Guilhem Blanchard
email: guilhem.blanchard@enpc.fr

Unstandardized standards: the making of demand in district-heating projects in France

Thanks to their efficiency, their capacity to exploit local energy sources and the adaptability of their energy mix, district-heating solutions are nowadays amongst the preferred options to supply heat to urban areas in Europe (1.1). As for all grid-based systems, estimating future consumption is an important issue for the development of heating networks (1.2). In French district heating projects, however, the numerous demand assessments that are produced at various stages of the design process comply with divergent calculation standards (1.3).

Drawing on an extensive empirical work on energy design in urban development projects, this paper therefore explores the following questions:

-What does explain both the diversity and the divergence of calculation standards for future heating demand? (2.1 & 2.2) -What are the consequences of this dissonance between standards for district-heating systems and projects? (2.3) -Why do these standards remain unquestioned? (3.1, 3.2, 3.3)

What energy is for: the making and dynamics of demand

1. The making of demand in district-heating projects: a significant issue

District-heating projects and urban climate-energy policies in France

The development of district heating and/or cooling systems has been considered lately amongst the most effective ways to decarbonise the energy supply of urban areas and to increase the share of non-fossil sources in their energy mix [START_REF] Bowitz | The social cost of district heating in a sparsely populated country[END_REF][START_REF] Gustavsson | Heating detached houses in urban areas[END_REF][START_REF] Holmgren | Role of a district-heating network as a user of waste-heat supply from various sources -the case of Göteborg[END_REF][START_REF] Lund | 4th Generation District Heating (4GDH): Integrating smart thermal grids into future sustainable energy systems[END_REF][START_REF] Rocher | Climate-Energy Policies, Heat Provision, and Urban Planning: A Renewal of Interest in District Heating in France: Insights from National and Local Levels[END_REF][START_REF] Guy | District Heating Comes to Ecotown: Zero-Carbon Housing and the Rescaling of UK Energy Provision[END_REF]. In fact, district heating (DH) networks enable the large-scale distribution of decarbonised heat to dense areas, providing efficiency gains compared to decentralised systems, and allowing recovery from capital-intensive waste and renewable energy sources (Fig. 1). Thanks to their features, and despite their complicated interaction with energy savings [START_REF] Gabillet | Energy supply and urban planning projects: Analysing tensions around district heating provision in a French eco-district[END_REF][START_REF] Späth | Conflicting strategies towards sustainable heating at an urban junction of heat infrastructure and building standards[END_REF], DH systems therefore provide interesting solutions for an "hyperlinked", "post-networked" urbanism [START_REF] Barles | Beyond the networked city, the hyper-networked city? Decline and renaissance of the Parisian non-potable water system (1820-2020)[END_REF].

District heating networks Decentralised systems

Pace of transition "Fast" (re-)structuration of entire neighbourhoods' heating supply Slow-pace dissemination through urban areas

Systems optimisation

Improved overall efficacy and efficiency thanks to mutualised, high-performance infrastructure (Hyper-)local optima, sometimes counterproductive

Energy sources

Only way to recover and distribute waste heat (from waste incineration, power plants, industries, data centers,…) and capital-intensive renewable sources (deep geothermal energy, biomass plants with top-performance particle filters,…)

Adapted to more extensive renewable and waste energy (solar heat and power, nearsurface geothermal energy, waste water,…)

Flexibility

Pipes need to be sized for decades to come, but new fuel and energy sources can be introduced "easily" by adding or replacing heat plants

Dependency on buildings' design

Land-use and aesthetics Almost neutral Space-intensive, visual impact

Socio-economics

Allow cost-sharing of infrastructure investment and price adjustments Less investment needed, but no sharing In France3 , few DH systems have been set up since the massive construction of large housing projects in the 1960s and 1970s [START_REF] Rocher | Climate-Energy Policies, Heat Provision, and Urban Planning: A Renewal of Interest in District Heating in France: Insights from National and Local Levels[END_REF]. In a context of highly-centralised, subsidised electricity and gas provision, individual heating has been preferred to collective systems. Since mid-2000s, however, DH has been regaining ground (Fig. 2). The rise of climate and energy issues in the political agendas, as well as the reconfiguration of multilevel energy governance towards more decentralisation, have led to a renewal of interest in district heating (Rocher, op. cit.). New rules and incentives, such as compulsory feasibility studies for renewable energy supply of new buildings and districts, subsidies from a national "renewable heat fund" or reduced VAT rates, have been introduced into the national regulatory framework. Going along with emerging urban strategies aimed at developing local, low-carbon energy supplies, these new regulations supported DH development, especially in metropolitan cities such as Paris, Lyon or Bordeaux.

Nowadays, district heating can therefore be seen as a growing segment in the energy sector, with three complementary trends: the creation of new systems, the extension and interconnection of existing networks, and the "greening" of their energy mix4 . From now on, we will focus on the development of new district-heating infrastructures in the context of urban development projects. Nevertheless, the conclusions we draw remain largely valid for other cases.

Estimating future demand: a key issue for district-heating projects

"[T]he decision to invest in a grid-based energy system is often made under considerable uncertainty with regard to subscriber behaviour. These uncertainties include whether or not prospective subscribers will decide to join the system and whether they will actually come 'on-line' at systembuilders' planned pace […] Another uncertainty concerns what subscribers' actual level of consumption will be and whether or not these consumption levels will change significantly over time: grid-based energy systems place high demands on the coordination of supply and demand within the system. Reductions in energy demand can lead to non-utilized capacity and economic loss unless new subscribers are contracted, while unforeseen increases in demand can cause problems in matching increases in demand with new instalments of capacity" (Summerton, 1992, p. 77) The making of energy demand, or more precisely the estimation of future heat demand, is crucial for district-heating projects. Energy demand estimates are indeed key parameters in both the financial and technical design of DH systems, thus impacting their socioeconomic and environmental features:

-As for many Large Technical Systems, the deployment of DH infrastructures requires high investment capacity, with long cost-recovery periods5 . To recover sunk costs, DH developers rely on long-term financial models based on above-marginal-cost charges applied to heat provision. In this context, heating demand assessments are crucial: they determine the basis upon which developers hope to get their return on investment and, consequently, the price of heat for future consumers. Since future demand is a factor of vital importance for the budget balance of the project, forecasting miscalculations may lead to significant financial risks, especially until break-even is reached.

-From a more technical point of view, demand estimates are key assumptions in the sizing of the infrastructure (pipes diameters, pressure and temperature of the fluid, boilers capacities,…) and the choice of heat sources to make up its energy mix. Underestimating future demand can then lead to failures in heat provision during very cold periods. On the opposite, overrating load curves may affect the overall performance of the system, since technical devices are designed for optimal functioning within given ranges of use. Of course, technical and financial aspects are closely intertwined since the infrastructure design determines the level of needed initial investment in the project.

At this point, it is important to make clear that both the magnitude and the distribution of future demand are key parameters for the financial and technical design of DH systems (Fig. 3). In fact, power demand affects the infrastructure design since systems are sized in order to prevent failures in heat provision while energy consumptions determine energy offtake from heat sources. Combining power demand and energy consumptions, the load curve impacts overall efficiency: basically, the smoother the load curve, the most efficient the heat provision system. Eventually, the structure of heat pricing reflects the structure of energy demand: a variable share (called "R1") is indexed on energy consumptions (in kWh), and a fixed share ("R2") is indexed on contracted power (in kW).

Entering the design & development process of a DH system: a dissonance between various demand assessments

As we have seen, estimating future demand is a key parameter for the design of DH systems. In this section, we follow heat demand assessments through the design process of a DH network in the context of an urban development project in France6 . At every step, a new actor enters the design arena and brings along new estimates, based on his own calculation method.

The first step occurs during the operational planning of the new district. The urban developer (aménageur), under the supervision of the local authority (collectivité locale), needs to choose between various energy supply solutions so as to provide heat, electricity and sometimes cold to future buildings. Neither the developer nor the urban authority staff members have the proper skills to carry out this choice alone: they usually contract with an urban energy consultant, who undertakes a comparative study of available solutions to support decision making. In order to assess the feasibility and interest of mutualised energy provision, the consultant needs to estimate the density of energy demand within various areas of the future neighbourhood. To do so, he has his own calculation tool, which usually uses surface power and consumption ratios based on both current and anticipated national regulations for thermal performance of new buildings. This estimate provides the first basis upon which a DH project is launched.

In the second phase, the local authority and the urban developer have to find an energy operator to design, build and manage the DH system. In fact, French DH networks are mostly owned by municipalities, but initial investments and infrastructure management is delegated to private companies through long-term (e.g. 25 years) public contracts (délégations de service public). To ensure fair competition, invitations to tender are first made public by the responsible authority and negotiations are conducted with a few candidates. Tender files include demand assessments, which are based on feedbacks from other DH networks managed by the same operator in similar urban contexts7 , and on anticipations of building performance evolutions during the next decade. Most of the time, these new figures are higher than the energy consultant's previous estimates (Fig. 4, Fig. 5): here is our first dissonance.

In the third phase, the DH infrastructure is being built by the operator: the divergence between demand assessments has been "resolved" by using the winner's estimates, since he is the one actor to assume the major part of the financial risk associated with the DH project8 . In parallel to the network's construction, property developers are negotiating the features of their building projects with the urban developer. Energy performance is included among the various issues addressed during this commercialisation process: the environmental engineer of the building's designing team has to convince the urban developer and his own consultant that planned building design complies with legal regulations and possible additional requirements. To do so, the engineer usually calculates future energy demand according to legal assumptions given by the national framework for buildings' thermal performance (the Th-BCE standard). Since these conventional assumptions are considered as quite distant from observed reality (see section 2.1), he may also provide complementary estimates by using dynamic thermal simulation software. It is interesting to notice that such estimates do not converge with any of the previous figures for heat demand (Fig. 4, Fig. 5): here is the second dissonance.

In our fourth (and last) phase, the DH system is becoming operational and new buildings are being built. In order to ensure the provision of heat to their products, property developers need first to have heat distribution networks (that is pipes and radiators) set up within the buildings, and second to contract heat supply with the DH operator. New "fluids" technicians (bureaux d'études fluides) are in charge of sizing the "secondary" distribution system and the contract power. The calculation method for this sizing is given by a national standard (the NF EN 12831 standard) issued by professionals from the sector. The assumptions of this last standard differ from both national thermal regulations and dynamic thermal simulations (STD). Moreover, they lead to very high contract power, quite different from what has been anticipated by DH operators. Here are our third and fourth dissonances (Fig. 4, Fig. 5). Finally, we sliced the design process of DH systems into four pieces (Fig. 5). At each step of the process, new actors enter the scene and bring along new estimates for future heat demand. Every estimate is based on a different calculation method, which leads to divergent demand assessments. In the following sections, we will see why demand estimates can differ that much (2.1), why the DH design process is punctuated by so many divergent assessments (2.2) and how it affects the overall performance of the heating supply (2.3).

How much heat shall we foresee? A tricky and ambiguous question

Demand estimates are fraught with uncertainty

Heat demand assessments for future buildings are fraught with uncertainties. To understand these uncertainties, we need to follow the methodological steps of heat demand assessments. Each of these steps provides a new estimate, which is supposed to be more accurate (that is closer to future measured reality) than the previous ones. Every new step, however, introduces new assumptions together with their uncertainties; uncertainties add up, therefore producing estimates with wide scopes for error (Fig. 6, Fig. 7).

-The first step is to determine which standard(s) (legal thermal regulation [RT], high environmental quality [HQE], low-consumption building [BBC], positive energy building [BEPOS]…) building projects with comply with. Each of these standards come with its own limitation for conventional, annual energy consumption, which provides a first heat demand estimate, though nothing is said about the consumptions pattern (power demand, load curve). This first step is associated with two uncertainties: first, no one knows exactly which will be the chosen standards for the various building projects to come; second, since urban development projects last for a decade (at least), standards' (fast) evolution has to be anticipated.

-The second step is to derive a theoretical heat demand from the conventional annual energy consumption of the building standard. To do so, one needs to presume a consumption pattern, using updated climate data and information on future users' profiles. Once again, such an operation is complex: future users are not known and their energy use is far from being understood, and even future climate is uncertain in a context of rapid climate change.

-The third step is to move from the theoretical project to the actual building. It is wellknown that buildings' construction process impact their energy performance (see [START_REF] Fischer | Re-interpreting Regulations: Architects as Intermediaries for Lowcarbon Buildings[END_REF]): compared to the project, alternative options may be chosen during the construction work, and implementation failures (e.g. in insulation attachment) affect the overall building design and performance.

-Fourth step, intrinsic building performance doesn't say all about actual heat demand: in fact, one has to take into account the in-use performance of technical devices (radiators, venting systems, control equipment,…) as well as the inhabitants' domestic practices (lifestyles, use of devices,…) and their evolution.

The methodology for demand assessments explains why estimates can diverge that much: first, even measured heat demands can be very different between housings with similar design (Fig. 7), with high dependence upon domestic practices and household lifestyles; second, uncertainties add up at every step of the estimation process, thus producing a wide scope for error in intrinsic building performance's assessment. This does not tell us, however, why heat demand is estimated in different ways by different actors during the design process of a district heating system.

One physical object looked at through many different lenses

To understand the divergence of demand assessments, one has to analyse the motivations behind those estimates. Let us go back to the four steps of DH design (section 1.3) to see what the main goals of the demand assessment's providers are.

First, the urban energy consultant needs to provide a comparative analysis of energy provision to the future neighbourhood. Because of the numerous uncertainties on the project, it is impossible to build a comparison precise enough to choose "the very best" solution. Therefore, one of the main concerns is to test the technical and economical robustness of various alternatives when urban development differs from what is planned at first. Since grid-based systems are highly dependent on demand intensity (see section 1.2), the consultant usually uses low-demand assumptions to make his estimates.

There is antagonism between the district-heating designer and the urban energy consultant. What they asked us [the consultant], was to prove that the network still makes sense if consumption is low […]

What the designer is asked, is to size an infrastructure so as to make sure that everybody has heat on a very cold, February 21 st day, even if everybody is at home and the urban development has been faster than expected.

(Interview with an urban energy consultant, June 2015, personal translation)

As for the DH operator, he is caught between two important concerns. On the one hand, he needs to size a system that is robust enough to get along with a peak in heat demand in order not to be faulted: that's why safety margins are included in the design assumptions. On the other hand, those same assumptions should not be overestimated because the financial model of the DH project is very sensitive to demand changes (see section 1.2). That is why usually, DH operators try to sharpen their estimates and to minimise their safety margins.

A building engineer, when he designs his building, he calculates the heat loss, for example 300kW, then he asks for an energy production facility of 350 or 400kW with domestic hot water. As for us, we don't have those parameters, so we do it backwards: we start from maximal consumption ratios from the thermal regulation, then we infer a heat consumption, and finally we estimate a power demand using a weather profile. Third, what environmental building engineers care much about is justifying the design choices for building projects. Since national thermal regulations are based on precise conventional technical assumptions, they have no need to question them when using the Th-BCE standard.

When it comes to dynamic thermal simulations, those are made to help optimizing the architectural choices for the project, as well as the selection of technical systems to implement.

To do so, engineers use highly contextualised assumptions that aim at providing realistic estimates of energy consumption and power demand.

Nevertheless, dynamic thermal simulations are not considered as baselines for the sizing of buildings' heating systems. Indeed, construction professionals use specific standards -such as the NF EN 12831 standard -to prevent potential claims about the quality of their work. When professional liability is at stake, the court judges whether the work has been done in accordance with standard practice (dans le respect des règles de l'art), which usually refers to professional standards such as NF technical norms even when they're not explicitly mandatory. To avoid major trouble, those professional standards are based on high safety-margins. Moreover, the very standard for heating systems' sizing has not been updated since 2004 even though construction techniques and heating systems have since moved on significantly.

Finally, heat demand assessments are framed with different imperatives in mind, which explains why they diverge so much (Fig. 8). Such a dissonance between successive estimates produces what can be considered as an overall sub-optimisation of the district heating system.

Diverging estimates: a sub-optimisation of heat supply in urban development projects?

Demand estimates were discussed at length. Working hypotheses are not the same between [the energy consultant] and [the operator] because responsibility is not shared: the one who's committed to provide heat is the operator. That's why he is responsible for the system's sizing. And when you add up high-demand assumptions for the network's sizing and high-demand assumptions for the sizing of power contract, you get to design solutions… I think it raises a major concern.

(Interview with an urban developer, January 2015, personal translation)

As we have seen, a district heating design process combines at least four heat-demand assessments that do not follow the same objective, thus providing diverging estimates for future demand. Such dissonances can produce contradictions within the process, thus leading to suboptimisation of the overall heat-supply design from (at least) two ways:

-First, there is a contradiction between the steps ① and ② of the DH design process (Fig. 9). When the urban energy consultant compares various energy-supply alternatives, he uses low-demand estimates to make sure grid-based systems still make sense if energy demand's development is lower than expected. This position leads him to base his global (that is technical, financial, environmental,…) comparisons on a low-demand scenario while in the meantime, system operators base their design on medium-high demand scenarios. This means that the upstream comparative studies for urban energy provision are "unrealistic" when compared to tenders from network operators, especially when it comes to heat price estimates. Although such a conservative position is understandable from a risk-management point of view, it leads to somehow "distorted" decision making from the local authorities, who may be tempted to launch solution-focused call for tenders that are based on "conservative, unrealistic" assessments. The divergence between upstream estimates and actual financial models is even more important when contract powers' overestimations from step ④ are included in the final pricing. -As it happens, overpricing is due to a second contradiction between the steps ② and ④ (Fig. 10). In fact, the DH operator builds the system's technical and financial model using "realistic", medium-high demand estimates; the heat pricing and the pipes and boilers' sizing, in particular, are based on those estimates. But during the DH commercialisation process, contracts rely on very high estimates for the contract power; since the fixed part ("R2") of the pricing depends on this contract power, property developers and final clients therefore suffer from overpricing due to power overestimations. Furthermore, the operator can't keep commercialising the DH when total contract power exceeds the system's overall capacity, so the network's extension capacity is compromised by contract power overestimations by building projects' "fluids" technicians. -Finally, it is ironic that the most "realistic" heat demand estimates respectively made at the scale of the DH system (by the operator) and at the scale of each building project (by the environmental engineer) usually never meet up during the whole design process, thus making impossible any homogenisation between design assumptions (Fig. 11).

Unstandardised standards: three interpretative readings

In such a context of apparent overall sub-optimisation of DH systems' design process, what can explain that nothing has been done to make calculation standards consistent so as to align the various demand assessments? In the following, we propose three different, complementary interpretations of this seemingly absurd situation.

A matter of coordination and mutual knowledge

A first interpretative reading relates to design management of energy within urban development.

The DH design process we described here refers to a distributed, multi-linear design model where the various components of the urban energy system are designed separately and sequentially (Fig. 12). Project management studies, however, have shown that concurrent engineering (Ben Mahmoud-Jouini and [START_REF] Mahmoud-Jouini | L'ingénierie concourante dans le bâtiment[END_REF][START_REF] Midler | L'auto qui n'existait pas. Management des projets et transformation de l'entreprise[END_REF] seems to produce more performant designs, especially when there are high levels of interdependencies between products' components. Another concern, then, is why concurrent engineering has not been implemented to design urban energy systems. In a context of concurrent engineering, integrative actors should be able to coordinate design operations, which includes the alignment of major assumptions so as to work within a shared framework: here, an "integrative actor" seems to be missing.

Municipalities and urban developers, who are central actors following on both energy supply projects, urban development projects and building projects, could play this part. Moreover, they would have important power over each project through public energy-provision contracts and building permits. The problem is, no one among these actors' staff members has enough knowledge to discuss technical issues with urban developers, building engineers and energy operators at the same time. Indeed, urban development and building construction's communities of practice [START_REF] Wenger | Communities of Practice: Learning, Meaning and Identity[END_REF] are not used to work on energy issues. Both urban developers and property developers need to contract with specialised engineers to provide basic energy expertise to their projects. These technical experts come from either the spatial planning community, the construction or the energy sector, but none of them is familiar enough with all of the three communities so as to develop top-level coordination and integration skills.

A matter of interests

The current situation's status quo can also be read as the result of a satisficing compromise9 between the various technical actors. In fact, even though we highlighted the overall imperfections of the design process, they give some kind of satisfactions to involved actors:

-As for urban energy consultants, the use of a unique, conservative demand assumption allows them to compare energy provision alternatives in only one development context. Multiplying demand assumptions would imply comparing more supply scenarios, which would make decision-making even more complex. Yet, what consultants are asked to, is to help decision-making by providing not-too-complex estimates of various alternatives' pros-and-cons.

-As for district heating operators, their financial model is highly dependent on fixed-share ("R2") incomes. Dependency upon variable-share ("R1") incomes is less important, since they correspond to variable costs (mainly primary energy), which are adjustable depending on actual (final) energy consumptions. When contract power is higher than power demand, it generates complementary R2 incomes that are much more important than losses associated with lower-than-expected consumptions.

-As for "fluids" building technicians, the use of a calculation standard with high security margins prevents them from being sued even if they miscalculate something. Since they usually don't have to justify their sizing during the building's design process, they get no trouble from the unnecessary costs generated by their assumptions.

-As for environmental building engineers, they would not want to use overestimated power demand assumptions to comply with actual sizing, since it would make it harder to justify the energy performance of the building's projected design.

A matter of collective risk management

These last two readings of heat-demand assessments during a DH design process may be considered critical. In this section, however, we would like to show that observed dissonances can also be analysed as a collective, distributed way to control the risk during an infrastructure project.

Indeed, the various safety margins that add up during the design process match with two different risks related to the DH project:

-If urban development is too slow, energy demand will be lower than expected, which threatens the DH financial model. -Nevertheless, if actual demand is higher than expected, the systems may be undersized, which would lead to either failures in heat provision or major expenditures so as to resize the whole infrastructure. This concern relates to the buildings' internal systems design as well.

In mega-projects, upstream feasibility studies are often criticised for being too optimistic [START_REF] Flyvbjerg | Megaprojects and risk: an anatomy of ambition[END_REF]. Unlike mega-projects, district heating projects can't rely on the State to compensate for spending overruns, and sunk costs place a significant financial burden on the operator. Using various, divergent estimates to assess the feasibility of a DH project and size the systems, then helps controlling the risks that are associated with major demand-related uncertainties. Put it another way, the dissonances between heat-demand assessments can be seen as a distributed, multi-criteria analysis of a district heating project.

Conclusion

Even though future demand assessment is crucial to design a district-heating project, we have seen that these projects bring various, divergent estimates into play, thus creating dissonances within design processes. In fact, each estimate complies with its own calculation standard, which obeys its own rationale.

One could see such a situation as an absurd sub-optimisation of DH systems' design process, due to the lack of coordination and shared knowledge between communities of practice associated with urban development, building construction and energy provision. Nevertheless, it can also be considered as the result of a strategic compromise between the "technical" actors of DH design, as well as a distributed way to control the risks associated with poor estimates for future demand.

Beyond this case study, our study first provides empirical data about the use of standards in the making of energy demand, from a supply-side perspective. By unblackboxing demand assessments within DH design processes, we bring out bring out the controversial nature and the performative power of calculation standards (Akerman and Peltola 2006). Mobilizing standards as indicators of sociotechnical processes involved in the making of demand, we also (partly) unveil the sociotechnical networks and decision-making chains into which district heating systems are inscribed, thereby providing new insights on the organisation and governance of urban energy systems [START_REF] Summerton | District heating comes to town. The social shaping of an energy system[END_REF][START_REF] Hawkey | Organisation and governance of urban energy systems: district heating and cooling in the UK[END_REF]).

Figure 1 .

 1 Figure 1. According to their promoters, DH systems have attractive features for urban energy transitions.

Figure 2 .

 2 Figure 2. There has been a renewed interested in DH supply in France since the mid-2000s.

Figure 3 .

 3 Figure 3. Both heat consumptions and power demand affect the whole financial and technical structuration of DH systems.

Figure 4 .

 4 Figure 4. Dissonances between heat demand estimates during one urban development project in Bordeaux.

Figure 5 .

 5 Figure 5. At each of the four steps in the DH design process, heat demand is estimated by a different actor using a new calculation standard, which leads to dissonances between the various demand assessments.

Figure 6 .

 6 Figure 6. Uncertainties add up during the estimation process of future heat demand.

Figure 7 .

 7 Figure 7. For a same building standard, conventional and actual heat consumptions are highly heterogeneous.

Figure 8 .

 8 Figure 8. Demand assessments follow different goals, which explains the divergence between estimates.

Figure 9 .

 9 Figure 9. Contradiction between steps ① and ②+④ leads to a first sub-optimisation of the energy-supply design process.

Figure 10 .

 10 Figure 10. Contradiction between steps ② and ④ leads to a second sub-optimisation.

Figure 11 .

 11 Figure 11. 'Realistic' estimates from steps ② and ③ usually don't meet up during the design process.

Figure 12 .

 12 Figure 12. Distributed, multi-linear design shared between three communities of practice vs. concurrent engineering.

PhD candidate at LATTS (Ecole des Ponts ParisTech, France) | guilhem.blanchard@enpc.fr Unless indicated otherwise, all figures and tables are made by the author.

The empirical work has been done for a PhD research on energy design in urban development projects. It brings together 40+ interviews, observations and a significant body of technical and institutional documentation.

A similar process is occurring in the UK[START_REF] Hawkey | District heating in the UK: A Technological Innovation Systems analysis[END_REF][START_REF] Hawkey | Organisation and governance of urban energy systems: district heating and cooling in the UK[END_REF][START_REF] Webb | Improvising innovation in UK urban district heating: The convergence of social and environmental agendas in Aberdeen[END_REF]

That means more recovery from renewable and waste energy, and less use of coal and oil. Gas remains trendy as a complementary source to renewable and waste energy.

For example, in recent proposals for a small-scale DHC network based on geothermal energy, initial investment represents about 15% of the overall costs in a 25-years period, and the share of fixed costs in the price construction is between 45 and

65%.

Even though our analysis is based on an extensive empirical study of one urban development project in Bordeaux, the major part of it remains valid for other urban development contexts in France.

In this case, similar urban context means comparable climate and real estate products.

Of course, our narrative is oversimplified. In reality, local authorities bear part of the financial risk, and most of the political risk associated with failures in providing the public service of heat. Anyway, energy operators are considered the most skilled structures when it comes to system design.

The compromise we mention here should be understood as the passive result of actors' strategies. It is highly unlikely that the actors involved or their (non-existent) representatives actively combined to bring about the current situation.


Fatima Zohra Benhamida

Mouloud Yacine Challal
email: y_challal@esi.dz

Mouloud Koudil
email: m_koudil@esi.dz

Adaptive Failure Detection in Low Power Lossy Wireless Sensor Networks

Keywords: failure detector model, adaptive timer-based techniques, lossy links, low-power WSN

published or not. The documents may come     Adaptive failure detection in low power lossy wireless sensor networks

Introduction

The detection of process crash in distributed systems is a critical problem designers have to cope with. Thus, failure detectors have been introduced as a fundamental service able to help in the development of resilient distributed systems. Its importance has been revealed by Chandra and Toueg [START_REF] Chandra | Unreliable failure detectors for reliable distributed systems[END_REF] who proposed the abstraction of unreliable failure detectors in order to circumvent the impossibility of consensus in asynchronous environments. Unreliable failure detectors, namely FD, can informally be seen as a per process oracle which periodically provides a list of probable crashed processes. This concept has been implemented for distributed systems with wired connectivity and abundant energy. In this article, we consider the study of FD in wireless sensor networks, which is a special case of distributed systems with new constraints on resources and radio link quality.

Wireless sensor network (WSN) consists of spatially deployed autonomous sensors, working cooperatively to monitor observed phenomena. It is an enabling technology for several applications such as surveillance of environmental conditions, battlefield tracking, medical assistance, etc. This kind of networks presents the following properties: (1) a node does not necessarily know all the nodes of the network due to storage capacity limitations. It can only send messages to its 1-hop neighbors, i.e. those nodes that are within its transmission range; (2) the network is not completely connected because of radio range limitation, which means that a message sent by a node might be routed through a set of intermediate nodes until reaching the destination;

(3) links are prone to failures and may momentarily drop messages during transmission; (4) nodes are equipped with very small autonomous batteries.

Communication protocols have to consider this limitation for efficient energy consumption; [START_REF] Mouradian | Rtxp: A localized real-time macrouting protocol for wireless sensor networks[END_REF] WSNs are prone to a variety of malfunctioning conditions due to the potential deployment in uncontrolled and harsh environment and to the complex architecture and energy depletion.

Fault tolerance is, therefore, one of the critical issues in WSN. This requires a consideration of the ability to cope with node crashes by detecting failed nodes, isolating them and eventually recovering routes to which they belonged. Notice that implementing FD, initially proposed for distributed systems, requires a special design to respond to WSN constraints. Some researchers have proposed few failure detectors tailored to WSN. However, most of them rely on assumptions that are not realistic with respect to WSN constraints and operation environment.

In this paper, we shall survey the main failure detectors proposed for distributed systems and the possibility to apply them to WSN. For this reason, we introduce a set of classification criteria to compare these different FD. The focus will be on energy depletion and lossy links for the reason that resource limitation and reliable communication represent one of the most relevant constraints for WSN [START_REF] Guo | Multipath routing in spatial wireless ad hoc networks[END_REF] [5] [START_REF] Abreu | Energy-aware routing for biomedical wireless sensor networks[END_REF]. Furthermore, we study the few proposed FD particularly designed for WSN. As we aim to enhance the failure detection paradigm for WSN, we propose a new FD class ♦S al . This class adapts FD properties for dynamic systems using local interactions for failure notification. The contributions of our work are manifolds:

1. We introduce failure detection model specifically designed for WSN, respecting WSN constraints and limitations: energy, memory, wireless transmission limitations (packet loss, intermittent connectivity), non complete graph topology, etc.; 2. The message exchange pattern is based on local exchanged information among neighbors and not on global exchanges among nodes in the system. This allows to define efficient energy consumption strategy; 3. It tolerates intermittent failures due to lossy links and adapts crash detection procedure using an adaptive timer; 4. It offers the possibility to customize the timer adaptation technique to application requirements in terms of completeness and accuracy.

The paper is organized as follows: in the next section, we recall failure detectors background. Then, in section 3, we present classification criteria to study FD in the perspective to apply them to WSN. We rely on this classification to present related works. In the 4 th section, we introduce a new FD model that fits low-power lossy WSN. The general algorithm and its properties are given in section 5. We explain its timer adaptation strategy. In section 6, we illustrate the use of this FD model and its dynamic timer by proposing three timer adaptation techniques. In the next section, we present performance evaluation analysis through extensive simulations using Omnet++/MiXim and comparison with respect to existing solutions. We end up this paper with conclusions.

Failure detector: definitions

In their seminal paper [START_REF] Chandra | Unreliable failure detectors for reliable distributed systems[END_REF], Chandra and Toueg define unreliable failure detector as a per process oracle which periodically provides a list of probable crashed processes in the system. Authors have proposed eight classes of unreliable failure detectors formally characterized by two properties: Completeness and Accuracy. Completeness requires that FD eventually suspect every process that actually crashed, while accuracy limits the mistakes FD can make. The FD is unreliable in the sense that it may not suspect a crashed process or can erroneously suspect a process of having crashed while it is correctly working. The FD can later on remove the process from its list if it believes that it was a mistaken suspicion. The eight possible classes, given in Table 1, are defined from the following completeness properties:

1. Strong completeness: eventually, every process that crashes is permanently suspected by every correct process.

2. Weak completeness: eventually, every process that crashes is permanently suspected by some correct processes.

The two completeness definitions can be combined with the following four accuracy properties:

1. Perpetual strong accuracy: no process is suspected before it crashes.

2. Perpetual weak accuracy: some correct processes are never suspected.

3. Eventual strong accuracy: there is a time after which no correct process is suspected.

4. Eventual weak accuracy: there is a time after which some correct processes are never suspected.

In what follows, we classify some related works and then investigate the use of FD in WSN with respect to WSN constraints.

Related Works

In this section, we review failure detectors proposed in the literature and analyze the ability to implement them for low-power lossy WSN. Our aim is to analyze how far each FD is suitable for WSN while considering WSN constraints and limitations. In addition to generic FD that have been designed

for distributed systems, we consider FD that have been designed specifically for WSN. Our review will follow classification criteria that we defined after deep analysis of existing solutions with respect to WSN constraints that would influence the design of appropriate FD. Namely, we will consider design decisions regarding detection paradigm, network connectivity, radio link failure, and energy consumption.

Failure Detection Paradigm

Many failure detection paradigms have been proposed according to system and network models. Some works implement keep-alive methods based on heartbeats, pings or application data messages. Both Aguilera et al. [START_REF] Aguilera | Heartbeat: A timeout-free failure detector for quiescent reliable communication[END_REF] and Rost et al. [START_REF] Rost | Memento: A health monitoring system for wireless sensor networks[END_REF] have proposed FD solutions based on heartbeats. Heartbeat is a message periodically sent from monitored node to the failure detector to inform that it is still alive. If the heartbeat doesn't arrive before timeout expires, the monitored node is then considered as faulty. Besides, Sens et al. have proposed in [START_REF] Sens | An unreliable failure detector for unknown and mobile networks[END_REF][11] detection mechanism using ping. Ping is a request message continually sent from a failure detector to monitored node.

Upon reception of this query, the node responds with an acknowledgment ACK. If the node fails to send the expected ACK, it is suspected of having crashed. Moreover, Memento [START_REF] Rost | Memento: A health monitoring system for wireless sensor networks[END_REF] relies on application data exchange to monitor faults. In this case, no additional messages are handled for crash detection. Failure detectors will rather use specific-application information transmitted through the network to make suspicion. Note that we can classify these paradigms into two types, depending on timers: the timer-based failure detectors handle timeouts to make suspicions. It is generally implemented for synchronous and static systems where timer delays are fairly predictable.

Network Connectivity

The design of FD solutions depends heavily on the considered network model.

Each failure detector maintains a list of suspicions as a subset from all monitored nodes known by its own process. When a node is addressed as faulty by any FD module, this information must be propagated to other modules. Nevertheless, failure propagation is time consuming in large scale systems such as WSN. Different approaches were proposed to improve propagation time.

Authors in [START_REF] Bonnet | Looking for the weakest failure detector for kset agreement in message-passing systems: Is Π k the end of the road?[END_REF][9] consider a complete graph; where every node is directly connected to all nodes in the system. This leads to immediate delivery of failure notifications. On the other hand, other FDs assume a partial connectivity, so that, only a subset of nodes is monitored. Authors in [START_REF] Aguilera | Heartbeat: A timeout-free failure detector for quiescent reliable communication[END_REF][12] [START_REF] Heinzelman | Energy-efficient communication protocol for wireless microsensor networks[END_REF][10] [START_REF] Greve | Asynchronous Implementation of Failure Detectors with partial connectivity and unknown participants[END_REF] monitor 1-hop neighbors. Moreover, Rost et al. propose in [START_REF] Rost | Memento: A health monitoring system for wireless sensor networks[END_REF] a hierarchical failure detector to arrange nodes into a multi-level hierarchy and partition monitoring into small groups. Failures are reported along a tree to improve scalability.

Link failure

In WSN, communication channels are highly volatile. Link failures are mainly due to radio interference where packets transmission is prone to burst losses.

Given that link failures are intermittent, failure detectors should be designed in a way that allows distinguishing link failure from process crash. Nevertheless, all solutions in [START_REF] Bonnet | Anonymous asynchronous systems: the case of failure detectors[END_REF] [START_REF] Rost | Memento: A health monitoring system for wireless sensor networks[END_REF] consider lossy links in their failure detection design.

Energy consumption

Failures in WSN cannot be approached in the same way as in traditional distributed systems. Indeed, traditional network protocols are generally not concerned with energy consumption; since wired networks are constantly powered and wireless ad hoc devices can get recharged regularly. Besides, battery depletion is one of the major causes that yield to process crash.

Therefore, the implementation of failure detection mechanism must be energy efficient. In [START_REF] Branch | Innetwork outlier detection in wireless sensor networks[END_REF], Branch et al. consider energy consumption as a vital constraint. Meanwhile, most of presented solutions (see Table 2) do not consider any resource constraint neither in their design nor during performance evaluation.

Discussion

In Table 2, we present a sample of FD solutions according to classification criteria introduced above. In addition to these factors, we study in Table 3 the advantages and drawbacks of each FD when applied for WSN. We notice Authors in [START_REF] Mostefaoui | Asynchronous implementation 50 of failure detectors[END_REF] propose a timer-free asynchronous FD. It is based on an exchange of messages and assumes the knowledge of two values: f (the maximum number of processes that can crash) and n (the number of nodes in the system). Moreover, the computation model consists of a set of initially completely connected known nodes. Yet, this timer-free approach is not applicable to partially-connected networks such as WSN. Some works deal with the scalable nature of dynamic systems [2][20]. Nonetheless, few of them tolerate links failures [START_REF] Aguilera | Heartbeat: A timeout-free failure detector for quiescent reliable communication[END_REF][14] [START_REF] Sens | An unreliable failure detector for unknown and mobile networks[END_REF]. In most of works, they only considered systems where process crashes are permanent and links are reliable (i.e., they do not lose messages) [START_REF] Bonnet | Anonymous asynchronous systems: the case of failure detectors[END_REF][8][9] [10][11]. This may increase the risk of mistakes when FD suspect a process of having crashed while the packets were lost because of intermittent failure due to unreliable links. Even though resource management is a vital constraint in WSN, most of solutions take no consideration for energy consumption, bandwidth or memory storage. Authors in [START_REF] Branch | Innetwork outlier detection in wireless sensor networks[END_REF] proposed an energy-efficient failure detection mechanism. However, their algorithm is designed for data outlier detection not for process crash.

Particularly, most general modules designed for distributed systems cannot be applied for WSN without modification. Therefore, it is hardly possible to use these FD given WSN constraints and limits. For this reason, some researchers have developed new FD tailored for WSN. Rost et al. present in [START_REF] Rost | Memento: A health monitoring system for wireless sensor networks[END_REF] a health monitoring system for WSN (Memento). This protocol dedicated for WSN applications, uses a routing tree and heartbeat mechanism. It considers a lossy communication channel, with partial connectivity between neighbors.

After this presentation of related works and discussion, we introduce hereafter a new FD model tailored to WSN applications and constraints. We will present the general algorithm to define the new FD class, adapted to lowpower lossy WSN. In addition to this abstract definition, we present three detection techniques based on the proposed model.

AFDEL:

A New Failure Detector Model for Low-power Lossy WSN

Overview

Let us consider the following simple configuration to illustrate the main issues and motivation behind our proposal. Consider a system of two processes (i.e. a network of two sensor nodes): a data collector P i and a data source P j . Process P j must periodically send data message to P i . Let us assume first that links are reliable which means that messages sent between correct processes are successfully transmitted. As we want to define a timer-based failure detector, we use a Failure Detection Timeout (F DT ij ) in process P i for neighbor P j : if F DT ij runs out before receiving the expected response, P i suspects that P j has crashed. F DT ij value is initiated according to application parameters; such as periodic sending interval, 1-hop transmission latency, etc.

However, the situation changes if, in addition to process crash, packet loss and link failures may also occur. In fact, with the above F DT , P i may make some mistakes, when the process is still correctly working but some messages are lost because of intermittent failures (lossy links, congestion...).

Moreover, the pattern of packet loss is not stable during all the lifespan of the network. Actually, changes may occur according to obstacles, geographic situation, sensors suppression, deployment or mobility. For this reason, we need to update F DT ij value following the dynamic lossy pattern of sensor nodes. Besides, if the network contains more than two nodes, every node's FD must detect failures locally then notify its suspicion to neighbors.

In this paper, we explore the use of adaptive timer tually strong class ⋄S to a dynamic system using local interaction for failure notification. Each process can query a failure detection module that provides information about which process of its neighbors has crashed. This information is typically given in a form of a list of suspects (Suspected i , is the list of process P i containing its suspected neighbors). This list is piggybacked on periodic data messages using neighborhood interaction to avoid extra overhead that would have been induced if dedicated signaling packets were used.

System model 4.2.1. Network model

We consider a wireless sensor network system consisting of a finite set V of n > 1 processes, namely, V = {P 1 , ..., P n }. There is one process per node and they communicate by sending and receiving messages via a radio network.

Processes have no knowledge about V or n; but, they know a subset of V , composed of nodes with whom they previously communicated. The system can be represented by a communication graph G(V, E) in which V represents the set of nodes and E represents the set of radio links. Nodes P i and P j are connected by a link (P i , P j ) ∈ E if and only if they are within their wireless transmission range. In this case, P i and P j are considered neighbors.

Assumption 1. We suppose that the remaining nodes in the same neighborhood where a fault might occur, can still communicate with each other.

Obviously, this assumption is weaker than f-covering property used in many related works (e.g. [START_REF] Mostefaoui | Asynchronous implementation 50 of failure detectors[END_REF] and [START_REF] Sens | An unreliable failure detector for unknown and mobile networks[END_REF]). Our assumption is equivalent to 2-node connected graph restricted to one neighborhood instead of the complete network1 .

Failure model

We assume that sensors may crash. Moreover, links between two neighbors are considered lossy: they may drop messages during transmission. This is commonly due to transmission link failure; which is intermittent by nature.

Subsequently, if a node fails to send some packets, this loss should be considered as intermittent failure. However, if a process crashes, it will never belong to the network anymore; and has to be notified to all its neighbors.

Hence, even if a failure detector may suspect a process of having crashed while actually the link is down it will be able to detect mistaken suspicions once the link is set back.

E(BL) = 1/λ (1)
Where:

λ is the probability for two consecutive packet loss.

2 Good state refers to successful packet delivery and Bad state refers to packet loss.

Then, given E(BL), it is possible to define a burst loss limit (BLL) which must be tolerated by the FD. BLL is a function of E(BL), and eventually other network and/or traffic parameters: In other words each FD timeout (F DT ) must be greater than the defined tolerated burst loss limit (BLL).

Thus, the timeout value covers a period of successive packet losses.To this end, we define the value of BLL hereafter:

BLL = E(BL) + V (BL) (2)
Where:

• BLL: Burst Loss Limit;

• E(BL): Mean Burst Length;

• V (BL) = √ 1-λ λ
: Standard deviation (λ is the probability for two consecutive packets loss).

In BLL, we empirically add up standard deviation value to the mean burst loss E(BL) in order to tolerate reasonable long burst losses. This allows to better separate intermittent failures due to lossy channels from other failures causes.

Data gathering model

We consider two types of data gathering models, namely time-driven and query-driven. First, we define the query-driven model, also known as a Query-Response routing mechanism. This kind of routing protocols is mainly based on network interrogation; where a collector node (also known as a sink)

periodically broadcasts a query for data (sensed or stored) to all network nodes using a multi-hop routing scheme. Each intermediate node receives the query from an upstream neighbor, and then diffuses it to all its neighboring nodes. When a source observes a matching event, it sends back response to all nodes from which it has received the corresponding query. Eventually, a single path is elected to send periodically data from source to sink. Directed Diffusion [22] is a query-driven protocol. On the other hand, time driven model uses a periodic scheme for data dissemination. The routing protocol defines a slot for each neighbor to send data within a forwarding interval.

LEACH [START_REF] Heinzelman | Energy-efficient communication protocol for wireless microsensor networks[END_REF] is a time driven protocol that uses TDMA schedule for its routing scheme. Notice that Query-Response and Time-driven models cover a very large set of routing protocols in WSN3 .

Interaction between system model and FD model

In figure 2, we illustrate the interactions between system models with our FD model: AFDEL uses the characteristics of the data gathering protocol (e.g.

round delay) and the pattern of packet losses to determine a timer F DT for each neighbor. The neighboring list is given by the network module.

Furthermore, the data gathering protocol sends (resp. receives) periodic messages to (resp. from) AFDEL module in order to update (resp. deliver) the list of suspicions. Thus, every message piggybacks information about nodes' crashes. Moreover, list updates (insert suspected process or delete We recall, this model can be adapted to several applications according to the chosen detection technique. The adaptation of F DT can be done in several ways and depends on the actual dynamics in the network. In section 6, we will define three F DT adaptation techniques and present performance evaluation and comparison through simulations.

AFDEL: Algorithm and properties

AFDEL algorithm

We recall that we consider a periodic data gathering model (time driven and query driven). The algorithm proceeds by rounds. At each round, a node sends a message to its neighbor(s) until it possibly crashes.

Suspected i list.

Properties of the new failure detection class ♦S al

Any failure detector FD is characterized by two properties: completeness and accuracy (see section 2). Completeness requires that FD eventually suspects every process that actually crashed, while accuracy limits the mistakes FD can make. Since we have considered network and failure models tailored to WSN, we define for AFDEL class new completeness and accuracy properties that better suit the conventional system model:

Definition 1: (1-hop-Completeness)

There is a time after which every process that crashes is suspected by all its correct neighbors.

Proposition 1. ∀ P i crashes, ∀ P j ∈ N eighbors i , ∃ τ ∈ T : ∀t > τ, P i ∈ Suspected j 1: procedure AFDEL.Send(msg) 2:

P iggyback(msg, Suspected i , P i )

3:

DLayer.Send(msg)

4:

for all P j ∈ N eighbors i \ Suspected i do

5:

F DT ij ← setF DT (P j )

6:

T imer.schedule(P j , F DT ij )

7:

end for 8: end procedure 9: procedure AFDEL.Receive(msg) 10:

Retrieve(msg, Suspected j , P j )

11:

Timer.stop(P j )

12:

if P j ∈ Suspected i then

13:

Suspected i ← Suspected i \ P j

14:

end if

15:

N etLayer.receive(msg)

16:

for all Ps ∈ Suspected j do

17:

Suspected i ← Suspected i ∪ {Ps}

18:

end for

19:

for all Pm ∈ Suspected i \ Suspected j do 20:

Suspected i ← Suspected i \ {Pm}

21:

end for 22: end procedure 23: Task: Timer.Fire(P j ) 24:

Suspected i ← Suspected i ∪ {P j } Figure 3: AFDEL Algorithm.
This property satisfies strong completeness limited to 1-hop neighborhood.

Definition 2 (1-hop-Accuracy)

There is a time after which some correct processes are never suspected by any correct neighbor.

Proposition 2. ∃ P i correct, ∀ P j ∈ N eighbors i , P j correct, ∃ τ ∈ T :

∀t > τ, P i / ∈ Suspected j
This property defines the eventual weak accuracy limited to 1-hop neighbors.

With these new properties, we define a new FD class; namely, ♦S al eventually strong class limited to 1-hop interaction. The merit of this new class is to provide adequate measurement tools of completeness and accuracy of failure detection tailored to the limitations and requirements of WSN. Indeed, if strong completeness and accuracy are mandatory in conventional distributed systems, in WSN 1-hop-completeness and 1-hop-accuracy are enough for route update provided that the neighborhood of the faulty node remains connected (assumption 1). Therefore, due to energy, storage and bandwidth limitations, every node monitors only its direct neighbors, even though the information is initiated by a further node. Later, suspicion notifications sent initially to neighbor nodes will reach on-route nodes to the sink and hence update their routes consequently. Finally, notice that, using this local interaction is energy efficient as will be demonstrated in performance evaluation section through simulations of three new techniques based on the proposed FD model.

Proposition: AFDEL belongs to ♦S al , i.e. AFDEL guarantees the following properties:

• 1-hop-completeness

• 1-hop-accuracy

Proof

Consider that the most recent status about a process P k is stored in Suspected i set of correct process P i . From the algorithm in figure 3 each correct process P i will execute line 2 to piggyback additional information about its suspected list using the periodic data gathering scheme. P i sends then its message containing P k in Suspected i set. Upon reception of such a message by neighbor P j , P j executes AFDEL.Receive primitive to retrieve information from received packet then update its own list. P j executes then lines 16-18 to add P k in Suspected j . In the next round, P j , the same as P i , must broadcast this new status regarding P k in its set. Using the same mechanism, P j must retrieve a previously suspected P k once it receives most recent information from P i notifying the mistake (lines 19-21). Given assumption 1, all 1-hop neighbors eventually add (resp. retrieve) P k in (resp. from) their Suspected set. This assures 1-hop-completeness and 1-hop-accuracy properties all over the network.

Timer adaptation strategy

We recall that AFDEL uses adaptive timer strategy to detect failures. Actually, AFDEL dynamically updates F DT respecting the application requirements in terms of completeness and accuracy, considering in-time changes in the system; such us transmission failures, communication protocol behavior and network dynamics. Notice that there is no general formula since it depends on the choice of the routing protocol and its parameters. In this abstract definition, we don't precise any detection mechanism. The motivation behind introducing a generic strategy instead of defining a special formula for timer adaptation, is to offer the possibility to each application to customize the dynamic pattern according to expected accuracy and completeness performance. However, to better understand the utility of the new FD, we illustrate more the use of its strategy by proposing three detection techniques based on the generic model. In what follows, we propose then three F DT adaptation techniques that can be used by AFDEL. Later, we provide performance analysis and comparisons through simulations and illustrate the impact of network dynamics model and the used F DT adaptation technique on the overall performances.

Timer Adaptation techniques

We define three FDT adaptation techniques, namely ASAT, CSAT and HAT. probability of message loss. Clearly, there is more congestion risk around sink neighbors than for distant nodes. This is due to the amount of sent data from all over the network toward the sink. HAT tries then to minimize false positive by separating intermittent failures from process crash according to node distance from the sink. We explain further the motivation behind each proposal. Before that, we give in Table 4 the common parameters used to implement these three techniques.

Stochastic Adaptation Techniques

We first recall that SAT techniques are based on stochastic modeling of network dynamics. At each round, we use statistics from previous rounds to update the timer according to dynamic changes in the routing protocol.

We first explain in figure 4 the algorithm to set and update timer for SAT techniques. Later on, we add separately the difference in both ASAT and CSAT mechanisms. In the beginning, since there is no former communication However, when FDT satisfies the desired TWD, AFDEL tries to enhance crash notification performance. Actually, AFDEL decreases back timer value if it doesn't reach yet the predefined reliability threshold (T r ) (line 9). T r is introduced by the application user in order to define the desired reliability of the failure detector allowing faster detection. FDT performance depends on the choice of the predefined parameters (T r , TWD) on the one hand and both Decrease(FDT), Increase(FDT) functions on the other hand.

The markov chain in figure 5 illustrates the stochastic timer process. Our approach for SAT techniques is inspired by control-theoretic adaptation similar to those widely used in Internet, such as AIMD or MIAD best known for TCP congestion avoidance [START_REF] Jain | Congestion avoidance in computer networks with a connectionless network layer[END_REF]. Hence, we propose two techniques based on SAT mechanism where time increase/decrease is differently implemented according to application requirements.

ASAT

By ASAT technique, we aim to notify crashes with good accuracy (Accuracyaware Stochastic Adaptive Technique). This approach seeks to reduce the mistaken suspicions rate. For this reason, we use Multiplicative Increase Additive Decrease algorithm(MIAD) [START_REF] Jain | Congestion avoidance in computer networks with a connectionless network layer[END_REF]. MIAD combines exponential growth of timer value with linear reduce to satisfy a minimum reliability in crash detection. Hereafter, the general formula for MIAD technique at time period t + 1:

F DT (t + 1) =    α × F DT (t) if Increase F DT (t) -β if Decrease (3)
Let us first explain the objective of using MIAD for timer update. Suppose that the failure detector has made many mistaken suspicions, so that the false suspicion rate WDR exceeds the tolerated threshold (W DR > T W R).

According to algorithm in figure 4, we increase the timer. Since ASAT aims to make fewer mistakes, we multiply the timer by α(α > 1). Moreover, the parameter α depends on local stochastic information observed during the application run, namely WDR and TWR. Hence, the exponential increase of the timer depends on the effective false positive rate that induces its growth.

However, in Decrease(FDT) function, the timer is reduced using parameter

β (β > 1)
. As for β value, it is deduced from the local notification delays during crash detections. Notice that Decrease(FDT) is triggered once the FD is under the required reliability threshold (line 9 in figure 4). For the sake of simplicity, we define the reliability as the rate of correct suspicions; namely 1 -W DR. By aggressively increasing the timer value upon false suspicions control, ASAT expands its waiting time to tolerate more intermittent failures and then, avoid false suspicion. Whenever the crash detection rate subsides, the timer is decremented according to the mean value of notification delay to quickly overcome unreliability.

CSAT

We propose Completeness-aware Stochastic Adaptive Technique (CSAT), for prompt crash detection. Thus, completeness takes the advantage on ac-curacy. The purpose is to quickly notify any crash failure. For this reason, we use Additive Increase Multiplicative Decrease technique [START_REF] Jain | Congestion avoidance in computer networks with a connectionless network layer[END_REF]. Inversely to MIAD approach, AIMD combines linear growth of timer value with exponential reduce as given in the formula hereafter at time period t + 1:

F DT (t + 1) =    β + F DT (t) if Increase α × F DT (t) if Decrease (4)
As for ASAT with AIMD, the timer increase, respectively decrease, depends on reliability in crash notification, respectively the false positive rate (see figure 5). However, CSAT aggressively diminishes the timer value to quickly detect any crash failure. For this reason, we multiply FDT by parameter α (α < 1) which is defined according to the effective false positive rate. The objective behind this choice is that CSAT decreases the timer to promptly detect crashes regarding the actual false positive rate. Meanwhile, to avoid mistaken suspicions, CSAT increases FDT when it reaches a required reliability. For this, we add up to FDT parameter β (β > 1), which depends on the stochastic information during the application run (e.g. we consider the mean period value of delayed delivery that caused some of the previous false notifications).

HAT technique

In the Hops-driven Adaptive Timer based technique, the timer update depends on the nodes in the routing path and their distance from the sink. In addition to packet loss, mistaken suspicion can be made because of transmission delay due to congestion. To avoid notifying this as failure, we must give more time to nodes according to the congestion risk in their region. Notice that there are more data packets as we get closer to the sink, because all sources send their messages toward the final destination (i.e. the sink). For this reason, HAT defines a timer for each node following equation 5. Notice that this timer represents a period to tolerate burst loss (intermittent packet loss). Then, we add up a second period inversely proportional to the distance separating the monitored node from the sink. We found convenient to set the maximum value (for 1-hop sink neighbors) to one forwarding interval I f .

F DT = T BL + I f /SHC (5)
Where:

T BL: Tolerated Burst Loss.

I f : Forwarding Interval.
SHC: Sink Hops Count.

Analysis of the AFDEL techniques

In this section, we study and evaluate the behavior of our dynamic AFDEL and the three proposed adaptation timer techniques. We start by comparing the general mechanism of our timer-based model with a timer-free FD. Then, we value the importance of updating timer and the impact of each proposed dynamic technique; namely CSAT, ASAT and HAT. To this end, we have chosen HeartBeat [START_REF] Aguilera | Heartbeat: A timeout-free failure detector for quiescent reliable communication[END_REF] as a timer-free FD. The failure detector module of HB at a process p outputs a vector of counters, one for each neighbor q of p. Each process periodically sends an 'I-am-alive' message (a "heartbeat")

and every process receiving a heartbeat increases the corresponding counter.

Thus, if neighbor q does not crash, its counter increases with no bound.

If q crashes, its counter eventually stops increasing. For failure detection, HB counts the total number of heartbeats received from each process, and considers that neighbor q has crashed when the counter stops increasing. HB outputs these "raw" counters to applications without any further processing or interpretation.

Simulation model

We carried out the simulations using MIXIM; an Omnet++ modeling framework [START_REF] Köpke | Simulating wireless and mobile networks in omnet++ the mixim vision[END_REF]. The simulation model is resumed in Table 5. We consider three network topologies: random, grid ans star. By varying the area of nodes deployment, the network density may vary (i.e. number of neighbors for each node). In order to illustrate the outcome of using adaptive failure detection, we consider several simulation tests using two main scenarios. In scenario 1, we vary the number of total nodes (20 to 200 nodes), while in scenario 2, we change the number of crashes for the same network (10% to 50% of total nodes). We repeat every configuration for 50 iterations, and then we calculate the mean value for each performance metric. As a periodic data communication model, we consider Directed Diffusion routing protocol, DD.

In our simulation tests, we compare DD-HB (DD augmented with timer-free HB), FaT2D [START_REF] Benhamida | Fat2d: Fault tolerant directed diffusion for wireless sensor networks[END_REF] (DD augmented with static timer FD) with three variants of the new proposed model AFDEL, depending on the used timer adaptation technique: AFDEL-ASAT, AFDEL-CSAT and AFDEL-HAT. All AFDEL timer-based techniques start with the same timer F DT 0 as used in static-timer FaT2D. However, FaT2D keeps the same value during simulation run, while each AFDEL technique adapts its own FDT according to equations and algorithm given in section 6. the motivation behind this comparison is to evaluate the following potential failure detection mechanisms:

1. Timer-free mechanism: this category regroups solutions that manage failures without using timeout [START_REF] Lima | The time-free approach to byzantine failure detection in dynamic networks[END_REF].

2. Static timer-based mechanism: in this category, proposed solutions use timer to detect failures. However, this timer is fixed to the same value during the network lifespan [START_REF] Banerjee | Effective fault detection and routing scheme for wireless sensor networks[END_REF] [27] [START_REF] Jhumka | Efficient fault-tolerant collision-free data aggregation scheduling for wireless sensor networks[END_REF]. For reason of simplicity, we consider in our simulation FaT2D, a static-timer based failure detection technique proposed for Directed Diffusion.

3. Adaptive timer-based mechanism: our proposed techniques are based on dynamic values of timeout. We will evaluate the use of this adaptive mechanism comparing to both timer-free and static timer-based mechanisms.

Performance metrics

During our experiments, we were interested in six main metrics classified in three main categories:

1. Failure detector properties: in this category, we test Accuracy and Completeness properties. This will allow classifying the proposed techniques according to their performance regarding the false positive rate (accuracy) and the detection rate (completeness).

Simulation results

We discuss hereafter some of the simulation results. Graphs in figure 6 and figure 7 show completeness performance using both scenarios (nodes variations and crash rate variation). Obviously, all three proposed techniques in AFDEL give results greater than both timer-free HB and static timer-based FaT2D. Moreover, CSAT and HAT offers the best rates (70% to 95% in scenario 1). Since timer adaptation strategy is application aware, and since CSAT aims to make prompt detections, the dynamic timer pattern allows then to enhance completeness property and gives greater results compared to other techniques. Surprisingly, HAT gives great results, especially for small networks and minor crash rate. This explains that setting timer value according to number of hops allow covering a great completeness rate. We have noticed during simulation, that for the same configuration, the mean timer value in HAT is less than values for other remaining techniques (including CSAT). Obviously, considering node position from the sink allows to enhance global detection rate. However, the timer-free HB detects only about 50% of the total faults in the network. Since HB can't make any decision until the gathered information from all the nodes is sent, the detection mechanism is very slow. Notice that completeness performance for all techniques is slightly decreasing while the network size is getting larger. This is mainly due to the increasing probability of dynamic changes for the routing paths. As the network size is bigger, there is more chance to participate other nodes for data transmission. Subsequently, this may cause to elect a new routing path before even any FD mechanism can detect some eventual faults in the previous path. Furthermore, we have noticed during simulation that completeness in timer-free method HB has the lowest value for scenario with small number of crashes in the network. This is due to the central decision of failure detection and notification. The base station promptly notifies failures when there are many packets lost due to many crashes in the network (figure 7). On another hand, ASAT gives the greatest accuracy rate. Clearly, this results from the formula of the timer update in ASAT which aims to minimize mistaken suspicions. We recall that ASAT timer adaptation strategy is based on additive decrease multiplicative increase AIMD, which promotes to enlarge timer values. Consequently, this will avoid false suspicions, and then, offer great accuracy rate. Yet, HAT offers remarkable performance as shown in both figure 8 and figure 9. We recall that HAT gives the lowest mean value of adaptive timer; which offers great completeness rate. Besides, HAT enlarges the timer mostly in regions prone to intermittent failures. Actually, inter- mittent failures are more frequent in sink neighborhood (because of packets collisions and MAC overload). Since HAT updates timer according to distance from the sink, it allows then to prevent from mistaken suspicions in this region. Subsequently, HAT offers great accuracy rate. However, CSAT gives lowest accuracy rate. As CSAT decreases its timer in order to give prompt detections, it leads to increase false suspicions rate. Subsequently, CSAT has the weakest accuracy rate (61% to 70%). However, timer-free HB shows great results. Obviously, this is due to mechanism used by HB. As mentioned before, HB sends all counters to application layer which decides for any failure occurrence. Since the process needs large delays to make any notification, it avoids therefore false suspicion to occur.

It is important to notice that accuracy and completeness do not vary very much according to number of crashes for the same technique (figures 7 & 9). This is mainly due to the local detection mechanism. Actually, each AFDEL technique uses local interactions to detect/notify failures. Moreover, timer adaptation strategy depends exclusively on exchanged information in the same neighborhood. For this reason, completeness/accuracy performance is directly related to the dynamic timer pattern and does not depend on the number of crash in the network. However, in figure 9, we notice that the accuracy rate varies from 60% to 80% with variable fluctuations. Some of the observed fluctuations in this interval are due to the impact of intermittent failures on network activity. Actually, the influence of injected intermittent failures depend on routing path length (number of nodes participating in routing data).

Graphs in figure 10 represent detection and recovery delays overlapped in the same histogram. Detection delay is defined by the crash detection period (i.e. first detection by any supervising neighbor). While the recovery period is the time after which all nodes (i.e. neighbors) have noticed the crash (i.e. the crash notification and node suppression from neighbors' list).

Their addition defines the total period of failure treatment (detection and notification then suppression and path recovery). Results show that implementing a dynamic mechanism for timer update has slightly increased the detection and recovery period comparing to static timer based FaT2D. Naturally, this is due to additional processing to adapt timer. Furthermore, notice that ASAT has the longest detection period. Obviously, this is due to large values of dynamic timer in order to avoid mistaken suspicion. Yet the compromise between failure detector properties (accuracy & completeness) and failure detection delay is better insured by the new adaptive techniques, especially CSAT and HAT. However, we notice in figure 10 some fluctuations in detection/recovery period. This variation is due to the nature of the implemented routing algorithm Directed Diffusion. We recall that DD periodically forwards exploratory data in order to reelect routing paths. In case where exploration is triggered just after a failure occurrence, the detection/recovery may be covered by DD route reelection. In this case, detection/recovery period is faster than the implemented failure management technique (DD launch recovery mechanism before the end of failure detection timer). This conclusion is satisfied in figure 11 for packet loss rate. For the same reasons discussed above, as some techniques may take a longer detection delay, this leads to a bigger loss rate. CSAT gives the best results for this metrics. We recall that HB shows the longest detection period as it waits for application layer to make decision about any crash notification. Besides, HB does not define any recovery mechanism. The final measurement was performed for the resource management. As energy consumption, memory storage and bandwidth are critical constraints for WSN, it's important to evaluate the impact of implementing a failure detection mechanism on the amount of battery usage and exchanged data overhead. Results in figure 12 show that, even though all three techniques implement an additional mechanism for timer update, the difference in battery consumption is very small comparing to timer-free HB. This result is promising since the exchanged data overhead due to implementing an additional technique for failure detection compensate the overhead that would AFDEL-ASAT +++ +++++ (1) ++ ++ ++++ +++ (2) AFDEL-CSAT ++++ + ++++ ++++ ++++ +++ (2) AFDEL-HAT +++++ ++++ (3) +++ +++ ++++ ++ (1) (1) Dense networks.

Conclusion

(2) Frequent crashes.

(3) Small networks.

In this paper, we present different failure detection solutions designed for dis-

  Heartbeat paradigms often use timers awaiting the monitored node's message as proposed in[START_REF] Nunes | Qos of timeout-based self-tuned failure detectors: the effects of the communication delay predictor and the safety margin[END_REF][START_REF] Heinzelman | Energy-efficient communication protocol for wireless microsensor networks[END_REF]. However, the majority of failure detectors for asynchronous and dynamic systems use timer-free paradigm since the timeout estimation can't be given from the network model[START_REF] Aguilera | Heartbeat: A timeout-free failure detector for quiescent reliable communication[END_REF][9][10][START_REF] Greve | Asynchronous Implementation of Failure Detectors with partial connectivity and unknown participants[END_REF][12][START_REF] Greve | Eventually Strong Failure Detector with Unknown Membership[END_REF].

Figure 1 :

 1 Figure 1: Gilbert-Elliot packet loss model.

Figure 2 :

 2 Figure 2: Interactions between AFDEL and system modules.

  mistaken suspicion) will lead to a new FDT refresh in order to give more accurate notifications in next rounds (prompt detection vs. less mistakes).F DT is then updated according to the new proposed techniques following the proposed general model. This update is triggered by the Timer Handler in our AFDEL module.

  Let's first define by SAT all detection techniques based on a Stochastic Adaptive Timer to notify failures. SAT mechanism uses in-time information about changes in the same routing path. This will allow adapting timer value according to network dynamics during the application run. We define now, two main techniques based on SAT mechanism; ASAT and CSAT. ASAT aims to notify all crashes with less false positive rate. Clearly, ASAT tries to enhance the accuracy property. Thus, we call it Accuracy-aware Stochastic Adaptive Timer technique. However, CSAT seeks to make in-time monitoring by notifying the sooner any process crash. Obviously, CSAT may increase the false positive rate. Yet, prompt detection is the goal behind this mechanism. We call it then Completeness-aware Stochastic Adaptive Timer technique. Conversely to both SAT techniques, the third one is based on the changes of the nodes participating in the routing protocol and their position in the network area. Therefore, we define another adaptive timer based on the hops number that separate the monitored node from the sink (final destination node), namely HAT; Hop-based Adaptive Timer. We consider this technique since sink neighbors are more prone to failures because of congestion and high

Figure 4 :

 4 Figure 4: Stochastic Timer adaptation algorithm.

Figure 5 :

 5 Figure 5: Stochastic timer update process.

Figure 6 :

 6 Figure 6: Completeness evaluation VS number of nodes (scenario1).

Figure 7 :

 7 Figure 7: Completeness evaluation VS number of crashes (scenario2).

Figure 8 :

 8 Figure 8: Accuracy evaluation VS number of nodes (scenario1).

Figure 9 :

 9 Figure 9: Accuracy evaluation VS number of crashes (scenario2).

Figure 10 :

 10 Figure 10: Detection and Recovery time.

Figure 11 :

 11 Figure 11: Data Loss Rate.

Figure 12 :

 12 Figure 12: Performance of energy consumption.

  tributed systems and study their application in WSN with respect to a set of proposed classification criteria. Then, we define a general failure detection model that can be used in WSN while considering packet loss, environment constraints and resource limits. Our model, called AFDEL, extends eventually strong ♦S class to ♦S al using adaptive timer and local interactions.Besides, we illustrate how AFDEL model is used, by introducing three different timer adaptation techniques (ASAT, CSAT, HAT), each with distinctive preferences and goals in what relates to accuracy, completeness and recovery delay. We carried out extensive simulations using Mixim/Omnet++ to evaluate the performance of our techniques and compare them against some solutions from the literature. Finally, our evaluation allows to make some recommendations on the AFDEL-based technique to use depending on application requirements (

Table 1 :

 1 Unreliable failure detector classes.

				Accuracy
			Strong Weak	Eventually Eventually strong weak
		Strong	P	S	♦P	♦S
	Completeness	Weak	Q	W	♦Q	♦W

Table 2 :

 2 Panorama of Failure Detectors.

	Failure Detec-tor	Paradigm	ConnectivityLinks	Class
	Aguilera et al.

Table 3 :

 3 Discussion of Failure Detectors in WSN.

	Failure Detec-tor	Advantage		Drawback	Observation
		-Perfect system model for
	Aguilera et al. [2]	WSN -Update mistaken suspicion -Extend previous work with	-Resource demanding -Extra-Data exchange	Quiescent algo-rithm
		lossy links
	Bonnet et al. [7]	-Anonymous -Asynchronous		-Lossy link intolerance	Consensus
				-Lossy link intolerance
	Bonnet et al. [8]	Asynchronous		-Fully connected	k-set ment	agree-
	Mostefai et al. [9]	Asynchronous		Lossy link intolerance	f-covering
					-f-covering
		-Update mistaken suspicion		-
		-Mobility		-Resource demanding	responsiveness
	Sens et al. [10]	-Anonymous		-Lossy link intolerance	& member-
		-Dynamicity			ship proper-
					ties
		-Mobility		-Lossy link intolerance	-Require
		-Anonymous		-Energy-demanding	at least d
	Greve et al. [11]	-Update mistaken suspicion	-Extra-Data	neighbors
	Greve et al. [12]	-Query-Response mechanism -Local asynchronous interac-tion	-No simulation test, no algo-rithm proof -Generic solution for wireless networks	CH consensus election,
	Hayashibara et al. [13]	-2 new properties (accrue-ment & unknown bound)	-Not designed for WSN (tested on LAN) -No energy-efficiency	Tested on LAN
	Rost et al. [14]	-Decrease of false positive rate -Aggregation and incremental difference	-No (analysis/evaluation) energy consideration -Hardly scalable because of the routing tree constraint
		-Resources	management
	Branch et al. [15]	(energy consumption, band-width) -WSN model	-Applied for data outliers only -No sensor failure detection	Can be tailored for byzantine failures
		-Accuracy
	Chen et al. [16]	-WSN model		Only sensor hardware failures

edgment to the source after every packet reception. Otherwise, the sender suspects the receiver of having crashed. Both heartbeat and acknowledgment mechanisms are not suitable for WSN where processes are limited in energy and communication bandwidth.

  It is important to notice that F DT is defined between two consecutive neighbors instead of any couple of nodes. This allows more accurate calculation of F DT that relies then on local predictable transmission delay without requiring knowledge about the entire system composition and network topology. Nevertheless, local suspicions and mistakes will propagate throughout the network. We take into consideration all notifications in route maintenance for the overall nodes of the WSN. We present thereby, a new failure management class for WSN, namely Eventually Strong class (see section 2)

F DT to circumvent this obstacle: we define a new failure detector as a general model for WSN. We call this model AFDeL; Adaptive Failure Detector for Low power lossy WSN. AFDEL brings two new properties of accuracy and completeness: one-hop accuracy and one-hop completeness. Moreover, we introduce an adaptive timer strategy. This strategy makes use of a stochastic approach to determine dynamic timer F DT taking into consideration loss ratio, links state, transmission delay, etc. We illustrate the use of this strategy by proposing three detection techniques based on AFDeL general model. Each technique defines different application requirements in terms of completeness and accuracy. for Adaptive Local detection; ♦S al . This class adapts the properties of even-

  The basic principle of our model is to piggyback failure suspicion on the data messages, and dispatch this information hop by hop. Hence, in addition to application data, we add up Suspected i list to each message. AFDEL module for pro-Receive(msg) aims to update suspected set according to the one piggybacked on the received message delivered from the downward layer. It tries also to discover previous mistaken suspicions in order to delete the corresponding nodes from suspected list. First, P i retrieves information, namely, suspected set with its source node P j (line 10), then it stops F DT ij , since P i has successfully received message from P j (line 11). P i checks then if P j (the source) was recently suspected in order to delete it from Suspected i set (line 12). After that, NetLayer.Receive sends the new message msg to the upward layer (line 15). Finally, P i calls the UpdateLists procedure in order to treat the received information about suspicions (and mistakes) in P j 's message. The two loops of procedure UpdateLists handle information about suspected (respectively erroneously suspected) processes. Thus, for each suspected node P s included in Suspected j set, P i includes P s in its Suspected i (lines[START_REF] Chen | Distributed fault detection of wireless sensor networks[END_REF][START_REF] Nunes | Qos of timeout-based self-tuned failure detectors: the effects of the communication delay predictor and the safety margin[END_REF][START_REF] Heinzelman | Energy-efficient communication protocol for wireless microsensor networks[END_REF]. Moreover, if there is a node P m notified as a previous mistaken suspicion by P j , P i removes P m from its Suspected i (lines[START_REF] Greve | Eventually Strong Failure Detector with Unknown Membership[END_REF][START_REF] Larrea | Optimal implementation of the weakest failure detector for solving consensus[END_REF][START_REF] Wang | Finite-state markov channel-a useful model for radio communication channels[END_REF]. The mistake is detected if Suspected j does not contain P m while the latter is still in

cess P i is described in figure

3

. It is composed of two main primitives (send & receive) and two procedures (UpdateList & Timer.Fire): The primitive AFDEL.Send(msg) includes Suspected i set in the message msg originated from the upper layer (line 2). After piggybacking the information, P i sends the new message to the downward layer (line 3) in order to forward it to the destination node. Then, P i initializes a new timer for every correct known neighbor; say F DT ij for node P j awaiting for the next message (lines 4-7). If any F DT ij runs out , Timer.Fire(P j ) is triggered (line 23); that is, P i suspects P j of being faulty. The new suspicion information is then inserted in Suspected i (line 24). This suspicion will be included in the next data message when AFDEL.Send is executed again. The second primitive AFDEL.

Table 4 :

 4 Variables definition for Timer Adaptation

	Variable	Definition
	F DT	Failure Detection Timer: to be defined
		and updated by the algorithm.
	I f	Forwarding Interval: defines interval of
		sending periodic data packets
	TBL	Tolerated Burst Loss: defines delay to
		tolerate for intermittent failures follow-
		ing the burst loss model BLL (see sec-
		tion 4)
	SHC	Sink Hops Count: defines number of
		hops separating the node from the
		sink.
	WDR	Wrong Detection Rate:defines the false
		positive rate during detection.
	TWD	Tolerated Wrong Detection: defines
		the maximum degree of accepted
		wrong detection
	Tr	Reliability Threshold: introduced by
		the user in order to define the relia-
		bility of the failure detector allowing
		faster detection.

if W DR ≥ T W D) then 8: else if (1 -W DR) ≤ Tr then 10:

Table 5 :

 5 Simulation scenarios.

	Scenario	Nb nodes	Nb faults	Data Gather-ing Protocol	FD	Topology	Simulation period/ Iter-ations
					-HB
	Scenario 1	[20-200]	10% of total nodes	Directed Diffu-sion	-FaT2D -CSAT	-Random -Grid	5h / 50
					-ASAT	-Star
					-HAT
	Scenario 2	100	[10%-50%] of total nodes	Directed Diffu-sion	-HB -ASAT -FaT2D -CSAT	-Star -Random -Grid	5h / 50
					-HAT
	2. Detection and recovery performances: every detection mechanism aims
	to notify crashes in the network in order to recover the routing path and
	stop the failure effect. For this reason, Detection and Recovery Periods
	are performed with Packet Loss Rate. These measurements test how
	fast is the detection technique and its impact on data message loss.
	3. Resource management: since WSN are resource-limited, we deem nec-
	essary to evaluate and compare both Energy Consumption and Over-
	head (amount of messages in the network) for each implemented tech-
	nique.

Table 6 :

 6 Synthesis of performance evaluation.

		FD properties	Detection & Recovery	Resources management
		Completeness	Accuracy	Recovery time	Data loss rate	Energy	Overhead
	HB(timer-free)	+	+++	+	+	++	+
	Fat2D(static-timer)	++	++	+++++	+++++	++++	+++ (1)

Table 6 )

 6 . If reducing false positive rate is at premium, then ASAT would be preferable, especially for dense networks. Conversely, if detecting all failures is more important than avoiding mistakes, then CSAT would represent the best choice. Furthermore, HAT helps to enhance the detection time and data delivery, particularly in small-size networks and mainly in case where intermittent failures are more frequent while approaching the sink region. Note that HAT relies only on the distance separating the monitoring node from the sink. However, SAT techniques use in-time network statistics to update timer. This may induce extra processing time and resource overhead. For this reason HAT shows better results compared to SAT with respect to resource overhead.As an extension to this work, we suggest to investigate the use of this model considering other WSN constraints such as mobility, security and heterogeneity.

This is always satisfied except in the case where the faulty node isolates the network in two separate sub-graphs (i.e. the faulty node was a Single Point of Failure).

The third model is Event-driven.

Interval of confidence

We have constructed an interval of confidence for all simulation results. To this end, we have used the formula with 95% of probability that true mean values lies in the following range :

Where:

x: the mean value of the sequence of simulation results during As illustration, we show in graph of figure 14 the mean value of completeness rate with their interval of confidence for HAT technique. Notice that the maximum value of error range is [-0.6, +o.6]. These values allow to rely on simulation scenario results and make reliable synthesis.