Static analysis of aspect interaction and composition in component models Component based software engineering and aspect orientation are claimed to be two complementary approaches. While the former ensures the modularity and the reusability of software entities, the latter enables the modularity of crosscutting concerns that cannot be modularized as regular components. Nowadays, several approaches and frameworks are dedicated to integrate aspects into component models. However, when several aspects are woven, aspects may interact with each other which often results in undesirable behavior. The contribution of this paper is twofold. First, we show how aspectized component models can be formally modeled in UPPAAL model checker in order to detect negative interactions (a.k.a., interferences) among aspects. Second, we provide an extendible catalog of composition operators used for aspect composition. We illustrate our general approach with an airport Internet service example. Component based software engineering, or CBSE in short [1] , enables the modularization of concerns in terms of separate software entities called components. Each component provides a set of services and may require other services from other components. Components can be assembled in order to construct complex component systems. On the other hand, aspect oriented programming, or AOP in short [2] , focuses on the modularization of scattered and tangled concerns that cannot be modularized using regular software entities. Crosscutting concerns are not related to a specific paradigm and CBSE is not an exception. Current works on CBSE focus only on the integration of aspects into component models missing the interactions among woven aspects. Aspects woven to the same system may interact with each other which may results in undesirable Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. GPCE'11, October 22-23, 2011 , Portland, Oregon, USA. Copyright c 2011 ACM 978-1-4503-0689-8/11/09. . . $10.00 behavior, this kind of interaction is also known as interferences. Moreover, aspect interferences detection and resolution is still a challenge for AOP. In this paper we contribute by analyzing aspect interactions on component models. In a previous work [3] , we introduced a declarative pointcut language VIL for component models. VIL enables the composition of aspects scattered on the architecture by reconfiguring systems. The implementation of aspect composition for Fractal component model [4] is given in [5] with an introduction to aspect interferences. In this paper, we extend our work in [5] by providing an architectural description language (ADL) to describe both structural and behavioral properties of components and aspects (section 3). We show how to formalize component systems using a set of transformation rules from our ADL to networks of automata (section 4). We use UPPAAL model checker [6] to detect potential interferences among aspects in the result formal system (section 5). Finally, we present a catalog of composition operators to solve interferences (section 6). The catalog describes five binary operator templates that can be instantiated for aspect composition. Our proposal is illustrated with a running example: an airport wireless connection. In this article, we have shown how to formally analyze aspect interferences in the context of component-based systems. First, a system is specified in an architecture description language (ADL) where primitive component behaviors and aspects are specified in UP-PAAL. Second, we have detailed a transformation scheme from ADL to UPPAAL generating a formal model of the complete system that can be model checked. This makes it possible to check whether the base system properties are violated by aspects and whether the desired properties of aspects are violated by aspect interferences. Third, our aspect advices explicitly return proceed or skip. This enables the definition of composition operators for aspects. We have proposed several operators and discussed how our approach makes it easy to define new ones. We have also formally modeled those operators which makes it possible to check whether a composition of aspects solves the interferences among them. In order to simplify and implement the ADL transformation to UP-PAAL network of automaton, we plan to use a model transformation framework such as Kermeta [23] . In addition, due to model checkers limitations and to avoid state explosion, we consider to provide a model transformer based on theorem provers such as B method [24] . Using B, each component and aspect can be modeled as machines that can be composed and checked using B tool. Another approach to prevent state explosion is to consider symbolic representation of states [25] . Note that our approach is not component model dependent. We have already shown how it can be applied to Fractal [5] and we plan to apply it to other models, this may require few adaptations. For example, Sofa [22] will require to extend our transformations in order to take into account component connectors for enabling several communication styles. Interference detection and resolution is still a challenge for both features [11] and aspects [12] . However, few works are dedicated to analyze aspect interactions and composition in component models. In particular, JAsCo [13] is an aspectized component model and it provides an API to compose aspects in a programmatic way. But no interference detection support is provided. LEDA is a component framework and AspectLEDA [14] is its extension with aspects. Aspects in LEDA are represented by regular components and aspect execution is ordered following a predefined priority order. Current works on features are focussing on domain specific interferences. In a recent work, Gouya et al. [15] propose an algorithm for feature interactions in IP multimedia subsystem (IMS). The algorithm uses a predefined interference rules based upon traces on service calls. Some of these interferences with their solutions are defined in a database, if the interference is not in the database, it is reported to the user. Several works are dedicated to aspect interference analysis in AOP. For example, Goldman et al. [16] model the base program, the aspects, and the woven system with state machines in order to formally check properties. Their weaving process is implemented by inlining the aspect state machine directly in the base system. Moreover, they focus on LTL and use two kinds of properties. First, they check if the base system satisfies aspect assumptions that enable their weaving. Second, they check if the woven system guarantees the expected behavior of aspects. The approach is limited to weave an aspect at a time and to only consider weakly invasive aspects. Moreover, when an interference is detected (i.e. a property is not satisfied) the programmer is responsible to fix it: they do not provide composition operators. Krishnamurthi et al. [17] also use state machines to model both aspects and base systems. However, the proposed approach defines a state machine for each advice. Moreover, the work is limited to treat aspects that do not modify data variables of base systems. Katz et al. [18] describe the expected behavior of aspects in LTL. In this work, a semi-automatic interactive process is proposed to define the assume-guarantee properties of aspects. Aspect interferences are checked independently of any base system by checking their guaranties properties. At the weaving stage, another check should be performed to show if the base system satisfies the assumptions of all the aspects to be woven. In [19] advices are annotated with assumptions about their composition. Interferences are detected by matching the assumptions of an advice and all the other advices. Finally, we should mention that our current proposal is a byproduct of our previous work on aspect interference detection and resolution [20] and formalization of aspects in a concurrent context [21] . The first work focuses on interferences at shared join points and introduces composition operators. The second models the woven system as FSP processes and checks properties with LTSA.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


An Agent-Based Distributed Coordination Mechanism for Wireless Visual Sensor Nodes Using Dynamic Programming The efficient management of the limited energy resources of a wireless visual sensor network is central to its successful operation. Within this context, this article focuses on the adaptive sampling, forwarding, and routing actions of each node in order to maximise the information value of the data collected. These actions are inter-related in a multi-hop routing scenario because each node's energy consumption must be optimally allocated between sampling and transmitting its own data, receiving and forwarding the data of other nodes, and routing any data. Thus, we develop two optimal agent-based decentralised algorithms to solve this distributed constraint optimization problem. The first assumes that the route by which data is forwarded to the base station is fixed, and then calculates the optimal sampling, transmitting, and forwarding actions that each node should perform. The second assumes flexible routing, and makes optimal decisions regarding both the integration of actions that each node should choose, and also the route by which the data should be forwarded to the base station. The two algorithms represent a trade-off in optimality, communication cost, and processing time. In an empirical evaluation on sensor networks (whose underlying communication networks exhibit loops), we show that the algorithm with flexible routing is able to deliver approximately twice the quantity of information to the base station compared to the algorithm using fixed routing (where an arbitrary choice of route is made). However, this gain comes at a considerable communication and computational cost (increasing both by a factor of 100 times). Thus, while the algorithm with flexible routing is suitable for networks with a small numbers of nodes, it scales poorly, and as the size of the network increases, the algorithm with fixed routing is favoured. Wireless sensor networks, composed of locally batterypowered sensor nodes that wirelessly communicate and route information sampled from the environment through the network to a base station, are receiving significant multi-disciplinary research interest from institutions around the globe. Due to their flexibility, cost effectiveness, ease of deployment, scalability, and dynamic coverage, wireless sensor networks are becoming increasingly prevalent in a wide variety of applications, including environmental and habitat monitoring [1, 2, 3] , structural health surveillance [4] , smart buildings [5] , and other health related applications [6] .. The rapidly increasing computational power of the nodes deployed within such networks has allowed them to perform ever more sophisticated tasks, and recently, wireless visual sensor networks (WVSNs), whose nodes consist of spatially distributed smart camera devices, have received increasing attention within the research community. Each node within these networks has its own image sensor, image processing, storage, communication, and limited power units (see Fig. 1 for an example of a wireless smart camera mote), such that it is capable of performing basic capturing and compression of visual data before relaying it to a base station, in a multi-hop fashion, to be processed, analysed, or fused into some form more useful than the individual data (e.g. to reconstruct the entire surveillance area covered by the network). WVSNs are therefore intended for distributed image acquisition routing any data. In such a setting, the choices of one node can potentially affect all other nodes in the network. As such, much of this work has developed approximate decentralised algorithms, or has used simple heuristic algorithms that allow the nodes to make local decisions to improve the overall performance of the network (see Sect. 5 for more details). While such approaches have proved valuable in the context in which they were developed, the move to WVSN means that there is now the possibility of deploying complete algorithms that can optimally maximise the overall effectiveness of the dynamic network through distributed computation, rather than local heuristics. It is this challenge that we address, and to this end, we adopt an agent-based approach in which each node is represented as an autonomous agent (with private information regarding its own state), and the complex, inter-connected, and rapidly changing network, as a multi-agent system in which the individual agents need to coordinate their activities cooperatively in a distributed manner towards achieving the system-wide goals (that is, each agent is capable of reactive, social, and goal-directed behaviour). Within this context, each node must be able to decide for itself whether or not to perform an action requested by another node. This is different from the node being a passive distributed object which encapsulates some private states and has public methods corresponding to operations that other nodes are always allowed to perform on these states.. Against this background, in this article, we develop a novel distributed algorithm that varies each node's inter-dependent sampling, transmitting, and forwarding rates (or actions) to ensure all nodes in a network focus their limited resources on maximising the information content of the data collected at the base station. The algorithm is complete meaning that it is capable of finding an optimal solution, if one exists, otherwise it correctly reports that no solution is feasible. We first assume that the route by which data is forwarded to the base station is fixed (either because the underlying communication network is a tree, or because an arbitrary choice of route has been made), and show that the resulting algorithm is scalable (running on hundreds or even thousands of nodes in real-time) and has minimal memory requirements. By utilizing distributed dynamic programming techniques, each node makes computationally tractable and optimal local decisions regarding its integration of actions by only exchanging a small number of coordination messages with its parent and children nodes.. Using the same technique to extensively truncate the search space of potential resource allocation decisions, we then extend the fixed route algorithm to deal with flexible routing, in which each node not only makes optimal decisions regarding the inter-related sampling, transmitting, and forwarding actions, but also determines the optimal route by which each item of 3 sensed data should be forwarded to the base station. To ground and evaluate these algorithms, we empirically evaluate them and show that they represent a tradeoff in optimality, communication cost, and processing time. In more detail, we show that when deployed on sensor networks with loopy topology (i.e. where data can follow multiple paths to the base station), the algorithm with flexible routing is able to deliver approximately twice the quantity of information to the base station compared to that of the algorithm using fixed routing. However, this gain comes at a considerable communication and computational cost (increasing both by a factor of 100 times). Thus, while the algorithm with flexible routing is suitable for networks with a small numbers of nodes, it scales poorly, and as the size of the network increases, the algorithm with fixed routing is favoured.. The remainder of this paper is organized as follows. In Sect. 2 we state the formal model of our distributed constraint optimization problem (i.e. the interrelated adaptive sampling, transmitting, forwarding, and routing problem). In Sect. 3 we detail our two novel algorithms and show how we find the optimal local allocation decisions. Our experimental results are presented in Sect. 4. We present previous work in this area in Sect. 5 and we conclude in Sect. 6. In this article, we have considered the problem of inter-related adaptive sensing, forwarding, and routing within WVSNs in order to manage the limited energy resources of nodes in an effective and efficient way. We have developed two novel optimal decentralised algorithms: one which assumes fixed routing and calculates the optimal sensing and forwarding actions that each node should perform, and one which assumes flexible routing, and makes optimal decisions regarding both the integration of actions that each node should choose, and also the route by which data should be forwarded to the base station. In an empirical evaluation, we showed that the algorithm with flexible routing delivered approximately twice the quantity of information to the base station, but at a considerably higher communication and computational cost. Thus, while the algorithm with flexible routing is suitable for networks with a small numbers of nodes, it scales poorly, and as the size of the network increases, the algorithm with fixed routing is favoured.. Our ongoing work in this area includes relaxing the restriction that the nodes may only forward data to nodes that are closer to the base station (in terms of hop count) than themselves and, in particular, we would like to characterise the circumstances in which this may yield some benefit. More significantly, we would also like to develop a principled algorithm for making the choice of route when applying the algorithm with fixed routing to loopy WVSNs (rather than having the nodes make an arbitrary choice of parent in order to convert the loopy network into a tree-structured network as we have done here). Our empirical results indicate that the performance of the algorithm with fixed routing is very close to that of the algorithm with flexible routing if the appropriate fixed route is selected (see Fig. 7 ), 9 and thus, there is great potential in doing so. We present the results of the simulation process described above in Fig. 7, 8 , and 9. We note that the standard error in the mean is close to the size of the plot symbols and, thus, error bars are omitted from the plots for clarity.. Considering first Fig. 7 , we observe that the algorithm with flexible routing delivers close to twice the quantity of information to the base station compared to the algorithm with an arbitrary fixed routing. This is as expected since in loopy communication networks, there are typically many alternative routes available for routing data, and the flexible algorithm is able to exploit them to deliver the maximum possible information to the base station. Note that the quantity of information delivered does not increase monotonically, but decreases in a number of cases. This effect is due to the way in which we have scaled the maximum energy budget of the nodes as the network increases in size. This scaling fails to fully account for the necessary increase in sample forwarding and, thus, the network becomes increasingly energy constrained as it grows in size. The uniform nonadaptive algorithm, however, performs poorly as it has no intelligence of adapting the nodes' actions.. In the same figure, we also show the mean maximum and minimum performance (that is, for each loopy network, we record the performance of the best and worst tree, and then average over each loopy network that we test) of the algorithm with fixed routing. We remark that by making an appropriate choice of parent, we can derive performance close to that of the algorithm with flexible routing without incurring any additional computation or communication cost as will be explained shortly.. However, the increased information delivered by the algorithm with flexible routing comes at considerable communication and computational cost. Fig. 8 and 9 show the total size of coordination messages exchanged by the nodes and the average computation time of each node. Note that these figures are presented on a logarithmic scale for a clearer visualization. Specifically, Likewise, Fig. 9 shows that the average computation time of a node required by the algorithm with fixed routing is typically less than 1 millisecond, while that of the algorithm with flexible routing approaches 100 milliseconds (a two orders of magnitude increase). 8 The increase in terms of computation time is due to the additional time which the flexible routing algorithm requires in order to enumerate each possible partition of forwarding.. Speaking more generally, these results indicate that the algorithm with flexible routing is able to deliver significantly more information to the base station, but it incurs a considerable additional computation and communication cost in doing so. The choice of algorithm thus largely depends on the actual application domain. If the network is small, and the size of the actual data messages is large, then the algorithm with flexible routing is most appropriate. However, this algorithm scales poorly as the size or connectivity of the network increases (due to the exponential growth in the number of possible combinations of routing options that it must evaluate). In such cases, the size of the coordination messages may rapidly approach that of the actual data messages, and hence, coordination may not actually yield any energy saving. To address this, the algorithm with fixed routing may be run on the original loopy network by ignoring the fact that there exist alternative routing options, and having each node make an arbitrary choice of route. While the quantity of information delivered to the base station will be reduced (by up to 50% in our experiments), this solution will scale well and use minimal communication and computational resources. The work that is most closely related to ours is that of Padhy et al. who develop a decentralised adaptive sampling and routing protocol [23] . Within this mechanism, each node adjusts its sampling rate depending on a valuation function that assigns a value to newly sampled data. This protocol is intended for low power, computationally constrained devices, and as such, relies on a heuristic approach to estimate the opportunity energy cost used by each sensor for sensing, forwarding, and routing data. The protocol is not efficient and the integration of the node's actions is very limited since there is no guarantee that the transmitted data will actually be forwarded to the base station. For instance, there might be cases where nodes with data of a high value are unable to send their data to the base station because intermediate nodes have depleted their energy. The protocol could thus result in no data collection.. In a somewhat similar setting, but still concerned with the decentralised approaches to decision making within sensor networks, Mainland et al. present a market-based approach for determining efficient node resource allocations [24] . Rather than manually tuning node resource usage, or providing specific algorithms as we do here, their approach defines a virtual market in which nodes sell goods (e.g. data sampling, listening, or forwarding) in response to global price information that is established by the end user. However, this approach involves an external coordinator to set prices in order to induce any particular global behaviour, and it is not clear how this price determination should be performed in order to elicit desirable system-wide properties.. Within agent-based approaches, a useful technique that has emerged for solving multi-agent distributed coordination problems is that of distributed constraint optimization. To date, there has been a rich set of real-world distributed applications, such as in the domain of networked systems, for which this technique has been used, particularly, in distributed applications where constraints exist among agents.. In more detail, a number of algorithms in this area have been developed; these include Synchronous Branch and Bound (SBB) [25] , Distributed Breakout Algorithm (DBA) [26] , Asynchronous Distributed Optimization (ADOPT) [27] , Distributed Pseudotree Optimization Procedure (DPOP) [28] , Asynchronous Partial Overlay (APO) [29] , and Max-Sum [30] . Now, many of these algorithms are also based on the dynamic programming method because it is often used to solve problems with distinguished properties of overlapping subproblems and optimal substructure. The method works by (i) breaking down the multi-agent problem into smaller subproblems, (ii) solving these subproblems optimally using this three-step process recursively, and (iii) constructing an optimal solution to the original problem by using these optimal solutions of the subproblems.. However, SBB is found to be ineffective due to its slow performance. Moreover, it uses the notion of a virtual agent that acts as a central manager to deliver messages among agents and that is aware of all of the delivered messages' state. DBA is preferable when we want a near optimal solution much quicker than SBB, however, it may fail to return a solution even if one exists and also it cannot correctly determine if no solution exists.. To counter the limitations introduced by systematic, synchronous, and sequential message exchanges between nodes, ADOPT and DPOP are guaranteed to converge to the optimal solution while using only localized asynchronous communication and computation in the setting of a sensor resource allocation problem. However, since these algorithms are complete and asynchronous, they require an exponential increase in either the total message size being exchanged or the memory complexity on the agents (unlike the case of our algorithm with fixed routing). This is unrealistic for sensor networks in which the nodes are typically installed with limited computational, storage, and memory resources. Moreover, they are not specifically tailored to the specific problem that we address here. We, however, adopt a similar message propagation method where each node coordinates and exchanges meta-data regarding the utility of the actual data with its neighbourhood nodes before sending the actual data itself. This is done in order to efficiently make use of the limited energy resources.. In contrast, APO uses centralised mediator agents to compute the solution for portions of the original problem and, therefore, lacks distributed control. Finally, Max-Sum exchanges messages between conflicting lowpower sensor nodes using a cyclic bipartite factor graph representation. It scales very well in tree-structured graphs and generates approximate solutions close to the global ones returned by ADOPT and DPOP. However, it is not a complete algorithm, and may fail to converge in cyclic graphs as there is no built-in termination algorithm to stop the message exchange process.. In a different setting, Pizzocaro et al. try to optimize a sensor mission assignment problem by modelling it as a NP-complete multiple knapsack problem [31] . They introduce the sensor utility maximization model in which each sensor-mission pair is associated with a utility offer. Each mission might require and compete for the same sensors, however, a sensor can only be assigned to serve only one mission at any point of time. A profit function is formulated and this represents the value that a sensor can bring to a mission. The goal is therefore to maximise the total profit, while ensuring that the total utility cumulated by each mission does not exceed its uncertain demand (otherwise, some utility offer will be wasted). A novel greedy algorithm is developed and showed to perform better compared to a number of benchmarks by offering the best trade-off between the quality of the returned solution and the computational cost. However, the algorithm considered here follows a centralised approach, where all the intensive computation takes place at a central node which has all the information about the system's state. The dynamism of the sensor-mission pair, where a mission may change or adapt its priority value over time if its demand is not met after a certain period of time, is also missing in this work.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O B O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O B B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


On Potential Cognitive Abilities in the Machine Kingdom Abstract Animals, including humans, are usually judged on what they could become, rather than what they are. Many physical and cognitive abilities in the 'animal kingdom' are only acquired (to a given degree) when the subject reaches a certain stage of development, which can be accelerated or spoilt depending on how the environment, training or education is. The term 'potential ability' usually refers to how quick and likely the process of attaining the ability is. In principle, things should not be different for the 'machine kingdom'. While machines can be characterised by a set of cognitive abilities, and measuring them is already a big challenge, known as 'universal psychometrics', a more informative, and yet more challenging, goal would be to also determine the potential cognitive abilities of a machine. In this paper we investigate the notion of potential cognitive ability for machines, focussing especially on universality and intelligence. We consider several machine characterisations (non-interactive and interactive) and give definitions for each case, considering permanent and temporal potentials. From these definitions, we analyse the relation between some potential abilities, we bring out the dependency on the environment distribution and we suggest some ideas about how potential abilities can be measured. Finally, we also analyse the potential of environments at different levels and briefly discuss whether machines should be designed to be intelligent or potentially intelligent. In about the last 15 years, there have been several efforts to give formal definitions, measures and tests of intelligence based on computation theory and (algorithmic) information theory Hajek 1997a, b, 1998; Dowe and Hernández-Orallo 2012; Hernández-Orallo 2000a, b; Hernández-Orallo and Dowe 2010; Hernández-Orallo et al. 2012a, b; Hernández-Orallo and Minaya-Collado 1998; Legg and Hutter 2007; Mahoney 1999) . All of these works have worked on the notion of actual intelligence, i.e., the intelligence which is measured over a system at a particular stage of its development (or a particular moment of its life). If this is not already a very difficult question, things become even more complex when we try to evaluate potential intelligence, which can be loosely defined (for now) as the capacity that a system has to eventually become intelligent, where the terms 'capacity' and 'eventually' will be understood respectively as 'probability' and 'in a given future time under a range of circumstances'.. Small human children are said to be potentially intelligent even though their actual intelligence is very low compared to an adult's. In fact, an adult rat has higher actual intelligence than a new-born baby, for whom perception and reaction are still inoperative or very primitive. Potential intelligence is linked to the notions of development environment and education, and also to the nature vs. nurture dilemma. In other words, having the potential does not mean that this potential will ever be attained (or realised). A very talented child can be spoilt with an inappropriate education, while another, less talented, child can be boosted with the appropriate, specialised education. In this natural context, the notion of potential makes sense, as either a limit that a subject can attain or the easiness (in terms of education or environment) to reach a given level.. Things start becoming more interesting (but perhaps counter-intuitive, as well) when we move from biological systems to artificial systems. Let us consider, for the moment, universal Turing machines (UTMs). And let us assume, for the moment, that intelligence is not a score, but a binary property (a system is either intelligent or not, by, e.g., setting a threshold relative to which we consider a system intelligent). Let us also assume that this property is computably realisable.. 1 Under these conditions, as we will show (in a more formal, straightforward way), any UTM can become intelligent. If we define potential intelligence as the possibility of reaching actual intelligence, then we have that any UTM is potentially intelligent. This is not very informative, since we know that some (universal) machines are potentially more intelligent than others. This shows that the notion needs to be refined to be more useful.. The way-out from here is the definition of potential intelligence as the probability(classical) Turing machines, and highlights the relevance of the input distribution and the number of steps considered (the temporal period), in order to make sense of the definition. From the temporal notion of potential we make the first important distinction between TMs becoming or imitating another TM. Section ''Potential Abilities of Interactive Agents'' extends and adapts some of the previous definitions for computable agents, i.e., interactive Turing machines inside an environment. This brings out a more realistic perspective, also including speed, and more sophisticated relations between potential and the distribution of environments. Section ''Measuring Potential Abilities'' deals with the challenge of evaluating potential properties. We are interested in how the potential can be approximated from behaviour, not from internal introspection. Section ''Related Notions'' discusses related, but different, notions, such as the exploration/exploitation dilemma, which is a recurrent issue in reinforcement learning, and the distinction between fluid vs. crystallised intelligence, a crucial concept in psychometrics. Section ''Discussion'' closes the paper with a discussion of potential in terms of 'emergence' in complex systems, some open questions and the implications for building intelligent machines. In this paper we have focussed on the potential of individuals that acquire or lose a given ability (or increase or decrease its score). Along the way, we have also seen that the notion of potential could also be applied at many levels. For instance, we discussed that an environment could contain agents which may have some abilities. While it is clear that, in this case, the environment (as a closed system) does not have any of these abilities, it hosts agents having them. In the literature, this view of potential (usually referred to as 'emergence') has been used for three particular properties (arguably the three most important properties of all): universality, life and intelligence, which are also deeply related.. For instance, given a real or artificial world, we may be interested in determining whether the world can contain universal computers (possibly with resource limitations). It is clear that the universe, as we know it, holds resource-bounded universal computers. So, the universe, at the Big Bang (or however it might have begun), was a potential universality-holder. 20 The universe has developed life (at least on Earth), and DNA is another example of a Turing-complete machine. Some programs 'written' with this DNA (i.e., some genome) 'generate' humans, who are able to reason and think. Humans are able to emulate and hold models of the world. Natural language is a powerful Turing-complete language (Wallace 2005, sec. 9.3) . So universality emerges once again. Finally, humans have created computers, yet again sources of local universality. This trip across levels also occurs for life and intelligence, and will be more and more frequent in the future, with the growth and development of artificial life, the technological singularity and other self-replicating and self-improving systems.. All this can be studied in terms of being possible, being probable or just estimating when it will take place. For instance, Solomonoff (1985) studied several stages in the process towards the technological singularity, and gave predictions of when these stages could come, and not their probability. It is clearly more difficult to estimate when a property will appear than just estimating its probability. Also, it is important to estimate whether it will endure. For instance, current DNA ensures universality and self-replication, but it seems that self-replication came much before.. There is also a strong parallelism between an artificial life system running on a computer and a fantastic world running on a human's mind, such as figuring out a different fictional world by imagination or after reading a novel (Dowe 2011, sec. 7.7, p.968) . Intelligence, especially with natural language, is able to host other worlds (thoughts, situations, memories, etc.) which can have or host some other properties. In fact, a natural language and many Turing-complete computer languages share the property of being able to describe any effectively computable function. Minds and machines are just the substrate to execute them. Since natural language can be considered a universal programming language, the ability of learning a language may be seen as the ability of becoming universal (Wallace makes this point as well in his 2005 book, sec. 9.3), in the restricted sense above.. While all of this has been left out from the analysis in this paper, it is relevant for the concept of potential, and most especially for the properties of universality and intelligence. Some recent works have also explored related ideas in the context of intelligence, such as 'self-modification', 'mortality', 'delusion' and 'survival' Ring and Orseau 2011) .. Back to the mainstream view of potential in this paper, i.e., the capacity of individuals, we have seen that two important properties, universality and intelligence, are intertwined. Absolute universality (i.e., becoming universal) is incompatible with preserving intelligence for all inputs. Also, it implies that the machine can halt (i.e., die). However, other more restrictive views of the universality property are more compatible with (or even intrinsic to) intelligence, such as n-universality (temporal emulation), resource-bounded universality, etc.. The notion of potential ability is not only useful to clarify the relation between some properties. Having a clear definition of the concept is crucial for the characterisation of individuals, since humans, non-human animals and other machines are usually classified by their potential abilities rather than by their abilities. For instance, a baby is classified as a human being, even though it has none of the cognitive abilities an adult human being has. In fact, the very concept of 'person' is, in part, potential, and this and other concepts should be very clear before we want to extend them to AI artefacts. Actually, these notions lead to highly controversial ethical issues, such as the set and degree of potential properties required to make the processes of replication, abortion and/or euthanasia ethically unacceptable for machines.. The notion of potential intelligence, in particular, and any procedure that could be used to estimate it can be crucial for the field of artificial intelligence. It is quite unlikely that we can construct an algorithm such that it makes a machine intelligent the first day. Surely, the machine will require an appropriate environment (such as a playschool of Goertzel and Bugaj 2009) and some training (optimal training sequences of Solomonoff 1962) . 21 How long the training is (and how difficult finding a good training sequence is) will of course be related to potential abilities. In fact, in the worst case, training a machine to be intelligent would be like taking a UTM and finding the program that makes it intelligent. It looks like a trade-off between these two extremes (a very intelligent machine from scratch or a UTM to be given a good training sequence) needs to be found. This is the direction of the field of artificial general intelligence, which tries to split from the task-specific view of mainstream artificial intelligence. More orientated, the roadmap for machine intelligence may lie on the gestation of potentially intelligent systems and the construction of optimal training environments for intelligence. The evaluation of cognitive abilities for humans and non-human animals can be traced back to the now consolidated disciplines of psychometrics and comparative psychology. There is also a large and important body of work comparing abilities between humans and non-human animals, and the hybridisation between both disciplines is becoming stronger (see, e.g., Herrmann et al. 2007 Herrmann et al. , 2010 . However, generalising cognitive abilities for different species is not easy, since the assumptions about the required abilities and the proper interfaces required to evaluate each individual is always at issue. From a scientific point of view, and most especially from an evolutionary stance, it makes sense to evaluate the cognitive abilities of any subject in the 'animal kingdom' (including humans) at any stage of its development.

O O B I O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O B I O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O


Region Tracking via Level Set PDEs Without Motion Computation Tracking regions in an image sequence is a challenging and di cult problem in image processing and computer vision, and at the same time, one that has many important applications: Automated video surveillance, video database search and retrieval, automated video editing, ... So far, numerous approaches to region tracking have been proposed. Many of them su er from excessive constraints imposed on the motion of the region being tracked and need an explicit motion model (e.g. a ne, euclidean, ...). Some, which do not need a parametrized motion model, rely instead on a dense motion eld. By and large, most rely on some kind or other of motion information. Those which d o n o t u s e a n y motion information use instead a model of the region being tracked, typically by assuming strong intensity boundaries, or constraining the shape of the region to belong to a parametrized family of shapes. In this paper, we propose a novel approach to region tracking that derives from a Bayesian formulation. The novelty o f the approach i s t wofold: First, no motion eld or motion parameters need to be computed. This removes a major burden since accurate motion computation has been and remains a challenging problem and the quality of region tracking algorithms based on motion critically depends on the computed motion elds and parameters. The second novelty of this approach i s t h a t v ery little a priori information about the region being tracked is used in the algorithm. In particular, unlike numerous tracking algorithms, no assumption is made on the strength of the intensity edges of the boundary of the region being tracked, nor is its shape assumed to be of a certain parametric form. The problem of region tracking is formulated as a Bayesian estimation problem, and the resulting tracking algorithm is expressed as a level set partial di erential equation. We present further extensions to this partial di erential equation, allowing the possibility of including additional information in the tracking process, such as priors on the region's intensity boundaries, and we brie y discuss the issue of numerical implementation. Very promising experimental results are provided using numerous real image sequences with natural object and camera motion. Tracking of regions in an image sequence is one of the most important, and yet, di cult problems in video processing (object-based video database search, automated image manipulation, video surveillance), video compression (object-based coding such as in MPEG-4), and computer vision (scene analysis and interpretation).. A numberof di erent approaches to region tracking have beendeveloped to date, starting from the early tracking algorithms which concentrated on tracking feature points 1] and edge segments 2], 3]. Since the ultimate goal of a region tracking algorithm is to track whole regions and not only feature points in the region, strong assumptions had to bemadebothon the shape of the region and on the motion of the points, in order to allow the region to be recovered from its feature points. In the simplest case, the motion eld would be assumed to be translational and the shape of the region constant throughout the sequence. This would allow feature point t r a c king using simple cross-correlation computations between successive images in the sequence. A s l i g h tly higher degree of generality w ould be attained by a l l o wing the motion to beeuclidean and using rotational-invariant cross-correlation measures. The notion of tracking a region through its feature points was extended to three dimensions by 4]. There, a three dimensional polyhedral model was assumed, and computed from feature points in the image. Once the three dimensional model was computed, it would be reprojected onto the image plane. Clearly, all these algorithms perform well when the two-dimensional (or three-dimensional) shape of the region can be easily modeled and stays relatively constant o ver the image sequence. This is not the case in many t r a c king problems of interest, where the region of interest changes shape throughout the sequence, corresponding to deformable objects (e.g. blood cells 5]). There, feature point based tracking is not appropriate since the shape of the region cannot be related to the position of the feature points in any simple way. To o vercome these limitations of region tracking based on simple feature points, region tracking algorithms based on active contours were developed 5], 6], 7], 8]. Here, no assumption is made on the shape of the region (other than overall smoothness) yet, a very strong assumption is made on the boundaries of the region, that is they have to correspond to strong intensity boundaries. In this way, an active c o n tour is shrinked from an initial contour (large enough so as to englobe the region of interest) under a velocity eld which l o c ks the contour to intensity e d g e s . In the subsequent frame, this contour is used as initial condition and is locked onto the intensity edges of the region being tracked. To further constrain the motion of the active c o n tour, additional a priori models on the contour displacement h a ve been proposed 9] . Although relatively good results have been obtained, the active contour approach is limited to small displacements and uses only the boundary of the region being tracked, and not the region itself. For this class of algorithms, region tracking 2 is essentially a byproduct of intensity boundary detection. This is not so with region based tracking algorithms, which use region information and not merely boundary information. In this regard, approaches dual to edge detection have been proposed in 10], aiming at maximizing the intensity homogeneity inside the region to betracked and inside the background as well. Once region information is used, the motion eld can be computed over the region and used to compute the position of the region in the next frame. Furthermore, this motion eld can be temporally ltered in order to yield better estimates of the region position. The main drawback of region based techniques is that boundaries are not accurately computed. This imposes a rst restriction on the magnitude of motion between subsequent frames: The smaller the motion, the more accurately it is computed. But this is not enough. Indeed, due (usually) to excessive smoothing, motion is least accurately computed around motion boundaries, and these often coincide with boundaries of regions we wish to track. This suggests that motion information alone is not su cient to guarantee reliable tracking over long sequences. This has led researchers to combine both edge-based and region-based approaches.. A desirable feature of any tracking algorithm, rst proposed and demonstrated by 11] , is that the tracking algorithm allow changes in the topology of the region being tracked. Indeed, it may be the case that a region of interest split into sub-regions ove r a n umber of frames, or that conversely, a numberof regions of interest merge into one region. Such changes in topology, which may bedi cult to handle when region shape is parametrized, follow instead naturally whenever tracking is formulated as a level set partial di erential equation 11], 12], 13].. In 11], tracking is expressed as the solution of a system of coupled partial di erential equations: While one image is morphed into another via a particular level set partial di erential equation, the boundary of the region being tracked follows the ow obtained from this equation via another level set equation. Since the evolution equation for morphing is obtained by gradient descent on an L 2 norm of image di erences, this tracking algorithm can beapplied only when the displacements involved are small, typically on the order of a few pixels. In 12], tracking is expressed as minimum description length estimation using a geometric description length criterion, and knowledge of a dense or parametrized motion eld is assumed. The resulting tracking performance is critically dependent on the quality of the given motion eld or parameters, as shown in the results. The problem addressed in 13] is that of detection and tracking of moving objects in image sequences. In the proposed algorithm, a detection step forces a closed curve to converge towards moving areas of an image, while a tracking step evolves the curve even further, until it coincides with the exact boundary of the moving object. The detection step is based on temporal change detection, while the tracking step is actually nothing other than a classical intensity boundary detection algorithm using active contours and implemented using level sets. Thus, the tracking algorithm proposed in 13] is not a generic tracking algorithm, and since it is merely a byproduct of simple intensity boundary detection, it su ers from very stringent constraints in particular, the region to be tracked is assumed to have strong intensity boundaries, and the background is assumed to besmooth. Also, since the tracking step relies heavily on the preceding moving region detection step, the region beingtracked is assumed to bemoving, while the background is assumed to be stationary.. In this paper, we consider the generic problem of tracking regions in image sequences, be they moving or stationary, and we attempt to do so using only the least number of explicit constraints on the region being tracked. In particular, other than overall smoothness, we do not assume the region's shape to belong to a parametrized family, nor do we relate it to a three-dimensional model, nor do we assume that the region undergoes rigid motion. Also, in stark contrast to 13], we do not make the simplifying assumption that its boundary coincides with strong intensity boundaries, nor do we assume that the region to be tracked is moving on a xed and uniform background. Furthermore, unlike n umerous motion-based approaches (e.g. 12]) , we do not compute any motion eld or motion parameters or feature points for motion computation, and contrary to 11], we do not restrict tracking to small displacements. To be sure, we will have to make some assumptions on the way to our proposed tracking algorithm however, these assumptions will beexpressed probabilistically and will bemade on particular probability distributions. As a result, these assumptions will constrain the tracking problem only implicitely, as will be discussed in the paper. We believe s u c h implicit probabilistic assumptions are more suited to the tracking problem than the explicit assumptions commonly used this is demonstrated in the experimental results, where it is shown that our proposed algorithm yields precise tracking over numerous frames for real image sequences with substantially di erent motion, shape, and intensity boundary structure.. The starting point of our algorithm is a basic observation model that expresses the fact that the region's luminance/chrominance statistics vary little from frame to frame in the sequence. Clearly, without such an assumption, tracking would not make much sense. Although we do not assume any particular underlying motion, we assume the maximum range of motion in between image frames is given. This does not reduce the generality of the proposed algorithm and is used only to reduce its computational complexity. We pose region tracking as a bayesian estimation problem, and at each step on our way to solving this estimation problem, we use the minimum assumptions necessary to make the problem tractable. This bayesian estimation problem is ultimately formulated as an energy minimization problem, leading to the solution via Euler-Lagrange descent equations. These Euler-Lagrange equations are themselves formulated as level set partial di erential equations, leading to a stable numerical implementation, in addition to allowing the proposed tracking algorithm to retain the desirable feature of being topology independent, and allowing regions being tracked to freely split and merge. The tracking algorithm we propose is thus a particular level set evolution equation, and as will beseen in the experimental results, the tracking obtained is remarkably accurate despite the variety of test images used and despite the small number-two-of parameters to set, one of which is the same for all test runs. Although our proposed tracking algorithm makes no use of intensity boundary, shape, or motion information, we indicate precisely in the paper where and how such information, whenever available, could be incorporated in the tracking algorithm.. The paper is organized as follows. In Section II a formulation of region tracking as bayesian estimation is proposed. In Section III, the solution of this bayesian estimation problem in terms of Euler-Lagrange descent equations is provided. Then, in Section III-Cthe equivalent formulation of these equations in terms of level set partial di erential equations is given, and the numerical solution of these evolution equations is very brie y discussed. The estimation of the probability distribution functions which form the cornerstone of this algorithm is discussed in Section IV, together with basic extensions. In Section V, our proposed level set evolution equation for tracking is given, together with numerous extensions. The paper ends with experimental results in Section VI followed by conclusions.

B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O B I O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O B I O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


OBIWAN: Design and Implementation of a Middleware Platform Abstract-Programming distributed applications supporting data sharing is very hard. In most middleware platforms, programmers must deal with system-level issues for which they do not have the adequate knowledge, e.g., object replication, abusive resource consumption by mobile agents, and distributed garbage collection. As a result, programmers are diverted from their main task: the application logic. In addition, given that such system-level issues are extremely error-prone, programmers spend innumerous hours debugging. We designed, implemented, and evaluated a middleware platform called OBIWAN that releases the programmer from the above mentioned system-level issues. OBIWAN has the following distinctive characteristics: 1) allows the programmer to develop applications using either remote object invocation, object replication, or mobile agents, according to the specific needs of applications, 2) supports automatic object replication (e.g., incremental on-demand replication, transparent object faulting and serving, etc.), 3) supports distributed garbage collection of useless replicas, and 4) supports the specification and enforcement of history-based security policies well adapted to mobile agents needs (e.g., preventing abusive resource consumption). We presented OBIWAN, a middleware platform that helps programmers to develop distributed applications by allowing them to focus on the application logic. System-level issues such as object replication, preventing abusive resource consumption by mobile agents, and DGC, are automatically handled by the system. The performance results concerning replication, DGC, and security are very encouraging.. Programmers are free to use the programming paradigm that is most suited to their applications, either classical RMI, replication, or mobile agents. In particular, it is possible to change at runtime how objects are invoked: RMI or local invocation on a replica. Replicas are transparently created and mapped into processes; the programmer can control, at runtime, the amount of objects being replicated by creating dynamic clusters, thus improving the performance of the system. OBIWAN provides a security framework (from the specification to the enforcement by means of a security monitor) that supports history-based policies. These can be applied to mobile agents and, for example, prevent the abusive resource consumption on hosts, or to enforce a Chinese-wall policy, among others.. In addition, OBIWAN supports distributed garbage collection that handles correctly multiple replicas of objects, thus releasing the programmer from an extremely errorprone task.. Concerning future work, we intend to address both practical and more theoretical issues. Thus, we plan to integrate the OBIWAN platform with software development tools (e.g., VisualStudio-C#, Eclipse-Java), to use a library of consistency and reconciliation of replicas, and we are currently integrating our reference-listing garbage collector within ROTOR (shared-source version of Microsoft .Net). Regarding the theoretical issues, we are working toward an extension of the distributed garbage collector in order to reclaim distributed cycles of garbage; we also intend to address the issue of fault-tolerance, and the specification of automatic policies adapted to the specific context environment (e.g., network latency and cost). The OBIWAN platform can be related to several other systems that support remote invocation, replication, DGC, mobile agents, and security. An important difference is that such systems do not provide an integrated platform supporting all the mechanisms as OBIWAN does: paradigm flexibility (RMI, replication, mobile agents), automatic replication, DGC (correct in the presence of replicas), and security policies. This integration is an advantage to the programmer as he may decide what functionality is best adapted to his application scenario.. Javanaise [5] , [15] is a platform that aims at providing support for cooperative distributed applications on the Internet. In this system, the application programmer develops his application as if it were for a centralized environment, i.e., with no concern about distribution. Then, the programmer configures the application to a distributed setting; this may imply minor source code modifications. A proxy generator is then used to generate indirection objects and a few system classes supporting a consistency protocol. Javanaise does not provide support for incremental replication; clusters are defined by the programmer and are less dynamic than in OBIWAN. In addition, Javanaise provides no support for security policy definition, mobile agents, or DGC.. There has been some effort in the context of CORBA to provide support for replicated objects [9] as well as in the context of the World Wide Web [5] . However, most of this work addresses other specific issues such as group communication, replication for fault-tolerance, protocols evolution, etc.. Thor [21] is a distributed object oriented database (OODB) that provides a hybrid and adaptive caching mechanism handling both pages and objects; it provides its own programming language and DGC (which does not consider object replicas).. Most OODBs [39] , e.g., O 2 [6] and GemStone [4] are very heavyweight, and often come with their own specialized programming language. In addition, these systems offer the programmer a single programming paradigm and do not consider the security aspects.. There are a great number of Java-based mobile-agent systems available [19] . Among these, Object Space's Voyager [35] is the most interesting; it was designed from the ground to support object mobility. A Voyager's agent is simply a special kind of object that has the ability to move; otherwise, it behaves exactly like any other object. Voyager has introduced the concept of Virtual Object, which represents a proxy of a remote object or agent. Voyager can transform into an agent any arbitrary object using the Virtual Code Compiler. Once the object is processed, it exhibits some properties of an agent: it can be migrated from host to host and accessed remotely by other virtual objects in RMI-like fashion, and it can have its own life cycle. Unless specifically designed to be otherwise, they are simply passive objects that can be moved and manipulated remotely. In conclusion, with such agent platforms, the programmer can develop his application either with mobile agents or RMI. However, these platforms support neither objects to be automatically replicated nor provide DGC. In addition, the security specification and enforcement simply relies on native mechanisms (JVM or operating system).. Previous work in DGC such as IRC [23] , SSP chains [32] , and Larchant [11] served as the starting point of the DGC algorithm presented in this paper. Our algorithm is an improvement over these in such a way that it combines their advantages: no need for causal delivery support to be provided by the underlying communicating layer (from the first two), and capability to deal with replicated objects (from Larchant).. A work on DGC also related to ours is Skubiszewski and Valduriez GC-consistent cuts [34] . They consider asynchronous tracing of an OODB, but with no distribution or replication support. The collector is allowed to trace an arbitrary database page at any time, subject to the following ordering rule: For every transaction accessing a page traced by the collector, if the transaction copies a pointer from one page to another, the collector either traces the source page before the write, or traces both the source and the destination page after the write. In a certain way, these operations are equivalent to our safety rules 1 and 2. The authors prove that this is a sufficient condition for safety and liveness.. Concerning agents security, Deeds [8] offers an historybased access control mechanism that protects hosts resources from mobile code. In this platform, access control policies are written in Java. These policies can be inserted, removed, or simply modified while the monitored programs are still executing. An important limitation of Deeds is the way it identifies a program. It concatenates all userlevel code for a mobile program and uses a hash algorithm to generate a name for it. This method has a major drawback: It does not allow the execution of programs that dynamically load new classes. This approach is not, therefore, appropriate for a mobile agent platform, since it does not support agent migration with code on demand.. Ponder [7] provides a general-purpose deployment model for security and management policies. Its declarative language is able to express and specify some generic and complex security policies such as RBAC policies. The obligation policies provided by Ponder are used in an agent platform [22] to specify mobility policies of agents. In this platform, application logic is completely separated from migration logic. Although designed for mobile agents, this platform still does not consider any type of support for history-based security policies.. All these security solutions have their own merit, but they all fail to provide an integrated middleware platform with the flexibility of OBIWAN. In addition, and specifically with regard to the implementation of the security modules, OBIWAN provides more functionality with good performance. The DGC algorithm is a hybrid of tracing and referencelisting [23] , [24] , [32] . Thus, each process has two components: a local tracing collector and a distributed collector. Each process does its local tracing independently from any other process. The local tracing can be done by any markand-sweep based collector. The distributed collectors, based on reference-listing, work together by exchanging asynchronous messages.. The local and distributed collectors depend on each other to perform their job in the following way. A local collector running inside a process traces the local object graph starting from that process's local root and set of GC-scions. A local tracing generates a new set of GCstubs, i.e., for each outgoing interprocess reference, it creates a GC-stub in the new set of GC-stubs. From time to time, possibly after a local collection, the distributed collector sends a message called newSetStubs; this message contains the new set of GC-stubs that resulted from the local collection; this message is sent to the processes holding the GC-scions corresponding to the GC-stubs in the previous GC-stub set. In each of the receiving processes, the distributed collector matches the just received set of GC-stubs with its set of GC-scions; those GC-scions that no longer have the corresponding GC-stub, are deleted.. Once a local tracing is completed, every locally reachable object has been found (e.g., marked, if a mark-and-sweep algorithm is used); objects not yet found are locally unreachable; however, they can still be reachable from some other process holding a replica of, at least, one of such objects. To prevent the erroneous deletion of such objects, the local collector traces the objects graph from the lists inPropList and outPropList. Thus, the local and distributed collectors perform as follows:. 1. When a locally reachable object (already discovered by the local collector) is found, the tracing along that reference path ends. 2. When an outgoing interprocess reference is found, the corresponding GC-stub is created in the new set of GC-stubs. 3. For an object that is reachable only from the inPropList, a message unreachable is sent to the process from where that object has been replicated; this sending event is registered by changing a sentUmess bit in the corresponding inPropList entry from 0 to 1. When a unreachable message reaches a process, this delivery event is registered by changing a recUmess bit in the corresponding outPropList entry from 0 to 1. 4. For an object that is reachable only from the outPropList, and the enclosing process has already received a unreachable message from all the processes to which that object has been previously replicated, a reclaim message is sent to all those processes and the corresponding entries in the outPropList are deleted; otherwise, nothing is done. When a process receives a reclaim message it deletes the corresponding entry in the inPropList. As already mentioned, an object can be reclaimed only when all its replicas are no longer reachable. This is ensured by tracing the objects graph from the lists inPropList and outPropList; objects that are reachable only from these lists are not locally reachable; however, they cannot be reclaimed without ensuring their global unreachability, i.e., that none of their replicas are accessible. (This is the basis for the Union Rule.). Concerning the interaction between applications and the DGC algorithm, we have the following: 1) immediately before a message containing a replica is sent, the references being exported (contained in the replicated object) 6 must be found in order to create the corresponding GC-scions, and 2) immediately before a message containing a replica is delivered, the outgoing interprocess references being imported must be found in order to create the corresponding local GC-stubs. 7 It is worthy to note that the DGC algorithm does not require the underlying communication layer to support causal delivery (which is an improvement with regard to Larchant). This clearly contributes to its scalability and is ensured because the DGC algorithm creates the corresponding GC-scions and GC-stubs immediately before a replica is sent and delivered, respectively.. Thus, the DGC algorithm can be summarized by the following safety rules:. 1. Clean Before Send Replica. Before sending a message containing a replica of an object X from a process P, X must be scanned for references and the corresponding GC-scions created in P. 2. Clean Before Deliver Replica. Before delivering a message containing a replica of an object X in a process P, X must be scanned for outgoing interprocess references and the corresponding GC-stubs created in P. 3. Union Rule. A target object Z is considered unreachable only if the union of all the replicas of the source objects do not refer to it. We developed two prototypes of OBIWAN: 1) one runs on top of the JVM and is written in Java, and 2) the other runs on top of the .Net CLR and is written in C#. 9 The differences between the two prototypes are minimal. Both JVM and the CLR support the basic functionality required, i.e., RMI, dynamic code loading and reflection. OBIWAN does not require any modification of either JVM or CLR internals. This fact is key for OBIWAN portability.

O O O O O O B O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O O O B I O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B I O O O O O O O O O O O B O O O B O O O O O O O O B I I O O O O O O O O O O O O B I O O O B I O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O B O O O O O B I O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B I O O O O O O O O O O O O O O O O O O O O O O O O O B B I O B O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Interpolation in local theory extensions MotivationCan use provers for T 1 , T 2 as black-boxes to prove theorems inWhich information needs to be exchanged between the provers?Reason about lists of integers and monotone functions over integers Motivation: Abstraction-based Verification • Local theory extensions. • Computing interpolants in local theory extensions. • Applications. • Conclusions, perspectives. Our goal

B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O