Assigning types to processes AbstractIn wide area distributed systems it is now common for Background In the distributed computing environments nowadays, it is common for higher-order code to be transferred from one domain to another [10, 23, 25] . This is recognised as dangerous and various schemes have been put forward to ensure the integrity of systems in the presence of such operations. In this paper we propose a new subtyping system which can be used to control the effect of migrating code on local environments. Our investigation is in terms of a higher-order π-calculus in which values, including process terms, can be exchanged along communication channels [3, 29, 37] . We believe that our typing system can be readily adapted to related location based distributed calculi such as [5, 8, 18, 12, 28, 34] . This Section concludes the paper with extensions, further issues and related work. For more details, see [38] .. Distributed Higher-order π-calculus Type Safety Theorem means that our typing system can be used to ensure various kinds of host security; that is, protecting hosts from untrusted imported code. In the full version of this paper, [38] , we discuss this issue more explicitly, by extending our typing system to the distributed version of λπ v , given in [37] . Once more the expressiveness of our fine-grained types means that, for example, channel locality, [37] , can easily be enforced; specifically there is no requirement to annotate higher-order values as being sendable. A similar problem appears with type systems for the λ-calculus involving arrow and reference types, [24] . We hope that an extension of our scheme to higher-order functional shared variables (i.e. passing environments as com types) will also be useful in this setting.. More type constructors One beneficial point of our typing system is that it is relatively straightforward to extend our set of types with many of the standard constructs from the literature for both the λ-calculus and the π-calculus; these include recursive types [4, 21, 33, 26] , record types [9, 32] , polymorphic types [6, 27] , linear/affine types [19, 5, 13, 36] , and dynamic types [2, 28] . An extension of our capability based typing systems to more advanced distributed primitives, especially to constructs involving security [1, 11, 15, 35] would be more challenging.. Type limitations One limitation of our typing system is that, while name variables in types can be abstracted by channel dependency types (x : σ) ! ρ of the channel λ-abstraction λ(x : σ) P, a similar abstraction is not allowed when we bound name variables by input prefix a?(x : σ) P. The result is that there is a loss of information in many of the types we can assign to processes. A typical example is the process a?(x) b!hx!hvii. In the current system this can only be assigned a process type in which b has the capability to output values of the undifferentiated type hproci.. Clearly some form of channel abstraction would be needed to give a more informative type but it is difficult to see how this might be formulated. One problem here is that, unlike β-application, value reception is nondeterministic. In the composed term a?(x) b!hx!hvii j a!hci j a!hdi the particular channel, c or d which is bound to x depends on which message is delivered to the waiting process. Indeed the residual, after receiving an input, may take one of the There is a similar loss of information in typing restricted processes, ( Here essentially the only the possibility for τ is the type hproci. But we should be able to say that b can output a (thunked) process which contains some unknown channel name of type (nat) O , and the input type associated with b should be able to accommodate such constraints. Some form of existential quantification over types may be appropriate but integrating such a construct into the type language is also a non-trivial task. In this paper we formulate a fine-grained subtyping system for the higher-order π-calculus following the basic ideas mentioned above. This results in a simple, but nontrivial, extension of the IO-subtyping for π-calculus [26] to the higher-order setting. The main technical results can be summarised as follows.. 1. First, we design a novel notion of type for the higherorder π-calculus, in which process have types corresponding to interfaces. Because type variables appear both in program terms and in types (in particular the types of processes), the formal definition of what constitutes a valid term and a valid type are interdependent and both in turn require a careful definition of even a valid typing environment. An analogous, albeit somewhat simpler, situation arises in subtyping for the polymorphic λ-calculus [6] . We clarify technical similarities and differences between the two typing systems. Although some techniques developed for the λ-calculus are useful in the current setting, novel concepts are required for process types.. 2. Second, we propose a typing system in which many higher-order π-calculus processes can be assigned non-trivial interface types. We prove its soundness (Subject Reduction Theorem) and also establish a Type Safety Theorem, which ensures that no well-typed process can input higher-order code which does not conform the local interface of that process.. 3. Finally we define a new typed behavioural equivalence for the higher-order π-calculus. Our fine-grained types enable us to establish general, and useful, process identities. Their application is illustrated on an example distributed system.. Outline of the Paper Section 2 introduces the types, syntax and a reduction semantics of λπ v . Section 3 proposes the new typing system of λπ v and demonstrates its expressiveness by typing the example in Section 2. In Section 4, we prove Subject Reduction and Type Safety Theorems. Section 5 briefly studies the typed behavioural equalities. Finally Section 6 concludes the paper with further issues and related work. Due to space limitations, the proofs and many examples, including a further application to a distributed higher-order π-calculus, are left to the full version [38] . We have already made reference to the extensive literature on typing for the π-calculus and related processes. In developing our fine-grained type system we have been guided by the polymorphic λ-calculus [9, 6] , where type variables play an important role; as with our channel names they may appear, and be bound, both in terms and types. However there is an essential technical difference: channel instantiation in our system can result in dynamic changes to the types annotating a term. Channels are exchanged as values between processes but they also appear as interaction points in the types of processes. On the other hand, type variables of the polymorphic λ-calculus are instantiated by types (say int) whereas in our case channel variables occurring in types are instantiated by channels, not by types. This feature necessitated the development of new concepts of well-formed type, subtyping, well-formed substitution, etc., independent of those developed in the context of the λ-calculus.. Pierce and Sangiorgi [27] recently proposed a polymorphic π-calculus and used a refined typed behavioural equivalence to reason about concurrent abstract data types. Since their polymorphic types are based on those of the polymorphic λ-calculus (that is they abstract over type variables via the operator 9), they are quite different from ours. In particular they do not address the issue of assigning fine-grained types to processes.. For sequential computations, Tofte and Talpin have developed the effect typing system [31] , and Tang and Jouvelot developed its subtyping system [30] . This was recently applied to Facile by Kirli [18] . 1 One may think our dependency types correspond to her region polymorphism. However, again her typing system is different from ours since she adds the original effect system to the functional types; hence all process has a constant type Unit and channels cannot carry nested effects. More precisely, the effect types in [31, 30] are used to represent the region allocation or effects of values during β-reduction, while our process types are used to represent interaction effects between con-current processes. Hence an integration of the effect typing system of the λ-calculus and the IO-subtyping system of the π-calculus would have difficulty in expressing the kind of constraints guaranteed by our typing system.. De Nicola, Ferrari and Pugliese studied a subtyping system for a language based on Linda [7] , and showed that it is used to control the mobility of agents. In their language, each located process is equipped with different capabilities (read, input, our, eval and newloc) rather than the unique process type, which is similar to our framework. However their calculus is based on CCS rather than the π-calculus and our form of process types based on IO-subtyping and λ-subtyping are not considered in their formulation.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Distributed verification and hardness of distributed approximation We study the verification problem in distributed networks, stated as follows. Let H be a subgraph of a network G where each vertex of G knows which edges incident on it are in H. We would like to verify whether H has some properties, e.g., if it is a tree or if it is connected (every node knows in the end of the process whether H has the specified property or not). We would like to perform this verification in a decentralized fashion via a distributed algorithm. The time complexity of verification is measured as the number of rounds of distributed communication.In this paper we initiate a systematic study of distributed verification, and give almost tight lower bounds on the running time of distributed verification algorithms for many * A full version of this paper is available as [5] at http:// arxiv.org/abs/1011.3049 † Part of the work done while at Georgia Institute of Technology.fundamental problems such as connectivity, spanning connected subgraph, and s − t cut verification. We then show applications of these results in deriving strong unconditional time lower bounds on the hardness of distributed approximation for many classical optimization problems including minimum spanning tree, shortest paths, and minimum cut. Many of these results are the first non-trivial lower bounds for both exact and approximate distributed computation and they resolve previous open questions. Moreover, our unconditional lower bound of approximating minimum spanning tree (MST) subsumes and improves upon the previous hardness of approximation bound of Elkin [STOC 2004] as well as the lower bound for (exact) MST computation of Peleg and Rubinovich [FOCS 1999]. Our result implies that there can be no distributed approximation algorithm for MST that is significantly faster than the current exact algorithm, for any approximation factor.Our lower bound proofs show an interesting connection between communication complexity and distributed computing which turns out to be useful in establishing the time complexity of exact and approximate distributed computation of many problems. Large and complex networks, such as the human society, the Internet, or the brain, are being studied intensely by different branches of science. Each individual node in such a network can directly communicate only with its neighboring nodes. Despite being restricted to such local communication, the network itself should work towards a global goal, i.e., it should organize itself, or deliver a service.. In this work we investigate the possibilities and limitations of distributed/decentralized computation, i.e., to what degree local information is sufficient to solve global tasks. Many tasks can be solved entirely via local communication, for instance, how many friends of friends one has. Research in the last 30 years has shown that some classic combinatorial optimization problems such as matching, coloring, dominating set, or approximations thereof can be solved using small (i.e., polylogarithmic) local communication. For example, a maximal independent set can be computed in time O(log n) [22] , but not in time Ω( log n/ log log n) [17] (n is the network size). This lower bound even holds if message sizes are unbounded.. However "many"important optimization problems are "global" problems from the distributed computation point of view. To count the total number of nodes, to determining the diameter of the system, or to compute a spanning tree, information necessarily must travel to the farthest nodes in a system. If exchanging a message over a single edge costs one time unit, one needs Ω(D) time units to compute the result, where D is the network diameter. If message size was unbounded, one can simply collect all the information in O(D) time, and then compute the result. Hence, in order to arrive at a realistic problem, we need to introduce communication limits, i.e., each node can exchange messages with each of its neighbors in each step of a synchronous system, but each message can have at most B bits (typically B is small, say O(log n)). However, to compute a spanning tree, even single-bit messages are enough, as one can simply breadth-first-search the graph in time O(D) and this is optimal [24] .. But, can we verify whether an existing spanning tree indeed is a correct spanning tree?! In this paper we show that this is not generally possible in O(D) time -instead one needs Ω( √ n + D) time. (Thus, in contrast to traditional non-distributed complexity, verification is harder than computation in the distributed world!). Our paper is more general, as we show interesting lower and upper bounds (these are almost tight) for a whole selection of verification problems. Furthermore, we show a key application of studying such verification problems to proving strong unconditional time lower bounds on exact and approximate distributed computation for many classical problems. We initiate the systematic study of verification problems in the context of distributed network algorithms and present a uniform lower bound for several problems. We also show how these verification bounds can be used to obtain lower bounds on exact and approximation algorithms for many problems.. Several problems remain open. A general direction for extending all of this work is to study similar verification problems in special classes of graphs, e.g., a complete graph. A few specific open questions include proving better lower or upper bounds for the problems of shortest s-t path, singlesource distance computation, shortest path tree, s-t cut, minimum cut. (Some of these problems were also asked in [7] .) Also, showing randomized bounds for Hamiltonian path, spanning tree, and simple path verification remains open.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Achievable Rate Regions and Performance Comparison of Half Duplex Bi-Directional Relaying Protocols Abstract-In a bi-directional relay channel, two nodes wish to exchange independent messages over a shared wireless half-duplex channel with the help of a relay. In this paper, we derive achievable rate regions for four new half-duplex protocols and compare these to four existing half-duplex protocols and outer bounds. In time, our protocols consist of either two or three phases. In the two phase protocols, both users simultaneously transmit during the first phase and the relay alone transmits during the second phase, while in the three phase protocol the two users sequentially transmit followed by a transmission from the relay. The relay may forward information in one of four manners; we outline existing amplify and forward (AF), decode and forward (DF), lattice based, and compress and forward (CF) relaying schemes and introduce the novel mixed forward scheme. The latter is a combination of CF in one direction and DF in the other. We derive achievable rate regions for the CF and Mixed relaying schemes for the two and three phase protocols. We provide a comprehensive treatment of eight possible half-duplex bi-directional relaying protocols in Gaussian noise, obtaining their relative performance under different SNR and relay geometries.Index Terms-Achievable rate regions, bi-directional communication, compress and forward, relaying. In this paper, we have derived achievable rate regions for 4 new half-duplex bi-directional relaying protocols and have provided a comprehensive numerical comparison of the halfduplex two-way achievable rate regions and outer bounds assuming Gaussian input distributions in AWGN channels. For the MABC protocol, DF (with random or lattice codebooks) or CF is the optimal scheme, depending on the given channel and SNR regime. In particular, the new half-duplex lattice DF MABC protocol performs well for symmetric, high SNR channels. In asymmetric cases, Mixed protocols which employ DF in one direction and CF in the other perform well, as different forwarding schemes in the two directions may be more tailored to the different channel conditions in the two directions. In the TDBC protocol, the relative performance of the forwarding schemes depends on the given channel conditions. Notably, we have determined an example of a channel condition in which the mixed TDBC protocol outperforms the other proposed protocols. In general, the MABC protocol outperforms the TDBC protocol in the low SNR regime, while the reverse is true in the high SNR regime. . Since is arbitrary, a proper choice of , the conditions of Theorem 1, (76), and the AEP property guarantee that the right hand sides of (81), (83) and (85) corresponding to (76), (7) and (2)

B I I O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O B O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O B O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O B I B I I B O O O O O O B I I O O O O O B O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Rearrangement Phylogeny of Genomes in Contig Form There has been a trend in increasing the phylogenetic scope of genome sequencing while decreasing the quality of the published sequence for each genome. With reduced finishing effort, there is an increasing number of genomes being published in contig form. Rearrangement algorithms, including gene order-based phylogenetic tools, require whole genome data on gene order, segment order, or some other marker order. Items whose chromosomal location is unknown cannot be part of the input. The question we address here is, for gene order-based phylogenetic analysis, how can we use rearrangement algorithms to handle genomes available in contig form only? Our suggestion is to use the contigs directly in the rearrangement algorithms as if they were chromosomes, while making a number of corrections, e.g., we correct for the number of extra fusion/fission operations required to make contigs comparable to full assemblies. We model the relationship between contig number and genomic distance, and estimate the parameters of this model using insect genome data. With this model, we use distance matrix methods to reconstruct the phylogeny based on genomic distance and numbers of contigs. We compare this with methods to reconstruct ancestral gene orders using uncorrected contig data. W HILE the increasing pace of genome sequencing is adding phylogenetic breadth to the inventory of species available for comparative genomics, the sequencing goal for many of these species is not to produce completely assembled genomes. Instead, the published and archived data remain in draft form, with all or many of the numerous contigs not assigned chromosomal locations, and there are often no resources allocated to further polishing. The price paid for increasing phylogenetic scope in genome sequencing is thus the decreasing sequencing quality for each genome.. While such data may be adequate for many types of comparative genomic studies, they are not directly usable as input to genome rearrangement algorithms. These algorithms require whole genome data, i.e., complete representations of each chromosome in terms of gene order, conserved segment order, or some other marker order, in order to calculate the rearrangement distance d between two genomes. Items, whose chromosomal location is unknown, cannot be part of the input.. The present paper deals with gene order-based phylogeny. The question we ask here: Is there any way to use genome rearrangement algorithms to compare genomes available in draft form only? One elegant answer was provided by Gaul and Blanchette [9] for the comparison of two genomes. Other approaches have also been investigated [4] . These methods construct a number of intermediate structures before or during the actual comparison of the genomes. Since we will be using distance matrix methods for phylogenetic analysis, these intermediate structures are largely irrelevant; we need distances and not the detailed reconstruction of the structures used in calculating the distance. For these purposes, involving more than two genomes, our suggestion is to use the contigs directly in the rearrangement algorithms as if they were chromosomes. This introduces a number of biases, such as increasing the distance to accommodate the count of extra fusion/fission operations necessary to compare genomes with different numbers of chromosomes. This bias and other problems with rearrangement distances in general, and with contig-based distances in particular, must be corrected during the construction of a distance matrix to input into a phylogenetic analysis.. We apply our methods to data originating mostly in the 12-genome Drosophila project [7] . We compare 10 Drosophila genomes with two other dipteran genomes and two outgroup insect genomes. We discuss these data in Section 2.. In Section 3, we model the behavior of the genomic distance as a function of evolutionary time, and discuss how to invert this function in order to infer elapsed time. In Section 4, we study the case where one of the two genomes being compared is fully assembled and the other is in contig form. Simulations are used to understand the consequences on evolutionary time inference of using incomplete assemblies. The ideas developed there are then extended to the more complex case where both genomes are fragmented into contigs, in Section 5. We can then construct a matrix of corrected evolutionary divergence times between all pairs of genomes in the database and carry out a phylogenetic analysis of the 14 genomes, in Section 6. For the Drosophila data only, we compare this phylogeny to one generated by gene order reconstruction algorithms applied to the genomes without any corrections for contigs or distancetime nonlinearities. We have developed a principled approach to correcting genome rearrangement distance when comparing genomes in contig form. Features of this include:. . A model for the -d relationship motivated by an intuitive negative exponential connection between asymptotic genomic distance (EðdÞ % n) and adjacency retention, including an empirically motivated quadratic correction term to improve the fit to simulated values. . A reasoned procedure for subtracting artificial fusions and fissions due to the fragmentation of one or both of the genomes into contigs. . The discovery and quantitative characterization of the linear relation between the uncorrected distance and the number of contigs, when only one or both of the genomes are fragmented into contigs. These linearities hold for a wide range of , up to 6,000 for genomes of size around n ¼ 9;000, and up to ¼ 1;000 contigs, though saturation is more of a problem when both genomes are highly fragmented. . Improved phylogenetic reconstruction for a data set on 14 insect genomes. We recovered a tree that accurately reflects almost all the phylogenetic information extracted from the literature, and pinpointed a period of evolutionary acceleration on one lineage. . A validation approach based on the reconstruction of uncorrected ancestral genomes using gene-order medians biased towards contig fusion operations. As argued in Section 3, the values of the parameters 1 and 2 are not likely to be very sensitive to n, especially for n in the thousands, since the model relates the normalized variables =n and d=n. Nor should they depend on details of the rearrangement model such as the number of chromosomes or the proportions of different types of rearrangement, assuming the latter are naturally weighted as in the double-cut-and-join framework. Thus, the values we have estimated through simulation for 1 ; 2 , and (considered as a function of =n), should hold for a range of data sets. This stability reassures us that our methods should be widely applicable beyond the Drosophila data we have used, but only partly mitigates the main shortcoming of this and other models such as in [15] , namely that they are not analytically derived. Thus, the mathematical foundation of probability models and statistical analyses of genomic problems like the one addressed here, would benefit more from advances like those in [8] than by further characterization of empirical models such (3).. Adriana Muñ oz is working toward the PhD degree in the Department of Computer Science at the School of Information Technology and Engineering at the University of Ottawa. She received the master's degree in computer science from the University of Alberta. She was a member of the Scientific Research Division and project manager for Nortel for a number of years.. David Sankoff holds the Canada research chair in mathematical genomics at the University of Ottawa.. . For more information on this or any other computing topic, please visit our Digital Library at www.computer.org/publications/dlib.

O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O B O O B I O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O B O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Building Tcl-Tk GUIs for HRT-HOOD systems D e p a r t a m e n t o d e Inform=ttica, U n i v e r s i d a d d e E x t r e m a d u r a . A v d a . d e la U n i v e r s i d a d , s/n, 1 0 0 7 1 , C d c e r e s , S p a i n . 3 4 9 2 7 2 5 7 2 6 5 3 4 9 2 7 2 5 7 2 6 5 3 4 9 2 7 1 8 1 0 9 2 juancarl @ unex.es iirala @ unex.es jmrodri @ unex.es User interface is generally a neglectic topic in real time methodologies. Yet, both in industry and high education, monitoring and supervising the evolution of the system under development through a friendly graphic environment FirsL the problem of using the Tcl/Tk scripting language in mutithreaded Ada95 applications has been studied, while a solution proposed: the deferred server architecture. This demands a little extension to Tcl-Tk/TASH. A complex enough classic example, the Mine Control System, has been implemented to test these ideas with success. Secondly, the integration of Tcl/Tk in HRT-HOOD systems has been explored. The reentrant nature of Tcl-Tk and its mechanism of callbacks allow us takes us to conclude that is not possible to build a stand alone tree hard HRT-HOOD system with a Tcl-Tk user interface. Finally, in contrast, a distributed approach to the Tcl-Tk GUI that relies on the deferred server model, seems like a promising option. This distributed architecture has been described, and its problems pinpointed, posed. Work is in progress in order to gain experience on this approach; we aim to achieve the goal of developping true HRT-HOOD systems with Tcl-Tk script based user interfaces. The initial goal of this work is to build a mechanism that enables any Ada95 task to transparently execute a Tcl-Tk script using T e l _ E v a 1 . At the time of this writing, the Tcl-Tk reentrance is been addressed by its creators. The upcomming Tcl-Tk 8.1 release have reentrant features. It is thread-safe, although in a rather restricted sense: Each thread can have its own interpreters but each interpreter can only be accessed through a single thread. Thus, its true that T c l _ E v a l can be concurrently invoked from two different threads, but with (and only with) two separate interpreters. That means that every Ada95 task in the system that uses the Tcl-Tk GUI should create its own interpreter before any T c l _ E v a l call; this complicates programming, but it should not present any major difficulty. In order to share a single intepreter, the Tcl-Tk 8.1 provides new Tcl C-level APIs to send commands and scripts to another thread. Of course, the TASH thick binding must keep up with the new thread-safe 8.1 features in a concurrent Ada95 application. Up to that moment, and even later, we think that the monolithic approach of this work can be useful. It even is mandatory for those restricted to use non-re, entrant Tcl-Tk releases.

O B O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O B O O O B O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O B O O B I O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O


Prime: Byzantine Replication under Attack Abstract-Existing Byzantine-resilient replication protocols satisfy two standard correctness criteria, safety and liveness, even in the presence of Byzantine faults. The runtime performance of these protocols is most commonly assessed in the absence of processor faults and is usually good in that case. However, faulty processors can significantly degrade the performance of some protocols, limiting their practical utility in adversarial environments. This paper demonstrates the extent of performance degradation possible in some existing protocols that do satisfy liveness and that do perform well absent Byzantine faults. We propose a new performanceoriented correctness criterion that requires a consistent level of performance, even with Byzantine faults. We present a new Byzantine fault-tolerant replication protocol that meets the new correctness criterion and evaluate its performance in fault-free executions and when under attack. E XISTING Byzantine fault-tolerant state machine replication protocols are evaluated against two standard correctness criteria: safety and liveness. Safety means that correct servers do not make inconsistent ordering decisions, while liveness means that each update to the replicated state is eventually executed. Most Byzantine replication protocols are designed to maintain safety in all executions, even when the network delivers messages with arbitrary delay. However, the wellknown FLP impossibility result [2] implies that no asynchronous Byzantine agreement protocol can always be both safe and live, and thus these systems ensure liveness only during periods of sufficient synchrony and connectivity [3] or in a probabilistic sense [4] , [5] .. When the network is sufficiently stable and there are no Byzantine faults, Byzantine fault-tolerant replication systems can satisfy much stronger performance guarantees than liveness. The literature has many examples of systems that have been evaluated in such benign executions and that achieve throughputs of thousands of update operations per second (e.g., [6] , [7] ). It has been a less common practice to assess the performance of Byzantine fault-tolerant replication systems when some of the processors actually exhibit Byzantine faults. In this paper, we point out that in many systems, a small number of Byzantine processors can degrade performance to a level far below what would be achievable with only correct processors. Specifically, the Byzantine processors can cause the system to make progress at an extremely slow rate, even when the network is stable and could support much higher throughput. While "correct" in the traditional sense (both safety and liveness are met), systems vulnerable to such performance degradation are of limited practical use in adversarial environments.. We experienced this problem firsthand in 2005, when the US Defense Advanced Research Projects Agency (DARPA) conducted a red team experiment on our Steward system [8] . Steward survived all of the tests according to the metrics of safety and liveness, and most attacks did not impact performance. However, in one experiment, we observed that the system was slowed down to 20 percent of its potential performance. After analyzing the attack, we found that we could slow the system down to roughly one percent of its potential performance. This experience led us to a new way of thinking about Byzantine fault-tolerant replication systems. We concluded that liveness is a necessary but insufficient correctness criterion for achieving high performance when the system actually has Byzantine faults. This paper argues that new, performance-oriented correctness criteria are needed to achieve a practical solution for Byzantine replication.. Preventing the type of performance degradation experienced by Steward requires addressing what we call a Byzantine performance failure. Previous work on Byzantine fault tolerance has focused on mitigating Byzantine failures in the value domain (where a faulty processor tries to subvert the protocol by sending incorrect or conflicting messages) and the time domain (where messages from a faulty processor do not arrive within protocol time-outs, if at all). Processors exhibiting performance failures operate arbitrarily but correctly enough to avoid being suspected as faulty. They can send valid messages slowly but without triggering protocol time-outs; reorder or drop certain messages, both of which could be caused by a faulty network; or, with malicious intent, take one of a number of possible actions that a correct processor in similar circumstances might legitimately take. Thus, processors exhibiting performance failures are correct in the value and time domains yet have the potential to significantly degrade performance. The problem is magnified in wide-area networks, where timeouts tend to be large and it may be difficult to determine what type of performance should be expected. A performance failure is not a new failure mode but rather is a strategy taken by an adversary that controls Byzantine processors.. In order to better understand the challenges associated with building Byzantine fault-tolerant replication protocols that can resist performance failures, we analyzed existing protocols to assess their vulnerability to performance degradation by malicious servers. We observed that most of the protocols (e.g., [6] , [7] , [8] , [9] , [10] , [11] , [12] ) share a common feature: they rely on an elected leader to coordinate the agreement protocol. We call such protocols leader based. We found that leader-based protocols are vulnerable to performance degradation caused by a malicious leader.. Based on the understanding gained from our analysis, we developed Prime, the first Byzantine fault-tolerant state machine replication protocol capable of making a meaningful performance guarantee even when some of the servers are Byzantine. Prime meets a new, performanceoriented correctness criterion, called BOUNDED-DELAY. Informally, BOUNDED-DELAY bounds the latency between a correct server receiving a client operation and the correct servers executing the operation. The bound is a function of the network delays between the correct servers in the system. This is a much stronger performance guarantee than the eventual execution promised by liveness.. Like many existing Byzantine fault-tolerant replication protocols, Prime is leader based. Unlike existing protocols, Prime bounds the amount of performance degradation that can be caused by the faulty servers, including by a malicious leader. Two main insights motivate Prime's design. First, most protocol steps do not need any messages from the faulty servers to complete. Faulty servers cannot delay these steps beyond the time it would take if only correct servers were participating in the protocol. Second, the leader should require a predictable amount of resources to fulfill its role as leader. In Prime, the resources required by the leader to do its job as leader are bounded as a function of the number of servers in the system and are independent of the offered load. The result is that the performance of the few protocol steps that do depend on the (potentially malicious) leader can be effectively monitored by the nonleader servers.. We present experimental results evaluating the performance of Prime in fault-free and under attack executions. Our results demonstrate that Prime performs competitively with existing Byzantine fault-tolerant replication protocols in fault-free configurations and that Prime performs an order of magnitude better in under attack executions in the configurations tested. In this paper, we pointed out the vulnerability of current leader-based Byzantine fault-tolerant state machine replication protocols to performance degradation when under attack. We proposed the BOUNDED-DELAY correctness criterion to require consistent performance in all executions, even when the system exhibits Byzantine faults. We presented Prime, a new Byzantine fault-tolerant state machine replication protocol, which meets BOUNDED-DELAY and is an important step toward making Byzantine fault-tolerant replication resilient to performance attacks in malicious environments. Our experimental results show that Prime performs competitively with existing protocols in fault-free configurations and an order of magnitude better when under attack in the configurations tested. In this section, we show that in those executions in which Stability-S2 holds, Prime provides BOUNDED-DELAY (see Definition 3.8). As before, we let L Ã timely and L Ã bounded denote the maximum message delay between correct servers for TIMELY and BOUNDED messages, respectively, and we let B ¼ 2K Lat L Ã timely þ Á pp . We also let Á agg denote a value greater than the maximum time between a correct server sending any of the following messages successively: PO-SUMMARY, SUMMARY-MATRIX, and PRE-PREPARE.. We first consider the maximum amount of delay that can be added by a malicious leader that performs well enough to avoid being replaced. The time between a server receiving and introducing a client operation, o, for preordering and all correct servers sending SUMMARY-MATRIX messages containing at least 2f þ 1 PO-SUMMARY messages that cumulatively acknowledge the preordering of o is at most three bounded rounds plus 2Á agg . The malicious servers cannot increase this time beyond what it would take if only correct servers were participating. By Property 5.1, a leader that retains its role as leader must provide a TAT, t B, to at least one correct server. By definition,. Since correct servers flood PRE-PREPARE messages, all correct servers receive the PRE-PREPARE within three bounded rounds and one aggregation delay of when the SUMMARY-MATRIX messages are sent. All correct servers globally order the PRE-PREPARE in two bounded rounds from the time, t, the last correct server receives it. Reconciliation guarantees that all correct servers receive the PO-REQUEST containing the operation within one bounded round of time t. Summing the total delays yields a maximum latency of ¼ 6L. If a malicious leader delays proposing an ordering, by more than B, on a summary matrix that proves that at least 2f þ 1 servers preordered operation o, it will be suspected and a view change will occur. View changes require a finite (and, in practice, small) amount of state to be exchanged among correct servers, and thus they complete in finite time. As described in Section A.3 in Appendix A, a faulty leader will be suspected if it does not terminate the view change in a timely manner. Property 5.2 of Suspect-Leader guarantees that at most 2f view changes can occur before the system settles on a leader that will not be replaced. Therefore, there is a time after which the bound of holds for any client operation received and introduced by a stable server. The throughput results are different when the two protocols are attacked. With an aggressive time-out of 300 ms, BFT can order fewer than 30 updates/sec. With the default time-out of five seconds, BFT can only order two updates/sec (not shown). Prime plateaus at about 400 updates/sec due to the bandwidth overhead incurred by the Reconciliation subprotocol. Prime's throughput continues to increase until it becomes bandwidth constrained. BFT reaches its maximum throughput when there is one client per server. This throughput limitation, which occurs when only a small amount of the available bandwidth is used, is a consequence of judging the leader conservatively.. The slope of the curve corresponding to Prime under attack is less steep than when it is not under attack due to the delay added by the malicious leader. We include results with K Lat ¼ 1 and K Lat ¼ 2. K Lat accounts for variability in latency (see Section 3). As K Lat increases, a malicious leader can add more delay to the turnaround time without being detected. The amount of delay that can be added by a malicious leader is directly proportional to K Lat . For example, if K Lat were set to 10, the leader could add roughly 10 round-trip times of delay without being suspected. When under attack, the latency of Prime increases due to the two extra protocol rounds added by the leader. When K Lat ¼ 2, the leader can add approximately 100 ms more delay than when K Lat ¼ 1. The latency of BFT under attack climbs as soon as more than one client is added to each server because the leader can order one update per server per time-out without being suspected. This paper focused on leader-based Byzantine fault-tolerant protocols [6] , [7] , [8] , [9] , [10] , [11] , [12] that achieve replication via the state machine approach [22] , [23] . The consistency of these systems does not rely on synchrony assumptions, while liveness is guaranteed assuming the network meets certain stability properties. To ensure that the stability properties are eventually met in practice, they use exponentially growing time-outs during view changes. This makes these systems vulnerable to the type of performance degradation when under attack described in Section 2.2. In contrast, Prime uses the Suspect-Leader subprotocol to allow correct servers to collectively decide whether the leader is performing fast enough by adapting to the network conditions once the system stabilizes. Aiyer et al. [15] first noted the problems that can be caused by a faulty primary and suggested rotating the primary to mitigate its attacks. Prime takes a different approach, enforcing timely behavior from any leader that remains in power and eventually settling on a leader that provides good performance. Singh et al. [24] demonstrate how the performance of different protocols can degrade under unfavorable network conditions. More recently, the Aardvark system of Clement et al. [13] proposed building robust Byzantine replication systems that sacrifice some normal-case performance in order to ensure that performance remains acceptably high when the system exhibits Byzantine failures. The approaches taken by Prime and Aardvark are quite different. Prime aims to guarantee that every request known to correct servers will be executed in a timely manner, limiting the leader's responsibilities in order to enforce timeliness exactly where it is needed. Aardvark aims to guarantee that over sufficiently long periods, system throughput remains within a constant factor of what it would be if only correct servers were participating in the protocol. It achieves this by gradually increasing the level of work expected from the leader, which ensures that view changes take place. Aardvark guarantees high throughput when the system is saturated, but individual requests may take longer to execute (e.g., if they are introduced during the grace period that begins any view with a faulty primary). The Spinning protocol of Veronese et al. [14] constantly rotates the primary to reduce the impact of faulty servers.. Rampart [25] implements Byzantine atomic multicast over a reliable group multicast protocol. This is similar to how Prime uses preordering followed by global ordering. Both protocols disseminate requests to 2f þ 1 servers before a coordinator assigns the global order. Drabkin et al. [26] observe the difficulty of setting time-outs in the context of group communication in malicious settings. Prime's Reconciliation subprotocol uses erasure codes for efficient data dissemination. A similar approach was taken by Cachin and Tessaro [27] and Fitzi and Hirt [28] .. Other Byzantine fault-tolerant protocols [4] , [5] , [29] , [30] use randomization to circumvent the FLP impossibility result, guaranteeing termination with probability one. These protocols incur a high number of communication rounds during normal-case operation (even those that terminate in an expected constant number of rounds). However, they do not rely on a leader to coordinate the ordering protocol and thus may not suffer the same kinds of performance vulnerabilities when under attack.. Byzantine quorum systems [31] , [32] , [33] , [34] can also be used for replication. While early work in this area was restricted to a read/write interface, recent work uses quorum systems to provide state machine replication. The Q/U protocol [33] requires 5f þ 1 replicas for this purpose and suffers performance degradation when write contention occurs. The HQ protocol [34] showed how to mitigate this cost by reducing the number of replicas to 3f þ 1. Since HQ uses BFT to resolve contention when it arises, it is vulnerable to the same types of performance degradation as BFT.. A different approach to state machine replication is to use a hybrid architecture in which different parts of the system rely on different fault and/or timing assumptions [35] , [36] , [37] . The different components are therefore resilient to different types of attacks. We believe leveraging stronger timing assumptions may allow for more aggressive performance monitoring.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Extending XCSF beyond linear approximation XCSF is the extension of XCS in which classifier prediction is computed as a linear combination of classifier inputs and a weight vector associated to each classifier. XCSF can exploit classifiers' computable prediction to evolve accurate piecewise linear approximations of functions. In this paper, we take XCSF one step further and show how XCSF can be easily extended to allow polynomial approximations. We test the extended version of XCSF on various approximation problems and show that quadratic/cubic approximations can be used to significantly improve XCSF's generalization capabilities. XCSF [15] extends the typical concept of learning classifier systems through the introduction of a computable classifier prediction. In XCSF classifier prediction is not memorized into a parameter but computed as a linear combination of the current input and a weight vector associated to each classifier. Wilson [15] applied XCSF to simple function approximation problems showing that computable prediction can be used to evolve accurate piecewise linear approximations of a target function. In this paper we extend previous results and show that XCSF can be easily extended Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. to include polynomial approximations. For this purpose, we consider the version of XCSF with linear least squares update recently introduced in [10] (i) to speed up the convergence of classifier weights and (ii) to improve the generalization capabilities of XCSF. We show how XCSF can be easily extended for generic polynomial approximations by adding a simple preprocessing step to the usual XCSF's weight update procedure [15] . To extend XCSF to evolve polynomial approximations of degree k, given the current input x = x1 . . . xn , classifiers weights are updated with respect to the input y obtained by enriching x with power terms, that is y = x1, x [15] or linear least squares [10] . We apply XCSF with quadratic and cubic approximation to approximate functions taken from the literature such as the three sine and the four sine problems [9] , the polynomial 1 + x + x 2 + x 3 from [8] , and other functions from [16] . We show that the generalization mechanism of XCSF can exploit quadratic and cubic approximations to evolve solutions that are significantly more accurate and significantly more compact.. The paper is organized as follows. We begin in Section 2 with a description of XCSF [15] and then in Section 3 we briefly introduce linear least squares for XCSF [10] which we use in all the experiments discussed in this paper. In Section 4 we illustrate the general approach we follow to extend XCSF to allow polynomial approximations. In Section 6, we compare XCSF with linear approximation and XCSF with quadratic and cubic approximations on several approximation problems. The results are statistically analyzed in Section 7 showing that the improvement in accuracy and generalization obtained through quadratic/cubic approximations is statistically significant. Future research directions and additional issues related to polynomial approximation with XCSF are discussed in Section 8. We have shown how XCSF can be easily extended beyond linear approximation so as to allow polynomial approximations for computing classifier predictions. We have compared the original XCSF with linear prediction, to the versions of XCSF extended with quadratic and cubic prediction on different problems taken from the literature. The results we report show that the generalization mechanism of XCSF can effectively exploit quadratic and cubic approximations to evolve solutions that are usually more accurate and more compact than those evolved by the original XCSF with linear approximation. The statistical analysis of the results shows that such improvements are statistically significant, both in accuracy and in generalization capability. Finally, we note that the approach we discussed here is generalizable to higher order polynomials. However, our statistical analysis suggests that increasing the degree of the polynomials used to approximate classifier prediction might not lead to statistically significant improvements unless small error thresholds are involved.

O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Image-guided weathering: A new approach applied to flow phenomena The simulation of weathered appearance is essential in the realistic modeling of urban environments. A representative and particularly difficult effect to produce on a large scale is the effect of fluid flow. Changes in appearance due to flow are the result of both the global effect of large-scale shape, and local effects, such as the detailed roughness of a surface. With digital photography and Internet image collections, visual examples of flow effects are readily available. These images, however, mix the appearance of flows with the specific local context. We present a methodology to extract parameters and detail maps from existing imagery in a form that allows new targetspecific flow effects to be produced, with natural variations in the effects as they are applied in different locations in a new scene. In this article, we focus on producing a library of parameters and detail maps for generating flow patterns; and this methodology can be used to extend the library with additional image exemplars. To illustrate our methodology, we show a rich collection of patterns applied to urban models. Real materials change in appearance as a result of their interaction with the surrounding environment, and nowhere are such changes more apparent than in urban scenes. Variations in appearance are due to the specific type of weathering, the exposure and shape of an object, and the material of which an object is composed. Specifying and generating weathering effects on large-scale scenes remains a challenge. In this article, we present an approach for extracting appearance change data from photographs, which is then used to guide a weathering simulation with novel effects in a complex synthetic scene. As a representative type of weathering crucial to urban modeling, we consider the characteristic washing and staining patterns due to the flow of water over surfaces.. Our contribution is a new approach to weathering which uses photographs to drive a simulation, rather than simply reusing the photograph or patches of pixels from the photograph directly. Our approach is illustrated in Figure 1 , outlining the major components required for this new approach. In particular, we present a method to separate the effect of the weathering phenomena (in this case stains) from the original object material, allowing the effect to be applied to materials of different color. We then introduce a method to extract simulation parameters from photographs of stains by optimization, allowing the effect to be applied to surfaces of different geometry. Finally, we show how we can extract high-frequency details of the effect, enabling simulation of weathering effects with naturallooking small-scale variations. Our approach to overcome the problems of using either texture synthesis or procedural models alone is to extract parameters and details from captured images that can then be used in a phenomenological simulation. The simulation can then produce results that are similar to the captured image, but which are adapted to the specific target and that have natural variations in each instance.. We begin with a photograph of a weathering effect on a building, in particular a stained area produced by flows. We use approximate frontal images of flat surfaces or surfaces that can be approximated with a simple geometric proxy (e.g., a box or a cylinder). For future reference, we label the image by geometry of the source of the effect (e.g., point source such as a small pipe or pole, or line source such as a ledge or window sill), the source material (e.g., rust, chalked paint, biological growth, dirt) and the target of the material that is stained (e.g., concrete, stucco, bricks). We use simple user input followed by an automated process to segment out the weathered material in the image, resulting in a stain degree map. If exactly the same parameters and geometries were used in the simulated scenes as were found in the segmented images, the segmented images could just simply be copied onto the modeled geometry. However, even in this case the effects would need to have variations introduced to be realistic; an observer would notice the same stain repeated over and over again. Texture synthesis is not an appropriate solution in this case, since no control is provided to take the physical properties of the underlying phenomena into account. In addition, such methods have difficulty reproducing the regular structure of downward flows, for example. To account for the differences between the source photographs and target surfaces being stained, and to introduce natural variations in the stains we produce, we extract data from the photographs rather than reuse them directly.. Three types of data are extracted from the segmented photograph; the nonlinear relationship between degree of staining and color, estimated parameters for a simulation, and maps of high spatial frequency details. These data are extracted from the photographs starting with a stain degree map. The nonlinear color variation in stains is estimated from a histogram of stain color as a function of stain degree. The parameters for a simple phenomenological method for flow are estimated using nonlinear optimization to find parameters that form a flow pattern similar to the stain degree map. Finally the difference between the flow pattern from the optimized parameters and the original stain degree map is used as a source for synthesizing a map of high spatial frequency details for stains.. To apply the extracted data in a particular scene, we run the phenomenological simulation with the parameters we have estimated. In the simulation, the properties of the target surface are modulated using the high spatial frequency details. Finally the flow is combined with the target surface background using the nonlinear color mixing procedure.. The extracted data is independent of the target scene. A user can collect many stain photographs and create a library of flow parameters and detail maps that can be used in their own scene modeling toolkit, or which can be shared with other users.. In the following sections we detail each of the steps in extracting reusable flow parameters and detail maps from a photograph of a stained surface. We have presented a new method for using photographs as input for generating realistic imagery. Rather than use photographs directly for texture synthesis, we instead extract simulation parameters and detail maps that are used to generate scene-specific stains with natural variations. By making use of photographs to generate realistic patterns, our approach eliminates the difficult and sometimes impossible task of finding appropriate parameters for simulations. Future work includes applying a similar approach to extract data from images of other types of aging effects as the basis for a system capable of generating a broad palette of weathering phenomena. Given the parameters for individual weathering effects, cascading effects (weathering effects that produce patterns that in turn contribute to additional effects) could be applied without the need for locating images for each possible combination of effects. In this section, we show results of our approach for simulating stains on new synthetic scenes. The input images used in the examples are included in Figure 10 . These images show a variety of stain materials and background surfaces that are typically found in real environments, including rust, efflorescence, mold, or green biological growth. The parameters, distributions, detail maps, and color information extracted from the images and other exemplars are included in the supplementary material. A variety of approaches have been brought to bear on the problem of generating aging effects for realistic image synthesis. The wide range of biological, chemical, and mechanical aging effects and the various methods applied to simulate them are described in surveys by Merillou et al. [2008] and in the book by Dorsey et al. [2007] . One approach is to have skilled artists assemble combinations of processed digital photographs and digital painting, applying image processing methods as described by Demers [2001] and demonstrated in work such as that by Clement et al. [2007] . In an alternative approach, researchers have developed physically-based and phenomenological simulation models to systematically generate effects that are tedious to produce manually, or to achieve a more realistic look. Specifically in the area of stains produced by flow, Dorsey et al. [1996] introduced a phenomenological simulation using a particle system to create flow effects. This approach was generalized to general transfer phenomena in the "gamma-ton" method by Chen et al. [2005] . Flow accessibility has been studied for simulating pollution as well [Mérillou et al. 2010] .. Recently, methods to produce aged appearance based on photographic exemplars have been developed. Wang et al. [2006] introduced a technique based on capturing examples of different "degrees" of weathering due to a single effect in a single image. These examples form the basis of an appearance manifold that approximates an underlying subspace of weathered surface point appearances for a material. Xue et al. [2008] further developed this idea, focusing on the interactive editing of weathering effects in images with an eye to transferring effects from one image to another.. Beyond using individual images, more sophisticated capture systems [Weyrich et al. 2009 ] have been used to obtain aged appearance data. This includes systems that capture time-varying reflectance data for flat surfaces [Koudelka 2004; Gu et al. 2006; Sun et al. 2007] , aged appearance correlated to geometric effects [Mertens et al. 2006] , and a system that captures time-varying effects as a function of geometry [Lu et al. 2007] .. Systems that use captured data produce either pixel values or texture patches that are correlated to a control variable, such as time, weathering degree, and/or local geometric properties, such as curvature or orientation. Ambient occlusion, which is closely related to accessibility [Miller 1994 ] and surface exposure [Hsu and Wong 1995] , has also been found to be highly correlated with weathering concentration. Fast texture synthesis methods can be used to map the captured values or patches to an object for which the control variable can be computed on the surface. When the control variable is a geometric property, it can be computed locally at each point on the surface. However, when the control variable is time or magnitude of exposure, such as solar irradiation, a simulation is needed. In the case of solar exposure, the full scene geometry needs to be considered, but the direct exposure calculation is independent of material type. A time-or degree-dependent control variable can be computed on a structure, and subsequently used with data acquired from a flat surface or image degree map to obtain spatial variations. For variables that depend on weathering degree, an additional problem is that an appropriate dataset or image with multiple weathering degrees is not available for an effect to be modeled. A more fundamental problem is when a control variable cannot be computed locally and/or independently of material. This fundamental problem occurs with flow phenomena (as well as with other phenomena such as cracking and erosion). Stains due to flows depend on global geometry: the full history along the path from where water first hit a surface to where stain particles are deposited. Furthermore, that history depends on the nature of the stain particle and the surface properties. For this reason, the capture-plus-control-variable paradigm fails for creating stains. This leaves manual application and phenomenological simulations as the methods available for stained surfaces.. Our focus here is generating weathering effects in urban scenes. The modeling of urban scenes has been the subject of great interest in the computer graphics and computer vision communities for decades. A major focus of these modeling methods has been in procedurally generating geometry for cities; a recent comprehensive survey can be found in Watson et al. [2008] . There has been increasing interest in generating associated textures for these methods, especially in the context of computer vision (e.g., Koutsourakis et al. [2009] ). In all these methods, however, texture is reused "asis" from the photograph or with minor preprocessing for lighting; aging is not treated. The texturing demands posed by today's procedurally generated urban-scale models call for efficient, automated approaches. For local effects or solar exposure, fast texture synthesis with control variables is becoming viable. However, flow effects on a large scale are still problematic.. A recent study by Endo et al. [2010] considered manual application and Dorsey et al.'s particle flow system as methods for creating realistic flow effects in imagery. They designed a new variant of the particle system that allows the user to interactively adjust the parameters to get the desired stain appearance. They found that adjusting the parameters was substantially faster than trying to paint in the stains in a photo-editing system. However, even with the new system, the trial-and-error user adjustment of parameters to get the stain correct took minutes per stain. Such an approach is not feasible for urban-scale scenes.. •

O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Multiobjective real-coded bayesian optimization algorithmrevisited: diversity preservation This paper provides empirical studies on MrBOA, which have been designed for strengthening diversity of nondominated solutions. The studies lead to modified sharing. A new selection scheme has been suggested for improving diversity performance. Empirical tests validate their effectiveness on uniformity and front-spread (i.e., diversity) of nondominated set. A diversity-preserving MrBOA (dp-MrBOA) has been designed by carefully combining all the promising components; i.e., modified sharing, dynamic crowding, and diversity-preserving selection. Experiments demonstrate that dp-MrBOA is able to significantly improve diversity performance (for the scaling problems), without weakening proximity of nondominated set. Real-world problems involve incommensurable and often competing objectives [1, [3] [4] [5] [6] [7] . They are known as multiobjective (or multicriteria) optimization problems (MOPs). In general, a real-valued MOP can be formulated as follows: This paper has tried to take a close look at the main operators of MrBOA. A potential source of diversity preservation has been investigated. Adaptive sharing has been modified by involving both the domination and the nondom- Table 6 : Performance comparison of s-MrBOA and dp-MrBOA on non-scaling problems. No statistical significance appears from a paired, two-tailed test of α = 0.05. The values of parenthesis stand for population size N and problem size n, respectively. ination counts. Experimental results have shown that this strategy can be effective in improving the diversity of the nondominated set. Further, a diversity-preserving selection has been developed by introducing some solutions largely apart from the worst group of individuals. It has shown that the proposed selection rather than the truncation selection is more beneficial to diversity promotion. These results lead to the dp-MrBOA which combines modified sharing, dynamic crowding, and diversity-preserving selection. Experimental results have shown that the concomitant synergy significantly improves uniformity and front-spread of nondominated solutions (i.e., diversity performance) while achieving appreciable proximity.

O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


A Choice Relation Framework for Supporting Category-Partition Test Case Generation Abstract In this paper, we have developed a choice relation framework for supporting category-partition test case generation. The major merits of the framework are:. (a) We capture the constraints among choices in a rigorous and systematic manner via the introduction of various relations.. (b) We improve on the effectiveness and efficiency of complete test frame construction by means of consistency checks and automatic deductions of relations.. (c) We provide a means of removing only the incorrectly defined relations and any related ones, thereby saving the effort of repeating the entire construction process for the choice relation table.. (d) We provide a direct way to control the maximum number of generated test frames.. (e) We enable the software tester to specify the relative priorities for choices that are used for the subsequent formation of complete test frames.. We have applied our approach to real-life situations and reported on the effectiveness of consistency checks and automatic deductions of choice relations. (i) every element in S that is manually defined, (ii) every element in S that is automatically initialized in step (4) of this procedure, and (iii) the manually defined ancestor(s) of every element in S that is automatically deduced in step (5)( f ) of this procedure. Then, prompt the user to select the erroneous ones from (i) and (iii) above. Correct the selected elements using the procedure correct operator. Repeat this step (e) until no inconsistency is detected.. ( f ) Whenever possible, perform automatic deductions for yet-to-be-defined elements, using Proposi- It would be worth reviewing other work related to the original CPM and our choice relation framework:. (a) Amla and Ammann [1] suggest that CPM is applicable to natural-language functional specifications, which may be incomplete and unstructured. Software testers will need undue effort to define testing requirements, thus hampering the effectiveness of the method. On the other hand, they argue that testing requirements are, to a large extent, already captured in formal specifications. They analyze the feasibility of applying CPM to Z specifications, and verify that testing requirements can be derived from formal specifications more easily.. (b) Following up on the above study, Ammann and Offutt [2] define a minimal coverage criterion, called the base-choice-coverage criterion, for category-partition testing. They develop a procedure for converting Z specifications into test specifications that satisfy this criterion, and introduce a method to produce test scripts from the test specifications.. (c) Using the notion of test templates, Stocks and Carrington [19] develop a unified, flexible, and formal framework for specification-based testing. Their framework provides not only a formal model of tests and test suites, but also a method for applying the model in testing. In this way, test suites can be constructed in a concise and formal manner. They also investigate several application areas of the framework, including test oracles, refinement, and regression testing.. (d) Zeil and Wild [20] observe that test descriptions generated by testing criteria are, effectively, sets of constraints that define test cases. Solutions to a set of constraints correspond to actual test data. 3 There may, however, be more that one solution, and a common practice is to choose one of them arbitrarily. Zeil and Wild argue that some solutions may have a higher probability of revealing failures. Hence, they suggest a refinement process to reduce the solution set with the aim of identifying test data with a higher failure-revealing capability. Refinement is achieved by imposing further constraints incrementally.. (e) Offutt and Irvine [16] investigate the effectiveness of fault detection in object-oriented programs using test cases generated by CPM. Common types of faults in C++ programs are identified. Such faults are inserted into two programs. Test cases are then generated using CPM with a view to uncovering these seeded faults. Their results show that these test cases help identify almost all the faults, except those involving memory management. They propose that C++ programs can be tested effectively by combining CPM with a tool for detecting memory management faults. They further conclude that traditional testing techniques, such as CPM, are also effective for testing object-oriented programs, and hence software developers do not need new testing methods in the object-oriented paradigm.. ( f ) Grochtmann and Grimm [11] propose a classification-tree method to help construct test cases from functional specifications. In this method, a classification tree, which is in the form of a hierarchical structure, organizes classifications and classes at alternate levels. 4 The basic approach of the classification-tree method is very similar to that of CPM, namely to build a model of the constraints in the input domain with a view to generating all the valid test frames while suppressing invalid ones as far as possible. Chen et al. [7] further study how to improve on the tree structure to facilitate the construction of test frames.. (g) Previous work has also been done on test case prioritization. For example, Avritzer and Weyuker [3] develop load testing strategies to generate test suites to check the resource allocation behavior of software systems according to operational profiles. Elbaum et al. [9] study version-specific test case prioritization techniques in regression testing, with a view to improving the rate of fault detection.. The major difference between approaches (a)-(c) and ours is that the former are based on formal specifications. In our project, rather than formalizing the specification language, we attempt to improve on CPM by proposing a rigorous and systematic framework. On the other hand, both approach (c) and ours provide a formal framework to systematically define test suites for specification-based testing.. In (c) and (d), the notion of refinement has been used to derive test cases. Our framework can also support the generation of test cases via refinement, such as by splitting choices or imposing additional constraints on choices. It will be interesting to investigate, as future research, how the concept of refinement can be used to enhance the choice relation framework, so as to further facilitate the construction of test cases from test frames.. With regard to (e), we note that discussions on the testing of object-oriented software are beyond the scope of the current paper. Readers may refer to [5, 6] for our perspective on this topic.. CPM and ( f ) differ in how invalid test frames are modeled and suppressed. CPM achieves this by capturing constraints in textual form whereas ( f ) represents constraints in the form of tree structures. It has been found that the latter approach may not be applicable to every scenario.. Finally, the work highlighted in (g) studies the generation of test suites to cover states in proportion to their use [3] , or the prioritization of existing tests in regression testing [9] . On the other hand, our work addresses prioritization from the perspective of the specification-based CPM.

O B I I O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


On Certain Values of Kloosterman Sums Let $K_{q^n}(a)$ be a Kloosterman sum over the finite field $\F_{q^n}$ of characteristic $p$. In this note so called subfield conjecture is proved in case $p>3$: if $a\ne0$ belongs to the proper subfield $\F_q$ of $\F_{q^n}$, then $K_{q^n}(a)\ne-1$. This completes recent works on the subfield conjecture by Shparlinski, and Moisio and Lisonek. The problem is motivated by some applications to bent functions. Moreover, in the course of the proof a large class of translates of Dickson polynomials are shown to be irreducible.

O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O