Knowledge-based programs

Summary.  Reasoning about activities in a distributed computer system at the level of the knowledge of individuals and groups allows us to abstract away from many concrete details of the system we are considering. In this paper, we make use of two notions introduced in our recent book to facilitate designing and reasoning about systems in terms of knowledge. The first notion is that of a knowledge-based program. A knowledge-based program is a syntactic object: a program with tests for knowledge. The second notion is that of a context, which captures the setting in which a program is to be executed. In a given context, a standard program (one without tests for knowledge) is represented by (i.e., corresponds in a precise sense to) a unique system. A knowledge-based program, on the other hand, may be represented by no system, one system, or many systems. In this paper, we provide a sufficient condition for a knowledge-based program to be represented in a unique way in a given context. This condition applies to many cases of interest, and covers many of the knowledge-based programs considered in the literature. We also completely characterize the complexity of determining whether a given knowledge-based program has a unique representation, or any representation at all, in a given finite-state context. Received: October 1995 / Accepted: February 1997     

Phase I/II clinical radioimmunotherapy with an iodine-131-labeled anti-carcinoembryonic antigen murine monoclonal antibody IgG

The aim of this study was to determine, in a Phase I/II clinical trial, the pharmacokinetics, dosimetry and toxicity, as well as antitumor activity, of the 131I-labeled murine anti-carcinoembryonic antigen (CEA) monoclonal antibody, NP-4 (IgG1 subtype). METHODS: A total of 57 patients with CEA-expressing tumors (29 colorectal, 9 lung, 7 pancreas, 6 breast and 4 medullary thyroid cancer patients), mostly in very advanced stages, were treated. The patients underwent a diagnostic study (1-3 mg of IgG and 8-30 mCi of 131I) to assess tumor targeting and to estimate dosimetry, followed by the therapeutic dose (4-23 mg and 44-268 mCi), based on the radiation dose to the red marrow. Imaging was performed from 4-240 hr postinjection (planar and SPECT). Blood and whole-body clearance were determined; radiation doses were calculated by the Medical Internal Radiation Dose scheme. RESULTS: Red marrow doses ranged from 45 to 706 cGy, and whole-body doses ranged from 31 to 344 cGy. Differences in pharmacokinetics were found between different types of CEA-producing tumors: blood T 1/2 was significantly lower in colorectal cancer when compared to all other tumor types (21.4 +/- 11.1 hr versus 35.8 +/- 13.2 hr, p < 0.01), as was also whole-body t 1/2. Myelotoxicity was dose-limiting, and its severity was related to the types of prior therapy and extent of bone marrow involvement. In patients without prior radiation or chemotherapy, marrow doses as high as 600 cGy were tolerated without evidence of dose-limiting toxicity. No major toxicity to other organs was observed. Tumor doses were inversely related to the tumor mass and ranged between 2 and 218 cGy/mCi. Modest antitumor effects were seen in 12 of 35 assessable patients (1 partial remission, 4 minor/mixed responses and 7 with stabilization of previously rapidly progressing disease). CONCLUSION: These results suggest that prior chemotherapy or external beam radiation is an important risk factor for the development of hematological toxicity in radioimmunotherapy and that higher radiation doses may be delivered to tumors of patients without prior therapy compromising the bone marrow reserve. The different and, in the individual cases, unpredictable clearance rates suggest the necessity of dosimetry-based treatment planning rather than mCi/m2 dosing. Small tumors seem to be more suitable for radioimmunotherapy because of their favorable dosimetry, but to achieve better therapeutic results in patients with bulky disease, the application of higher, potentially myeloablative doses is indicated.     

Coverage metrics for temporal logic model checking*

In formal verification, we verify that a system is correct with respect to a specification. Even when the system is proved to be correct, there is still a question of how complete the specification is, and whether it really covers all the behaviors of the system. In this paper we study coverage metrics for model checking. Coverage metrics are based on modifications we apply to the system in order to check which parts of it were actually relevant for the verification process to succeed. We introduce two principles that we believe should be part of any coverage metric for model checking: a distinction between state-based and logic-based coverage, and a distinction between the system and its environment. We suggest several coverage metrics that apply these principles, and we describe two algorithms for finding the non-covered parts of the system under these definitions. The first algorithm is a symbolic implementation of a naive algorithm that model checks many variants of the original system. The second algorithm improves the naive algorithm by exploiting overlaps in the variants. We also suggest a few helpful outputs to the user, once the non-covered parts are found.

Vacuity detection in temporal model checking

One of the advantages of temporal-logic model-checking tools is their ability to accompany a negative answer to the correctness query by a counterexample to the satisfaction of the specification in the system. On the other hand, when the answer to the correctness query is positive, most model-checking tools provide no witness for the satisfaction of the specification. In the last few years there has been growing awareness as to the importance of suspecting the system or the specification of containing an error also in the case model checking succeeds. The main justification of such suspects are possible errors in the modeling of the system or of the specification. Many such errors can be detected by further automatic reasoning about the system and the environment. In particular, Beer et al. described a method for the detection of vacuous satisfaction of temporal logic specifications and the generation of interesting witnesses for the satisfaction of specifications. For example, verifying a system with respect to the specification ϕ=AG(reqAFgrant) (“every request is eventually followed by a grant”), we say that ϕ is satisfied vacuously in systems in which requests are never sent. An interesting witness for the satisfaction of ϕ is then a computation that satisfies ϕ and contains a request. Beer et al. considered only specifications of a limited fragment of ACTL, and with a restricted interpretation of vacuity. In this paper we present a general method for detection of vacuity and generation of interesting witnesses for specifications in CTL^*. Our definition of vacuity is stronger, in the sense that we check whether all the subformulas of the specification affect its truth value in the system. In addition, we study the advantages and disadvantages of alternative definitions of vacuity, study the problem of generating linear witnesses and counterexamples for branching temporal logic specifications, and analyze the complexity of the problem. Published online: 22 January 2002     

On the expressive power of data dependencies

Summary The class of data dependencies is a class of first-order sentences that seem to be suitable to express semantic constraints for relational databases. We deal with the question of which classes of databases are axiomatizable by data dependencies. (A class of databases is said to be axiomatizable by sentences of a certain kind if there exists a set of sentences of that kind such that is the class of all models of that set.) Our results characterize, by algebraic closure conditions, classes of databases that are axiomatizable by dependencies of different kinds. Our technique is model-theoretic, and the characterization easily entails all previously known results on axiomatizability by dependencies.Research partially supported by Swiss National Science Foundation Grant No. 82.820.0.80 (1980–1982), revision of the paper was done while visiting the Mathematisches Forschungsinstitut at the Swiss Federal Institute of Technology (Summer 1985)Part of the research reported here was done while the author was at Stanford University and supported by a Weizmann Post-Doctoral Fellowship and AFOSR grant 80-0212     

The universal-relation data model for logical independence

The universal-relation model is introduced, and its fundamental ideas are outlined. This model keeps access-path independence by removing the need for logical navigation among relations. One benefit is a simple yet powerful query-language interface. Two universal-relation database-management systems are discussed that provide good examples of the model: System/U, developed at Stanford University, and FIDL, developed at International Computers Ltd. in Britain     

Bladder sensory power factor (BSPF): a novel diagnostic tool

45 patients who had received total laryngectomy for laryngeal neoplasia were reviewed with CT, using a study protocol for systematic evaluation as well as the identification of the principal sites of probable recurrence. The advantages of this technique, and some of the considerations which have to be taken into account to avoid error in diagnosis, are commented upon.     

Spontaneous pneumomediastinum in children: clinical and natural history

Investigation of the clinical characteristics and natural history of nine children with spontaneous pneumomediastinum (SPM) was conducted at the Tel Aviv University Sheba Medical Centre between 1984 and 1994. Most cases occurred in the setting of a valsalva-type manoeuvre, while symptoms and signs on admission were mainly chest pain, dyspnoea, neck pain, subcutaneous emphysema, and Hamman's sign. Three clinical patterns concerning longterm sequelae were identified: patients without any long-term sequelae, patients with a tendency to airway hyperreactivity and subclinical asthma, and patients in whom SPM was the presenting feature of their asthma. CONCLUSION: Close personal follow up, including pulmonary function tests, should be designed for all children with Spontaneous pneumomediastinum.     

Maximum likelihood reconstruction for emission tomography

Previous models for emission tomography (ET) do not distinguish the physics of ET from that of transmission tomography. We give a more accurate general mathematical model for ET where an unknown emission density lambda = lambda(x, y, z) generates, and is to be reconstructed from, the number of counts n(*)(d) in each of D detector units d. Within the model, we give an algorithm for determining an estimate lambdainsertion mark of lambda which maximizes the probability p(n(*)|lambda) of observing the actual detector count data n(*) over all possible densities lambda. Let independent Poisson variables n(b) with unknown means lambda(b), b = 1, ..., B represent the number of unobserved emissions in each of B boxes (pixels) partitioning an object containing an emitter. Suppose each emission in box b is detected in detector unit d with probability p(b, d), d = 1, ..., D with p(b,d) a one-step transition matrix, assumed known. We observe the total number n(*) = n(*)(d) of emissions in each detector unit d and want to estimate the unknown lambda = lambda(b), b = 1, ..., B. For each lambda, the observed data n(*) has probability or likelihood p(n(*)|lambda). The EM algorithm of mathematical statistics starts with an initial estimate lambda(0) and gives the following simple iterative procedure for obtaining a new estimate lambdainsertion mark(new), from an old estimate lambdainsertion mark(old), to obtain lambdainsertion mark(k), k = 1, 2, ..., lambdainsertion mark(new)(b)= lambdainsertion mark(old)(b)Sum of (n(*)p(b,d) from d=1 to D/Sum of lambdainsertion mark()old(b('))p(b('),d) from b(')=1 to B), b=1,...B.