectangles of height one have the same X coordinate for their origin as well as the same le ngth. For this specific constraint we come up with an incremental bipartite matching algorithm which is triggered while we sweep over the time axis. We illustrate the usefulness of this new pruning method on a timetabling problem, w here each task can't be interrupted and requires the simultaneous availability of n distinct persons. Each person has its own periods of unavailability a nd can only perform one task at a time.Sweep Synchronization as a Global Propagation Mechanism It has been quoted in [10] that one of the importan t challenges for constraint programming, is to "identify innovative ways to com bine constraints to produce efficient pruning techniques". The purpose of this paper is to present an instance of such a constraint pattern and its corresponding fil tering algorithm. In [2] we have introduced a generic sweep algorithm for adjusting the minimum or the maximum value of a domain variable 1 X according to a conjunction of constraints where al l constraints mention X as well as another domain variable Y .. The main contribution of this paper is to present a generalization of the previous algorithm to the following constraint pattern. We now consider n conjunctions ( ). of constraints such that all the constraints of each conjunction k C mention a given pair of domain 1 A domain variable is a variable that ranges over a finite set of integers; min( V) and max( V) respectively denote the minimum and maximum values of variable V, while dom( V) and sizedom(V) respectively designates the set of possible value s of variable V and the number of elements of that set. . The main benefit of this new technique is to obtain more pruning by replacing n independent sweeps by one single process where we coordinate the different sweeps.. The new filtering algorithm is based on an idea whi ch is widely used in computational geometry and which is called sweep [4 ] . Consider the illustrative example given in Fig. 1 where we have five constrai nts and their projection on two given variables, and assume that we want to find ou t the smallest value of X . By trying out In dimension 2, a plane sweep algorithm solves a pr oblem by moving a vertical line from left to right along the abscissa. It uses the following data structures: − a data structure called the sweep-line status, which contains some information related to the current position ∆ of the sweep-line, − a data structure named the event point series , which holds the events to process, ordered in increasing order wrt. the abscissa. The algorithm initializes the sweep-line status for the initial value of ∆. Then the sweep-line jumps from event to event; each event is handled, updating the sweep-line status. In our context, the sweep-line scans the va lues of the domain variable X that we want to prune. . of constraints by moving a sweepline from the minimum value of X to its maximum value. In our case, the events to process correspond to the starts and the ends of fo rbidden regions wrt. the constraints occurring in It can also be used in order to adjust the maximum value, or to prune completely the domain of a variable.. essentially means that the constraints of S have a specific structure of which one takes advantage for deriving a necessary condition, which can be evaluated efficiently. This is what is done for the timetabling problem present ed in Sect. 4. The next section recalls the notion of forbidden re gions, which is a way to represent constraints that is suited for the algori thms of this paper. Sect. 3 describes the synchronized sweep algorithm itself. Finally Se ct. 4 presents its specialization to the non-overlapping rectangles constraint where eac h rectangle has a height of one as well as the same length, and where in addition we t ake into account the fact that some rectangles have the same X coordinate for their origin. For this purpose we c ome up with an incremental bipartite matching algorithm ad apted to the fact that, while we sweep over the time axis, we hide and restore some nodes and all their attached edges.

B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O


Computationally sound secrecy proofs by mechanized flow analysis We present a novel approach for proving secrecy properties of security protocols by mechanized flow analysis. In contrast to existing tools for proving secrecy by abstract interpretation, our tool enjoys cryptographic soundness in the strong sense of blackbox reactive simulatability/UC which entails that secrecy properties proven by our tool are automatically guaranteed to hold for secure cryptographic implementations of the analyzed protocol, with respect to the more fine-grained cryptographic secrecy definitions and adversary models.Our tool is capable of reasoning about a comprehensive language for expressing protocols, in particular handling symmetric encryption and asymmetric encryption, and it produces proofs for an unbounded number of sessions in the presence of an active adversary. We have implemented the tool and applied it to a number of common protocols from the literature. Security proofs of cryptographic protocols are known to be difficult and the automation of such proofs has been studied soon after the first protocols were developed. From the start, the actual cryptographic operations in such proofs were idealized into so-called Dolev-Yao models, following [22, 23, 39] , e.g., see [31, 47, 4, 38, 44, 13] . This idealization simplifies proof construction by freeing proofs from cryptographic details such as computational restrictions, probabilistic behavior, and error probabilities. Conducting secrecy proofs by typing based on these abstractions has shown to be a particularly salient technique as it allowed for elegant and fully automated proofs, often even for an unbounded number of sessions.. A type system was recently presented in [35] that combines the conciseness of language-based reasoning in Dolev-Yao models with strong computational soundness guarantees, i.e., if an abstract proPermission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. tocol typechecks then its cryptographic realization provably keeps the quantities handed to it by the protocol users (payload data) secret in the computational sense. Such computational soundness guarantees of abstract proofs have recently been identified as central for gaining trustworthy guarantees of security protocols: the computational model strives for stronger, more fine-grained security notions and furthermore considers a more realistic adversary that is allowed to perform arbitrary bitstring manipulations as long as they can be performed in probabilistic polynomial-time. However, despite being the first type system that allows for abstract, computationally sound reasoning under active attacks, the major drawback of [35] was that type inference was not considered. As a consequence, this work did not entail an automated procedure for analyzing secrecy aspects of cryptographic protocols with cryptographic soundness guarantees, which arguably is the central goal of unifying the advantages of both approaches.. We remedy this shortcoming by presenting a mechanized approach for soundly proving secrecy of payload data in cryptographic protocols by analysing the possible flows of data during the execution of the protocol. Our approach is capable of reasoning about a comprehensive language for expressing protocols, in particular handling symmetric encryption and asymmetric encryption, allows for more precise analyses compared with the type system of [35] , is fully automated, and produces proofs for an unbounded number of sessions in the presence of an active adversary.. Our results (and the one of [35] as well) rely on a variant of the Dolev-Yao model of Backes, Pfitzmann, and Waidner, henceforth called the BPW model, which has been shown to be computationally sound in the strong sense of of blackbox reactive simulatability (BRSIM). The security notion of BRSIM means that one system (here, the cryptographic realization) can be plugged into arbitrary protocols instead of another system (here, the BPW model) [45, 18] . While first security proofs of several common protocols have been hand-crafted using the BPW model [8, 6] , recent work has shown that the BPW model is accessible to theorem proving techniques as well [48] . Our work shows that soundly proving secrecy properties in a fully automated manner is possible using the BPW model, and it identifies cryptographically sound secrecy by typing as a promising direction for future work in general. In particular, our line complements the large number of existing works that aims at establishing computational soundness of Dolev-Yao models without considering secrecy by typing, cf. the section on related work for more details.. The analysis presented in this paper builds on the spi-calculusstyle language, its deterministic semantics and the corresponding type system from [35] and is inspired by methods from control flow analysis. It works by collecting for each defined variable at each protocol point the possible shapes of terms that this variable may point to, including the possible creation points of the atomic subterms. The same information is also collected for channels between participants for encryption keys, thus yielding information which terms may be communicated over which channel, and which terms may be encrypted with which keys by honest participants, respectively. Finally, the same abstraction is also collected for terms that the adversary may learn during the run of the protocol.. There are a couple of noteworthy points. First, all inputs from the adversary are modeled using a single abstract value, thus freeing the analyser from the necessity to model every new term that the adversary may construct. Instead, we consider explicit rules for decomposing this abstract value, i.e., the adversary's input, which allows us to keep the description of the adversary's knowledge finite. Secondly, parts of the protocol statically following a public-key decryption are analysed twice -once assuming that the ciphertext was created by an honest participant and once assuming that it was created by the adversary. The distinction of these two cases (which was already present in [2] and also in [35] ) is important for the precision of the analyser. Thirdly, we collect not only the possible values of variables but also relationships between them. Whenever certain operations restrict the set of possible values of some variables, we exploit these recorded relationships in order to restrict the set of values of related variables as well. This collection of relationships is reminiscent of shape analysis [51] , although our task is considerably simpler here than a full shape analysis because we do not have destructive updates. We record the relationships between variables by collecting a set of constraints that their abstractions must satisfy.. Our prover (consisting of constraint generator and solver) has been implemented in O'Caml and can be downloaded at http: //www.ut.ee/ ∼ peeter l/research/brsiman. We set up a constraint system whose solutions upper-approximate the values flowing through the protocol. A constraint system consists of two main parts -constraint variables and the set of constraints. A constraint variable is just an identifier together with an associated domain (an upper semilattice) of possible values. A constraint is a statement of the form E ≤ C where C is a constraint variable and E is a monotone expression over constraint variables. A solution of a constraint system is a valuation, mapping each constraint variable to a value in its domain, such that all constraints are satisfied.. We will prove that any solution to our constraint system will be a safe approximation of any possible protocol run. To get the best precision, we are interested in the least solution. There are wellknown methods for finding the least solutions for constraint systems with monotone constraints. Early work on linking Dolev-Yao-style symbolic models and cryptography [5, 28, 32, 29] only considered passive attacks, and therefore cannot make general statements about protocols.. The security notion of BRSIM was first defined generally in [45] , based on simulatability definitions for secure (one-step) function evaluation. It was extended in [46, 18] , the latter with somewhat different details and called UC (universal composability), and has been widely applied to prove individual cryptographic systems secure and to derive general theoretical results. In particular, BR-SIM/UC allows for plugging one system into arbitrary protocols instead of another system while retaining essentially arbitrary security properties [45, 18, 10] .. A cryptographic justification of a Dolev-Yao model in the sense of BRSIM/UC was first given in [11] with extensions in [12, 9] . Later papers [40, 34, 19] considered to what extent restrictions to weaker security properties or less general protocol classes allow simplifications compared with [11] : Laud [34] has presented cryptographic foundations for a Dolev-Yao model of symmetric encryption but specific to certain confidentiality properties where the surrounding protocols are restricted to straight-line programs. Warinschi et al. [40, 20] have presented cryptographic underpinnings for a Dolev-Yao model of public-key encryption, yet for a restricted class of protocols and protocol properties that can be analyzed using this primitive. Baudet, Cortier, and Kremer [14] have established the soundness of specific classes of equational theories in a Dolev-Yao model under passive attacks. Canetti and Herzog [19] have shown that a Dolev-Yao-style symbolic analysis can be conducted using the framework of universal composability for a restricted class of protocols, namely mutual authentication and key exchange protocols with the additional constraint that the protocols must be expressible as loop-free programs using public-key encryption as their only cryptographic operation. We stress that none of these works build on type inference for proving secrecy properties of security protocols.. The work that comes closest to our work is the work of Laud [35] who designed a type system for proving secrecy aspects of security protocols based on the BPW model. He shows that if an abstract protocol typechecks in his system, then its cryptographic realization provably keeps the quantities handed to it by the protocol users secret in the computational sense. The proof of this fact exploits the BRSIM/UC soundness result of [11, 9, 10] for carrying over symbolic proofs of secrecy in the BPW model to the actual cryptographic realization, similar to the present paper. However, type inference has not been implemented yet in this paper so that the paper did not entail a mechanized procedure for soundly proving secrecy aspects of security protocols.. Efforts are also under way to formulate syntactic calculi with a probabilistic, polynomial-time semantics, including approaches based on process algebra [41, 37] , security logics [30, 21] and cryptographic games [15] . In particular, Datta et al. [21] have proposed a promising logical deduction system to prove computational security properties. We are not aware of any implementations of these frameworks, except for Blanchet's [15] , who has recently presented an automated tool for proving secrecy properties of security protocols based on transforming cryptographic games. This line of work is orthogonal to the work of justifying Dolev-Yao models, which offer a higher level of abstractions and thus much simpler proofs where applicable, so that proofs of larger systems can be automated.. Let us also mention some of the work in the area of type systems for cryptographic protocol analysis. The first type system of this kind was proposed by Abadi [1] , which could be used for verifying the secrecy of payloads or nonces in the protocols using only symmetric encryption. This type system, as well as all the remaining ones that we describe work in the Dolev-Yao model. The type system was extended to cope with asymmetric encryption by Abadi and Blanchet [2] . Abadi and Blanchet [3] further generalized this type system to handle generic cryptographic primitives. The type system of Abadi has also been extended by Gordon and Jeffrey [25, 26, 27] to check for integrity properties. Finally, a static program analysis [33] and a type system [36] exist that work directly in the computational model, handling programs containing symmetric encryption, both for passive adversaries only.. Abstract interpretation, which is in most cases automatable using data flow analysis, has also been considered for the analysis of cryptographic protocols within the Dolev-Yao model. See for example [16] and the references contained therein. We find the (componentwise) least solution for the aforementioned collection of inequalities. The least fixed point is computed iteratively, using a version of the solver from [24] , which is specifically tailored to systems of constraints. The computation might not terminate but we believe that this is not a problem for real protocols; in fact, we have never encountered this situation when we applied our tool to common protocols of the literature. The only case in which computation is not guaranteed to terminate is if the protocol is able to create terms of arbitrary complexity all by itself, without the help from the adversary. We also believe that the potentially exponential number of variables in the size of the protocol is not a problem in practice because protocol descriptions are short.. There are ways to deal with the divergence of the fixed-point computation (add suitable widenings). Also, we believe that the exponential number of sets can be represented in a more compact way, if necessary.. The value of L(R, C) is also computed iteratively, using the same solution method. The mapping X is initialized with R and the iteration proceeds downwards.. The constraint generator and solver have been implemented in O'Caml (version 3.09 was used to compile it to native code). We have tested the analyser on several protocols from the literature, namely Needham-Schroeder public key [42] , its fix by Lowe [38] , Otway-Rees [43] , Yahalom, and its modification by Burrows et. al [17] . The goal of all these protocols is to exchange a symmetric key between two parties. We use our analysis to find out whether it is safe to use the exchanged key to protect secret payloads in transit over public networks. We have thus added an extra message at the end of the protocol sessions in all of these protocols. This extra message contains a secret payload encrypted under the freshly exchanged key. (Note again that we do not consider real-or-random secrecy of the keys in this paper, but secrecy of the (encrypted) payloads.) Our analysis considers all these protocols secure, except for the original (and indeed flawed) Needham-Schroeder protocol. If one allows old session keys to become known to the adversary, there may be attacks that are not discovered by our analyser since the BPW model does not consider the leakage of secret keys that have been used (this would cause a so-called commitment problem which makes a proof of computational soundness in the sense of BRSIM/UC impossible). Problems with the Needham-SchroederLowe and the modified Yahalom protocol have been published [19, 49] but these problems do not affect payload secrecy propertiesthey do not allow an adversary to learn the new key or inject its own key which could then be used to learn information on the payload. The running times of the analyser on a computer with 1 GHz Intel Celeron processor and 256 MB of main memory are between one and eight seconds for these protocols with less than two seconds for Needham-Schroeder-Lowe and both versions of Yahalom.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Holistic Verification of Handwritten Phrases AbstractÐIn this paper, we describe a system for rapid verification of unconstrained off-line handwritten phrases using perceptual holistic features of the handwritten phrase image. The system is used to verify handwritten street names automatically extracted from live U.S. mail against recognition results of analytical classifiers. Presented with a binary image of a street name and an ASCII street name, holistic features (reference lines, large gaps and local contour extrema) of the street name hypothesis are ªpredictedº from the expected features of the constituent characters using heuristic rules. A dynamic programming algorithm is used to match the predicted features with the extracted image features. Classes of holistic features are matched sequentially in increasing order of cost, allowing an ACCEPT/REJECT decision to be arrived at in a time-efficient manner. The system rejects errors with 98 percent accuracy at the 30 percent accept level, while consuming approximately 20/msec per image on the average on a 150 MHz SPARC 10.Index TermsÐWord verification, holistic approaches, word shape matching, handwritten word recognition, address interpretation. H ANDWRITTEN Word Recognition (HWR), also called Isolated Handwritten Word Recognition, deals with the problem of machine reading of handwritten words. The location and segmentation of handwritten words from their surroundings is a complex task for most real applications (reading legal amounts on bank checks, responses on forms, and addresses on mail pieces), and a research problem in its own right. Most work on isolated HWR assumes that the handwritten word has been segmented by an algorithm appropriate to the application domain prior to being presented to the HWR algorithm.. Approaches to the task of HWR have traditionally been classified as analytical and holistic. The analytical approach treats a word as a collection of simpler subunits such as characters and proceeds by segmenting the word into these units, identifying the units and building a word-level interpretation using the lexicon. The word-based or holistic approach, on the other hand, treats the word as a single, indivisible entity and attempts to recognize it using features of the word as whole. The latter approach is inspired by psychological studies of human reading [1] , [2] which indicate that humans use features of word shape such as length, ascenders, and descenders in reading.. In this paper, we use the term ªword verificationº to refer to the task of verifying that a given image of a word or phrase is that of a given ASCII string, or one of a given set of ASCII strings. While word recognition is a classification task with as many possible responses as there are word classes, verification is the task of deciding whether or not a pattern could belong to a given word class. Independent verification is useful in overcoming limitations of a particular set of features or HWR algorithm, in terms of spotting errors and improving robustness with respect to a variety of writing styles.. Section 2 describes some related work in the area of using holistic features and verification. In Section 3, we discuss some challenges to the purely shape-based verification of U.S. street names. In Section 4, we describe HOVER, a system for rapid holistic verification of street name images using coarse shape features.. Section 5 describes the evaluation of the system. A summary of this effort and a plan for future work is presented in Section 6. [4] and CMR [5] . Each classifier takes as input the binary image of the street name and the expanded lexicon of street name candidates, computes a confidence for each street name candidate, and ranks the lexicon by decreasing confidence. Both classifiers are based on the analytical paradigm of oversegmentation of the given binary word image into segments, and use of OCR to determine the identities of groups of segments. However, they differ in the segmentation algorithm, features used by OCR, and the extent to which the lexicon is integrated into the recognition process. An error is defined in the context of this task as the event that the add-on associated with the top choice of a classifier is not the correct add-on for the mail piece. HOVER allows rapid verification of handwritten phrases using holistic features such as gaps, length, ascenders, and descenders. The detection of the true word gaps, ascenders, and descenders is lexicon-driven. In general, ªover-extractionº of candidates combined with lexicon-driven detection improves the reliability of feature detection. The confidences of image features are derived from multiple attributes using logistic functions computed from training samples using Logistic Regression.. Features of verification strings (lexicon phrases) are predicted from tabulated features of constituent characters using heuristic rules. A dynamic programming algorithm is used for matching positional feature candidates from the image with predicted features of the lexicon phrase.. Image processing in chain code and a hierarchical treatment of features maximize computational efficiency. The hierarchical strategy also facilitates rapid rejection of poor matches and increases system throughput.. Increasing the robustness of feature extraction is an important concern. Spurious extrema typically lead to additional ascenders and descenders. The writing of many authors is marked by an extending below the baseline of the leading vertical stroke of the starting letter in each word. Optional features help to compensate for these, but must be used with caution since they may match genuine image features. The elimination of spurious minima is therefore an important research direction. Moreover, the confidences computed for image features are highly dependent on the reference lines. The use of separate sets of reference lines for each word in the phrase [19] instead of a single set of global reference lines for the entire phrase is highly desirable.. More powerful character models which incorporate statistics from training is the important next step after ideal features. Improved modeling of optional features, better ways of combining results from distortion models, and better thresholding schemes are other important directions for further research. Evelyn Kleinberg is a senior research scientist at the Center of Excellence for Document Analysis and Recognition (CEDAR), at State University of New York at Buffalo. Since 1990, she has participated in a variety of projects at CEDAR involving handwriting recognition and address interpretation. She has served as technical manager on several projects for the U.S. Postal Service, including real-time handwritten address interpretation and remote computer reading. These projects are now functional in the field.. Venu Govindaraju received the PhD degree in computer science from the State University of New York, at Buffalo in 1992. Currently, he is the associate director of Center of Excellence for Document Analysis and Recognition (CEDAR) and concurrently holds the research associate professorship in the Department of Computer Science and Engineering, State University of New York at Buffalo. Presently, he is leading multiple projects on postal applications. He has coauthored more than 90 technical papers in various international journals and conference proceedings and has one U.S. patent. He is the associate editor of the Journal of Pattern Recognition and the area chair of the IEEE SMC technical committee for pattern recognition. Dr. Govindaraju has been a coprincipal investigator on several federally sponsored and industry sponsored projects. He is a senior member of the IEEE. The context of interpretation of handwritten addresses (HWAI) is the prime motivation for the development of a fast word verification system based on the holistic paradigm. Streets recognized with high confidence by either classifier are accepted and those with poor confidences are rejected by WRC. Street names recognized with confidences in the ªgray-areaº of both classifiers are passed to a decision combination stage which looks for agreement between the two classifiers and accepts the agreed upon top-ranked street name if their combined confidence exceeds a threshold . In general, when neither WMR nor CMR is very confident, but both agree on the top-ranked street, it is more likely than not that the street is correctly recognized. Experiments indicate that nearly 84 percent of the cases of agreement rejected in the decision combination stage due to low classifier confidences are, in fact, correctly classified. A word verification system may be used to salvage some of the correctly classified cases from the pool of ªagreement-rejectsº by verifying that the street name image is that of the agreed upon street name.. Clearly, the correctly classified cases are not separable from the error cases based on CMR and WMR confidences, and the verifier must use a different set of features. The verification must also be rapid to meet the real-time requirements for the HWAI task. Holistic features are a logical choice for this purpose, both because of their orthogonality to the features used by the analytical classifiers, and the speed of feature extraction and matching they make possible.. We have used holistic methods as a lexicon reduction step and analytical recognizers as the second stage [6] . However, such a strategy is more suitable in applications such as recognition of prose where the initial lexicon size is very large (! IY HHH). The HWAI application presents an average lexicon size of 10. Hence, we choose to use the holistic paradigm to verify the choice(s) made by the analytical recognizers. We do use a way of weighting the recognizers by the choice of the confidence thresholds. The more reliable recognizer's results are accepted at a lower threshold. This is indirectly enforcing a weighting scheme. In our application, on average, WMR is the most reliable followed by CMR and the holistic recognizer (HOVER). Moreau [7] extracted vertical and horizontal strokes, loops, i-dots, and t-bars from the offline image to obtain a string descriptor, and compared the descriptor with unique prototypes of words found in French check amounts and their more common orthographic deviations using Dynamic Programming.. Leroux et al. [8] extracted ascenders, descenders, loops, i-dots, and unattached t-bars from the contours of connected components, and obtained a string descriptor. Word length was estimated as the number of letter segments obtained as a by-product of a separate analytical subsystem. The Levenshtein metric was used to compare the test string with reference strings obtained from training corresponding to a small lexicon of check amounts.. Camillerapp et al. [9] labeled singular vertices (endpoints, crossings, and points of local curvature) in the skeletonized gray-level image and obtained a tree of stroke primitives. Each tree node was described by the type of primitive, vertical word zone position, and its relative horizontal position within the word. Each lexicon word was coded as a similar tree of primitives, except that each node could describe a set of primitives covering variations that may be expected at that point. The presence of extensions and a length estimate were used to reject irrelevant candidates. A similarity score was using a two-dimensional adaptation of edit distance with only insertions and deletions. In addition, a dissimilarity score was computed based on the primitives present in the word but forbidden in the model. The likelihood of a word model was computed as the difference between the similarity and dissimilarity scores. Dodel and Shinghal [10] describe a hybrid analyticalholistic method for offline words which uses a decision tree (akin to`20-questions') to identify the correct class from a static lexicon of 31 words. Aspect ratio (horizontal extent/ mid zone width), and relative positions of ascenders and descenders are used to achieve direct recognition of some words such as`Eight,' and partial recognition of others.. Holistic features have been used for the verification of handwritten British postal addresses [11] , [12] . The authors report that for some choice of thresholds, the verification procedure allows 43 percent of the postcodes to be read with an error rate of 1.5 percent. Because the object of the system is verification of the postcode using the rest of the address, the authors have not attempted to quantify the success of the system at verifying individual words in the address. The execution time per address of the verification process is also not discussed.. The term ªverificationº is encountered most frequently in the context of signatures [13] . Signature verification is markedly different from the application we have outlined in at least two respects: 1) The classes are static, and usually a large number of exemplars of each class may be assumed available, and 2) there is very little variability in the appearance of the handwritten signal compared to the general case of omni-scriptor, unconstrained handwritten words.. Recently, there has been some investigation into the task of spotting keywords in handwritten documents [14] . These approaches are typically based on global word shape and require models of the keywords to be constructed from training. This naturally limits the keywords that may be searched for to those with sufficient presence in the data set. The task of verification as we have described it, on the other hand, works by synthetically constructing word models from character models, since the ªkeywordº (phrase to be verified) is not known a priori.. Clearly, our task calls for the application of the holistic paradigm to a dynamic lexicon scenario [15] , wherein the lexicon is not known a priori. Each zip code and street number pair presents a unique lexicon. Thus, each street name image is linked with a unique lexicon. As the zip code and street numbers vary among mail pieces, so do the lexicons. Such dynamic and large lexicon scenarios represent a challenge for holistic approaches since traditional training of a classifier from a large population of sample images of each word class is not possible. In [16] , we developed a methodology of coarse holistic features and heuristic prediction of such features from ASCII that allows the application of holistic features to large and dynamic lexicon scenarios. In this section, we introduce HOVER, a system for rapid HOlistic VERification of handwritten phrases such as street name images using coarse word shape features. The input to HOVER is a binary image of a handwritten phrase and a verification lexicon containing one or more ASCII verification strings. The objective of the system is to verify that the image is that of any one of the verification strings using coarse word shape features.. In our application, the input image is that of a handwritten street name as extracted by the HWAI system, and the lexicon is comprised of the street name variants of the concurrent highest ranked street from WMR. The design of HOVER, however, is independent of application domain. We will use the term ªlexicon phraseº interchangeably with verification string to refer to strings from the verification lexicon.. The major components in HOVER are described in detail in the sections that follow. Processing is composed of a bottom-up feature extraction followed by a top-down evaluation phase.. The salient features of HOVER are the following:. 1. Chain-code-based image processing: Preprocessing operations such as slant normalization and feature extraction tasks such as detection of local extrema and determination of reference lines are implemented using a chain-coded representation of the binary image for greater computational efficiency [17] . 2. Lexicon-driven detection of features: In lieu of purely bottom-up, image-driven detection of positional features such as interword gaps, ascenders, and descenders, multiple candidates are extracted from the image and the predicted features of the verification string are used to determine the true image features among the extracted candidates. This is analogous to a lexicon-driven ªoversegmentationº strategy of using elastic matching to select the best alignment of segmentation points corresponding to a lexicon string [4] . 3. Variable feature grid: Positions of features such as gaps, ascenders, and descenders are computed with respect to a variable grid determined by the reference lines and lower contour minima [18] . The positions are real-valued and expressed in terms of Holistic Segment Distance. 4. Heuristic prediction of lexicon features: Features of the verification string are predicted from ASCII using coarse models of ªidealº characters. 5. Hierarchical evaluation: Lexicon evaluation is organized into stages. The sequence of features used is: 1) length, 2) gaps, 3) ascenders, and 4) descenders. Each stage is composed of a feature matching step and a decision step enabling rapid rejection of poor matches. 6. Elastic matching: A dynamic programming algorithm is used to match positional features such as gaps, ascenders, and descenders of the verification string with the corresponding candidates from the image, the object being to determine the best match for the predicted lexicon features from among the extracted image feature candidates. 7. Models of positional distortion: Models of how ideal shape features are distorted in practice are implicitly employed to determine the best match between the ideal lexicon features and feature candidates from the image. 8. Attributes of writing style: Style parameters computed during the matching process are used to compensate for particular writing styles by rescaling confidence measures prior to thresholding. 9. Training: Confidences for positional features such as gaps, ascenders, and descenders are computed from logistic models obtained using Logistic Regression from manually truthed training samples.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I B I I B I I B I O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Automatic Guidance of a Farm Tractor Relying on a Single CP-DGPS Abstract. Precision agriculture involves very accurate farm vehicle control along recorded paths, which are not necessarily straight lines. In this paper, we investigate the possibility of achieving this task with a CP-DGPS as the unique sensor. The vehicle heading is derived according to a Kalman state reconstructor, and a nonlinear velocity independent control law is designed, relying on chained systems properties. Field experiments, demonstrating the capabilities of our guidance system, are reported and discussed. The development of guidance systems for agricultural vehicles receives more and more attention from researchers and manufacturers. The objectives and the motivations are numerous, since automatic guidance:. -reduces the work arduousness: for instance, achieving perfectly parallel runs when driving manually, is very tiring over hours. -allows the driver to fully devote his time to the monitoring and the tuning of the tool. This clearly can improve the quality of the agronomic work carried out. -insures an optimal work precision throughout the day and on the whole field, by minimizing double applied and skipped areas between successive passages. This enables the exact placement of field inputs (seeds, fertilizers, pesticides, . . .), and therefore reduces their cost. -allows to operate wider tools at higher speeds. Therefore it can increase productivity.. Many experiments have been conducted and reported in the literature. They can be classified into 2 categories, according to the kind of sensor to be used.. The first category uses relative information. Researchers have for instance investigated the video camera sensor (Debain et al., 2000; Khadraoui et al., 1998; Ollis and Stentz, 1997) . This approach proposes two kinds of difficulties: the first one is the reference extraction. Extreme conditions of dust, for instance, reveal the weakness of the detection side. The other problem arises when the new reference is computed in an iterative way from the previous one. The automatic guidance system can then lead to oscillations.. The second category uses absolute information. A recent technological development allows accurate 3D positioning of the vehicle in a field without the need for buried cables or field-installed beacons: the Global Positioning System (GPS).. DGPS (Differential GPS) were first used in agricultural applications in order to produce field maps. For instance, during the harvest, corn weight measurement devices are coupled with a DGPS in order to produce yield maps. DGPS can also be used to map the amount of seed, of pesticide or of fertilizer displayed on each field location.. State of the art CP-DGPS (Carrier Phase DGPS), also named RTK GPS (Real-Time Kinematic GPS), reach the realtime centimeter accuracy. This clearly allows the design and the implementation of an absolute vehicle guidance system. This technology can be used in special operations, in which the vision system is unable to proceed, for instance, in spraying or fertilizing operations with no visible markers such as boom wheel tracks or foam marks. Promising results have been reported in the literature: a GPS and a fiber optic gyroscope (FOG) have been used in Nagasaka et al. (1997 ), when O'Connor et al. (1996 has described a solution with multiple GPS antennas. Marketing of such devices has then followed almost immediately: the first commercial guidance system, relying on a CP-DGPS, and dedicated to agricultural use, has been introduced in 1997 by the Australian company AgSystems. This device, named BEELINE Navigator, consists in a GPS coupled with an Inertial Navigation System (INS). It has won a number of industry awards, and more than 100 guidance systems have been sold in Australia. AgSystems then entered into the U.S. market (California) in late 1999. This market is currently led by the U.S. company IntegriNautics. Their AutoFarm System makes use of 3 GPS receivers embarked on the tractor. Moreover, GPS systems suppliers as well as agricultural manufacturers are now also investing in this market: Trimble is selling the AgGPS Autopilot, relying mainly on their AgGPS 214 CP-DGPS, when manufacturer John Deere has established a partnership with the University of Illinois to develop a completely automated tractor using several sensors (GPS, vision, near infrared reflectance sensor) (Reid and Niebuhr, 2001) . John Deere is also co-working with Stanford University, (Bevly and Parkinson, 2000) . Similar approaches are under current development in Japanese universities, (Yukumoto et al., 2000) . These works and commercial products show clearly the relevancy of GPS guidance systems for agricultural applications.. Currently, these devices are mainly devoted to applications where the vehicles must execute perfectly straight lines (row cropping, harvesting, . . .) . Extending guidance systems capabilities in order that vehicles could also follow curved paths would be of practical interest (in order to achieve automatic half-turns, field boundaries following, . . .). In addition, it can be observed that most of the above-mentioned guidance systems make use of several sensors. Such an equipment is efficient since it provides control designers with the whole vehicle attitude, but is quite expensive. This paper addresses these 2 directions: our objective is to investigate the possibility to achieve curved paths following from a unique CP-DGPS sensor. Our experimental vehicle, depicted on Fig. 1 , is a farm tractor.. Preliminary results can be found in Cordesses et al. (1999 Cordesses et al. ( , 2000 . This paper proposes a comprehensive report on our work. It is organized as follows: the kinematic model of a farm tractor is first derived. Then, the problem of measuring the whole tractor state vector with a GPS as the unique sensor is addressed. Next, the design of a nonlinear, velocity independent, curved path following control law is detailed. Finally experimental results are displayed and discussed.

O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Gradient estimation for a class of systems with bulk services: A problem in public transportation This article presents a comparison of different gradient estimators for the sensitivity of waiting times in a bulk server system. Inspired by a transportation network, our model is that of a bursty arrival process that waits at a "platform" until the server is available (representing a train or bus ready for departure). At the departure epochs, all waiting passengers leave at once. The departure process is assumed to be a renewal process and, based on a limiting result, the interdeparture times are approximated by truncated normal random variables. The interarrival times are assumed to be identically and independently distributed (i.i.d.), with a general distribution of bounded density. We are interested in calculating the sensitivities of the total cumulative waiting time of all passengers with respect to the interdeparture times. For this general model where neither the interarrival times nor the interdeparture times are exponential, there is no analytical formula available. However, the estimation of such sensitivities is an important problem for flow control in such networks. We establish a Smoothed Perturbation Analysis (SPA), a Measure-Valued Differentiation (MVD), and a Score Function (SF) estimator, including numerical experiments. The present research is motivated by a larger research project on intelligent urban transportation (see Vázquez-Abad and Zubieta [2005] and references therein). The goal is to synthesize a decentralized control procedure to adjust the frequencies of the different lines in a subway network, using stochastic approximation to optimize the total daily cost of the network. The results show that such control procedures can give meaningful results in real time if:. -It is possible to build an estimator of certain local gradients at each platform where two or more lines meet (called transfer platforms), and -This estimator has a relatively small variance so that the procedure can actually adapt in a timely manner to changes in passenger behavior.. The purpose of the present work is to answer these two questions. To better compare the estimators, we develop instances of gradient estimators using the three methodologies that are the only ones applicable to the problem, to our knowledge. Our development is not merely an exercise on the implementation of known techniques: New theoretical results and implementation of the estimation methods are analyzed. Motivated by an important and challenging problem in public transportation, we derived an SPA, an SF, and an MVD estimator for the sensitivities of the waiting times of bursty arrivals to a bulk server system. For our model, the SPA and MVD sensitivity estimators turn out to be intrinsically different and our analysis may serve as a counterexample to the folk belief that SPA and measure-valued differentiation yield in principle equivalent estimators. Efficient implementation of the SPA estimators suffers from the problem of biasedness, whereas the SF estimator can be implemented without difficulty in its unbiased form. While single run requires somewhat elaborate coding, when it comes to sample variance, the MVD estimator outperforms the others. It should be apparent that our single-path implementation is actually independent of the distribution of interdeparture times; that is, once the random variables Y ± ( p) are generated, regardless of their distribution, the code will evaluate a MVD derivative. This implies that the MVD formulation here can be extended to other bulk service systems with different interdeparture times. In this sense, we believe that the phantom MVD estimators present the same advantages of single-path implementation methods such as IPA, as well as those of distributional approaches such as SF, while overcoming their disadvantages. The investigation into variance reduction techniques such as control variates is a topic of further research.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O B I O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Diagnosis of Gastric Carcinoma By Classification on Feature Projections A new classification algorithm, called BCFP (for Benefit Maximizing Classifier on Feature Projections), is developed and applied to the problem of diagnosis of gastric carcinoma. The domain contains records of patients with known diagnosis through gastroscopy results. Given a training set of such records, the BCFP classifier learns how to differentiate a new case in the domain. BCFP represents a concept in the form of feature projections on each feature dimension separately. Classification in the BCFP algorithm is based on a voting among the individual predictions made on each feature. In the gastric carcinoma domain, a lesion can be an indicator of one of nine different levels of gastric carcinoma, from early to late stages. The benefit of correct classification of early levels is much more than that of late cases. Also, the costs of wrong classifications are not symmetric. In the training phase, the BCFP algorithm learns classification rules that maximize the benefit of classification. In the querying phase, using these rules, the BCFP algorithm tries to make a prediction maximizing the benefit. A genetic algorithm is applied to select the relevant features. The performance of the BCFP algorithm is evaluated in terms of accuracy and running time. The rules induced are verified by experts of the domain. In clinical medicine, reaching a conclusion about a patient's symptoms, when presented with complex and sometimes contradictory clinical information, is really difficult. A clinician usually makes decisions based on a set of measurements and observations about a patient. He evaluates all the factors subjectively in order to reach a diagnosis. However, it is obvious that clinicians may have great difficulty in analyzing enormous amount of clinical and histopathological data. Therefore more sophisticated quantitative techniques are needed to help clinicians to consider all the data and make better diagnoses. Some sophisticated quantitative techniques are proposed to the doctors by computer scientists via machine learning techniques in order to help in this decision making process. In this paper we propose an inductive supervised learning algorithm called Benefit Maximizing Classifier on Feature Projections (BCFP) applied to a medical dataset in order to diagnose the gastroenterological tumors. BCFP is based on a technique, called feature projections, which has been successfully employed in CFP [6] .. The input to the BCFP training algorithm is a set of training instances that are the descriptions of subjects with known diagnoses. Learning from the training examples, BCFP constructs a representation of the classification knowledge inherent in these examples. This knowledge is represented as the projections of the training dataset as feature intervals on each feature dimension separately. For each feature dimension, projection points with similar characteristics are grouped into intervals. Therefore, an interval is a generalization that represents a set of feature values that yield the same classifications. Classification in the BCFP algorithm is based on a voting among the individual predictions made on each feature. Since each feature participates independently of the others, both in learning and classification, BCFP enables an easy and natural way of handling missing feature values by simply ignoring them.. Other machine learning algorithms using feature projection based knowledge representation were successfully applied to medical domains. For example, an expert system named DES was implemented for differential diagnosis of erythemato-squamous diseases in dermatology [5] based on the VFI (Voting Feature Intervals) technique [4] . CFI was applied to the diagnosis of cardiac arrhythmia from standard 12 lead Electrocardiograph (ECG) recordings [3] . These classification systems, however, are not designed for cost-sensitive classification domains. Therefore they do not work on the gastric carcinoma domain, where the benefit of correct classification of early stages is more than that of later stages; also the cost of wrong classification is different for all pairs of predicted and actual classes.. The next section describes the gastric carcinoma domain in detail. Section 3 explains the BCFP algorithm. Section 4 presents the results of the application of the BCFP algorithm to the gastric carcinoma domain; also the BCFP algorithm is compared with the performance of the medical students specializing on gastroenterology. Finally, the last section concludes with some remarks and suggestions for feature work. In this paper, a new classification algorithm, called BCFP, has been developed and applied to the diagnosis of gastric carcinoma tumors. The BCFP algorithm aims to maximize the benefit of classification, reducing the cost of possible misclassifications. It uses the feature projections based knowledge representation.. The feature projections based knowledge representation allows the BCFP algorithm to process each feature separately. The missing feature values of instances are simply ignored, and only the known values are used both in training and querying. The classification model is constructed only using the known feature values of the training instances. Also the class of a query instance is predicted by considering only the given values of the features. This feature of the BCFP algorithm makes it robust to missing feature values. In other classification algorithms, such as decision tree algorithms, missing values require extra care [13] .. Another advantage of using the feature projections as the knowledge representation is that the constructed rules are based on a single feature and an associated set of values. Therefore, the rules are simple and easy to be verified by a human expert. The rules constructed for the gastric carcinoma dataset have been verified and found to be correct by the expert gastro-enterologists.. The BCFP algorithm is applicable, in particular, to concepts where each feature, independent of the other features, can be used in the classification. One might think that this requirement may limit the applicability of BCFP, since in some domains the features might be dependent on each other. However, Holte has pointed out that the most real-world data sets for classification tasks are such that their attributes can be considered independently of each other [7] . Also, Kononenko claimed that in the data sets used by human experts there are no strong dependencies between features [10] . The BCFP algorithm achieved very good accuracy on the gastric carcinoma dataset available. The result was even better than the medical students specializing on internal medicine. This showed us that the differential diagnosis of gastric carcinoma classes is quite difficult even for medical doctors. We used a genetic algorithm for selecting the relevant features. With selected features the BCFP algorithm achieved an excellent classification accuracy.. The BCFP algorithm constructs a rule for each interval formed by the projections of training instances on features. The votes of an interval to the class labels are based on the number of training instances with that class value falling in that interval, and the entries of the benefit table. A rule which gives similar votes to each class does not make any difference in the final classification of the query instance. Such a rule is usually uninteresting to the domain expert. Therefore it can be discarded from the model. As a future work we plan to develop a system that can measure the interestingness of a rule constructed by the BCFP algorithm. Selecting and providing these interesting rules constructed from the data available may provide a domain expert with some pointers for further experiments and research ideas. The BCFP algorithm and the accompanying genetic algorithm for feature selection have been implemented in the C language to run the experiments. In measuring the performance of the BCFP algorithm we used 10-fold cross-validation accuracy, i.e., the whole data set is partitioned into 10 equal sized subsets. One of the subsets is used as the test set, and the other nine as the training set. This process is repeated 10 times, once for each subset as the test set. This technique ensures that the training sets are disjoint, and each instance in the data set is classified exactly once. Accuracy is the average of the accuracy values of these 10 runs.. Using all of the 68 features of the data set, the BCFP algorithm achieved 85.7% accuracy. However, the feature selection algorithm chose only 32 of the 68 features as relevant for a beneficial classification. With the selected set of features the BCFP algorithm achieved 94.3% accuracy. The selected features are Rh factor, intestinal metaplasia, curvature, depth, cauliflower, flower bed appearance, infiltrated ulcer, club or rod like thickening, shallow ulcer, surface mucosa spotty redness, surface mucosa Smooth/Normal, discolorate, surface mucosa uneven, surface mucosa infiltrated, erithematous ch of surface, surrounding mucosa irregular, surrounding mucosa infiltrated, surrounding mucosa redness/hyperemic, surrounding mucosa spotty redness, surrounding mucosa margin irregularity, bleeding, erosion, mucosal elevation, base infiltrated, base redness, base wide, polyp, sessile, stomach deformed, whole stomach infiltrated, depressed area, and infiltrated mass. Some of the rules induced by the BCFP algorithm are shown in Fig. 5 . The numbers following the class labels indicate the votes of each corresponding class.. The rules constructed by the BCFP algorithm are easy to be verified by experts. According to these rules, if the depth of the lesion is 1 (mucosa) or 2 (sub mucosa), then it is more likely that the case is an early gastric cancer; while if the depth is 4 (subserosa) or 5 (serosa) then advanced gastric cancer is more certain. If the lesion has a flower bed appearance, then it is certainly Early IIa. On the other hand, if the infiltrated ulcer is present, then the case is either BII, BIII or BIV. The other rules can be interpreted in the similar manner.. In order to see how difficult it is to make a prediction with high benefits, we have conducted an experiment with 16 fellows on internal medicine. The students were shown only the data set that was used by the BCFP algorithm. As a group, the fellows' accuracy was 63%. This indicates that making accurate decision in the diagnosis of the gastric carcinoma is quite difficult.

O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B I O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O


Using formal metamodels to check consistency of functional views in information systems specification UML notations require adaptation for applications such as Information Systems (IS). Thus we have defined IS-UML. In this article, we propose an extension to this language to deal with functional aspects of IS. We use two views to specify IS transactions: the first one is defined as a combination of behavioural UML diagrams (collaboration and state diagrams), and the second one is based on the definition of specific classes of an extended class diagram. The final objective of the article is to consider consistency issues between the various diagrams of an IS-UML specification. In common with other UML languages, we use a metamodel to define IS-UML. We use class diagrams to summarize the metamodel structure and a formal language, B, for the full metamodel. This allows us to formally express consistency checks and mapping rules between specific metamodel concepts. This paper reports part of an ongoing research programme bringing formality to the development of information systems (IS) [13] . This section motivates our work, then provides a general introduction to the relevant aspects of IS and formal methods.. Formality, or the addition of mathematical notations to conventional diagrambased modelling, allows us to prove the consistency of the model at each stage of development. This improves the verification of models, bringing verification activities into the development process, rather than relying on implementation testing.. Our work has two aspects. The first is to provide a rigorous underpinning to IS modelling. This entails identifying and modifying UML modelling notations that are appropriate to IS, and extending the UML metamodel to represent the IS-UML. A complete formal metamodel is also prepared. The second aspect is to provide automatic translation of IS-UML models into formal models. Elsewhere [16, 15] , we have shown that, with the help of these formal models, it is possible to construct tools that can automatically generate a consistent implementation of the core functionality (ie a relational database schema) of an IS.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O