Search

In the railway domain, rolling stock maintenance affects service operation time and efficiency. Minimizing train unavailability is essential for reducing capital loss and operational costs. To this aim, prediction of failures of rolling stock equipment is crucial to proactively trigger proper maintenance activities. Indeed, predictive maintenance is a golden example of the digital transformation within Industry 4.0, which affects several engineering processes in the railway domain. Nowadays, it may leverage artificial intelligence and machine learning algorithms to forecast failures and schedule the optimal time for maintenance actions. Generally, rail systems deteriorate gradually over time or fail directly, leading to data that vary extremely slowly. Indeed, ML approaches for predictive maintenance should consider this type of data to accurately predict and forecast failures. This paper proposes a methodology based on Long Short-Term Memory deep learning algorithms for predictive maintenance of railway rolling stock equipment. The methodology allows us to properly learn long-term dependencies for gradually changing data, and both predicting and forecasting failures of rail equipment. In the framework of an academic-industrial partnership, the methodology is experimented on a train traction converter cooling system, demonstrating its applicability and benefits. The results show that it outperforms state-of-the-art methods, reaching a failure prediction and forecasting accuracy over 99%, with a false alarm rate of ∼ 0.4% and a mean absolute error in the order of 10−4, respectively.

Orchestration systems are becoming a key component to automatically manage distributed computing resources in many fields with criticality requirements like Industry 4.0 (I4.0). However, they are mainly linked to OS-level virtualization, which is known to suffer from reduced isolation. In this paper, we propose RunPHI with the aim of integrating partitioning hypervisors, as a solution for assuring strong isolation, with OS-level orchestration systems. The purpose is to enable container orchestration in mixed-criticality systems with isolation requirements through partitioned containers., 2 pages, accepted for publication in Proc. ISSREW, 2022

Time predictable edge cloud is seen as the answer for many arising needs in Industry 4.0 environments, since it is able to provide flexible, modular, and reconfigurable services with low latency and reduced costs. Orchestration systems are becoming the core component of clouds since they take decisions on the placement and lifecycle of software components. Current solutions start introducing real-time containers support for time predictability; however, these approaches lack of determinism as well as support for workloads requiring multiple levels of assurance/criticality. In this paper, we present k4.0s, an orchestration model for real-time and mixed-criticality environments, which includes timeliness, criticality and network requirements. The model leverages new abstractions for both node and jobs, e.g., node assurance, and requires novel monitoring strategies. We sketch an implementation of the proposal based on Kubernetes, and present an experimentation motivating the need for node assurance levels and adequate monitoring., This paper is an extended version of the paper published at "2022 IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf on Cloud and Big Data Computing, Intl Conf on Cyber Science and Technology Congress"

Real-time containers can be seen as the convergence of hard real-time operating systems and container-based virtualization technologies that can be used to build mixed-criticality cloud systems. In this paper we investigate the implementation of this concept based on earliest deadline first and server-based scheduling on a Linux kernel with the RTAI real-time patch. With respect to earlier proposals, our solution allows more flexibility with simplified admission checks and better utilization of CPU resources. We compare the solution with the SCHED DEADLINE scheduling class, already available in the Linux kernel, and we show, with experiments on real hardware, that the proposal allows to prevent timing failures to tasks running within real-time containers, despite the presence of disturbances.

Emerging Multiprocessor System-on-Chip (MPSoC) platforms, featuring asymmetric multi-processing (AMP), are becoming the underlying tool to develop real-time embedded mixed-criticality systems. These type of systems are key enablers for the emerging Industry 4.0 and Industrial Internet of Things revolution. Virtualization technologies can even more boost the opportunities brought by MPSoCs, providing unique isolation and flexibility features in next generation embedded devices. However, the management of hardware accelerators, such as realtime processing units (RPUs) available on today's MPSoCs, is still an open challenge. In this paper, we propose a virtualization-based architectural solution to RPU sharing in modern MPSoCs. The aim is to isolate the execution on RPUs of many tasks offloaded by several different VMs running on traditional application processors on the same chip. The practical implications of such architecture are discussed in the context of a case study regarding the real-time plasma vertical stabilization control in the ITER11ITER is a Nuclear Facility INB-174. The views and opinions expressed herein do not necessarily reflect those of the ITER Organization.experimental fusion power plant.

The industrial Internet of Things (IIoT) is currently foreseen as a foundation to implement the Industry 4.0 vision. However, device heterogeneity and the need of integration and configuration exposes the industrial infrastructure to potential threats, such as black-hole, man-in-the-middle, and malicious configuration attacks. In this article, we investigate how to manage distributed trust information and to enable trusted configuration actions in the IIoT, by opportunistically intermingling blockchain with the software defined networking and container orchestration technologies. In particular, we focus on how the joint and coordinated adoption of such technologies can make technicians’ interventions on industrial equipment both easier and more trusted. To this purpose, we present the design of a software architecture to simplify the management, configuration, and assessment of IIoT systems, and we discuss our experiences with the application of the proposed architecture in a railways use case.

Internet of Vehicles (IoV) requires trust management to implement effective authentication and authorization of nodes, as it is not possible to establish trusted connections to the roadside components that eventually a vehicle will meet during its journey, ahead of time. To cope with this issue, dynamic access control is required, where authorizations are granted considering security policies and the node trustworthiness. However, decentralized trust management is a preferable solution, but it implies a considerable consumption of energy. Consumption is further exacerbated by the means needed to protect from attacks the trust management entities themselves. This work proposes suitable trust management for the IoT and IoV by exploiting the eventual consistency and security guarantees of blockchain. The design of a solution based on such technology is described, and an empirical assessment of its protection degree is provided.

Critical industrial systems have become profitable targets for cyber-attackers. Practitioners and administrators rely on a variety of data sources to develop security situation awareness at runtime. In spite of the advances in security information and event management products and services for handling heterogeneous data sources, analysis of proprietary logs generated by industrial systems keeps posing many challenges due to the lack of standard practices, formats, and threat models. This article addresses log analysis to detect anomalies, such as failures and misuse, in a critical industrial system. We conduct our study with a real-life system by a top leading industry provider in the air traffic control domain. The system emits massive volumes of highly-unstructured proprietary textual logs at runtime. We propose to extract quantitative metrics from logs and to detect anomalies by means of game theoretic feature selection and evidence combination. Experiments indicate that the proposed approach achieves high precision and recall at small tuning efforts.

Computer applications, such as servers, databases and middleware, ubiquitously emit execution traces stored in log files. The use of logs for the analysis of application failures is known since the early days of computers. Field data studies have shown that application logs are fraught with uncertainty, i.e., missing or noisy events in the logs. A body of research that has dealt successfully with uncertainty in event logs is process mining from the business process management community, specifically by discovering process models. The literature has shown the value of process mining across several domains, but as yet there is no study that quantifies possible improvements from using process models, and the impact of uncertainty in the context of application failures. This work addresses the use of process mining for detecting failures from application logs. First, process models are discovered from logs; then conformance checking is used to detect deviations from the models. We contribute to knowledge engineering research with a systematic measurement study that quantifies the failure detection capability of conformance checking in spite of missing events, and its accuracy with respect to process models obtained from noisy logs. Analysis is done with a dataset of 55,462 execution traces from three independent real-life applications. We obtain a mixed answer depending on the application under test; our measurements provide insights into the use of process mining for failure analysis.

Critical computer systems strongly rely on event logs to record the occurrence of normative and anomalous events occurring at runtime. In spite of the advances in Security Information and Event Management for handling monitoring data in production, event logs remain quite underutilized with respect to more conventional security data sources. Eliciting actionable knowledge for situational awareness poses many challenges in the case of logs emitted by industrial systems due to the lack of standard practices, formats and threat models. This paper addresses log analysis in a critical industrial system. We conduct our study with a real-life system by a top leading company in the Air Traffic Control domain, which emits massive volumes of unstructured proprietary logs. We propose a filtering method that pinpoints interesting events from logs, i.e., events that should be followed up by analysts. Experiments are done with logs from normative and misuse scenarios; moreover, we compare the outcome of our method with a reference filtering technique based on the conceptual clustering. Results indicate that the proposed method is effective to retain interesting events at remarkable precision and recall and to pinpoint misuse indicators. We overcome several drawbacks of existing filtering techniques, such as the need for labeled logs and domain knowledge, which makes our method easier to use by practitioners.

The plasma control system (PCS) in a tokamak device is in charge of controlling the evolution of plasma parameters according to prescribed models against uncertainties and disturbances. The PCS accomplishes its mission by receiving data from the diagnostics and by computing in real-time the commands to the actuators that affect the plasma behavior. The design of the ITER PCS includes many different aspects, which are not limited to the design of control algorithms, including the definition of the verification and validation tests for various components and commissioning procedures. Moreover, contributions come from different parties that adopt heterogeneous sources. To homogenize these contributions and to keep track of the PCS life-cycle throughout various design stages, a specific system-engineering approach has been adopted on top of the standard ITER life-cycle and the requirement management process. Such an approach relies on a database (DB) implemented using Enterprise Architect that allows modeling various aspects of the PCS design using SysML. This article gives an overview of the adopted approach and describes the structure and the current content of the PCS DB.

The ITER Plasma Control System (PCS) is an essential component for ITER operations. It will include multiple controls loops as well as a number of support functions dedicated to providing input control parameters and distributing commands to actuators. In addition, a supervisory system within the PCS architecture will manage the orchestration of the PCS control loops during the discharge as well as an Exception handling system to react to real-time changes in the plasma and/or in the plant systems. To investigate and develop controllers and supervisory techniques, a simulation platform is being developed to support the staged evolution of the PCS. The PCS Simulation Platform (PCSSP), based on Matlab/Simulink, is used to design and assess PCS control functions and verify the consistency of the PCS architecture. Moreover, the PCSSP will assist in implementing PCS algorithms, directly deploying PCS code on the ITER Real Time Framework (RTF). This paper will present the overall work-flow processes from control simulations, control assessment, code generation, interfaces and deployment into the RTF and PCS commissioning. This will include interface management and co-ordination with ITER investment protection, the pulse scheduling system, and the plant system configuration during operations. How the entire preparation process will be managed, for ITER first plasma operations will be reported here.

On-line timing error detection entails gathering and analyzing monitoring data to pinpoint deviations from the expected timing behavior of a given software system. Current solutions for system monitoring and runtime analysis present several practical drawbacks that limit their usability in real industrial systems, such as the need of kernel-level probes or the coarse per-node/per-process monitoring granularity. This paper proposes a novel framework for timing error detection that capitalizes on the systematic interleaving of logging instructions across the functional code in order to overcome above limitations. The paper faces the practical challenges related to the specification and implementation of a log weaving technique, detection algorithms, and a data centralization platform to collect and analyze fine-grained execution traces in distributed systems. We experiment the proposed framework in two real-world critical information systems from the Crisis Management and the Air Traffic Control domains. Results show that our framework achieves 95% timing error coverage and allows reconstructing error trends with high statistical confidence at negligible performance overhead.

Over the past decades logs have been widely used for detecting and analyzing failures of computer applications. Nevertheless, it is widely accepted by the scientific community that failures might go undetected in the logs. This paper proposes a measurement study with a dataset of 3,794 log traces obtained from normative and failure runs of the Apache web server. We use process mining (i) to infer a model of the normative log behavior, e.g., presence and ordering of messages in the traces, and (ii) to detect failures within arbitrary traces by looking for deviations from the model (conformance checking). Analysis is done with the Integer Linear Programming (ILP) Miner, Inductive Miner and Alpha++ Miner algorithms. Our measurements indicate that, although only around 18% failure traces contain explicit error keywords and phrases, conformance checking allows detecting up to 87% failures at high precision, which means that most of the errors are hidden across the traces.

In a complex project as the ITER one, it is essential to rely on a system-engineering oriented approach for requirements management, to both track the development of the various systems and to assess their compliance with the requirements set expressed at each operational phase. Such an approach is currently adopted for the ITER Plasma Control System (PCS), where a database implemented using the Enterprise Architect tool has been setup to act as the central collaboration tool for all the PCS system design. This paper describes the current structure of the PCS DB, and presents examples on the interfacing of the PCS and diagnostics, relevant for first plasma operations.

Wireless sensor networks demands proper means in order to obtain an accurate location of their nodes for a twofold reason: on the one hand, the exchanged data must be spatially meaningful since their content may be unusual if the location of where they have been produced is not associated to them, on the other hand, such networks need efficient routing algorithms where optimal routing decisions must be based on location information. Accuracy is not the only demands for positioning of sensors, but also simplicity and infrastructure independence in order to avoid excessive energy consumption and deployment costs. For these reasons, GPS is not used but the RF technologies are mainly preferred. Based on those technologies, most of the solutions tailored for sensors are designed so as to determine a location based on simple measurements of the signal intensity of the received messages. Despite being able to satisfy the peculiar requirements for localization in sensor networks, those methods have been proved to be particularly inaccurate, due to the unreliability of the adopted measurements upon which location is inferred. This article proposes a novel approach for range-free localization by obtaining intensity measurements at different Power of Transmission levels, using them as inputs for multiple location estimators, and aggregating the outputs of those estimators in order to achieve a more accurate determination of a sensor position. We have implemented our solution on real sensor platforms and performed some experiments in order to show how this simple solution allows halving the localization error and reducing the energy consumption of about 18% with respect to the state-of-the-art algorithms.

Trust management is extremely important for sensor networks, and the emerging vision of the Internet of Things (IoT) does not represent an exception. In fact, it allows to realize a dynamic access control needed to cope with internal attacks conducted by compromised nodes, which are likely to occur in real world. However, trust management implies a considerable consumption of energy, due to the amount of messages exchanged to collect reputation scores. Consumption is further exacerbated by the means needed to protect from attacks the trust management entities themselves. This work proposes a suitable trust management for the IoT by exploiting the eventual consistency and security guarantees of blockchain. The design of a solution based on such a technology is described, and a qualitative assessment of its protection degree is provided.

It is nowadays extremely popular to devise applications of top of the blockchain technology, due to the flourishing of several open-source platforms and the progressive success of this technology outside its traditional cryptocurrency domain. Testing these applications is particularly challenging and traditionally limited to the performance and functionality verification. How-ever, the progressive adoption of such a technology in critical domains is calling for dependability guarantees. This paper highlights the challenges related to the dependability assessment of these applications, and sketches a possible research direction.

This paper presents an explorative study on microservices monitoring. The study paves the way for MetroFunnel, our novel application-transparent and zeroconf monitoring tool, which aims to cope with the flexibility of microservices systems. MetroFunnel generates a tracelog of microservices' invocations based on the REST request-response communication model. We present an overview of MetroFunnel and its assessment within the well-consolidated Clearwater IMS.

An overview of the preliminary design of the ITER plasma control system (PCS) is described here, which focusses on the needs for 1st plasma and early plasma operation in hydrogen/helium (H/He) up to a plasma current of 15 MA with moderate auxiliary heating power in low confinement mode (L-mode). Candidate control schemes for basic magnetic control, including divertor operation and kinetic control of the electron density with gas puffing and pellet injection, were developed. Commissioning of the auxiliary heating systems is included as well as support functions for stray field topology and real-time plasma boundary reconstruction. Initial exception handling schemes for faults of essential plant systems and for disruption protection were developed. The PCS architecture was also developed to be capable of handling basic control for early commissioning and the advanced control functions that will be needed for future high performance operation. A plasma control simulator is also being developed to test and validate control schemes. To handle the complexity of the ITER PCS, a systems engineering approach has been adopted with the development of a plasma control database to keep track of all control requirements.

Grid computing is a largely adopted paradigm to federate geographically distributed data centers. Due to their size and complexity, grid systems are often affected by failures that may hinder the correct and timely execution of jobs, thus causing a non-negligible waste of computing resources. Despite the relevance of the problem, state-of-the-art management solutions for grid systems usually neglect the identification and handling of failures at runtime. Among the primary goals to be considered, we claim the need for novel approaches capable to achieve the objectives of scalable integration with efficient monitoring solutions and of fitting large and geographically distributed systems, where dynamic and configurable tradeoffs between overhead and targeted granularity are necessary. This paper proposes GAMESH, a Grid Architecture for scalable Monitoring and Enhanced dependable job ScHeduling. GAMESH is conceived as a completely distributed and highly efficient management infrastructure, concentrating on two crucial aspects for large-scale and multi-domain grid environments: (i) the scalable dissemination of monitoring data and (ii) the troubleshooting of job execution failures. GAMESH has been implemented and tested in a real deployment encompassing geographically distributed data centers across Europe. Experimental results show that GAMESH (i) enables the collection of measurements of both computing resources and conditions of task scheduling at geographically sparse sites, while imposing a limited overhead on the entire infrastructure, and (ii) provides a failure-aware scheduler able to improve the overall system performance, even in the presence of failures, by coordinating local job schedulers at multiple domains.

Virtualized multicore systems represent an emerging computing paradigm in the critical systems industry. Virtualization-based solutions leverage the different cores of the processor to run operating systems and applications within separate partitions, to support the development of parallel mixed-criticality systems, and to improve fault-tolerance by protecting and isolating the operating environments. The critical systems industry is subjected to international standards, which recommend fault injection as a mean to contribute with evidence to safety cases. This paper proposes a framework to inject hardware faults in virtualized multicore systems. Our proposal capitalizes on the error reporting architecture of modern processors and allows injecting faults both at hypervisor- and guest-OS-level. We implement the framework in the context of the widely used Intel Core i7 processor and Xen hypervisor. We demonstrate the use of the framework by means of about 60,000 injection experiments in a Linux-based virtualized multicore system installation.

Static analysis is a widely adopted technique in the industrial development of software systems. It allows to automatically check for code compliance with respect to predefined programming rules. When applied to large software systems, sanitizing the code in an efficient way requires a careful guidance, as a high number of (more or less relevant) rule infringements can result from the analysis. We report the results of a static analysis study conducted on several industrial software systems developed by SELEX ES, a large manufacturer of software-intensive mission-critical systems. We analyzed results on a set of 156 software components developed in SELEX ES; based on them, we developed and experimented an approach to prioritize components and violated rules to correct for a cost-effective code sanitization. Results highlight the benefits that can be achieved in terms of quality targets and incurred cost.

Practitioners widely recognize the importance of event logging for a variety of tasks, such as accounting, system measurements and troubleshooting. Nevertheless, in spite of the importance of the tasks based on the logs collected under real workload conditions, event logging lacks systematic design and implementation practices. The implementation of the logging mechanism strongly relies on the human expertise. This paper proposes a measurement study of event logging practices in a critical industrial domain. We assess a software development process at Selex ES, a leading Finmeccanica company in electronic and information solutions for critical systems. Our study combines source code analysis, inspection of around 2.3 millions log entries, and direct feedback from the development team to gain process-wide insights ranging from programming practices, logging objectives and issues impacting log analysis. The findings of our study were extremely valuable to prioritize event logging reengineering tasks at Selex ES.

Energy efficiency of large processing systems is usually assessed as the relation between a performance and a power consumption metric, neglecting malfunction. Execution failures have a tangible cost in terms of wasted energy, however. They are often managed through fault tolerance mechanisms, which in turn consume electricity. We introduce the consumability attribute for batch processing systems, encompassing performance, consumption, and dependability aspects altogether. We propose a metric for its quantification and a methodology for its analysis. Using a real 500-node batch system as a case study, we show that consumability is representative of both efficiency and effectiveness, and we show the usefulness of the proposed metric and the suitability of the proposed methodology.

This paper presents the main objectives and preliminary results of the NAPOLI FUTURA project, which aims to define novel approaches for protecting critical infrastructures from cyber attacks. The paper focuses on the architectural design of the NAPOLI FUTURA platform. The platform leverages cutting-edge big data analytics solutions to detect security attacks and to support live migration of services in the context of Critical Information Infrastructures (CIIs).

The analysis of monitoring data is extremely valuable for critical computer systems. It allows to gain insights into the failure behavior of a given system under real workload conditions, which is crucial to assure service continuity and downtime reduction. This paper proposes an experimental evaluation of different direct monitoring techniques, namely event logs, assertions, and source code instrumentation, that are widely used in the context of critical industrial systems. We inject 12,733 software faults in a real-world air traffic control (ATC) middleware system with the aim of analyzing the ability of mentioned techniques to produce information in case of failures. Experimental results indicate that each technique is able to cover a limited number of failure manifestations. Moreover, we observe that the quality of collected data to support failure diagnosis tasks strongly varies across the techniques considered in this study.

Context awareness, namely the provisioning of the current execution context at the application level, forces the continuous delivery of context data to resource-constrained mobile devices, and that can become too severe a constraint even for modern support (Android, iOS, etc.). This article focuses on the realization of a context data distribution infrastructure for Android-based mobile phones, and highlights important details on the implementation of specific context distribution primitives. Finally, we present new experimental results to assess the runtime performances obtainable with a real Android deployment.

This paper presents a novel approach to assess time coalescence techniques. These techniques are widely used to reconstruct the failure process of a system and to estimate dependability measurements from its event logs. The approach is based on the use of automatically generated logs, accompanied by the exact knowledge of the ground truth on the failure process. The assessment is conducted by comparing the presumed failure process, reconstructed via coalescence, with the ground truth. We focus on supercomputer logs, due to increasing importance of automatic event log analysis for these systems. Experimental results show how the approach allows to compare different time coalescence techniques and to identify their weaknesses with respect to given system settings. In addition, results revealed an interesting correlation between errors caused by the coalescence and errors in the estimation of dependability measurements. Index Terms—Event Log Analysis, supercomputer dependability, data coalescence, dependability assessment

The design and realization of health monitoring systems has attracted the interest of large communities both from industry and academia. Remote and continuous monitoring of patient’s vital signs is the target of an emerging business market that aims both to improve the quality of life of patients and to reduce costs of national healthcare services. Such applications, however, are particularly critical from the point of view of dependability. This presents the design of a set of services for the assurance of high degrees of dependability to generic mobile health monitoring systems. The design is based on the results of a detailed failure modes and effects analysis (FMEA), conducted to identify the typical dependability threats of health monitoring systems. The FMEA allowed the authors to conceive a set of configurable monitoring services, enriching the system with the ability to detect failures at runtime, and enabling the realization of dependable services for future mobile health monitoring systems.

Wireless Sensor Networks (WSNs) are widely recognized as a solution to build monitoring systems, even in critical environments. WSNs, however, are subjected to faults due to several causes (i.e. rain, EMF radiations, vibrations, etc..) and tools and methodologies for the design of dependable WSN-based systems are needed. Formal methods partially meet such needs by assessing the degree of correctness of design models and identifying potential system bottlenecks. The aim of this paper is to define a methodology for the static verification of WSN based systems using a formal language (Event Calculus). In particular we show how the formal specification can be used to verify the design of a WSN in terms of its dependability properties. To this aim, we define a set of correctness specifications that apply to a generic WSN, coupled with specific structural specifications describing the target network topology to evaluate. Finally, after having presented an automatic tool, designed to support the designer, we adopt this methodology to a case study.

Middleware plays a key role for the achievement of the mission of future large scale complex critical infrastructures, envisioned as federations of several heterogeneous systems over Internet. However, available approaches for data dissemination result still inadequate, since they are unable to scale and to jointly assure given QoS properties. In addition, the best-effort delivery strategy of Internet and the occurrence of node failures further exacerbate the correct and timely delivery of data, if the middleware is not equipped with means for tolerating such failures. This paper presents a peer-to-peer approach for resilient and scalable data dissemination over large-scale complex critical infrastructures. The approach is based on the adoption of epidemic dissemination algorithms between peer groups, combined with the semi-active replication of group leaders to tolerate failures and assure the resilient delivery of data, despite the increasing scale and heterogeneity of the federated system. The effectiveness of the approach is shown by means of extensive simulation experiments, based on Stochastic Activity Networks.

Multicore processors are becoming more and more attractive in embedded and safety-critical domains because they allow increasing the performance by ensuring reduced power consumption. However, moving to multicore systems raises novel dependability challenges: the number of cores, concurrency issues, shared resources and interconnections among cores make it hard to develop and validate software deployed on the top of multicore processors. This paper discusses a preliminary fault injection framework, which aims to investigate dependability properties of multicore-based systems. The proposed framework leverages the error reporting architecture provided by modern processors and has been instantiated in the context of the Intel Core i7 processor. Fault injection campaigns have been conducted under the Linux OS to show the benefits of the framework.

This paper introduces the design of a logging framework for the on-line failure analysis of Android Smart Phones. The framework enables the collection of failure data at runtime, useful to assess the dependability of smart phones, to deeply investigate the causes of failures, and to reduce maintenance efforts. Existing tools mainly focus on the collection of failure data about application crashes. The aim of the proposed framework is to extend the collection to other types of failures, such as, application hang, phone freeze and phone self-reboot. The paper describes the main design choices behind the components of the framework, and investigates advantages and disadvantages of different solutions.

Many critical services are nowadays provided by large and complex software systems. However, the increasing complexity introduces several sources of non-determinism, which may lead to hang failures: the system appears to be running, but part of its services is perceived as unresponsive. Online monitoring is the only way to detect and to promptly react to such failures. However, when dealing with off-the-shelf-based systems, online detection can be tricky since instrumentation and log data collection may not be feasible in practice. In this paper, a detection framework to cope with software hangs is proposed. The framework enables the non-intrusive monitoring of complex systems, based on multiple sources of data gathered at the operating system (OS) level. Collected data are then combined to reveal hang failures. The framework is evaluated through a fault injection campaign on two complex systems from the air traffic management (ATM) domain. Results show that the combination of several monitors at the OS level is effective to detect hang failures in terms of coverage and false positives and with a negligible impact on performance.

Self-adaptive management and quality adaptation of multimedia services are open challenges in the heterogeneous wireless Internet, where different wireless access points potentially enable anywhere anytime Internet connectivity. One of the most challenging issues is to guarantee streaming continuity with maximum quality, despite possible handoffs at multimedia provi-sioning time. To enable handoff management to self-adapt to spe-cific application requirements with minimum resource consump-tion, this paper offers three main contributions. First, it proposes a simple way to specify handoff-related service-level objectives that are focused on quality metrics and tolerable delay. Second, it presents how to automatically derive from these objectives a set of parameters to guide system-level configuration about handoff strategies and dynamic buffer tuning. Third, it describes the de-sign and implementation of a novel handoff management infra-structure for maximizing streaming quality while minimizing resource consumption. Our infrastructure exploits i) experimen-tally evaluated tuning diagrams for resource management and ii) handoff prediction/awareness. The reported results show the ef-fectiveness of our approach, which permits to achieve the desired quality-delay tradeoff in common Internet deployment environ-ments, even in presence of vertical handoffs.

On-line failure detection is an essential means to control and assess the dependability of complex and critical software systems. In such context, effective detection strategies are required, in order to minimize the possibility of catastrophic consequences. This objective is however difficult to achieve in complex systems, especially due to the several sources of non-determinism (e.g., multi-threading and distributed interaction) which may lead to software hangs, i.e., the system is active but no longer capable of delivering its services. The paper proposes a detection approach to uncover application hangs. It exploits multiple indirect data gathered at the operating system level to monitor the system and to trigger alarms if the observed behavior deviates from the expected one. By means of fault injection experiments conducted on a research prototype, it is shown how the combination of several operating system monitors actually leads to an high quality of detection, at an acceptable overhead.

This paper proposes a flexible framework for dependability modeling and assessing of Wireless Sensor Networks (WSNs). The framework takes into account network related aspects (topology, routing, network traffic) as well as hardware/software characteristics of nodes (type of sensors, running applications, power consumption). It is composed of two basic elements: i) a parametric Stochastic Activity Networks (SAN) failure model, reproducing WSN failure behavior as inferred from a detailed Failure Mode Effect Analysis (FMEA), and ii) an external library reproducing network behavior on behalf of the SAN model. This library specializes the SAN model by feeding it with quantitative parameters obtained by simulation or by experimental campaigns; it is also in charge of updating the network state in response to failure events during the simulation (e.g., routing tree updated due to node failures). The framework is thus suited to evaluate the dependability of several WSNs, with different topologies, routing algorithms, hardware/software platforms, without requiring any changes to its structure. The use of the external library makes the model simpler, decoupling the network behavior from the failure behavior. Simulation experiments are discussed that provide a quantitative evaluation of WSN dependability for a sample scenario: results show how the proposed framework supports WSN developers to find proper cost-reliability trade-offs for the system being deployed.

The overwhelming success of mobile devices and wireless communications is stressing the need for the development of mobility-aware services. Device mobility requires services adapting their behavior to sudden context changes and being aware of handoffs, which introduce unpredictable delays and intermittent discontinuities. Heterogeneity of wireless technologies (Wi-Fi, Bluetooth, 3G) complicates the situation, since a different treatment of context-awareness and handoffs is required for each solution. This paper presents a middleware architecture designed to ease mobility-aware service development. The architecture hides technology-specific mechanisms and offers a set of facilities for context awareness and handoff management. The architecture prototype works with Bluetooth and Wi-Fi, which today represent two of the most widespread wireless technologies. In addition, the paper discusses motivations and design details in the challenging context of mobile multimedia streaming applications.