11institutetext: The University of Strathclyde

# Security Landscape for Robotics

Ryan Shah

###### Abstract

In this paper, the current state of security in robotics is described to be in
need of review. When we consider safety mechanisms implemented in an Internet-
connected robot, the requirement of safety becomes a crucial security
requirement. Upon review of the current state of security in the field of
robotics, four key requirements are in need of addressing: the supply chain
for calibration, integrity and authenticity of commands (i.e. in
teleoperation), physical-plane security and finally, secure, controlled
logging and auditing.

##  1 Introduction

Robotics has taken a graceful leap into a wide range of application areas,
including but not limited to autonomous vehicles, and surgical and industrial
robotics. The use of robotics in these areas brings forth the potential to
increase the efficiency of output, as well as the accuracy of operations. In
the area of surgical robotics, a high level of accuracy and precision is a key
factor, which, in the context of surgery, in some cases could mean the
difference between life and death. Reuters published an article [1] that
states the shipments for robots increased by nearly 16% from 2017, where
shipments increased in every sector other than the automotive industry. An
increase in shipments of robots and their corresponding components, ultimately
corresponds to an increase in robotic installations, each of which are
becoming Internet-connected. Whilst robots traditionally pose many safety
challenges, becoming Internet-connected exposes the robots to cyber attacks
which can result in safety-critical events, and thus safety problems now
become a security concern.

##  2 Background

###  2.1 Surgical Robotics

In the case of surgical robotics, there are robots which are configured based
on pre-planned operations, such as bone-milling robots like Robodoc [2], as
well as robot systems which are directly teleoperated by the surgeon, such as
RAVEN II [3] and the da Vinci surgical system [4].

Preoperative planning robots, like Robodoc, consist of a planning computer
workstation and a robotic arm with an instrument, such as a high-speed milling
device, as an end effector [5]. Before these robots were introduced, there was
a need to address the inability to optimally fit implants into the bone of
patients, as there are many factors which can impact the fitting of implants,
including accurately sizing the implant and the precise positioning of the
implant within the bone. As a result, preoperative planning robots designed
for bone milling were introduced, which have shown to be feasible and provide
successful surgery for implants, with a reduction in the number of post-
surgery complications such as rejection of the implants and bone fractures.
The precision and accuracy that these robots provide, allows for better bone
milling at optimal speeds and locations which, due to a computer-operated
preoperative planning system, is suitable for a wider variety of implant-
related surgeries.

Teleoperated surgical robotic systems, such as da Vinci, provides medical
professional with robot-assistance in procedures, to improve surgical
performance. The da Vinci robot is a widely used surgical robot system, which
is a quadbrachical (four-arm) robot, which is operated by a surgeon via a
surgeon’s console. The surgeon’s console consists of finger controllers that
translates human movements into instructions the robot can interpret. The
RAVEN II surgical system consists of two surgical arms, but the motor chassis
(base) allows two RAVEN II surgical robots to be mounted on either side of the
surgery site [6]. Similarly, both of these robots are coupled with a surgical
console, that provides feedback to the surgeon, such as by providing a 3D view
of the surgical site.

Noticeably, with a comparison of both the RAVEN II and da Vinci robots, whose
architectures span a majority of surgical robots, we can deduce that a key
component across all surgical robotic systems is the surgeon’s console. In the
case of preoperative planning robots used in surgery, the console can be
compared to the planning computer, where feedback to the surgeon’s console
such as radiography images (x rays, etc.) and robotic movements are used as
input to the robot pre-surgery.

In a preoperative procedure, the surgical console is started and primed, and
allowed to self-test itself, where it recognises its various components [4].
The cameras used in the surgical suite are black and white balanced and
calibrated to a cross bar, as well as other factors such as the height are set
to comfortable levels for the surgeon. Camera and arm movements are tested,
and the system is left to stand by.

###  2.2 Industrial Robotics

Industrial robots accompany a large portion of installed robotics systems,
which range from aiding in collection, production and packing of food products
[7], to the automotive industry. An experimental security analysis of
industrial robots [8] shows that the majority of industrial robot
architectures are extremely similar to surgical robot architectures. More
specifically, industrial robot systems can be compared to teleoperated
surgical robots, where the industrial robot is paired with a controller
(pendant) that allow the robot to be both operated by human operators as well
as autonomously. There is a main control system which links the controller,
inter-connected components and the network in which the robot operates.
Another comparison to surgical robotics, the control system is regarded as one
of the most safety- and security-critical components. The components of the
robot system communicate with each other using an internal robot network, and
the robot system is connected to a dedicated organisational subnet or the
Internet via a service network; similar to the da Vinci surgical system.
Traditional industrial robots are paired with a teach pendant that allows the
robot to perform simple repetitive tasks, without any sensor feedback. The
authors in [9] describe a system to achieve coordinated task-based control for
an industrial robot, which has a rotating torso and two seven degree-of-
freedom arms to perform grasping tasks and object manipulation
teleoperatively. Traditional robots are limited by a timing delay between the
issuing of commands and the corresponding robotic action, but the authors show
that the use of sensors allow the robot motion to be controlled with collision
avoidance, object identification and locating. As well as this, using sensors
and machine learning provide the robot with force-feedback control, where
located objects can be securely held with enough force to prevent the object
slipping, by estimating the weight and center of gravity of the object as well
as its position. Another example of embedded sensors in an industrial robot is
described in [7], where the robot system uses cameras and sensors for
constructing a 3D model used in automatic pruning of grape vines. The cameras
of this robot are calibrated using standard methods and the robot-to-camera
transform is computed by attaching a calibration target to the robot arm. To
cut canes, a mill-end is attached to a 100W 24,000 RPM brushless DC motor on
the arm. The 3D model is optimised using AI techniques and is used to update
the robot’s trajectory so that its six degree-of-freedom arm can reach the
required vine cuts accurately.

###  2.3 Autonomous and Unmanned Vehicles

To a general audience, autonomous vehicles are primarily viewed as cars or
other highway vehicles, yet this term is further classified. Autonomous
vehicles can also be classified into civilian aircraft, trains, Unmanned Sea
and Surface Vehicles (USVs), and Unmanned Aerial Vehicles (UAVs) [10].
Although the architectures of autonomous vehicles may differ among classes,
they all utilise common components, such as cameras, sensors, GPS, etc. –
somewhat similar to surgical and industrial robots. These common components
are heavily relied on, to aid with actions such as real-time manoeuvring
decisions.

For autonomous cars, many in-built functions, such as enabling/disabling the
brakes, are controlled by Electrical Control Units (ECUs), which are
interconnected by the Controller Area Network (CAN) protocol [11]. Originally
designed in the 1980s, the CAN bus is still the most widely used in-vehicle
bus to date, due to its cost efficiency [12]. As well as this, a large
proportion of autonomous systems can be directly addressed via cellular
networks, and the Internet. In an autonomous vehicle, a combination of the
ECUs in the vehicle are interconnected via the CAN bus, and thus we can
portray autonomous vehicles to consist of a multi-agent system architecture,
composed of one or more subsystems [10]. Similar to surgical robots,
autonomous cars consist of one or more control modules, which may be connected
to the CAN bus such that in can be interconnected with the ECUs in the vehicle
[13].

##  3 Discussion of Robot Security

Upon exploring the problem space associated with security in three primary
aspects of robotics, we identified key challenges that need to be addressed.

###  3.1 Cyber Domain Challenges

Attacks in the cyber domain are ever so present, when we connect robot systems
to the Internet or even an organisation’s network. Alemzadeh et al. [6] state
that cyber domain attacks include the modification of control commands,
without needing to modify the control flow or induce changes in the
performance of the target program. The authors present attacks that exploit
the time of check-time of use (TOCTOU) vulnerability, between the safety
checks on the commands the actual execution of commands. As a result of
attacks in the cyber domain, potentially catastrophic consequences arise in
the physical domain, such as abrupt/jerked axial movements, which can lead to
a reduction in accuracy and precision. Results like these are extremely hard
to notice, unless closely watched by the operator, and it is hard to
distinguish whether the result was due to a failure in the robot system, or if
it was due to a human-induced failure. The challenges here include ensuring
the integrity of commands whilst in-flight, maintaining the accuracy and
precision of robot output, and providing tamper-resistant logs to maintain a
trail of evidence in the event of failures or anomalous behaviour.

In surgical robotics systems, the key critical component is its electronic
control system [6], which both receives commands form the surgeon’s console
and translates these into robotic actions, whilst providing video feedback to
the surgeon’s console. Bonaci et al. [14] describe attacks between the
surgeon’s console and the robot itself, which they classify into three
categories: intention modification, intention manipulation, and hijacking
attacks. Respectively, these attacks include impacting intended actions of the
surgeon, modifying feedback messages from the robot to the surgeon’s console,
and having the robot ignore the intended actions of the surgeon and ultimately
perform a completely different action. Attacks such as these further suggest
that providing tamper-resistant messages is important, and because commands
are sent in real-time and executed as soon as they arrive, the integrity of
commands must be maintained in-flight. On top of this, the communication
channels between components in the robot system must not be tampered with, in
the sense that messages within the channel shall not be altered, nor can
unauthorised messages be sent and accepted within the channel.

In the case for industrial robots, with the architectures very similar to
those of surgical robots, the critical component is also the control system.
Industrial robots tend to have components interconnected and communicate with
each other through an internal robot network, as well as a service network
where the robot is connected to a dedicated organisational subnet and possibly
to the Internet [8]. What is challenging, is to secure robots that are
connected to the public Internet, where adversaries can target the robot (or
multiple) from anywhere. On top of this, even when a robot is connected to the
organisational subnet, there is still a risk of local adversaries that may
look to attack the robot in the cyber domain. Demarinis et al. [15] present
results from scanning the entire IPv4 address space of the Internet for
instances of the Robot Operating System (ROS), which is a widely used robotics
platform for research, and found that a number of hosts that support ROS are
exposed to the public Internet. They identified that some robots are connected
to simulators, but a number appear to be legitimate robots which are capable
of being teleoperated, such that they can be remotely moved in ways that could
potentially pose risks to both the robot and its surrounding environment,
including human operators. An open ROS master was shown to indicate a robot
whose sensors can be remotely accessed, and who’s actuators can be remotely
controlled. From a single scan, 15 instances of the operating system were
identified, with 11 of them located in cloud service provider networks.
Multiple different sensors were also discovered to be in use by these openly
accessible robots, which included laser range finders, cameras, GPS devices
and barometric pressure sensors. Ultimately, the authors suggest that, at a
minimum, the network should be monitored to detect exposure. The main
challenge here is to only allow entities to teleoperate upon authorisation,
whilst either securing or isolating the robot from the public Internet.

While safety is becoming of increasing importance, the implementation of
safety mechanisms in software establishes higher security requirements.
Focusing attacks on these safety mechanisms can subsequently impact the
physical domain. Impacts on the operations of the robot itself can occur, but
also indirect impacts on its operators and surrounding environment may be ever
so present. An indicative example of this relates back to an attack which can
cause abrupt, unjust movements in the robot arms [6]. In this example, the
authors uncover an interesting challenge with the E-stop (emergency stop)
software mechanism. This mechanism can also be hard-wired, but their
experiment involved a software e-stop mechanism. Assuming that a robot has
been compromised, installing a safety mechanism which can impose a system-wide
halt would be prone to problems. For example, if a rival manufacturing company
was to attack the e-stop software mechanism, they could interrupt the entire
manufacturing process of their competitors. This not only leads back to the
challenges of securing the robot itself, but also providing a tamper-resistant
log of evidence, in the event that this may take place; such that unintended
actions can be traced back to the origin of the action.

###  3.2 Physical domain challenges

Aside from challenges that arise in the cyber domain, we must also consider
attacks in the physical domain; as the connected robots consist of both cyber
and physical components which cooperate to enable smooth operation in the real
world.

First, we must consider physical compromise. The availability of these robots
is regarded as a property of uttermost importance, which is unfortunately also
the most easily influenced. For example, an adversary who targets an
autonomous vehicle with a jamming attack, focusing on the optical channels,
could induce an emergency stop resulting in a denial-of-service (DoS) attack.
Aside from jamming attacks, even tampering with a sensor or replacing it with
an unauthorised sensor could provide images with unintended perturbations or
of low quality, which can result in poor misclassification of objects in a
robots perceived environment. Therefore, we must consider the challenges of
not only mitigating the effects of jamming attacks, but also avoid
unauthorised equipment to be added (or in replacement of another) to robots.
Furthermore, it is also a challenge to ensure only authenticated components
are in place to ensure that the robot and its components behave and perform as
intended.

As well as safety mechanisms implemented in software, we must also discuss
challenges posed by safety mechanisms in the physical domain. Industrial
robots have been discussed for use in construction [16], which poses many
interesting challenges, as construction work invokes higher requirements for
flexibility and adaptability, compared to traditional industrial robot
solutions. The working environment in construction is ever changing, with
humans potentially cooperating aside the robot itself, and materials coming in
and out of the robots perceived environment. Compared to typical industrial
environments, the accuracy of components and buildings vary and are relatively
lower, and thus must be compensated for. Salmi et al. [16] note that using
sensors for 3D vision and force control allow robots to better manage complex
environments, as well as adapt to product variation and adapt process
parameters to varying requirements. The use of sensors as a safety mechanism
allows for flexible fenceless safety systems, which is ideal in environments
where humans and robots closely collaborate. However, risks such as collision,
compression and sparks, among others, can occur at different stages of robot
operation (i.e. boot, clearing of disturbances, etc.) even with the use of
sensors. Sensors can be expensive, but [9] shows that off-the-shelf sensor
components and software can be drawn upon, which can greatly reduce costs.
Using cheaper sensors, albeit a cheaper option, does not guarantee a long
component-life. Furthermore, the calibration of these sensors can pose a
threat to the accuracy and precision of these sensors, and ultimately its
effectiveness as a safety mechanism.

###  3.3 Secure calibration

The calibration of any equipment, including sensors used in AVs or even the
instruments used for surgical robotics, is performed to ensure that the output
of the equipment are of high quality, precision and accuracy, and low
uncertainty. Moreover, the definition of equipment goes further to also cover
cables and resistors that are used in the equipment itself. To enable this,
they are calibrated against a higher standard of accuracy, to identify the
margin of errors in output. Calibration is also performed to meet quality
audit requirements, and ensure reference designs, subsystems and integrated
systems perform as intended. After calibration is performed, a calibration
certificate is produced as an output, which outlines the measurement
uncertainty, error margins and precision under certain environmental
conditions (dependent on calibration), amongst others. A piece of equipment’s
calibration and uncertainty should be traceable to corresponding SI units, to
a standard or reference method [17] – producing a chain of equipment and
associated calibration certificates, leading to the SI units. We can define a
simple traceability chain for a sensor, where the sensor is calibrated at one
or more intermediate calibration facility, against one or more calibration
units. These calibration units are themselves calibrated against some master
calibration units, and this continues until we reach calibration performed at
National Measurement Institutes (NMIs), which use calibration units that are
calibrated against the SI units; providing the highest levels of accuracy and
lowest levels of uncertainty. As we move from the NMIs at the top of the
chain, the accuracy decreases and uncertainty increases, but equipment at each
level should have a set uncertainty; which should be maintained.

The challenges associated with robot equipment are ensuring that all its
components are correctly calibrated, whilst maintaining the integrity of
calibration and certificates. Aside from integrity, we must also ensure that
for some equipment, i.e. a sensor, its traceability chain is unbroken.
Specifically, if one master unit in its traceability chain is out of
calibration (needing recalibration) or was calibrated incorrectly, all
subsequent equipment/units downwards from that point should effectively be
recalibrated.

As well as challenges associated with implemented safety mechanisms of robots,
Quarta et al. [8] note a key challenge associated with calibration parameters.
These calibration parameters are an essential construct for determining
factors such as axial positions of the arms, which are used for compensation
for known measurement errors. By manipulating the calibration parameters, they
demonstrated induced effects on the robot’s servo motor, causing it to move
erratically. This was because the true error in the measurement signal was in
fact different to that which the controller knew. Calibration parameters for
all components in a robot system may be held by its controller or main
computer. If this is the case, then any potential compromise of the controller
or main computer can subsequently violate the integrity of calibration
parameters, thus leading to potentially anomalous output of sensors or even
unintended actions even if the robot was operated normally.

###  3.4 Secure boot

Importantly, calibration, configuration and component connections are all
established through the boot process. By tampering with only the boot process,
an adversary could modify the calibration and configuration parameters known
by the controller, and potentially force extreme erratic movements or unsafe
robot starting positions. Aside from tampering with the boot process,
incorrect calibration, faulty connections, etc. could result in potentially
catastrophic consequences. Therefore, assuming a secure boot, the boot process
should ensure factors such as authentic component connections and valid
calibration, before the robot can operate safely.

###  3.5 Summary of challenges

Overall, we have established a number of challenges that arise in security of
robotics, from cyber and physical domain challenges, to further refined
challenges in the calibration of interconnected components such as sensors and
even cables used to connect components.

  1. 1.

Ensuring the integrity and authenticity of commands, even whilst in-flight.

  2. 2.

Maintaining tamper-resistant logs and trails of evidence, for auditing and
locating sources of failures and anomalous/unsafe behaviour.

  3. 3.

Securing communication channels from tampering commands, adversarial input,
and eavesdropping.

  4. 4.

Securing the teleoperability of robots – only authorised entities can
teleoperate, even if a robot is connected to the public Internet or an
organisation’s subnet.

  5. 5.

Mitigation of physical plane attacks, such as jamming and signal saturation
attacks.

  6. 6.

Ensuring only authentic and authorised equipment is in place, to ensure no
physical tampering occurs. This includes sensors, and actuators, while going
even further to include components such as power and ethernet cables.

  7. 7.

Maintaining valid calibration for all components in a robot system, to ensure
high accuracy and precision, and low uncertainty (low margin of error from
calibration).

  8. 8.

Maintaining the integrity of calibration certificates and stored
calibration/configuration.

  9. 9.

Securing the boot process (startup).

##  4 The Requirement for a Progressive Shift in Robot Security

Upon discussion of the challenges associated with robot security, we propose a
number of research questions which are to be further explored.

Supply chain for calibration: First, how can we secure the supply chain,
before a robot is produced? The majority of components that make up a robot
system have a calibration a chain, which means that they have a calibration
certificate detailing accuracy, precision and margins of error. Thus, it is a
requirement to ensure that the calibration of these components is up-to-date
and performed correctly and to international standards [18]. Furthermore, not
only should the calibration of a component be valid, the calibration of all
calibration units that supersedes must also be valid such that the
traceability chain remains unbroken. If part of this chain is broken, all
subsequent members of the chain must be recalibrated. In a real-world
scenario, assuming a sensor was out-of-calibration, the robot may perform less
efficiently or incorrectly classify sensed objects; and such the question of
whether the robot should still be in operation becomes of question. This can
be taken a step further, and the proper calibration of a robot can be
determined in a secure boot process which ultimately determines whether a
robot can start or not.

Integrity and authenticity of commands (i.e. from teleoperation), even whilst
in-flight: Bonaci et al. [14] describe an attack which impacts a surgeon’s
intended actions and modifying in-flight packets. Doing so could result in the
robot assuming a surgeon’s commands are valid and ultimately perform a
consequential action targeting a patient. As a solution to attacks against the
integrity and authenticity of commands, the authors propose a number of
challenges to be addressed. First, teleoperated robots execute commands as
soon as they are received, and thus if an adversary was to flood the robot
with packets, it may start behaving abnormally. Not only would this pose a
risk to a patient, but also to the robot and its environment. As a minimum
requirement, they propose that assurance of legitimate sources of commands
should be maintained and to limit a robot’s processing rate to a specific
amount to protect the robot and its environment from harm.

Physical plane security: Assuming that we have a secure supply chain, once the
robot is produced and ready to be used, how can we ensure it is physically
secure? We must first ensure that robots are able to maintain relatively
normal operation even under adversarial threats. For example, if jamming or
signal saturation attacks are in place to disrupt a driverless vehicle, we
must mitigate the effects of these attacks as best as possible, to enable the
vehicle to continue driving regularly. On top of this, we must ensure that all
interconnected components of a robot system are authentic and allowed to be
there. Specifically, we must ensure that sensors installed during production
have not been changed unless the change was authorised and logged securely.
This would help prevent faulty components being used, as well as preventing an
adversary from implementing a modified component for their benefit. For
example, if a UAV was captured in a battlefield scenario, an attacker may
modify its GPS component so it provides incorrect information to the owner of
the UAV. Furthermore, even cables can be used maliciously. USB cables can
seemingly be legitimate, yet an attacker can modify the USB cables to inject
malware, as demonstrated by Nohl and Lell [19]. Therefore, it is a requirement
to ensure that all components are authentic and that even component
connections should be authorised. For example, a challenge should be made to
verify that a cable is allowed to be attached to an Ethernet port. Finally,
robots should also be securely maintained. This can pose a difficult
requirement to address, as some robots operate remotely or are always running,
and therefore it is difficult to perform maintenance on a live robot. Can we
patch the robot, even whilst it is in operation, without disrupting its
operability? Can we, securely and safely, lock or shutdown the robot in the
event of compromise or abnormal behaviour?

Secure, controlled logging and auditing: The need for tamper-resistant logs is
a valuable requirement, which can provide a trail of evidence in catastrophic
events, for example to locate the source of potential problems. As well as
this, logs are also used for auditing - which is an essential event that
occurs regularly within the calibration infrastructure. There has been several
research papers focusing on append-only [20], tamper-evident [21] and tamper-
resistant logs [22] and secure audit logging, which primarily focus on
publicly verifiable audit logs [23, 24, 25, 26] for distributed systems.
However, there is little work done on privacy-preserving audit logging. At the
least, work on privacy-preserving audit logging focuses on inter-domain audit
logging [27, 28, 29], but in a robotics environment, with multiple levels each
of different security requirements (i.e. confidentiality and integrity), it is
important to establish a framework for cross-domain, multi-level, privacy-
preserving audit logging.

## References

  * [1] Reuters.  U.s. companies put record number of robots to work in 2018, February 2019\.  https://www.reuters.com/article/us-usa-economy-robots/u-s-companies-put-record-number-of-robots-to-work-in-2018-idUSKCN1QH0K0.
  * [2] Russell H Taylor, Leo Joskowicz, Bill Williamson, André Guéziec, Alan Kalvin, Peter Kazanzides, Robert Van Vorhis, Jianhua Yao, Rajesh Kumar, Andrew Bzostek, et al.  Computer-integrated revision total hip replacement surgery: concept and preliminary results.  Medical image analysis, 3(3):301–319, 1999.
  * [3] Blake Hannaford, Jacob Rosen, Diana W Friedman, Hawkeye King, Phillip Roan, Lei Cheng, Daniel Glozman, Ji Ma, Sina Nia Kosari, and Lee White.  Raven-ii: an open platform for surgical robotics research.  IEEE Transactions on Biomedical Engineering, 60(4):954–959, 2013\.
  * [4] Ashutosh Tewari, James Peabody, Richard Sarle, Guruswami Balakrishnan, Ashok Hemal, Alok Shrivastava, and Mani Menon.  Technique of da vinci robot-assisted anatomic radical prostatectomy.  Urology, 60(4):569–572, 2002.
  * [5] William L Bargar, André Bauer, and Martin Börner.  Primary and revision total hip replacement using the robodoc (r) system.  Clinical Orthopaedics and Related Research (1976-2007), 354:82–91, 1998.
  * [6] Homa Alemzadeh, Daniel Chen, Xiao Li, Thenkurussi Kesavadas, Zbigniew T Kalbarczyk, and Ravishankar K Iyer.  Targeted attacks on teleoperated surgical robots: Dynamic model-based detection and mitigation.  In 2016 46th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), pages 395–406. IEEE, 2016.
  * [7] Tom Botterill, Scott Paulin, Richard Green, Samuel Williams, Jessica Lin, Valerie Saxton, Steven Mills, XiaoQi Chen, and Sam Corbett-Davies.  A robot system for pruning grape vines.  Journal of Field Robotics, 34(6):1100–1122, 2017.
  * [8] Davide Quarta, Marcello Pogliani, Mario Polino, Federico Maggi, Andrea Maria Zanchettin, and Stefano Zanero.  An experimental security analysis of an industrial robot controller.  In 2017 IEEE Symposium on Security and Privacy (SP), pages 268–286. IEEE, 2017.
  * [9] Daniel Kruse, John T Wen, and Richard J Radke.  A sensor-based dual-arm tele-robotic system.  IEEE Transactions on Automation Science and Engineering, 12(1):4–18, 2015.
  * [10] Eray Yağdereli, Cemal Gemci, and A Ziya Aktaş.  A study on cyber-security of autonomous and unmanned vehicles.  The Journal of Defense Modeling and Simulation, 12(4):369–381, 2015\.
  * [11] Mohammad Farsi, Karl Ratcliff, and Manuel Barbosa.  An overview of controller area network.  Computing & Control Engineering Journal, 10(3):113–120, 1999.
  * [12] Bogdan Groza and Pal-Stefan Murvay.  Efficient intrusion detection with bloom filtering in controller area networks.  IEEE Transactions on Information Forensics and Security, 14(4):1037–1051, 2019.
  * [13] Wenhao Zong, Changzhu Zhang, Zhuping Wang, Jin Zhu, and Qijun Chen.  Architecture design and implementation of an autonomous vehicle.  IEEE Access, 6:21956–21970, 2018.
  * [14] Tamara Bonaci, Jeffrey Herron, Tariq Yusuf, Junjie Yan, Tadayoshi Kohno, and Howard Jay Chizeck.  To make a robot secure: An experimental analysis of cyber security threats against teleoperated surgical robots.  arXiv preprint arXiv:1504.04339, 2015.
  * [15] Nicholas DeMarinis, Stefanie Tellex, Vasileios Kemerlis, George Konidaris, and Rodrigo Fonseca.  Scanning the internet for ros: A view of security in robotics research.  arXiv preprint arXiv:1808.03322, 2018.
  * [16] Timo Salmi, Jari M Ahola, Tapio Heikkilä, Pekka Kilpeläinen, and Timo Malm.  Human-robot collaboration and sensor-based robots in industrial applications and construction.  In Robotic Building, pages 25–52. Springer, 2018.
  * [17] CA Nieto de Castro, MJV Lourenço, and MO Sampaio.  Calibration of a dsc: its importance for the traceability and uncertainty of thermal measurements.  Thermochimica Acta, 347(1-2):85–91, 2000.
  * [18] International Organization for Standardization.  General requirements for the competence of testing and calibration laboratories.  https://www.iso.org/standard/66912.html, 2017.
  * [19] Karsten Nohl and Jakob Lell Security Research Labs.  Badusb — on accessories that turn evil.  https://srlabs.de/wp-content/uploads/2014/07/SRLabs-BadUSB-BlackHat-v1.pdf, 2014\.
  * [20] Attila A Yavuz, Peng Ning, and Michael K Reiter.  Efficient, compromise resilient and append-only cryptographic schemes for secure audit logging.  In International Conference on Financial Cryptography and Data Security, pages 148–163. Springer, 2012.
  * [21] Scott A Crosby and Dan S Wallach.  Efficient data structures for tamper-evident logging.  In USENIX Security Symposium, pages 317–334, 2009.
  * [22] Di Ma and Gene Tsudik.  A new approach to secure logging.  ACM Transactions on Storage (TOS), 5(1):2, 2009.
  * [23] Attila Altay Yavuz and Peng Ning.  Baf: An efficient publicly verifiable secure audit logging scheme for distributed systems.  In 2009 Annual Computer Security Applications Conference, pages 219–228. IEEE, 2009.
  * [24] Jason E Holt.  Logcrypt: forward security and public verification for secure audit logs.  In ACM International Conference Proceeding Series, volume 167, pages 203–211, 2006.
  * [25] Ahmad Waqas, Zulkefli Muhammed Yusof, and Asadullah Shah.  Fault tolerant cloud auditing.  In 2013 5th International Conference on Information and Communication Technology for the Muslim World (ICT4M), pages 1–5. IEEE, 2013\.
  * [26] Rui Xie and Rose Gamble.  A tiered strategy for auditing in the cloud.  In 2012 IEEE Fifth International Conference on Cloud Computing, pages 945–946. IEEE, 2012.
  * [27] Adam J Lee, Parisa Tabriz, and Nikita Borisov.  A privacy-preserving interdomain audit framework.  In Proceedings of the 5th ACM workshop on Privacy in electronic society, pages 99–108. ACM, 2006.
  * [28] Tobias Pulls, Roel Peeters, and Karel Wouters.  Distributed privacy-preserving transparency logging.  In Proceedings of the 12th ACM workshop on Workshop on privacy in the electronic society, pages 83–94. ACM, 2013.
  * [29] Mehul A Shah, Ram Swaminathan, and Mary Baker.  Privacy-preserving audit and extraction of digital contents.  IACR Cryptology ePrint Archive, 2008:186, 2008.


#  Analytical Pricing of 2 Factor Structural PDE model for a Puttable Bond
with Credit Risk

1 Hyong-Chol O, 2 Dae-Song Choe, 3 Gyong-Dok Rim
1,2,3 Faculty of Mathematics, Kim Il Sung University, Pyongyang , D P R K
* Corresponding author’s Email address<EMAIL_ADDRESS>
Abstract: In this paper is proposed a 2 factor structural PDE model of pricing
puttable bond with credit risk and derived the analytical pricing formula. To
this end, first, a 2 factor structural (PDE) model of pricing zero coupon bond
with credit risk is provided, the analytical pricing formula is derived under
some conditions for default boundary and default recovery, and the strict
monotonicity of the bond price function with respect to the firm value
variable is proved. Then a (2 factor) pricing model of the option on zero
coupon bond with credit risk is provided and under some condition on the
exercise price its analytical pricing formula is derived by transforming the 2
factor model into a terminal boundary value problem for Black-Scholes equation
with time dependent coefficient using zero coupon bond as numeraire. Using it,
we provide the pricing formulae of the puttable and callable bonds with credit
risk.

Keywords: analytical pricing formula; option on bond with credit risk; 2
factor structural model; puttable bond; callable bond

MSC 2020 35C15, 35K15, 35K20, 35Q91

##  1 Introduction

Issuing bonds is one of financing tools of governments or firms and the
corporate bonds are defaultable. The pricing problem for defaultable bonds
that is related to credit risk modeling and the credit risk problem is one of
the most interesting problems in financial mathematics.

Among the corporate bonds, there are some bonds with provisions related to
early redemption [3, 1]. There are two kinds of early redemption provisions.
One is the provision allowing the bond holder to demand early redemption. In
this case, the bond holder has the right to demand early redemption from the
bond issuer prior to maturity. That is, the bond holder has the right to put
(sell) the bond back to the bond issuer at a predetermined price (early
redemption premium). Such a bond is called a puttable bond. It can be seen
that the holder of such a bond has purchased a bond put option which provides
the right to sell the bond prior to maturity as well as the bond itself.
Because the put option increases the value of the bond to the holder, the
prices of the puttable bonds are more expensive than the straight bonds with
no early redemption (put) features. Another one is the provision allowing the
bond issuing firm to demand early ending the debt contract. In this case, the
issuing firm has the right to buy back the bond at a predetermined price prior
to maturity. Such a bond is called a callable bond. It can be seen that the
holder of such a bond has sold a call option on the bond to the bond issuer.
The call price in this option is the predetermined price that must be paid by
the issuer to the holder and thus the prices of the callable bonds are cheaper
than bonds with no early redemption (call) features.

It seems that it is clear why the bond holder demand early redemption. But
what is the reason that the bond issuer demands such a call provision? One
reason is that bond indentures often place a number of restrictions to the
issuing firm and companies need some routes to escape from the restrictions if
the restrictions prove too inhibiting. The call provision provides the escape
route [1].

Puttable or callable bonds include some bond options as described in the
above. Recently, pricing problems of bond options are widely studied. In [2,
12, 13] are studied the pricing problems of American bond options and in [10,
11] are considered the pricing problems of coupon bonds as interest
derivatives under the 1 and 2 factor Hull-White models. These are all the
pricing problems for bond options without credit risk.

According to experts, the pricing problem of puttable bonds(options on bonds)
with credit risk is a challenging problem. [8] provides a partial differential
equation model of the price of a Discrete Coupon Bond with Early redemption
provision (with credit risk) and an analytical solution representation but
their approach is to analyze together by adding an early-redemption provision
to the pricing model of the discrete-coupon bonds of [6, 7]. That is not the
approach from the viewpoint of the bond option. On the other hand, In [9],
authors proposed a 1 factor structural model for option on zero coupon bond
with credit risk and provided analytical pricing formulae of the puttable and
callable bonds with credit risk using the solution representations and
monotonicity result of the solutions to the boundary value problems for Black-
Scholes equations with some special maturity payoff functions.

The purpose of this paper is to extend the 1 factor models and pricing
formulae for options on bonds with credit risk provided in [9] to the 2 factor
models. To this end, first, a 2 factor structural (PDE) model of pricing zero
coupon bond with credit risk is provided, the analytical pricing formula is
derived under some conditions for default boundary and default recovery, and
the strict monotonicity of the bond price function with respect to the firm
value variable is proved. Then 2 factor structural PDE model of the option on
zero coupon bond with credit risk is provided. Unlike the 1 factor model in
[9], this model is a terminal boundary value problem for a partial
differential equation with variable coefficients and two spatial variables and
thus generally does not have analytical pricing formula. In this paper under
some conditions on the default barrier and early redemption premium using zero
coupon bond as numeraire, the 2 factor model is transformed into a terminal
boundary value problem for Black-Scholes equation with time dependent
coefficient and its analytical pricing formula is derived using the methods of
[4] and [9]. Using it, we provide the pricing formulae of the puttable and
callable bonds with credit risk. Due to the restrictions on the default
barrier and early redemption premium, our pricing formulae do not include the
results of [9] but in the case that $q=0,\;\;a=r,\;\;E=Ee^{-r(T-T_{1})}$ they
include the results of [9].

Pricing problems of puttable or callable bonds are divided by pricing the
straight bonds (the bonds without put or call provisions) and calculation of
bond option premium. So the rest of the paper is organized as follows: in
Section 2, a 2 factor structural PDE model for the straight bond with credit
risk and the pricing formula are provided and the monotonicity of the bond
price with respect to the firm value variable is proved. In Section 3, the
pricing model for option on bond with credit risk and the pricing formulae of
bond option and puttable (callable) bond with credit risk are provided.

##  2 Two Factor Structural Model for Zero Coupon Straight Bond with Credit
Risk and Pricing Formula

###  2.1 Two factor structural model for zero coupon straight bond

Assumption 1. Risk free rate follows Vasicek model:

$dr_{t}=\theta(\mu-r_{t})dt+s_{r}dW_{1}(t).$ (2.1)

Here $W_{1}$ is standard Brownian motion and $\theta,\;\;\mu,\;\;s_{r}$ are
constants. Under the condition (2.1), the price $Z(r,\;\;t)=Z(r,\;\;t:\;T)$ of
default free zero coupon bond with maturity $T$ is the solution to the problem

$\left\\{\begin{array}[]{l}{\displaystyle\frac{\partial Z}{\partial
t}+\frac{1}{2}s_{r}{}^{2}\displaystyle\frac{\partial^{2}Z}{\partial{\kern
1.0pt}r^{2}}+\theta(\mu-r)\displaystyle\frac{\partial Z}{\partial{\kern
1.0pt}r}-rZ=0,}\\\ {Z(r,\;\;T)=1}\end{array}\right.$ (2.2)

and provided as follows (see [3].):

$Z(r,\;\;t)=Z(r,\;\;t:T)=e^{\bar{A}(t,\;\;T)-\bar{B}(t,\;\;T)r},$ (2.3)
$\begin{array}[]{l}{\bar{B}(t,\;T)=\displaystyle\frac{1-e^{-\theta(T-t)}}{\theta},}\\\
{\bar{A}(t,\;T)=-\displaystyle\int_{t}^{T}[\theta\mu\bar{B}(s,\;T)-\displaystyle\frac{1}{2}s_{r}{}^{2}\bar{B}^{2}(s,\;T)]ds}\\\
{\;\;\;\;\;\;=[\bar{B}(t,\;T)-T+t](\mu-\displaystyle\frac{s_{r}{}^{2}}{2\theta^{2}})-\displaystyle\frac{s_{r}{}^{2}}{4\theta}\bar{B}^{2}(t,\;T).}\end{array}$
(2.4)

Assumption 2. The firm value $V$consists of $m$ shares of traded asset $S$ and
$n$ sheets of zero coupon bonds:

$V_{t}=mS_{t}+nC_{t}$ (2.5)

and follows the geometric Brownian motion:

$\displaystyle\frac{dV(t)}{V(t)}=\beta(r_{t},V_{t},t)dt+s_{V}(r_{t},V_{t},t)dW_{2}(t).$
(2.6)

Here $W_{2}$ is standard Brownian motion and the firm does not pay out any
dividend.

Assumption 3. Default event occurs when $V\leq V_{b}(r,\;\;t)$.

Assumption 4. Default recovery is $R_{d}(V_{t},\;\;r_{t},\;\;t)$.

Assumption 5.

$dW_{1}\cdot dW_{2}=\rho{\kern 1.0pt}dt(ignoring\;higher\;orders\;of\;dt)$
(2.7)

Assumption 6. The price $C_{t}$ at time $t$ of our bond is provided by a
deterministic function $f(x_{1},x_{2},t)$ as $C_{t}=f(r_{t},\;\;V_{t},\;\;t)$
and the price at time $T$ (the face value) is 1(unit of currency). For
convenience, $f(x_{1},x_{2},t)$ is written as $C(r,\;\;V,\;\;t)$.

Under the assumptions 1$\mathrm{\sim}$6, the price function $C(r,\;\;V,\;\;t)$
satisfies the following PDE. (Note that this is a special case of the model
studied in Section 5 of [5].)

$\displaystyle\frac{\partial C}{\partial
t}+\displaystyle\frac{1}{2}\left(s_{r}^{2}\displaystyle\frac{\partial^{2}C}{\partial
r^{2}}+2\rho{\kern 1.0pt}s_{r}s_{V}V\displaystyle\frac{\partial^{2}C}{\partial
r\partial V}+s_{V}^{2}V^{2}\displaystyle\frac{\partial^{2}C}{\partial
V^{2}}\right)+\theta(\mu-r)\displaystyle\frac{\partial C}{\partial
r}+rV\displaystyle\frac{\partial C}{\partial V}-rC=0.$ (2.8)

Thus the PDE model for our bond is the terminal value problem given in domain
$\Sigma=$ $\\{(r,\;\;V,\;\;t):0<t<T,\;\;r>0,\;\;V>V_{b}(r,\;\;t)\\}$ and
consisting of (2.8) and the following terminal value condition and boundary
condition:

$C(r,\;\;V,\;\;T)=1$ (2.9)
$C(r,\;\;V_{b}(r,t),\;\;t)=R_{d}(V_{b}(r,t),\;\;r,\;\;t).$

This problem is terminal boundary value problem for a partial differential
equation with variable coefficients and two spatial variables and thus
generally does not have analytical pricing formula.

###  2.2 Analytic pricing formula and monotonicity with respect to firm value
variable

To obtain the solution representation, some additional assumptions are added

Assumption 7. $V_{b}(r,\;t)={\rm\;}BZ(r,\;t)(B$ is a constant and $s_{V}$ is a
constant, too. The default recovery is provided as follows (exogenous face
value recovery)

$R_{d}=R\cdot Z(r,\;\;t)(0\leq R<1)(exogenous\;face\;value\;recovery).$ (2.10)

Under these assumptions, the domain and boundary condition are modified as
follows:

$\Sigma=\\{(r,\;\;V,\;\;t):0<t<T,\;\;r>0,\;\;V>BZ(r,\;\;t)\\}$ $C(r,\;\;B\cdot
Z(r,\;\;t),\;\;t)=R\cdot Z(r,\;\;t)$ (2.11)

Now find the solution representation of the terminal boundary value problem
(2.8), (2.9), (2.11) in
$\Sigma=\\{(r,\;\;V,\;\;t):0<t<T,\;\;r>0,\;\;V>BZ(r,\;\;t)\\}$.

In the problem (2.8), (2.9), (2.11), using the transformation

$x=\displaystyle\frac{V}{Z},\;\;u(x,\;\;t)=\displaystyle\frac{C(r,\;\;V,\;\;t)}{Z}$
(2.12)

(here zero coupon bond price $Z$ is used as numeraire) and considering (2.2)
and $Z_{r}/Z=-\bar{B}(t,\;\;T)$, then we have the following problem

$\begin{array}[]{l}{u_{t}+\displaystyle\frac{1}{2}\sigma_{x}^{2}(t)x^{2}u_{xx}=0,\;\;(x>B,\quad
0<t<T)}\\\
{u(x,\;\;T)=1,\quad\quad\quad\quad\quad\quad\quad\quad\quad(x>B)}\\\
{u(B,\;\;t)=R,\quad\quad\quad\quad\quad\quad\quad\quad(0<t<T).}\end{array}$

Here $\sigma_{x}(t)$ is defined as follows:

$\sigma_{x}^{2}(t\;;\;T)=s_{r}^{2}\bar{B}^{2}(t,\;T)+s_{V}^{2}-2\rho{\kern
1.0pt}s_{r}\bar{B}(t,\;T)s_{V}\geq 0,\;\;0\leq t\leq T.$ (2.13)

Using the transformation

$u=R+(1-R)W,$ (2.14)

then we have the following problem for W.

$\begin{array}[]{l}{W_{t}+\displaystyle\frac{1}{2}\sigma_{x}^{2}(t)x^{2}W_{xx}=0,\;\;(x>B,\quad
0<t<T)}\\\ {W(x,\;\;T)=1,\quad\quad\quad\quad\quad\quad\quad(x>B)}\\\
{W(B,\;\;t)=0,\quad\quad\quad\quad\quad\quad\;\;(0<t<T).}\end{array}$ (2.15)

Returning to original variables by (2.12) and (2.14), then our bond price can
be represented by $W$ as follows:

$C(r,\;\;V,\;\;t)=[W(1-R)+R]Z=W(V/Z,\;\;t)Z+[1-W(V/Z,\;\;t)]RZ.$ (2.16)

Now we solve (2.15). Use the transformation

$s=\displaystyle\int_{0}^{t}\sigma_{x}^{2}(u,T)du,\;\;T^{*}=\displaystyle\int_{0}^{T}\sigma_{x}^{2}(u,\;T)du,\;\;W(x,\;\;t)=f(x,\;\;s).$

Then (2.15) is changed to the following [4].

$\begin{array}[]{l}{f_{s}+\displaystyle\frac{1}{2}x^{2}f_{xx}=0,\quad\quad(0<s<T^{*},\quad
x>B)}\\\ {f(B,\;\;s)=0,\quad\quad\quad\quad\quad\quad(0<s<T^{*})}\\\
{f(x,\;\;T^{*})=1.\quad\quad\quad\quad\quad\quad(x>B).}\end{array}$

This problem is a special case of the problem (6), (7), (8) studied in [9] and
the solution is given by

$f(x,s)=N(d_{1})-\displaystyle\frac{x}{B}N(d_{2}),$

and from Theorem 2 of [9], we have

$f_{x}(x,\;\;s)>0,\;\;0=f(B,\;\;s)<f(x,\;\;s)<f(+\infty,\;\;s)=1\;\;(x>B,\;\;s<T*).$

Here

$N(x)=\displaystyle\frac{1}{\sqrt{2\pi}}\displaystyle\int_{-\infty}^{x}e^{-t^{2}/2}dt,d_{1}=\displaystyle\frac{\ln\displaystyle\frac{x}{B}-\displaystyle\frac{1}{2}(T^{*}-s)}{\sqrt{T^{*}-s}},\;\;d_{2}=\displaystyle\frac{\ln\displaystyle\frac{B}{x}-\displaystyle\frac{1}{2}(T^{*}-s)}{\sqrt{T^{*}-s}}.$

Returning to original variables, the we have the following representation and
estimates for $W$.

$\begin{array}[]{l}{W(x,\;\;t)=N(d_{1})-\displaystyle\frac{x}{B}N(d_{2}),}\\\
{W_{x}(x,\;t)>0,\;\;0=W(B,\;t)<W(x,\;t)<W(+\infty,\;t)=1\;\;(x>B,\;0\leq
t<T)}\end{array}$ (2.17)
$\begin{array}[]{l}{d_{1}=d(x/B,\;\;t,\;\;T):=\displaystyle\frac{\ln\displaystyle\frac{x}{B}-\displaystyle\frac{1}{2}\displaystyle\int_{t}^{T}\sigma_{x}^{2}(u,\;\;T)du}{\sqrt{\displaystyle\int_{t}^{T}\sigma_{x}^{2}(u,\;\;T)du}}=\displaystyle\frac{\ln\displaystyle\frac{V}{BZ}-\displaystyle\frac{1}{2}\displaystyle\int_{t}^{T}\sigma_{x}^{2}(u,\;\;T)du}{\sqrt{\displaystyle\int_{t}^{T}\sigma_{x}^{2}(u,\;\;T)du}}:=a,}\\\
{d_{2}=d(B/x,\;\;t,\;\;T)=\displaystyle\frac{\ln\displaystyle\frac{B}{x}-\displaystyle\frac{1}{2}\displaystyle\int_{t}^{T}\sigma_{x}^{2}(u,\;\;T)du}{\sqrt{\displaystyle\int_{t}^{T}\sigma_{x}^{2}(u,\;\;T)du}}=\displaystyle\frac{\ln\displaystyle\frac{BZ}{V}-\displaystyle\frac{1}{2}\displaystyle\int_{t}^{T}\sigma_{x}^{2}(u,\;\;T)du}{\sqrt{\displaystyle\int_{t}^{T}\sigma_{x}^{2}(u,\;\;T)du}}:=\tilde{a}.}\end{array}$
(2.18)

Here zero coupon bond price $Z$ is given by (2.3).

Remark 1. From (2.16), the price of our bond at time $t$ can be seen as an
expectation of the current value of the bond in the case that we have no
default at or after time $t$ and the value of the bond in the case that
default event occurs at or after time $t$. So $W(V/Z,\;\;t)$ in (2.16) can be
regarded as the survival probability (probability of no default at or after
time $t$) in the case with default barrier $BZ(r,\;\;t)$ and (2.15) is the PDE
model for the survival probability at or after time $t$ in the case with
default barrier $BZ(r,\;\;t)$.

Consider $x=V/Z$ and substitute (2.17) into (2.16), then we have the following
theorem.

Theorem 1. Under the assumptions 1$\sim$7 the solution to the problem (2.8),
(2.9), (2.11) (the price function of zero coupon straight bond with default
boundary $BZ(r,\;\;t)$) is represented as follows:

$C(r,\;\;V,\;\;t)=[R+W(V/Z,\;\;t)(1-R)]\cdot Z(r,\;\;t).$ (2.19)

In particular,$C(r,\;V,\;t)/Z(r,\;t)$ is an strictly increasing function of
the variables $x=V/Z$and furthermore we have

$C_{V}(r,\;\;V,\;\;t)>0,\;\;R\cdot
Z(r,\;\;t)<C(r,\;\;V,\;\;t)<Z(r,\;\;t)\;\;(V>B\cdot Z(r,\;\;t),\;\;0\leq
t<T).$ (2.20)

Thus the bond price (2.19) is strictly increasing on $V(>BZ(r,\;\;t))$.

Remark 2. The financial meaning of (2.19) is clear: the first term is the
current price of the part to be given to bond holder regardless of default
event and the second term is the allowance dependent on default probability at
time $t$. If at some moment $t$, the default is certain ($W(V/Z,\;t)=0$) = 0),
then the price of the bond at $t$ is exactly the current price of default
recovery. And as shown in formula (2.19), if $R=0$, that is, if there is
nothing to recover in case of default, then the bond price is the product of
zero coupon bond and survival probability; and if $R=1$, that is, if there is
no any loss in case of default, then the bond price is the same with risk free
zero coupon bond.

Remark 3. Theorem 1 does not include Theorem 3 (for 1 factor model) of [9] due
to the peculiarity of default boundary (the assumption 7) but in the case with
$a=r$ and $q=0$ it includes Theorem 3 of [9].

##  3 Two Factor Structural Model for Option on Bond with Credit Risk and
Pricing Formulae

###  3.1 Puttable Bond with Credit Risk

Now we assume that the bond issuing company added to the bond defined by the
Assumptions 1$\mathrm{\sim}$6 a new provision that allows the bond holder to
demand early redemption at a predetermined date prior to the maturity.

Assumption 8. At a predetermined date , the bond holder can receive $K$(unit
of currency) and end the bond contract.

By this assumption, the bond holder has the credit bond defined by assumptions
1$\mathrm{\sim}$6 together with the right to sell this bond for the exercise
price $K$ at time $T_{1}$. Thus the Assumption 8 provides the bond holder the
bond (put) option with maturity $T_{1}$. This is a bond option on zero coupon
bond with credit risk. If the default event occurs, then the bond holder
receives the default recovery and the bond contract is ended, and thus the
bond option contract is also ended. Therefore this bond option contract is a
kind of barrier option contract and its price $P(r,\;\;V,\;\;t)$ is the
solution to the following problem in domain
$\Sigma_{1}=\\{(r,\;\;V,$$t):0<t<T_{1},\;\;r>0,\;\;V>V_{b}(r,\;\;t)\\}$

$\displaystyle\frac{\partial P}{\partial
t}+\displaystyle\frac{1}{2}\left(s_{r}^{2}\displaystyle\frac{\partial^{2}P}{\partial
r^{2}}+2\rho{\kern 1.0pt}s_{r}s_{V}V\displaystyle\frac{\partial^{2}P}{\partial
r\partial V}+s_{V}^{2}V^{2}\displaystyle\frac{\partial^{2}P}{\partial
V^{2}}\right)+\theta(\mu-r)\displaystyle\frac{\partial P}{\partial
r}+rV\displaystyle\frac{\partial P}{\partial V}-rP=0$ (3.1)
$P(r,\;\;V_{b}(r,\;\;t),\;\;t)=0,\;\;\;\;\;\;\;\;\;\;\;\;0\leq t<T_{1}$
$P(r,\;\;V,\;T_{1})=(K-C(t,\;\;V,\;T_{1}))^{+},\;\;V>V_{b}(T_{1})$

This problem is a boundary value problem of parabolic equation with 2 spatial
variables and moving boundary and thus generally, it does not have solution
representation.

In order to obtain its solution representation, we add the assumption 7 in
Section 2 and the following assumption.

Assumption 9. $K=E\cdot Z(r,\;T_{1})\;(E$: constant)

Then the domain of the problem is
$\Sigma_{1}=\\{(r,\;\;V,\;\;t):0<t<T_{1},\;\;r>0,\;\;V>BZ(r,\;\;t)\\}$ and the
boundary conditions are changed as follows:

$P(r,\;\;BZ(r,\;\;t),\;\;t)=0,\;\;\;\;\;\;\;\;\;\;\;\;0\leq t<T_{1}$ (3.2)
$P(r,\;\;V,\;\;T_{1})=(EZ(r,\;\;T_{1})-C(r,\;\;V,\;T_{1}))^{+},\;\;V>BZ(r,\;\;T_{1}).$

Here$R<C(r,\;V,\;T_{1})/Z(r,\;T_{1})<1$ from (2.19) and (2.17) and from
Theorem 1,

$C(r,\;V,\;T_{1})/Z(r,\;T_{1})=R+W(V/Z,\;\;t)(1-R)$

is a strict increasing function with respect to $V/Z$. Thus if$R<E<1$, then
there exists a constant $L>B$ such that $R+W(L,\;\;t)(1-R)=E$ and

$C(r,\;\;V,\;T_{1})<E\cdot Z(r,\;T_{1})$ for $V<L\cdot Z(r,\;T_{1})$,

$C(r,\;\;V,\;T_{1})\geq E\cdot Z(r,\;T_{1})$ for $V\geq L\cdot Z(r,\;T_{1})$.

Thus the terminal condition of the bond option is written as follows:

$P(r,\;\;V,\;\;T_{1})=[EZ(r,\;\;T_{1})-C(r,\;\;V,\;T_{1})]\cdot 1\\{V<L\cdot
Z(r,\;\;T_{1})\\},\;\;V>BZ(r,\;\;T_{1}).$

($L\cdot Z(r,\;T_{1})$ is called the early redemption boundary at time
$T_{1}$.) Therefore considering (2.16), then we have

$P(r,\;\;V,\;\;T_{1})=Z(r,\;\;T_{1})\left\\{E-R-W(\displaystyle\frac{V}{Z},\;\;t)(1-R)]\right\\}\cdot
1\left\\{\displaystyle\frac{V}{Z(r,\;\;T_{1})}<L\right\\},\;\;\displaystyle\frac{V}{Z(r,\;\;T_{1})}>B.$
(3.3)

Now we find the solution representation of the problem (3.1), (3.2), (3.3).
Use the transformation $x=V/Z,\;\;p(x,\;\;t)=P(r,\;\;V,\;\;t)/Z$, then we have

$p_{t}+\displaystyle\frac{1}{2}\sigma_{x}^{2}(t)x^{2}p_{xx}=0,\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\quad(x>B,\;\;0<t<T_{1})$
(3.4)
$p(B,\;\;t)=0,\quad\quad\quad\quad\quad\quad\quad\qquad\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\quad(0<t<T_{1})$
(3.5) $p(x,\;\;T_{1})=[E-R-(1-R)W(x,\;\;T_{1})]\cdot
1\\{x<L\\},\;\;\;\;(x>B).$

Consider (2.17), then we have

$p(x,\;T_{1})=\left\\{E-R-(1-R)\left[N(\bar{d}_{1})-\left(\displaystyle\frac{x}{B}\right)N(\bar{d}_{2})\right]\right\\}\cdot
1\\{x<L\\},\;\;(x>B).$ (3.6)

Here

$\bar{d}_{1}=d(x/B,T_{1},T)=\left(\sqrt{\displaystyle\int_{T_{1}}^{T}\sigma_{x}^{2}(u,T)du}\right)^{-1}\left(\ln\displaystyle\frac{x}{B}-\displaystyle\frac{1}{2}\displaystyle\int_{T_{1}}^{T}\sigma_{x}^{2}(u,T)du\right),\bar{d}_{2}=d(B/x,T_{1},T).$
(3.7)

As in Section 2, use the transformation

$s=\displaystyle\int_{0}^{t}\sigma_{x}^{2}(u,T)du,\;\;p(x,\;\;t)=f(x,\;\;s),\;\;T_{1}^{*}=\displaystyle\int_{0}^{T_{1}}\sigma_{x}^{2}(u,\;T)du,$

then we have

$f_{s}+\displaystyle\frac{1}{2}x^{2}f_{xx}=0,\;\;0<s<T_{1}^{*},\;\;x>B$ (3.8)
$\begin{array}[]{l}{f(x,\;\;T_{1}^{*})=[E-R]\cdot
1\\{B<x<L\\}-(1-R)N(\bar{d}_{1})\cdot 1\\{B<x<L\\}}\\\
{\;\;\;\;\;\;\;\;\;\;\;\;\;\;+(1-R)\left(\displaystyle\frac{x}{B}\right)N(\bar{d}_{2})\cdot
1\\{B<x<L\\},\;\;\;\;x>B}\end{array}$ (3.9) $f(B,\;\;s)=0,\;\;0<s<T_{1}^{*}.$
(3.10)

Here

$\begin{array}[]{l}{\bar{d}_{1}(x\;;\;\;T_{1}^{*},\;\;T^{*})=\displaystyle\frac{\ln\displaystyle\frac{x}{B}-\displaystyle\frac{1}{2}(T^{*}-T_{1}^{*})}{\sqrt{T^{*}-T_{1}^{*}}}(=d(x/B\;;\;T_{1},\;\;T))\;,}\\\
{\bar{d}_{2}(x\;;\;\;T_{1}^{*},\;\;T^{*})=\displaystyle\frac{\ln\displaystyle\frac{B}{x}-\displaystyle\frac{1}{2}(T^{*}-T_{1}^{*})}{\sqrt{T^{*}-T_{1}^{*}}}(=d(B/x\;;\;T_{1},\;\;T))\;.}\end{array}$

The problem (3.8)$\mathrm{\sim}$(3.10) is a special case of the problem
(19)$\mathrm{\sim}$(21) of [9](with $r=q=a=0,\;\;\sigma=1,\;\;K=L$,
$T_{1}=T_{1}^{*},\;\;T=T^{*}$) and thus from Theorem 4 of [9], the solution to
the problem (3.8)$\mathrm{\sim}$(3.10) is represented as follows:

$\begin{array}[]{l}{f(x,\;\;s)=(E-R)\\{N(b_{1}(x))-N(b_{2}(x))-(x/B)[N(\tilde{b}_{1}(x))-N(\tilde{b}_{2}(x))\\}}\\\
{\;\;\;\;\;\;\;\;\;\;-(1-R)\\{N_{2}(a(x),\;\;b_{1}(x);\;\;\delta)-N_{2}(a(x),\;\;b_{2}(x);\;\;\delta)-}\\\
{\;\;\;\;\;\;\;\;\;\;-(x/B)[N_{2}(\tilde{a}(x),\;\;\tilde{b}_{1}(x);\;\;\delta)-N_{2}(\tilde{a}(x),\;\;\tilde{b}_{2}(x);\;\;\delta)]\\}}\\\
{\;\;\;\;\;\;\;\;\;\;+(1-R)\\{(x/B)[N_{2}(\tilde{a}(x),\;\;-\tilde{b}_{1}(x);\;\;-\delta)-N_{2}(\tilde{a}(x),\;\;-b_{3}(x);\;\;-\delta)]-}\\\
{\;\;\;\;\;\;\;\;\;\;\;\;\;\;-[N_{2}(a(x),\;\;-b_{1}(x);\;\;-\delta)-N_{2}(a(x),\;\;-b_{3}(x);\;\;-\delta)]\\},\;\;x>B,\;\;s<T_{1}^{*}.}\end{array}$

Here

$b_{1}(x)=\displaystyle\frac{\ln\displaystyle\frac{x}{B}-\displaystyle\frac{1}{2}(T_{1}^{*}-s)}{\sqrt{T_{1}^{*}-s}}=d(x/B,\;\;t,\;\;T_{1}),\;\;\;\;b_{2}(x)=\displaystyle\frac{\ln\displaystyle\frac{x}{L}-\displaystyle\frac{1}{2}(T_{1}^{*}-s)}{\sqrt{T_{1}^{*}-s}}=d(x/L,\;\;t,\;\;T_{1}),$
$\tilde{b}_{1}(x)=b_{1}(B^{2}/x)=d(B/x,\;\;t,\;\;T_{1}),\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\tilde{b}_{2}(x)=b_{2}(B^{2}/x)=d(B^{2}/Lx,\;\;t,\;\;T_{1}),$
$a(x)=\bar{d}_{1}(x\;;\;\;s,\;\;T^{*})=d(x/B,\;\;t,\;\;T)\;,\;\;\;\;\;\;\;\;\;\;\;\tilde{a}(x)=\bar{d}_{2}(x\;;\;\;s,\;\;T^{*})=d(B/x,\;\;t,\;\;T)\;,$
$\tilde{b}_{3}(x)=-\displaystyle\frac{\ln\displaystyle\frac{x}{L}+\displaystyle\frac{1}{2}(T_{1}^{*}-s)}{\sqrt{T_{1}^{*}-s}}=d(L/x,\;\;t,\;\;T_{1}),\;\;b_{3}(x)=\tilde{b}_{3}(B^{2}/x)=d(Lx/B^{2},\;\;t,\;\;T_{1}),$
$\delta(s)=\sqrt{(T_{1}^{*}-s)/(T^{*}-s)}=\sqrt{{\displaystyle\int_{t}^{T_{1}}\sigma_{x}^{2}(u,\;T)du\mathord{\left/{\vphantom{\displaystyle\int_{t}^{T_{1}}\sigma_{x}^{2}(u,\;T)du\displaystyle\int_{t}^{T}\sigma_{x}^{2}(u,\;T)du}}\right.\kern-1.2pt}\displaystyle\int_{t}^{T}\sigma_{x}^{2}(u,\;T)du}}=\bar{\delta}(t).$
(3.11)

Returning to the original variables, we have the following solution
representation of the problem (3.1), (3.2), (3.3) in the domain
$\Sigma_{1}=\\{(r,\;\;V,\;\;t):0<t<T_{1},\;\;r>0,\;\;V>BZ(r,\;\;t)\\}$:

$P(r,\;\;V,\;t)=p(V/Z,\;\;t)\cdot Z(r,\;\;t)=$
$\begin{array}[]{l}{=Z(r,\;\;t)(E-R)\left\\{N(b_{1})-N(b_{2})-\displaystyle\frac{V}{BZ}[N(\tilde{b}_{1})-N(\tilde{b}_{2})\right\\}}\\\
{\;\;-Z(r,\;\;t)(1-R)\left\\{N_{2}(a,\;\;b_{1};\;\;\bar{\delta})-N_{2}(a,\;\;b_{2};\;\;\bar{\delta})-\displaystyle\frac{V}{BZ}[N_{2}(\tilde{a},\;\;\tilde{b}_{1};\;\;\bar{\delta})\right.}\\\
{\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;-N_{2}(\tilde{a},\;\;\tilde{b}_{2};\;\;\bar{\delta})]+N_{2}(a,\;\;-b_{1};\;\;-\bar{\delta})-N_{2}(a,\;\;-b_{3};\;\;-\bar{\delta})}\\\
{\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\left.-\displaystyle\frac{V}{BZ}[N_{2}(\tilde{a},\;\;-\tilde{b}_{1};\;\;-\bar{\delta})-N_{2}(\tilde{a},\;\;-\tilde{b}_{3};\;\;-\bar{\delta})]\right\\}.}\end{array}$
$\begin{array}[]{l}{=Z(r,\;\;t)\cdot\\{(E-R)[N(b_{1})-N(b_{2})]-(1-R)[N_{2}(a,\;\;b_{1};\;\;\bar{\delta})-N_{2}(a,\;\;b_{2};\;\;\bar{\delta})}\\\
{\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;+N_{2}(a,\;\;-b_{1};\;\;-\bar{\delta})-N_{2}(a,\;\;-b_{3};\;\;-\bar{\delta})]\\}}\\\
{\;\;+\displaystyle\frac{V}{B}\\{-(E-R)[N(\tilde{b}_{1})-N(\tilde{b}_{2})+(1-R)[N_{2}(\tilde{a},\;\;\tilde{b}_{1};\;\;\bar{\delta})-N_{2}(\tilde{a},\;\;\tilde{b}_{2};\;\;\bar{\delta})}\\\
{\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;+N_{2}(\tilde{a},\;\;-\tilde{b}_{1};\;\;-\bar{\delta})-N_{2}(\tilde{a},\;\;-\tilde{b}_{3};\;\;-\bar{\delta})]\\}}\end{array}$
(3.12)

Here

$\begin{array}[]{l}{d(x,\;\;t,\;\;T):=\left(\sqrt{\displaystyle\int_{t}^{T}\sigma_{x}^{2}(u,\;\;T)du}\right)^{-1}\left[\ln
x-\displaystyle\frac{1}{2}\displaystyle\int_{t}^{T}\sigma_{x}^{2}(u,\;\;T)du\right]\;,}\\\
{a=d(V/(BZ),\;\;t,\;\;T)\;,\;\;\;\;\;\;\;\;\;\tilde{a}=d(BZ/V,\;\;t,\;\;T)\;,}\\\
{b_{1}=d(V/(BZ),\;\;t,\;\;T_{1})\;,\;\;\;\;\;\;\;b_{2}=d(V/(LZ),\;\;t,\;\;T_{1}),}\\\
{\tilde{b}_{1}=d(BZ/V,\;\;t,\;\;T_{1}),\;\;\;\;\;\;\;\;\;\tilde{b}_{2}=d(B^{2}Z/(LV),\;\;t,\;\;T_{1})\;,}\\\
{b_{3}=d(LV/(B^{2}Z),\;\;t,\;\;T_{1}),\;\;\;\tilde{b}_{3}=d(LZ/V,\;\;t,\;\;T_{1})\;.}\end{array}$
(3.13)

Therefore we have proved the following theorem.

Theorem 2. Under the assumptions 1$\mathrm{\sim}$9, if $R<E<1$, then the price
for bond put option (the solution to the problem (3.1), (3.2), (3.3) is given
by (3.12).

Remark 4. Assumption 8 gives the holder of the bond with expiry date $T$ the
right to be able to demand early repayment of debts at the date $T_{1}$ prior
to the expiry date (the early redemption recovery is$E\cdot Z(r,\;\;T_{1})$).
(3.12) is just the early redemption premium which the holder should pay more
due to this early redemption provision. Thus the price of the puttable bond
(the bond with early redemption provision) in the time interval
$[0,\;\;T_{1}]$ is the sum of $B$ given by (2.19) and $P$ given by (3.13), and
the price in the time interval $(T_{1},\;\;T]$ is equal to $B$.

Remark 5. Theorem 2 does not include Theorem 4 (for 1 factor model) of [9] due
to the peculiarity of default boundary and early redemption recovery(the
assumption 7 and 9) but in the case with $a=r,\;\;q=0$ and
$E:=Ee^{-r(T-T_{1})}$, it includes Theorem 4 of [9].

###  3.2 Callable Bond with Credit Risk

Now, we assume that the bond issuing company added to the bond defined by the
Assumptions 1$\mathrm{\sim}$6 a new provision that allows the company to pay
back the debt early at a predetermined date prior to the maturity.

Assumption 10: At a predetermined date , the bond issuing company can give
$K$(unit of currency) and call back the bond.

By this provision, the bond issuing company has the right to purchase this
bond defined by the Assumptions 1$\mathrm{\sim}$6 for the exercise price $K$
at time $T_{1}$. Thus the Assumption 10 provides the company the bond (call)
option with maturity $T_{1}$. This is a bond option on zero coupon bond with
credit risk. If the default event occurs, then the bond holder receives the
default recovery and the bond contract is ended, and thus the bond option
contract is ended, too. Therefore this bond option contract is a kind of
barrier option contract and its price function $P=P(r,\;\;V,\;\;t)(0\leq t\leq
T_{1})$ satisfies (3.1) in the domain
$\Sigma_{1}=\\{(r,\;V,$$t):0<t<T_{1},\;r>0,\;V>V_{b}(r,\;t)\\}$ and boundary
conditions similar to those in the model for puttable bond. This problem is a
boundary value problem of parabolic equation with 2 spatial variables and
moving boundary and thus generally, it does not have solution representation.
In order to obtain its solution representation, we add the assumption 7 in
Section 2 and the assumption 9 in the above. Then $P=P(r,\;\;V,\;\;t)$ $(0\leq
t\leq T_{1})$ satisfies (3.1) and (3.2) in
$\Sigma_{1}=\\{(r,\;\;V,\;\;t):0<t<T_{1},\;\;r>0,\;\;V>BZ(r,\;\;t)\\}$ and the
following terminal condition:

$P(r,\;\;V,\;\;T_{1})=(C(r,\;V,\;T_{1})-EZ(r,\;T_{1}))^{+},\;\;V>BZ(r,\;\;T_{1}).$

Here $C(r,\;V,\;T_{1})$ is provided by (2.19). Thus as in the precious
subsection, if $R<E<1$, then there exists a constant $L>B$ such that the
terminal condition of this bond option is written as follows:

$P(r,\;\;V,\;\;T_{1})=[C(r,\;\;V,\;T_{1})-EZ(r,\;\;T_{1})]\cdot 1\\{V>L\cdot
Z(r,\;\;T_{1})\\},\;\;V>BZ(r,\;\;T_{1}).$

Therefore from (2.19) and (2.17), we can rewrite as follows:

$\begin{array}[]{l}{P(r,\;\;V,\;\;T_{1})=[R+W(\displaystyle\frac{V}{Z(r,T_{1})},\;T_{1})(1-R)-E]\cdot
Z(r,\;T_{1})\cdot
1\\{\displaystyle\frac{V}{Z(r,\;T_{1})}>L\\},\;\;\displaystyle\frac{V}{Z(r,\;T_{1})}>B}\\\
{\;\;\;\;\;\;\;\;\;\;\;\;\;\;\;=Z(r,\;T_{1})\cdot\left\\{R-E+(1-R)\left[N(d_{1})-\displaystyle\frac{V}{BZ(r,\;T_{1})}N(d_{2})\right]\right\\}\cdot
1\\{\displaystyle\frac{V}{Z(r,\;T_{1})}>L\\}.}\end{array}$ (3.14)

Using the similar method in Theorem 2 we have the following theorem.

Theorem 3. Under the assumptions 1$\mathrm{\sim}$7 and 9$\mathrm{\sim}$10, if
$R<E<1$, then the price function for bond call option (the solution to the
problem (3.1), (3.2), (3.14)) is provided as follows:

$\begin{array}[]{l}{P(r,\;\;V,\;t)=Z(r,\;t)\left\\{(R-E)\left[N(b_{2})-\displaystyle\frac{V}{BZ}N(\tilde{b}_{2})\right]\right.+}\\\
{\;\;\;\;\;\;\;\;+(1-R)\left.\left[N_{2}(a,\;\;b_{2};\;\bar{\delta})-\displaystyle\frac{V}{BZ}N_{2}(\tilde{a},\;\;\tilde{b}_{2};\;\bar{\delta})+N_{2}(a,\;\;-b_{3};\;-\bar{\delta})-\displaystyle\frac{V}{BZ}N_{2}(\tilde{a},\;\;-\tilde{b}_{3};\;-\bar{\delta})\right]\right\\}}\end{array}$
$\begin{array}[]{l}{=Z(r,\;t)\\{(R-E)N(b_{2})+\;(1-R)[N_{2}(a,\;\;b_{2};\;\bar{\delta})+N_{2}(a,\;\;-b_{3};\;-\bar{\delta})]\\}+}\\\
{\;\;\;-\displaystyle\frac{V}{B}\\{(R-E)N(\tilde{b}_{2})\\}+(1-R)[N_{2}(\tilde{a},\;\;\tilde{b}_{2};\;\bar{\delta})+N_{2}(\tilde{a},\;\;-\tilde{b}_{3};\;-\bar{\delta})]\\}.}\end{array}$
(3.15)

Remark 6. Assumption 10 gives the bond issuing company the right to be able to
pay$K$(unit of currency) and call back the bond with expiry date $T$ and puts
the bond holder under an obligation. (3.15) is just the early redemption
premium which the bond issuing company should pay the bond holder due to this
early redemption provision. Thus the price of the callable bond (the bond with
early redemption provision) in the time interval $[0,\;\;T_{1}]$ is the
difference of $P$ given by (3.13) from $B$ given by (2.19), and the price in
the time interval $(T_{1},\;\;T]$ is equal to $B$.

Remark 7. Theorem 3 does not include Theorem 5 (for 1 factor model) of [9] due
to the peculiarity of default boundary and early redemption recovery(the
assumption 7 and 9) but in the case with $a=r,\;\;q=0$ and
$E:=Ee^{-r(T-T_{1})}$, it includes Theorem 5 of [9].

## References

  * [1] R.A.Brealey, S.C. Myers, Principles of Corporate Finace, 6th edition, McGraw Hill Companies, Inc., 2003, 717-720.
  * [2] A. Falco, Ll. Navarro, C. V?zquez, A direct LU Solver for Pricing American Bond Options under Hull-White model, to appear in Journal of Computational and Applied Mathematics (2016), http://dx.doi.org/10.1016/j.cam.2016.05.003
  * [3] J.C. Hull, Options, Futures and other Derivatives, 6th edtion, Pearson Prentice Hall, 2006, 614-619, 651-652.
  * [4] Li-shang Jiang, Mathematical Models and Methods of Option Pricing, World Scientific, 2005, 82-85.
  * [5] H.C. O, N. Wan, Analytical Pricing of Defaultable Bond with Stochastic Default Intensity, arxiv:1303.1298v3[q-fin.PR], (2013), 1-35.
  * [6] H.C. O, J.J. Jo, S.Y. Kim, , S.G. Jon.; A comprehensive unified model of structural and reduced form type for defaultable fixed income bonds, Bulletin of the Iranian Mathematical Society , 43, 3 (2017) 575-599.
  * [7] H.C. O, D.H. Kim, C.H.Pak, Analytical pricing of defaultable discrete coupon bonds in unified two-factor model of structural and reduced form models, J. Math. Anal. Appl. 416 (2014) 314–334
  * [8] H.C. O, T.S. Kim, Analysis on the Pricing model for a Discrete Coupon Bond with Early redemption provision by the Structural Approach, arXiv:2007.01511v1 [q-fin.PR] 3 Jul (2020), 1-30.
  * [9] H.C. O,, T.S. Kim, T.S. Choe, Solution Representations of Solving Problems for the Black-Scholes equations and Application to the Pricing Options on Bond with Credit Risk, arXiv2109.10818v2 [q-fin.PR] 17 Aug 2021, 1-12.
  * [10] V. Russo, F.J. Fabozzi, Pricing coupon bond options and swaptions under the one- factor Hull-White model. J Fixed Income, 25 (2016) 76–82
  * [11] V. Russo, F.J. Fabozzi, Pricing coupon bond options and swaptions under the two- factor Hull–White model. J Fixed Income 27 (2017) 30–36
  * [12] K. Zhang, J. Liu, Erkang Wang, Jin Wang, Quantifying risks with exact analytical solutions of derivative pricing distribution, Physica A, 471 (2017), 757–766.
  * [13] K. Zhang, S. Wang, Pricing American bond options using a penalty method, Automatica, 48 (2012), 472–479.
  * [14] H. J. Zhou, K. F. C. Yiu, L. K. Li, Evaluating American put options on zero - coupon bonds by a penalty method, Journal of Computational and Applied Mathematics, 235 (2011), 3921–3931.