VoxLogicA: A Spatial Model Checker for Declarative Image Analysis
Abstract
Spatial and spatiotemporal model checking techniques have a wide range of application domains, among which large scale distributed systems and signal and image analysis. We explore a new domain, namely (semi)automatic contouring in Medical Imaging, introducing the tool VoxLogicA which merges the stateoftheart library of computational imaging algorithms ITK with the unique combination of declarative specification and optimised execution provided by spatial logic model checking. The result is a rapid, logic based analysis development methodology. The analysis of an existing benchmark of medical images for segmentation of brain tumours shows that simple VoxLogicA analysis can reach stateoftheart accuracy, competing with bestinclass algorithms, with the advantage of explainability and easy replicability. Furthermore, due to a twoordersofmagnitude speedup compared to the existing generalpurpose spatiotemporal model checker topochecker, VoxLogicA enables interactive development of analysis of 3D medical images, which can greatly facilitate the work of professionals in this domain.
Keywords
Spatial logics Closure spaces Model checking Medical Imaging1 Introduction and Related Work
Spatial and Spatiotemporal model checking have gained an increasing interest in recent years in various domains of application ranging from Collective Adaptive Systems [11, 15, 18] and networked systems [27], to signals [32] and digital images [14, 26]. Research in this field has its origin in the topological approach to spatial logics, dating back to the work of Alfred Tarski (see [9] for a thorough introduction). More recently these early theoretical foundations have been extended to encompass reasoning about discrete spatial structures, such as graphs and images, extending the theoretical framework of topology to (quasi discrete) closure spaces (see for instance [1, 23, 24]). That framework has subsequently been taken further in recent work by Ciancia et al. [13, 14, 17] resulting in the definition of the Spatial Logic for Closure Spaces (SLCS), temporal extensions (see [12, 32, 36]), and related model checking algorithms and tools.
The main idea of spatial (and spatiotemporal) model checking is to use specifications written in a suitable logical language to describe spatial properties and to automatically identify patterns and structures of interest in a variety of domains (see e.g., [5, 16, 18]). In this paper we focus on one such domain, namely medical imaging for radiotherapy, and brain tumour segmentation in particular, which is an important and currently very active research domain of its own. One of the technical challenges of the development of automated (brain) tumour segmentation is that lesion areas are only defined through differences in the intensity (luminosity) in the (black & white) images that are relative to the intensity of the surrounding normal tissue. A further complication is that even (laborious and time consuming) manual segmentation by experts shows significant variations when intensity gradients between adjacent tissue structures are smooth or partially obscured [31]. Moreover, there is a considerable variation across images from different patients and images obtained with different Magnetic Resonance Images (MRI) scanners. Several automatic and semiautomatic methods have been proposed in this very active research area (see e.g., [20, 21, 22, 29, 34, 37]).
This paper continues the research line of [3, 7, 8], introducing the free and open source tool VoxLogicA (Voxelbased Logical Analyser)^{1}, catering for a novel approach to image segmentation, namely a rapiddevelopment, declarative, logicbased method, supported by spatial model checking. This approach is particularly suitable to reason at the “macrolevel”, by exploiting the relative spatial relations between tissues or organs at risk. VoxLogicA is similar, in the accepted logical language, and functionality, to the spatiotemporal model checker topochecker^{2}, but specifically designed for the analysis of (possibly multidimensional, e.g. 3D) digital images as a specialised image analysis tool. It is tailored to usability and efficiency by employing stateoftheart algorithms and open source libraries, borrowed from computational image processing, in combination with efficient spatial model checking algorithms.
We show the application of VoxLogicA on BraTS 2017^{3} [2, 31, 35], a publicly available set of benchmark MRI images for brain tumour segmentation, linked to a yearly challenge. For each image, a manual segmentation of the tumour by domain experts is available, enabling rigorous and objective qualitative comparisons via established similarity indexes. We propose a simple, yet effective, highlevel specification for glioblastoma segmentation. The procedure, partly derived from the one presented in [3], directly competes in accuracy with the stateoftheart techniques submitted to the BraTS 2017 challenge, most of which based on machine learning. Our approach to segmentation has the unique advantage of explainability, and is easy to replicate; in fact, the structure of a logically specified procedure can be explained to domain experts, and improved to encompass new observations. A mathematically formalised, unambiguous semantics permits results to be replicated not only by executing them in the multiplatform, open source tool that has been provided, but also by computing them via different implementations.
2 The Spatial Logic Framework
In this section, we briefly recall the logical language ImgQL (Image Query Language) proposed in [3], which is based on the Spatial Logic for Closure Spaces SLCS [13, 14] and which forms the kernel of the framework we propose in the present paper. In Sect. 4 we will see how the resulting logic can be used for actual analysis via spatial model checking.
2.1 Foundations: Spatial Logics for Closure Spaces
The logic for closure spaces we use in the present paper is closely related to SLCS [13, 14] and, in particular, to the SLCS extension with distancebased operators presented in [3]. As in [3], the resulting logic constitutes the kernel of a solid logical framework for reasoning about texture features of digital images, when interpreted as closure spaces. In the context of our work, a digital image is not only a 2dimensional grid of pixels, but, more generally, a multidimensional (very often, 3dimensional) grid of hyperrectangular elements that are called voxels (“volumetric picture elements”). When voxels are not hypercubes, images are said to be anisotropic; this is usually the case in medical imaging. Furthermore, a digital image may contain information about its “real world” spatial dimensions, position (origin) and rotation, permitting one to compute the realworld coordinates of the centre and edges of each voxel. In medical imaging, such information is typically encapsulated into data by machines such as MRI scanners. In the remainder of the paper, we make no dimensionality assumptions. From now on, we refer to picture elements either as voxels or simply as points.
Definition 1
A closure space is a pair \((X,\mathcal {C})\) where X is a nonempty set (of points) and \(\mathcal {C}: 2^X \rightarrow 2^X\) is a function satisfying the following axioms: \(\mathcal {C}(\emptyset )=\emptyset \); \(Y \subseteq \mathcal {C}(Y)\) for all \(Y \subseteq X\); \(\mathcal {C}(Y_1 \cup Y_2) = \mathcal {C}(Y_1) \cup \mathcal {C}(Y_2)\) for all \(Y_1,Y_2\subseteq X\). \(\bullet \)
Given any relation \(R\subseteq X \times X\), function \(\mathcal {C}_{R}:2^X \rightarrow 2^X\) with \(\mathcal {C}_{R}(Y) \triangleq Y\cup \{x \mid \exists y \in Y. y \, R\,x\}\) satisfies the axioms of Definition 1 thus making \((X,\mathcal {C}_{R})\) a closure space. Whenever a closure space is generated by a relation as above, it is called a quasidiscrete closure space. A quasidiscrete closure space \((X,\mathcal {C}_{R})\), can be used as the basis for a mathematical model of a digital image. X represents the finite set of voxels and \(R\) is the reflexive and symmetric adjacency relation between voxels [25]. A closure space \((X,\mathcal {C})\) can be enriched with a notion of distance, i.e. a function \(d: X \times X \rightarrow \mathbb {R}_{\ge 0} \cup \{\infty \}\) such that \(d(x,y)=0\) iff \(x=y\), leading to the distance closure space \(((X,\mathcal {C}),d)\).^{4}
It is sometimes convenient to equip the points of a closure space with attributes; for instance, in the case of images, such attributes could be the color or intensity of voxels. We assume sets A and V of attribute names and values, and an attribute valuation function \(\mathcal{A}\) such that \(\mathcal{A}(x,a) \in V\) is the value of attribute a of point x. Attributes can be used in assertions \(\alpha \), i.e. boolean expressions, with standard syntax and semantics. Consequently, we abstract from related details here and assume function \(\mathcal{A}\) extended in the obvious way; for instance, \(\mathcal{A}(x,a \le c) = \mathcal{A}(x,a) \le c\), for appropriate constant c.
Definition 2
In the logic proposed in [13, 14], the “may reach” operator is not present, and the surrounded operator \(\mathcal {S}\) has been defined as basic operator as follows: x satisfies \(\varPhi _1 \, \mathcal {S}\, \varPhi _2\) if and only if x belongs to an area of points satisfying \(\varPhi _1\) and one cannot “escape” from such an area without hitting a point satisfying \(\varPhi _2\). Several types of reachability predicates can be derived from \(\mathcal {S}\). However, reachability is in turn a widespread, more basic primitive, implemented in various forms (e.g., flooding, connected components) in programming libraries. Thus, in this work, we prefer to use reachability as a basic predicate of the logic, as in [4], which is dedicated to extending the Spatial Signal Temporal Logic of [32]. In the sequel we show that \(\mathcal {S}\) can be derived from the operators defined above, employing a definition patterned after the modelchecking algorithm of [13]. This change simplifies the definition of several derived connectives, including that of \( touch \) (see below), and resulted in notably faster execution times for analyses using such derived connectives. We recall the definition of \(\mathcal {S}\) from [14]: Open image in new window if and only if Open image in new window and for all paths \(\pi \) and indexes \(\ell \) we have: if \(\pi (0)=x\) and Open image in new window , then there is j such that \(0 < j \le \ell \) and Open image in new window .
Proposition 1
For all closure models \(\mathcal {M}=((X,\mathcal {C}), \mathcal{A}, \mathcal{V})\) and all formulas \(\varPhi _1\), \(\varPhi _2\) the following holds: \( \varPhi _1 \, \mathcal {S}\, \varPhi _2 \equiv \varPhi _1 \, \wedge \lnot (\rho \;\lnot (\varPhi _1 \vee \, \varPhi _2)[\lnot \varPhi _2]) \) \(\diamond \)
Definition 3
We define some derived operators that are of particular use in medical image analysis: \( touch (\varPhi _1, \varPhi _2) \triangleq \varPhi _1 \wedge \rho \;\varPhi _2[\varPhi _1] ; grow (\varPhi _1 , \varPhi _2) \triangleq \varPhi _1 \vee touch ( \varPhi _2 , \varPhi _1) ; flt (r, \varPhi _1) \triangleq \mathcal {D}^{< r} (\mathcal {D}^{\ge r} \lnot \varPhi _1) \) \(\bullet \)
The formula \( touch (\varPhi _1, \varPhi _2)\) is satisfied by points that satisfy \(\varPhi _1\) and that are on a path of points satisfying \(\varPhi _1\) that reaches a point satisfying \(\varPhi _2\). The formula \( grow (\varPhi _1, \varPhi _2)\) is satisfied by points that satisfy \(\varPhi _1\) and by points that satisfy \(\varPhi _2\) which are on a path of points satisfying \(\varPhi _2\) that reaches a point satisfying \(\varPhi _1\). The formula \( flt (r,\varPhi _1)\) is satisfied by points that are at a distance of less than r from a point that is at least at distance r from points that do not satisfy \(\varPhi _1\). This operator works as a filter; only contiguous areas satisfying \(\varPhi _1\) that have a minimal diameter of at least 2r are preserved; these are also smoothened if they have an irregular shape (e.g. protrusions of less than the indicated distance).
Example 1
In Fig. 1, the top row shows four pictures using colours blue and red, interpreted as atomic propositions. Each picture in the bottom row shows in white the points that satisfy a given formula. In particular: Fig. 1e is \(blue\, \mathcal {S}\, red\) of (a); Fig. 1f is \(\text{ touch }(red,blue)\) of (b); Fig. 1g is \(\text{ grow }(red, blue)\) of (c); Fig. 1h is \(red \, \mathcal {S}\; ( \mathcal {D}^{\le 11} blue)\) of (d). For more details the reader is referred to [6].
2.2 Region Similarity via Statistical Crosscorrelation
In the sequel, we provide some details on a logical operator, first defined in [3], that we use in the context of Texture Analysis (see for example [10, 19, 28, 30]) for defining a notion of statistical similarity between image regions. The statistical distribution of an area Y of a black and white image is approximated by the histogram of the grey levels of points (voxels) belonging to Y, limiting the representation to those levels laying in a certain interval [m, M], the latter being split into k bins. In the case of images modelled as closure models, where each point may have several attributes, the histogram can be defined for different attributes. Given a closure model \(\mathcal {M}= ((X,\mathcal {C}), \mathcal{A}, \mathcal{V})\), define function \(\mathcal{H}: A \times 2^X \times \mathbb {R}\times \mathbb {R}\times \mathbb {N}\rightarrow (\mathbb {N}\rightarrow \mathbb {N})\) such that for all \(m<M\), \(k>0\) and \(i\in \{1,\ldots ,k\}\), \( \mathcal{H}(a,Y,m,M,k)(i) = \Big \{y\in Y \mid (i1) \cdot \varDelta \le \mathcal{A}(y,a)  m < i \cdot \varDelta \}\Big  \) where \(\varDelta =\frac{Mm}{k}\). We call \(\mathcal{H}(a,Y,m,M,k)\) the histogram of Y (for attribute a), with k bins and m, M min and max values respectively. The mean \(\overline{h}\) of a histogram h with k bins is the quantity \(\frac{1}{k}\sum _{i=1}^k h(i)\). The cross correlation between two histograms \(h_1, h_2\) with the same number k of bins is defined as follows: \( \mathbf {r}(h_1,h_2) = \frac{\sum _{i=1}^k\left( h_1(i)  \overline{h_1} \right) \left( h_2(i)  \overline{h_2} \right) }{ \sqrt{ \sum _{i=1}^k \left( h_1(i)  \overline{h_1} \right) ^2 } \sqrt{ \sum _{i=1}^k \left( h_2(i)  \overline{h_2} \right) ^2 } } \). The value of \(\mathbf {r}{}{}\) is normalised so that \(1\le \mathbf {r}{}{}\le 1\); \(\mathbf {r}(h_1,h_2)=1\) indicates that \(h_1\) and \(h_2\) are perfectly correlated (that is, \(h_1 = ah_2+b\), with \(a>0\)); \(\mathbf {r}(h_1,h_2) =1\) indicates perfect anticorrelation (that is, \(h_1=ah_2+b\), with \(a<0\)). On the other hand, \(\mathbf {r}(h_1,h_2) = 0\) indicates no correlation.
3 The Tool VoxLogicA
VoxLogicA is a framework for image analysis, that embeds the logic ImgQL into a useroriented expression language to manipulate images. More precisely, the VoxLogicA type system distinguishes between booleanvalued images, that can be arguments or results of the application of ImgQL operators, and numbervalued images, resulting from imaging primitives. Underlying such expression language is a global model checker, that is, the set of points satisfying a logic formula is computed at once; this is done implicitly when an expression corresponding to a logic formula is saved to an image. Functionalitywise, VoxLogicA specialises topochecker to the case of spatial analysis of multidimensional images. It interprets a specification written in the ImgQL language, using a set of multidimensional images^{6} as models of the spatial logic, and produces as output a set of multidimensional images representing the valuation of userspecified expressions. For logical operators, such images are Booleanvalued, that is, regions of interest in medical imaging terminology, which may be loaded as overlays in medical image viewers. Nonlogical operators may generate numbervalued images. VoxLogicA augments ImgQL with file loading and saving primitives, and a set of additional commodity operators, specifically aimed at image analysis, that is destined to grow along with future developments of the tool. The main execution modality of VoxLogicA is batch execution. A (currently experimental) graphical user interface is under development.
Implementationwise, the tool achieves a twoordersofmagnitude speedup with respect to topochecker. Such speedup has permitted the rapid development of a novel procedure for automatic segmentation of glioblastoma that, besides being competitive with respect to the stateoftheart in the field (see Sect. 4), is also easily replicable and explainable to humans, and therefore amenable of improvement by the community of medical imaging practitioners.
3.1 Functionality

let f(x1,...,xN) = e is used for function declaration, also in the form let f = e(constant declaration), and with special syntactic provisions to define infix operators. After execution of the command, name f is bound to a function or constant that evaluates to e with the appropriate substitutions of parameters;

load x = "s" loads an image from file "s" and binds it to x for subsequent usage;

save "s" e stores the image resulting from evaluation of expression e to file "s";

print "s" e prints to the log the string s followed by the numeric, or boolean, result of computing e;

import "s" imports a library of declarations from file "s"; subsequent import declarations for the same file are not processed; furthermore, such imported files can only contain let or import commands.
The language features strong dynamic typing, that is, types of expressions are unambiguously checked and errors are precisely reported, but such checks are only performed at “run time”, that is, when evaluating closedform expressions with no free variables. The type system has currently been kept lightweight (the only typing rules regard constants and function application), in order to leave the design space open to future improvements. For instance, a planned development is function and operator overloading, as well as some form of static typing not interfering with the usability of the tool.
However, it is not the case that a type error may waste a longrunning analysis. Type checking occurs after loading and parsing, but before analysis is run. Actual program execution after parsing is divided into two phases. First (usually, in a negligible amount of time), all the “save” and “print” instructions are examined to determine what expressions actually need to be computed; in this phase, name binding is resolved, all constant and function applications are substituted with closed expressions, types are checked and the environment binding expressions to names is discarded. Finally, the set of closed expressions to be evaluated is transformed into a set of tasks to be executed, possibly in parallel, and dependencies among them. After this phase, no further syntax processing or name resolution are needed, and it is guaranteed that the program is free from type errors. The second phase simply runs each task – in an order compliant with dependencies – parallelising execution on multiple CPU cores.
Each builtin logical operator has an associated type of its input parameters and output result. The available types are inductively defined as Number, Bool, String, Model, and Valuation(t), where t is in turn a type. The type Model is the type assigned to x in load x = "f"; operations such as the extraction of RGB components take this type as input, and return as output the only parametric type: Valuation(t), which is the type of a multidimensional image in which each voxel contains a value of type t. For instance, the red component of a loaded model has type Valuation(Number), whereas the result of evaluating a logic formula has type Valuation(Bool)^{8}.
An important aspect of the execution semantics of VoxLogicA specifications is memoization, constituting the core of its execution engine, and used to achieve maximal sharing of subformulas. In VoxLogicA, no expression is ever computed twice, freeing the user from worrying about how many times a given function is called, and making execution of complex macros and logical operators feasible.
3.2 Implementation Details
VoxLogicA is implemented in the functional, objectoriented programming language FSharp, using the .NET Core implementation of the .NET specification^{9}. This permits a single code base with minimal environmentdependent setup to be crosscompiled and deployed as a standalone executable, for the major desktop operating systems, namely Linux, macOS, and Windows. Despite .NET code is compiled for an intermediate machine, this does not mean that efficiency of VoxLogicA is somehow “nonnative”. There are quite a number of measures in place to maximise efficiency. First and foremost, the execution time is heavily dominated by the time spent in native libraries (more details below), and VoxLogicA acts as a higherlevel, declarative frontend for such libraries, adding a logical language, memoization, parallel execution, and abstraction from a plethora of technical details that a stateoftheart imaging library necessarily exposes. In our experiments, parsing, memoization, and preparation of the tasks to be run may take a fraction of a second; the rest of the execution time (usually, several seconds, unless the analysis is extremely simple) is spent in foreign function calls. The major performance boosters in VoxLogicA are: a stateoftheart computational imaging library (ITK); the optimised implementation of the may reach operator; a new algorithm for statistical crosscorrelation; an efficient memoizing execution engine; parallel evaluation of independent tasks, exploiting modern multicore CPUs. Moreover, special care has been put in making all performancecritical loops allocationless. All used memory along the loops is preallocated, avoiding the risk to trigger garbage collection during computation. We will address each of them briefly in the following.
ITK Library. VoxLogicA uses the stateoftheart imaging library ITK, via the SimpleITK glue library^{10}. Most of the operators of VoxLogicA are implemented directly by a library call. Notably, this includes the Maurer distance transform, used to efficently implement the distance operators of ImgQL.
Novel Algorithms. The two most relevant operators that do not have a direct implementation in ITK are mayReach and crossCorrelation, implementing, respectively, the logical operator \(\rho \), and statistical comparison described in Sect. 2.2. The computation of the voxels satisfying \(\rho \;\phi _1[\phi _2]\) can be implemented either using the (classical, in computer graphics) floodfill primitive, or by exploiting the connected components of \(\phi _2\) as a reachability primitive; both solutions are available in SimpleITK. In our experiments, connected components perform better using this library from FSharp, for large input seeds. Several critical logical connectives (e.g. surrounded and touch), are defined in terms of mayReach. Therefore, an optimised algorithm for mayReach is a key performance improvement. The crossCorrelation operation is resourceintensive, as it uses the histogram of a multidimensional hyperrectangle at each voxel. Precomputation methods such as the integral histogram [33], would not yield the expected benefits, because crosscorrelation is called only few times on the same image. In this work, we designed a parallel algorithm exploiting additivity of histograms. Given two sets of values \(P_1\), \(P_2\), let \(h_1\), \(h_2\) be their respective histograms, and let \(h'_1\), \(h'_2\) be the histograms of \(P_1{\setminus }P_2\) and \(P_2{\setminus }P_1\). For i a bin, we have \(h_2(i) = h_1(i)  h'_1(i) + h'_2(i)\). This property leads to a particularly efficient algorithm when \(P_1\) and \(P_2\) are two hyperrectangles centred over adjacent voxels, as \(P_1{\setminus }P_2\) and \(P_2{\setminus }P_1\) are hyperfaces, having one dimension less than hyperrectangles. Our algorithm divides the image into as many partitions as the number of available processors, and then computes a Hamiltonian path for each partition, passing by each of its voxels exactly once. All partitions are visited in parallel, in the order imposed by such Hamiltonian paths; the histogram is computed incrementally as described above; finally crosscorrelation is also computed and stored in the resulting image. The asymptotic algorithmic complexity of the implementation of ImgQL primitives in VoxLogicA is linear in the number of voxels, with the exception of crossCorrelation, which, by the above explanation, has complexity \(O(k\cdot n)\), where n is the number of voxels, and k is the size of the largest hyperface of the considered hypercube.
Memoizing Execution Semantics. Subexpressions in VoxLogicA are by construction identified upto syntactic equality and assigned a number, representing a unique identifier (UID). UIDs start from 0 and are contiguous, therefore admitting an array of all existing subformulas to be used to precomputed valuations of expressions without further hashing.
3.3 Design and Data Structures
The design of VoxLogicA defines three implementation layers. The core execution engine implements the concurrent, memoizing semantics of the tool. The interpreter is responsible for translating source code into core library invocations. These two layers only include some basic arithmetic and boolean primitives. Operators can be added by inheriting from the abstract base class Model. The third implementation layer is the instantiation of the core layer to define operators from ImgQL, and loading and saving of graphical models, using the ITK library. We provide some more detail on the design of the core layer, which is the most critical part of VoxLogicA. At the time of writing, the core consists of just 350 lines of FSharp code, that has been carefully engineered not only for performance, but also for ease of maintenance and future extensions.
The essential classes are ModelChecker, FormulaFactory, Formula, and Operator, of which Constant is a subclass. Class Operator describes the available operators and their evaluation method. Class Formula is a symbolic representation of a syntactic subexpression. Each instance of Formula has a unique numeric id (UID), an instance of Operator, and (inductively) a list of Formula instances, denoting its arguments. The UID of a formula is determined by the operator name (which is unique across the application), and the list of parameter UIDs. Therefore, by construction, it is not possible to build two different instances of Formula that are syntactically equal. UIDs are contiguous and start from 0. By this, all created formulas can be inserted into an array. Furthermore, UIDs are allocated in such a way that the natural number order is a topological sort of the dependency graph between subformulas (that is, if \(f_1\) is a parameter of \(f_2\), the UID of \(f_1\) is greater than the UID of \(f_2\)). This is exploited in class ModelChecker; internally, the class uses an array to store the results of evaluating each Formula instance, implementing memoization. The class ModelChecker turns each formula into a task to be executed. Whenever a formula with UID i is a parameter of the formula with UID j, a dependency is noted between the associated tasks. The highlevel, lightweight concurrent programming library Hopac^{11} and its abstractions are used to evaluate the resulting task graph, in order to maximise CPU usage on multicore machines.
4 Experimental Evaluation
The performance of VoxLogicA has been evaluated on the Brain Tumor Image Segmentation Benchmark (BraTS) of 2017 [2, 31] containing 210 multi contrast MRI scans of high grade glioma patients that have been obtained from multiple institutions and were acquired with different clinical protocols and various scanners. All the imaging data sets provided by BraTS 2017 have been segmented manually and approved by experienced neuroradiologists. In our evaluation we used the T2 Fluid Attenuated Inversion Recovery (FLAIR) type of scans, which is one of the four provided modalities in the benchmark. Use of other modalities is planned for future work. For training, the numeric parameters of the VoxLogicA specification presented in Sect. 4.1 were manually calibrated against a subset of 20 cases. Validation of the method was conducted as follows. A priori, 17 of the 210 cases can be excluded because the current procedure is not suitable for these images. This is because of the presence of multifocal tumours (different tumours in different areas of the brain), or due to clearly distinguishable artifacts in the FLAIR acquisition, or because the hyperintense area is too large and clearly not significant (possibly by incorrect acquisition). Such cases require further investigation. For instance, the current procedure may be improved to identify specific types of artefacts, whereas multimodal analysis can be used to complement the information provided by the FLAIR image in cases where FLAIR hyperintensity is not informative enough. In Sect. 4.2, we present the results both for the full dataset (210 cases), and for the subset without these problematic cases (193 cases). We considered both the gross tumour volume (GTV), corresponding to what can actually be seen on an image, and the clinical target volume (CTV) which is an extension of the GTV. For glioblastomas this margin is a 2–2.5 cm isotropic expansion of the GTV volume within the brain.
4.1 ImgQL Segmentation Procedure
Specification 1 shows the tumour segmentation procedure that we used for the evaluation^{12}. The syntax is that of VoxLogicA, namely: ,&,! are boolean or, and, not; distlt(c,phi) is the set Open image in new window (similarly, distgeq; distances are in millimiters); crossCorrelation(r,a,b,phi,m,M,k) yields a crosscorrelation coefficient for each voxel, to which a predicate c may be applied to obtain the statistical similarity function of Sect. 2.2; the > operator performs thresholding of an image; border is true on voxels that lay at the border of the image. Operator percentiles(img,mask), where img is a numbervalued image, and mask is booleanvalued, considers the points identified by mask, and assigns to each such point x the fraction of points that have an intensity below that of x in img. Other operators are explained in Definition 3 (see also Fig. 1). Figure 2 shows the intermediate phases of the procedure, for axial view of one specific 2D slice of an example 3D MRI scan of the BraTS 2017 data set.
Interesting aspects of the ImgQL specification are its relative simplicity and abstraction level, fitting that of neuroradiologists, its explainability, its timeefficient verification, admitting a rapid development cycle, and its independence of normalisation procedures through the use of percentiles rather than absolute values for the intensity of voxels.
4.2 Validation Results
VoxLogicA evaluation on the BraTS 2017 benchmark.
Sensitivity (193 cases)  Specificity (193 cases)  Dice (193 cases)  Sensitivity (210 cases)  Specificity (210 cases)  Dice (210 cases)  

GTV  0.89(0.10)  1.0(0.00)  0.85(0.10)  0.86(0.16)  1.0(0.0)  0.81(0.18) 
CTV  0.95(0.07)  0.99(0.01)  0.90(0.09)  0.93(0.14)  0.99(0.2)  0.87(0.15) 
4.3 Comparison with topochecker
The evaluation of VoxLogicA that we presented in this section uses features that are present in VoxLogicA, but not in topochecker. On the other hand, the example specification in [3], and its variant aimed at 3D images, are quite similar to the one we presented, and can be readily used to compare the performance of VoxLogicA and topochecker. The specifications consist of two humanauthored text files of about 30 lines each. The specifications were run on a desktop computer equipped with an Intel Core I7 7700 processor (with 8 cores) and 16 GB of RAM. In the 2D case (image size: \(512\,\times \,512\)), topochecker took 52 s to complete the analysis, whereas VoxLogicA took 750 ms. In the 3D case (image size: \(512\times \,512\times \,24\)), topochecker took about 30 min, whereas VoxLogicA took 15 s. As we mentioned before, this huge improvement is due to the combination of a specialised imaging library, new algorithms (e.g., for statistical similarity of regions), parallel execution and other optimisations. More details could be obtained by designing a specialised set of benchmarks, where some of which can also be run using topochecker; however, for the purposes of the current paper, the performance difference is so large that we do not deem such detailed comparison necessary.
5 Conclusions and Future Work
We presented VoxLogicA, a spatial model checker designed and optimised for the analysis of multidimensional digital images. The tool has been successfully evaluated on 193 cases of an international brain tumour 3D MRI segmentation benchmark. The obtained results are wellpositioned w.r.t. the performance of stateoftheart segmentation techniques, both efficiencywise and accuracywise. Future research work based on the tool will focus on further benchmarking (e.g. various other types of tumours and tumour tissue such as necrotic and nonenhancing parts), and clinical application. On the development side, planned future work includes a graphical (web) interface for interactive parameter calibration (for that, execution times will need to be further improved, possibly employing GPU computing); improvements in the typesystem (e.g. operator overloading); turning the core design layer into a reusable library available for other projects. Finally, the (currently small, albeit useful) library of logical and imagingrelated primitives available will be enhanced, based on input from case studies. Calibration of the numerical parameters of our Glioblastoma segmentation was done manually. Future work aims at exploring different possibilities for humancomputer interaction in designing such procedures (e.g. via adhoc graphical interfaces), to improve user friendliness for domain experts. Experimentation in combining machinelearning methods with the logicbased approach of VoxLogicA are also worth being explored in this respect.
Footnotes
 1.
VoxLogicA: https://github.com/vincenzoml/VoxLogicA.
 2.
Topochecker: a topological model checker, see http://topochecker.isti.cnr.it, https://github.com/vincenzoml/topochecker.
 3.
 4.
We recall that for \(\emptyset \not =Y\subseteq X\), \(d(x,Y) \triangleq \inf \{d(x,y) \mid y \in Y\}\), with \(d(x,\emptyset ) =\infty \). In addition, as the definition of d might require the elements of \(R\) to be weighted, quasidiscrete distance closure spaces may be enriched with a \(R\)weighting function \(\mathcal{W}:R\rightarrow \mathbb {R}\) assigning the weight \(\mathcal{W}(x,y)\) to each \((x,y)\in R\). In the sequel we will keep \(\mathcal{W}\) implicit, whenever possible and for the sake of simplicity.
 5.
In particular, a predicate p can be a defined one, by means of a definition as \(p:=\alpha \), meaning that the feature of interest is characterized by the (boolean) value of \(\alpha \).
 6.
Besides common bitmap formats, the model loader of VoxLogicA currently supports the NIfTI (Neuroimaging Informatics Technology Initiative) format (https://nifti.nimh.nih.gov/, version 1 and 2). 3D MRFLAIR images in this format very often have a slice size of 256 by 256 pixels, multiplied by 20 to 30 slices.
 7.
 8.
Although such type system would permit “odd” types such as Valuation(Model), there is no way to construct them; in the future this may change when appropriate.
 9.
 10.
See https://itk.org and http://www.simpleitk.org.
 11.
 12.
Note that, although the procedure is loosely inspired by the one in [3], there are major differences, partly due to a different method for identification of hyperintensities (using percentiles), and partly since the task in this work is simpler, as we only identify the CTV and GTV (avoiding, for instance, to label the oedema).
References
 1.Aiello, M., PrattHartmann, I., van Benthem, J.: Handbook of Spatial Logics. Springer, Dordrecht (2007). https://doi.org/10.1007/9781402055874CrossRefzbMATHGoogle Scholar
 2.Bakas, S., et al.: Advancing the cancer genome atlas glioma MRI collections with expert segmentation labels and radiomic features. Sci. Data 4 (2017). https://doi.org/10.1038/sdata.2017.117. Accessed 05 Sept 2017
 3.Banci Buonamici, F., Belmonte, G., Ciancia, V., et al.: Int. J. Softw. Tools Technol. Transfer (2019). https://doi.org/10.1007/s10009019005119
 4.Bartocci, E., Bortolussi, L., Loreti, M., Nenzi, L.: Monitoring mobile and spatially distributed cyberphysical systems. In: Proceedings of the 15th ACMIEEE International Conference on Formal Methods and Models for System Design, MEMOCODE 2017, pp. 146–155. ACM, New York (2017). http://doi.acm.org/10.1145/3127041.3127050
 5.Bartocci, E., Gol, E.A., Haghighi, I., Belta, C.: A formal methods approach to pattern recognition and synthesis in reaction diffusion networks. IEEE Trans. Control Netw. Syst. 1 (2016). https://doi.org/10.1109/tcns.2016.2609138
 6.Belmonte, G., Ciancia, V., Latella, D., Massink, M.: VoxLogicA: a spatial model checker for declarative image analysis (Extended Version). ArXiv eprints, November 2018. https://arxiv.org/abs/1811.05677
 7.Belmonte, G., et al.: A topological method for automatic segmentation of glioblastoma in MRI flair for radiotherapy. Magn. Reson. Mater. Phys. Biol. Med. 30(S1), 437 (2017). https://doi.org/10.1007/s103340170634z. In ESMRMB 2017, 34th annual scientific meetingCrossRefGoogle Scholar
 8.Belmonte, G., Ciancia, V., Latella, D., Massink, M.: From collective adaptive systems to human centric computation and back: spatial model checking for medical imaging. In: ter Beek, M.H., Loreti, M. (eds.) Proceedings of the Workshop on FORmal Methods for the Quantitative Evaluation of Collective Adaptive SysTems, FORECAST@STAF 2016, Vienna, Austria, 8 July 2016. EPTCS, vol. 217, pp. 81–92 (2016). https://doi.org/10.4204/EPTCS.217.10
 9.van Benthem, J., Bezhanishvili, G.: Modal logics of space. In: Aiello, M., PrattHartmann, I., Van Benthem, J. (eds.) Handbook of Spatial Logics, pp. 217–298. Springer, Dordrecht (2007). https://doi.org/10.1007/9781402055874_5CrossRefGoogle Scholar
 10.Castellano, G., Bonilha, L., Li, L., Cendes, F.: Texture analysis of medical images. Clin. Radiol. 59(12), 1061–1069 (2004)CrossRefGoogle Scholar
 11.Ciancia, V., Gilmore, S., Latella, D., Loreti, M., Massink, M.: Data verification for collective adaptive systems: spatial modelchecking of vehicle location data. In: Eighth IEEE International Conference on SelfAdaptive and SelfOrganizing Systems Workshops, SASOW, pp. 32–37. IEEE Computer Society (2014)Google Scholar
 12.Ciancia, V., Grilletti, G., Latella, D., Loreti, M., Massink, M.: An experimental spatiotemporal model checker. In: Bianculli, D., Calinescu, R., Rumpe, B. (eds.) SEFM 2015. LNCS, vol. 9509, pp. 297–311. Springer, Heidelberg (2015). https://doi.org/10.1007/9783662492246_24CrossRefGoogle Scholar
 13.Ciancia, V., Latella, D., Loreti, M., Massink, M.: Specifying and verifying properties of space. In: Diaz, J., Lanese, I., Sangiorgi, D. (eds.) TCS 2014. LNCS, vol. 8705, pp. 222–235. Springer, Heidelberg (2014). https://doi.org/10.1007/9783662446027_18CrossRefGoogle Scholar
 14.Ciancia, V., Latella, D., Loreti, M., Massink, M.: Model checking spatial logics for closure spaces. Log. Methods Comput. Sci. 12(4), October 2016. http://lmcs.episciences.org/2067
 15.Ciancia, V., Latella, D., Massink, M., Pakauskas, R.: Exploring spatiotemporal properties of bikesharing systems. In: 2015 IEEE International Conference on SelfAdaptive and SelfOrganizing Systems Workshops, SASO Workshops, pp. 74–79. IEEE Computer Society (2015)Google Scholar
 16.Ciancia, V., Gilmore, S., Grilletti, G., Latella, D., Loreti, M., Massink, M.: Spatiotemporal model checking of vehicular movement in public transport systems. Int. J. Softw. Tools Technol. Transfer (2018). https://doi.org/10.1007/s1000901804838
 17.Ciancia, V., Latella, D., Loreti, M., Massink, M.: Spatial logic and spatial model checking for closure spaces. In: Bernardo, M., De Nicola, R., Hillston, J. (eds.) SFM 2016. LNCS, vol. 9700, pp. 156–201. Springer, Cham (2016). https://doi.org/10.1007/9783319340968_6CrossRefzbMATHGoogle Scholar
 18.Ciancia, V., Latella, D., Massink, M., Paškauskas, R., Vandin, A.: A toolchain for statistical spatiotemporal model checking of bike sharing systems. In: Margaria, T., Steffen, B. (eds.) ISoLA 2016, Part I. LNCS, vol. 9952, pp. 657–673. Springer, Cham (2016). https://doi.org/10.1007/9783319471662_46CrossRefGoogle Scholar
 19.Davnall, F., et al.: Assessment of tumor heterogeneity: an emerging imaging tool for clinical practice? Insights Imaging 3(6), 573–589 (2012)CrossRefGoogle Scholar
 20.Despotović, I., Goossens, B., Philips, W.: MRI segmentation of the human brain: challenges, methods, and applications. Comput. Math. Methods Med. 2015, 1–23 (2015). https://doi.org/10.1155/2015/450341CrossRefGoogle Scholar
 21.Dupont, C., Betrouni, N., Reyns, N., Vermandel, M.: On image segmentation methods applied to glioblastoma: state of art and new trends. IRBM 37(3), 131–143 (2016). https://doi.org/10.1016/j.irbm.2015.12.004CrossRefGoogle Scholar
 22.Fyllingen, E.H., Stensjøen, A.L., Berntsen, E.M., Solheim, O., Reinertsen, I.: Glioblastoma segmentation: comparison of three different software packages. PLOS ONE 11(10), e0164891 (2016). https://doi.org/10.1371/journal.pone.0164891CrossRefGoogle Scholar
 23.Galton, A.: The mereotopology of discrete space. In: Freksa, C., Mark, D.M. (eds.) COSIT 1999. LNCS, vol. 1661, pp. 251–266. Springer, Heidelberg (1999). https://doi.org/10.1007/3540483845_17CrossRefGoogle Scholar
 24.Galton, A.: A generalized topological view of motion in discrete space. Theor. Comput. Sci. 305(1–3), 111–134 (2003). https://doi.org/10.1016/S03043975(02)007016
 25.Galton, A.: Discrete mereotopology. In: Calosi, C., Graziani, P. (eds.) Mereology and the Sciences: Parts and Wholes in the Contemporary Scientific Context, pp. 293–321. Springer, Cham (2014). https://doi.org/10.1007/9783319053561_11CrossRefGoogle Scholar
 26.Grosu, R., Smolka, S., Corradini, F., Wasilewska, A., Entcheva, E., Bartocci, E.: Learning and detecting emergent behavior in networks of cardiac myocytes. Commun. ACM 52(3), 97–105 (2009)CrossRefGoogle Scholar
 27.Haghighi, I., Jones, A., Kong, Z., Bartocci, E., Grosu, R., Belta, C.: Spatel: a novel spatialtemporal logic and its applications to networked systems. In: Proceedings of the 18th International Conference on Hybrid Systems: Computation and Control, HSCC 2015, pp. 189–198. ACM, New York (2015)Google Scholar
 28.Kassner, A., Thornhill, R.E.: Texture analysis: a review of neurologic MR imaging applications. Am. J. Neuroradiol. 31(5), 809–816 (2010)CrossRefGoogle Scholar
 29.Lemieux, L., Hagemann, G., Krakow, K., Woermann, F.: Fast, accurate, and reproducible automatic segmentation of the brain in t1weighted volume mri data. Magn. Reson. Med. 42(1), 127–135 (1999)CrossRefGoogle Scholar
 30.Lopes, R., et al.: Prostate cancer characterization on MR images using fractal features. Med. Phys. 38(1), 83 (2011)CrossRefGoogle Scholar
 31.Menze, B.H., et al.: The multimodal brain tumor image segmentation benchmark (brats). IEEE Trans. Med. Imaging 34(10), 1993–2024 (2015)CrossRefGoogle Scholar
 32.Nenzi, L., Bortolussi, L., Ciancia, V., Loreti, M., Massink, M.: Qualitative and quantitative monitoring of spatiotemporal properties. In: Bartocci, E., Majumdar, R. (eds.) RV 2015. LNCS, vol. 9333, pp. 21–37. Springer, Cham (2015). https://doi.org/10.1007/9783319238203_2CrossRefGoogle Scholar
 33.Porikli, F.M.: Integral histogram: a fast way to extract histograms in Cartesian spaces. 2005 IEEE Computer Society Conference on Computer Vision and Pattern Recognition (CVPR 2005), vol. 1, pp. 829–836 (2005)Google Scholar
 34.Simi, V., Joseph, J.: Segmentation of glioblastoma multiforme from MR imagesa comprehensive review. Egypt. J. Radiol. Nucl. Med. 46(4), 1105–1110 (2015). https://doi.org/10.1016/j.ejrnm.2015.08.001CrossRefGoogle Scholar
 35.Spyridon (Spyros) Bakas, et al. (Ed.): 2017 international MICCAI BraTS Challenge: Preconference Proceedings, September 2017. https://www.cbica.upenn.edu/sbia/Spyridon.Bakas/MICCAI_BraTS/MICCAI_BraTS_2017_proceedings_shortPapers.pdf
 36.Tsigkanos, C., Kehrer, T., Ghezzi, C.: Modeling and verification of evolving cyberphysical spaces. In: Proceedings of the 2017 11th Joint Meeting on Foundations of Software Engineering, ESEC/FSE 2017, pp. 38–48. ACM, New York (2017). http://doi.acm.org/10.1145/3106237.3106299
 37.Zhu, Y., et al.: Semiautomatic segmentation software for quantitative clinical brain glioblastoma evaluation. Acad. Radiol. 19(8), 977–985 (2012). https://doi.org/10.1016/j.acra.2012.03.026CrossRefGoogle Scholar
Copyright information
Open Access This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.
The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.