Jean-Charles Fabre

Michal Lauer

Matthieu Roy

Matthieu Amy

William Excoffon

Miruna Stoicescu

Towards Resilient Computing on ROS for Embedded Applications

Systems are expected to evolve during their service life in order to cope with changes of various natures, ranging from fluctuations in available resources to additional features requested by users. For dependable embedded systems, the challenge is even greater, as evolution must not impair dependability attributes. Resilient computing implies maintaining dependability properties when facing changes. Resilience encompasses several aspects, among which evolvability, i.e., the capacity of a system to evolve during its service life. In this paper, we discuss the evolution of systems with respect to their dependability mechanisms, and show how such mechanisms can evolve accordingly. From a component-based approach that enables to clarify the concepts, the process and the techniques to be used to address resilient computing, in particular regarding the adaptation of fault tolerance (or safety) mechanisms, we show how Adaptive Fault Tolerance (AFT) can be implemented with ROS. Beyond some implementation details given in the paper, we draw the lessons learned from this work and discus the limits of this runtime support to implement such resilient computing features in embedded systems.

I.

INTRODUCTION

Evolution during service life is inevitable in many systems today. A system that remains dependable when facing changes (new threats, change in failures modes, updates of applications) is called resilient. The persistence of dependability when facing changes is called resilience [START_REF] Laprie | From Dependability to Resilience[END_REF]. Resilient computing encompasses several aspects, among which evolvability, i.e., the capacity of a system to evolve during its service life. On the other hand, dependability relies on fault-tolerant computing at runtime, enabled by Fault Tolerance Mechanisms (FTMs) attached to the application. As such, one of the key challenges of resilient computing is the capacity to adapt the FTMs attached to an application during its operational life.

One important aspect of a dependable system design is the definition of the fault model. This fault model considers both hardware and software faults may lead to failure modes that impair the correct behavior of the system. In critical systems, such failure modes may violate safety properties. The role of the safety analysis (e.g. using the FMECA method, FMECA stands for Failure Modes, Effects and Criticality Analysis) is to identify the failure mode and then define the safety mechanisms to prevent the violation of safety properties. Such safety mechanisms rely on basic error detection and recovery mechanisms, namely fault tolerance techniques following Laprie's terminology. Such safety mechanisms are based on Fault Tolerance Design Patterns that can be combined together. The safety analysis is often done a priori according to the fault model that had been defined.

During the operational life of the system, several situation may occur. New threats may lead to revise the fault model (electromagnetic perturbations, obsolescence of HW components, Software aging, etc.). A revision of the fault model has consequences on the fault tolerance mechanisms to be used. In other words, the validity of the fault tolerance mechanisms of safety mechanisms (whatever you want to call them) depends on the representativeness of the fault model. In a certain sense, a bad choice of the fault model may lead to pay for useless mechanisms in both normal operation and erroneous situations. This has an obvious side effect on the performance and on the dependability measures (reliability, dependability) respectively. This means that a change in the definition of the fault model implies a change in the fault tolerance mechanisms.

Beyond the fault model, there are other sources of changes.

Resources changes may also impair some safety mechanisms that rely on hardware resources. A typical example is the lost of processing units, but simply a loss in networks bandwidth may invalidate some fault tolerance mechanisms from a timing viewpoint.

Application changes are more and more frequent during the operational lifetime. This is obvious for many conventional applications (e.g. mobile phones) but it is becoming also needed for more critical embedded systems. This is the case for long living systems like space or avionics systems, but also in the automotive domain, not only for maintenance purposes but also of commercial reasons. The evolution of the specification during the lifetime of a system is a fact, it follows the evolution of the user requirements or needs. The notion of versioning (updates) or the loading of additional features (upgrades) may lead to change the assumptions on top of which the implementation of FT mechanisms rely. Such change implies revisiting the FMECA spreadsheets but also the implementation of the FT mechanisms. Some FT mechanisms rely on strong assumptions regarding the behavior of the application, and everybody knows in the dependability community the importance of the coverage of such assumptions [START_REF] Powell | Failure Mode Assumption and Assumpion Coverage[END_REF].

As a conclusion, the safety mechanism must remain compliant with all assumptions in terms of fault model, resources and application characteristics during the whole lifetime of the system. Their efficiency relies on this statement.

In this paper, we first motivate the issue and then report on an approach taking advantage of Component Based Software Engineering technologies for tackling this crucial aspect of resilient computing, namely the adaptation of fault tolerance mechanisms. We defined a minimal runtime support for implementing adaptive fault tolerance. The second part of this paper shows how this minimal runtime support can be implemented on ROS (Robot Operating System), presently used in many applications (robotics applications, automotive applications like ADAS -Advanced Driver Assistance Systems, or military applications). We illustrate the mapping of ideal components to ROS components and give implementation details of a fault tolerance design pattern that is adaptive at runtime. We finally draw the lessons learnt from our first experiments, discuss the limits of the exercise, and identify some promising directions.

In Section II we present the problem statement, and then summarize our Component-Based Software Engineering (CBSE) approach for adaptive fault tolerance in Section III. A full account of this approach can be found in [START_REF] Stoicescu | From Design for Adaptation to Component-Based Resilient Computing[END_REF]. The mapping of this approach to ROS is described in Section IV. The lessons learnt are given in Section V before concluding.

II. PROBLEM STATEMENT

The need for Adaptive Fault Tolerance (AFT) rising from the dynamically changing fault tolerance requirements and from the inefficiency of allocating a fixed amount of resources to FTMs throughout the service life of a system was stated in [START_REF] Kim | Adaptive Fault Tolerance: Issues and Approaches[END_REF]. AFT is gaining more importance with the increasing concern for lowering the amount of energy consumed by cyber-physical systems and the amount of heat they generate [START_REF] Krishna | Adaptive Fault-Tolerance for Cyber-Physical Systems[END_REF]. For Dependable systems that cannot be stopped for performing off-line adaptation, on-line adaptation of Fault Tolerance Mechanisms (FTMs) has attracted research efforts for some time now. However, most of the solutions [START_REF] Fraga | An Adaptive Fault-Tolerant Component Model[END_REF], [START_REF] Lung | An Infrastructure for Adaptive Fault Tolerance on FT-CORBA[END_REF], [START_REF] Marin | Towards Adaptive Fault-Tolerance for Distributed Multi-Agent Sys-tems[END_REF] tackle adaptation in a preprogrammed manner: all FTMs necessary during the service life of the system must be known and deployed from the beginning and adaptation consists in choosing the appropriate execution branch or tuning some parameters, e.g., the number of replicas or the interval between state checkpoints. Nevertheless, predicting all events and threats that a system may encounter throughout its service life and making provisions for them is impossible. The use of FTMs in real operational conditions may lead to slight updates or unanticipated upgrades, e.g., compositions of FTMs that can tolerate a more complex fault model than initially expected.

In both aeronautical and automotive systems, the ability to perform remote changes for different purposes is essential: maintenance but also updates and upgrades of embedded applications. The remote changes should be partial as it is unrealistic to reload completely an processing unit from small updates. This idea is recently promoted by some car manufacturers like Renault, BMW but also TESLA Motors in the USA stating in its website "Model S regularly receives over-the-air software updates that add new features and functionality". It is important to mention that performing remote changes will become very important for economic reasons, for instance selling options a posteriori since most of the evolution in the next future will rely on software for the same hardware configuration (sensors and actuators). In addition to this, the X-to-X applications (X being cars, planes or any smart critical objet) will imply rapid adaptation of onboard software to remain consistent with the network of X.

We propose an alternative to preprogrammed adaptation that we denote agile adaptation of FTMs. The term "agile" is inspired from agile software development [START_REF] Highsmithanda | AgileSoftwareDevelopment: The Business of Innovation[END_REF] that emphasizes the importance of accommodating change during the lifecycle of an application at a reasonable cost, rather than striving to anticipate an exhaustive set of requirements. Agile adaptation of FTMs enables systematic evolution: according to runtime observations of the system and of its environment, new FTMs can be designed off-line and integrated on-line in a flexible manner, with limited impact on the existing software architecture.

Evolvability has long been a prerogative of the application business logic. A rich body of research exists in the field of software engineering consisting of concepts, tools, methodologies and best practices for designing and developing adaptive software [START_REF] Mckinley | Composing Adaptive Software[END_REF]. Consequently, our approach for the agile adaptation of FTMs leverages advancements in this field such as Component-Based Software Engineering [9], Service Component Architecture [10] and Aspect-Oriented Programming [11].

The basic idea is the following. Fault Tolerance or Safety Mechanisms are developed as a composition of elementary mechanisms, e.g. basic design patterns for fault tolerance computing.

Using such concepts and technologies, we design FTMs as "Lego"-like brick-based assemblies that can be methodically modified at runtime through fine-grained changes affecting a limited number of bricks. This is the basic idea of our approach that maximizes reuse and flexibility, contrary to monolithic replacements of FTMs found in related work, e.g., [START_REF] Fraga | An Adaptive Fault-Tolerant Component Model[END_REF], [START_REF] Lung | An Infrastructure for Adaptive Fault Tolerance on FT-CORBA[END_REF], [START_REF] Marin | Towards Adaptive Fault-Tolerance for Distributed Multi-Agent Sys-tems[END_REF].

However, most of software runtime supports used in embedded systems today do not rely on dynamic CBSE concepts. AUTOSAR, for instance, relies on very static system engineering concepts and does not provide today much flexibility [START_REF] Martorell | Partial Updates of AUTOSAR Embedded Applications -To What Extent?[END_REF]. A new approach enabling remote updates to be carried out, including for safety mechanisms, is required.

ROS seems an appealing candidate for the dynamic composition of safety mechanisms. ROS is described as 1 : ROS is an open-source, meta-operating system for your robot. It provides the services you would expect from an operating system, including hardware abstraction, low-level device control, implementation of commonly-used functionality, message-passing between processes, and package management. It also provides tools and libraries for obtaining, building, writing, and running code across multiple computers. ROS can be viewed as a middleware running on top of a Unix-based operating system (typically Linux). ROS is used in robotics applications (e.g. Robonaut 2 from NASA within the ISS) but also in other industry sectors, the automotive industry for instance. This middleware provides a weak component approach and means to dynamically manipulate system configuration. It is open-source, its user community is very large and it is used for critical application e.g. at NREC (The National Robotics Engineering Center in Pittsburgh) for unmanned military vehicles (e.g. the Crusher).

III. ADAPTIVE FAULT TOLERANCE

A. Basic concepts for AFT

Some basic concepts must be discussed to address the problem of Adaptive Fault Tolerant computing. Three essential concepts must be discussed beforehand:

• Separation of concerns: this concepts is now well known, it implies a clear separation between the functional code, i.e. the application, and the non-functional code, i.e. the fault tolerance mechanisms in our case. The connection between the application code and the FTM must be clearly defined as specific connections. This means that the FTMs can be disconnected and replaced by a new one provide the connectors remains the same.

• Componentization: this concepts means that any software components can be decomposed into smaller components. Each component exhibit interfaces (services provided) and receptacles (services required). This means that any FTMs can be decomposed into smaller pieces, and conversely that an FTM is the aggregation of smaller. The ability to manipulate the binding between components (off-line but also on-line) is of high interest for AFT.

• Design for adaptation: the adaptation of software systems imply that (i) the software itself has been analyzed with adaptation in mind for later evolution using componentization (although all situations cannot be anticipated) and (ii) designed to simplify their adaptation including from a programming viewpoint (e.g. using object-oriented, aspect-oriented programming concepts).

Such basic concepts have been established and validated through various steps of analysis of fault tolerance design patterns and after several design and implementation loops, as discussed in [START_REF] Stoicescu | Architecting Resilient Computing Systems: A Component-based Approach[END_REF].

The main benefits of AFT with respect to pre-programmed adaptation is clear, it provides means to define and update dependability mechanisms later during the lifetime of the system. Pre-program adaptation implies that all possible undesirable situations are defined at design time, which is difficult to anticipate regarding new threats (attacks), new failure modes (obsolescence of components), or simply adverse situations that have been ignored or forgotten during the safety analysis. In short, fine grain adaptation of FTMs improves maintainability of the system from a non-functional viewpoint.

B. Change Model

The choice of an appropriate fault tolerance mechanism (FTM) for a given application depends on the values of several parameters. We consider three classes of parameters: 1) fault tolerance requirements (FT); 2) application characteristics (A); 3) available resources (R). We denote (FT,A,R) as change model. At any point in time, the FTM(s) attached to an application component must be consistent with the current values of (FT, A, R).

The three classes of parameters enable to discriminate FTMs. Among fault tolerance requirements FT, we focus, for the time being, on the fault model that must be tolerated. Our fault model classification is based on well-known types [START_REF] Seinturier | A Component-Based Middleware Platform for Reconfigurable Service-Oriented Architectures[END_REF], e.g., crash faults, value faults, development faults. In this work, we focus on hardware faults but the approach is perfectly reproducible for FTMs that target development faults.

The application characteristics A that we identified as having an impact on the choice of an FTM is: application statefulness, state accessibility and determinism. We con-sider the FTMs are attached to a black-box application. This means there is no possibility to interfere with its internals, for tackling non-determinism, for instance, in case an FTM only works for deterministic applications. Resources R play an important part and represent the last step in the selection process. FTMs require resources such as bandwidth, CPU, battery life/energy. In case more than one solution exists, given the values of the parameters FT and A, the resource criterion can invalidate some of the solutions. A cost function can be associated to each solution, based on R.

Any parameter variation during the service life of the system may invalidate the initial FTM, thus requiring a transition towards a new one. Transitions may be triggered by new threats, resource loss or the introduction of a new application version that changes the initial application characteristics. A particularly interesting adaptation trigger is the fault model change. Incomplete or misunderstood initial fault tolerance requirements, environmental threats such as electromagnetic interferences or hardware aging may change the initial model to a more complex one.

C. FT Design Patterns and Assumptions

To illustrate our approach, we consider some fault tolerance design patterns (design patterns of FTMs) and discuss their underlying assumptions and resource needs. Any change that invalidates an assumption or implies an unacceptable resource change calls for an update of the FTMs.

Duplex protocols tolerate crash faults using passive (e.g. Primary-Backup Replication denoted PBR), or active replication strategies (e.g. Leader-Follower Replication denoted LFR). In this case, each replica is considered as a selfchecking component, the error detection coverage is perfect. The fault model includes hardware faults or random operating system faults (no common mode faults). At least 2 independent processing units are necessary to run this FTM.

Two design patterns tolerating transient value faults are briefly discussed here. Time Redundancy (TR) tolerates transient physical faults or random runtime support faults using repetition of the computation and voting. This is way to improve the self-checking nature of a replica, but it introduces a timing overhead. Assertion&Duplex (A&D) tolerates both transient and permanent faults. It's a combination of a duplex strategy with the verification using assertions of safety properties that could be violated by a value fault or by a random runtime support error.

Assumptions / FTM PBR LFR TR A&D Fault Model (FT) crash    transient   Application behaviour (A) Deterministic   () State access  () Resources (R) Bandwidth high low nil (TDB) # CPU 2 2 1 2

Fig. 1. Assumptions and fault tolerance design patterns charateristics

The underlying characteristics of the considered FTMs, in terms of (FT,A,R), are shown in Fig. 1. For instance, PBR and LFR tolerate the same fault model, but have different A and R. PBR allows non-determinism of applications because only the Primary computes client requests while LFR only works for deterministic applications as both replicas compute all requests. LFR could tackle non-determinism if the application was not considered a black-box, as in our approach. PBR requires state access for checkpoints and higher network bandwidth (in general), while LFR does not require state access but generally incurs higher CPU costs (and, consequently, higher energy consumption) as both replicas perform all computations.

During the service life of the system, the values of the parameters enumerated in Fig. 1 can change. An application can become non-deterministic because a new version is installed. The fault model can become more complex, e.g., from crash-only it can become crash and value fault due to hardware aging or physical perturbations. Available resources can also vary, e.g., bandwidth drop or constraints in energy consumption. For instance, the PBR→LFR transition is triggered by a change in application characteristics (e.g. inability to access application state) or in resources (bandwidth drop), while the PBR→A&D transition is triggered by a change in the considered fault model (e.g. safety property verification). Transitions can occur in both directions, according to parameter variation.

The priority is the fault model, the selection of the solution (i.e. the composition of several FTMs) depending on the application characteristics and the available resources. The final objective is always to comply with the dependability properties during the service lifetime.

D. Design for adaptation of FTMs

Our "design for adaptation" aims at producing reusable elementary components that can be combined to implement a given fault tolerance or safety mechanism. Any FTM follows the generic Before-Proceed-After metamodel. Many FTMs can be mapped and combined using this model, as shown in Fig. 2 Composition implies nesting the Before-Proceed-After metamodel. This approach improves flexibility, reusability, composability and reduces development time. Updates are minimized since just few components have to be changed.

E. Runtime support

The software runtime support must provide key features to manipulation the component graph. Any application or an FTM is perceived as a graph of components. From previous experiments reported in [START_REF] Stoicescu | Architecting Resilient Computing Systems: A Component-based Approach[END_REF], the following primitive are required.

• Dynamic creation, deletion of components;

• Suspension, activation of components;

• Control over interactions between components for the creation and the removal of connections (bindings);

Our first implementation was done on a reflective component-based middleware, FRASCATI [START_REF] Seinturier | A Component-Based Middleware Platform for Reconfigurable Service-Oriented Architectures[END_REF] providing a scripting language to manipulate the component graph, FScript [START_REF] Leger | Reliable Dynamic Reconfigurations in a Reflective Component Model[END_REF]. The proposed approach is reproducible on any other support that provides these features.

IV. ADAPTIVE FAULT TOLERANCE ON ROS

The main goal of ROS is to allow the design of modular applications: a ROS application is a collection of programs, called nodes, interacting only through message passing. Developing an application involve the assembly of nodes, which is akin to component-based approaches. Such an assembly is referred to as the computation graph of the application.

A. Component model and reconfiguration

Two communication models are available in ROS: a publisher/subscriber model and a client/server one. The publisher/subscriber model defines one-way, many-to-many, asynchronous communications through the concept of topic. When a node publishes a message on a topic, it is delivered to every nodes subscribing to this topic. Note that a publisher is not aware of the subscriber to its topic nor the other publishers. The client/server model defines bidirectional transaction (one request/one reply) synchronous communications through the concept of service. A node providing a service is not aware of the client nodes that may use its service. These high-level communication models allows to add, replace or delete nodes in a transparent manner, either offline or online.

To provide this level of abstraction, each ROS application includes a special node called the ROS Master. It provides registration and lookup services to the other nodes. All nodes register services and topics to the ROS master. It is the only node that has a comprehensive view of the computation graph. When a node issues a service call, it queries the master for the address of the node providing the service and then it sends its request to this address.

In order to be able to add fault-tolerance mechanisms to an existing ROS application in the most transparent manner, we need to implement interceptors. An interceptor provides a means to insert functionality, such as safety or monitoring nodes, into the invocation path between two ROS nodes. To this end, a relevant ROS feature is its remapping capability. At launch time, it is possible to reconfigure the name of any services or topics used by a node. Thus, requests and replies between nodes can be rerouted to interceptor nodes.

B. Implementing a componentized FT design pattern

A full implementation on ROS of a duplex FT design pattern, a Primary Backup Replication (PBR) combined with a Time-Redundancy (TR) design pattern is developed here.

1) Generic Computation Graph

We have identified a generic pattern for the computation graph of a FTM. Figure 3 shows its application in the context of ROS. Node Client uses a service provided by Server. The FTM computation graph is inserted between the two thanks to the ROS remapping feature. Since Client and Server must be re-launched for the remapping to take effect, the insertion is done offline. The FTM nodes, topics, and services are generic for every FTM discussed in section II. Implementing a FTM consist in specializing the before, proceed, and after nodes with its corresponding behavior (see Fig. 3). We illustrate the approach, through a Primary-Backup Replication (PBR) mechanism added to the Client/Server application in order to tolerate a crash fault of the Server. Fig. 4 presents the associated architecture. Three machines are involved: the Client, which is also hosting the ROS, master, the MASTER site hosting the primary replica and the SLAVE site hosting the backup replica. For the sake of clarity, the symmetric topics and services between MASTER and SLAVE are not represented. Elements of the slave are suffixed with "_S".

2) Implementing PBR

We present the behavior of each node, the topics/services used through a request/reply exchange between a node Client and node Server (see Fig. 4).

• Client sends a request to Proxy (service clt2pxy);

• Proxy adds an identifier to the request and transfers it to Protocol (topics pxy2pro);

• Protocol checks whether it is a duplicate request: if so, it sends directly the stored reply to Proxy (topics pro2pxy).

Otherwise, it sends the request to Before (service pro2bfr);

• Before transfers the request for processing to Proceed (topics bfr2prd); no action is associated in the PBR case, but for other duplex protocol, Before may synchronize with the other replicas;

• Proceed calls the actual service provided by Server (service prd2srv) and forwards the result to After (topics prd2aft);

• After gets the last result from Proceed, captures Server state by calling the state management service provided by the server (service aft2srv), and builds a checkpoint based on this information which it sends to node After_S of the other replica (topics aft2aft_S);

• Protocol gets the result (topics aft2pro) and sends it to Proxy (topics pro2pxy);

• On the backup replica, After_S transfers the last result to its protocol node Proto_S (topics aft2pr_S) and sets the state of its server to match the primary.

In parallel with request processing, the node crash detector on the MASTER (noted CD) periodically gives a proof of life to the crash detector (CD_S) on the SLAVE to assert its liveliness (topics CD2CD_S). If a crash is detected, then the crash detector of the slave notifies the recovery node (topics CD_S2rcy). This node has two purposes: (i) in order to enforce the fail-silent assumption, it must ensure that every node of the MASTER are removed; (ii) it switches the binding between the Client proxy and the MASTER protocol to the SLAVE protocol. Thus, the SLAVE will receive the Client's requests and will act as the Primary, changing its operating mode. ROS does not provide APIs to dynamically change bindings between nodes. The node developer must implement the transition logics. The SLAVE protocol spins waiting for a notification from recovery (topics rcy2pro_S). This is done using the ROS API: background threads, within a node, check for messages independently of the node's main functionality. Upon reception of this topic, protocol subscribes to topic pxy2pro and publishes to topic pro2pxy. After this transition, the proxy forwards the Client's requests to the Slave protocol.

3) Impact on the existing application

From the designer viewpoint, there are two changes required to integrate a FTM computation graph to its application. First, Client will have to be remapped offline to call the proxy node's service instead of directly the Server. Second, state management services, to get and set the state of the node, must be integrated to the Server. Form an objectoriented viewpoint any server inherits from an abstract class stateManager providing two virtual methods, getState and setState, overridden during the server development. C. Implementing a componentized FT design pattern 1) Generic Computation Graph: We identified a generic pattern for the computation graph of a FTM. Figure 1 shows its application in the context of ROS. Node Client uses a service provided by Server. The FTM computation graph is inserted between the two thanks to the ROS remapping feature. The FTM nodes, topics, and services are generic for every FTM discussed in section II. Implementing a FTM consist in specializing the before, proceed, and after nodes with its corresponding behavior (see table X).

We illustrate the approach, through a Primary-Backup Replication (PBR) mechanism added to the Client/Server application in order to tolerate a crash fault of the Server. Figure 2 shows the architecture. Three machines are involved : the CLIENT which is also hosting the ROS master, the MASTER hosting the primary replica and the SLAVE hosting the backup replica. For the sake of clarity, the symmetric topics and services between MASTER and SLAVE are not represented. Elements of the slave are suffixed with " S"

We present the behavior of each nodes, the topics/services used through a request/reply exchange between a node Client and node Server.

• Client sends a request to Proxy (service clt2pxy);

C. Composition of FT mechanisms

The generic computation graph for FTM is designed for composability. In this section, the composition scenario is two-fold. We first illustrate the composition of two FTMs, PBR for crash faults and TR for transient value faults. Initially the application was installed with PBR. From an operational standpoint, at a given point in time, transient faults impacting numerical calculations appeared due to hardware components aging or sudden increase of environmental radiations. In a second step, later on, we consider that the communication channel between client and server can be the target for intrusions. Cryptographic protocols, based for instance on a simple Public Key Infrastructure (PKI), can be used to cipher communications and add cryptographic signatures.

1) Composition of PBR and TR on ROS

With respect to request processing, a Protocol node and a Proceed node present the same interfaces: a request as input, a reply as output. Hence, a way to compose mechanisms is to replace the Proceed node of a mechanism by a Protocol and its associated Before/Proceed/After nodes, as shown in Fig. 6.

Our approach enables developing a new mechanism on the foundation of several existing ones. This improves the development time and the assurance in the overall system, since all mechanisms have been validated off-line by test and fault injection techniques.

The architecture of the composite FTM made of PBR and TR is given in Fig. 5. This figure is an extension of Fig. 4 where the Proceed node of the PBR has been replaced with the Protocol node of the TR implementation.

2) Composing FTM with Cryptographic protocols

The generic computation graph presented in Fig. 3 enables cryptographic protocols to be seamlessly added to an application, already equipped with accidental fault tolerance mechanisms, PBR and TR in our example. The cryptographic mechanism (called SEC for security) is located at both the client (SEC_C) and the server side (SEC_S) as shown in Fig. 7). On the server side, SEC operates before PBR and TR. In this example, we only deal with possible intrusions between the client and the server.

We assume that a node implements the Certification Authority (CA). between the Client proxy and the Master protocol to the Slave protocol. Thus, the Slave will receive the Client's requests and will act as the Primary, changing its operating mode.

Note that ROS does not provide APIs to dynamically change bindings between nodes. The transition logic must be implemented by the developper in the nodes. For instance, the Slave protocol spins waiting for a notification from recovery (topic rcy2pro S). This is carried out by background threads within a node independently of its main functionality. We use some ROS API for this. Upon reception of this topic, protocol advertise that it is providing service 2 (as defined in figure X). Further request from the Client will now be forwarded by the proxy to the Slave protocol becoming now primary.

2) Impact on the existing application: Form the application designer point of view, there are two main changes required to integrate a FTM computation graph to its application. First, Client will have to be remapped to call the proxy nodes service instead of directly the service of Server. Second, state management services, to get and set the state of the node, must be integrated to the Server. Form an Object Oriented viewpoint any server inherit from an abstract class stateManager providing two virtual methods, getState and setState. Both methods are overridden during the server development. the Master, respectively the Slave, to collect the certificate of the Client. We assume that all parties know CA's public key. We assume that, for each participant, Client or Server, Before and After of the SEC mechanism share the pair of private and public keys they received when initialized.

Before of the Client can then ciphers the request with ! !"# ! , the Server's public key, and adds a signature, using ! !"#$ ! the Client's private key;

Using the generic scheme given in Fig. 6, a message is sent by the client to the server side through a new topic (called Client_2_Server) connecting Before of SEC_C to Protocol of SEC_S.

Before of the Master deciphers the request with ! !"#$ ! , the Server's private key, and checks the signature, using ! !"# ! , the Client's public key;

The Server can then proceed with a valid deciphered request through PBR and TR.

Conversely, After of the Master ciphers the reply and computes a signature. After of the Client deciphers the reply, checks the signature, and finally delivers the reply to the Client.

The communication between Master and Slave can also be secured using a similar security protocol.

V. DYNAMIC COMPOSITION: TO WHAT EXTENT WITH ROS

A. Dynamic Adaptation of FTM Dynamic adaptation of FTM is required to provide continuity of service in resilient systems. The question is then: is it possible to safely adapt a FTM at runtime in the context of ROS? A set of minimal API required to guarantee the consistency of the transition between two different FTMs has been established in previous work [START_REF] Seinturier | A Component-Based Middleware Platform for Reconfigurable Service-Oriented Architectures[END_REF]:

• Control over components life cycle at runtime (add, remove, start, stop).

• Control over interactions between components at runtime, for creating or removing bindings.

Furthermore, ensuring consistency before, during and after reconfiguration, requires that no requests or replies are lost:

• Components are stopped in a quiescent state, i.e. when all internal processing has finished

• Incoming requests on stopped components must be buffered

With the exception of add and remove, ROS does not provide these APIs. However, these APIs can be emulated with dedicated logics in some nodes. For instance, we are using some binding control in the Primary to Backup switch described in our example. Controlling node lifecycle is more complex but can be done in the same manner and these principles can be applied in the context of dynamic adaptation, i.e. add new nodes at runtime and binding them in the computation graph.

The protocol node plays a central part to provide proper consistency during a transition. Indeed, our design pattern for FTM is such that only stateless nodes, namely before, proceed and after, need to change in order to switch from one FTM to the next. Thus, protocol does not need to be changed during a transition and it can be used to buffer messages and detect when the changing nodes are in quiescent state. To do this, protocol is extended to deal with three new messages. The first one is used to signal protocol that a transition is about to happen and it has to start storing incoming requests. The second one is published by protocol and confirms that the FTM is in a safe state and transition can be safely executed. In particular, the safe state is reached when protocol has received the replies of all pending requests. The third message is used to signal protocol that the transition has been executed and it can resume normal operation and release the requests stored during the transition.

Note that the described transition technique requires that an FTM is already in place in the system, meaning that the Client and the Server are already configured to use our proxy nodes. Installing an FTM in an application without interruption is not possible with ROS since control over binding at runtime is only possible with dedicated code within the nodes.

B. Implementing Dynamic Binding on ROS

Dynamic binding is not a core feature of ROS. As far as AFT is concerned, this is a major concept for runtime adaptation. However, ROS does not contain any API to control bindings online. In ROS, connections between nodes are based on pre-defined Topics and messages are sent/received through ports.

A Topic is defined by: • A name: ports are connected through a named Topic.

• A sending port: Publisher or Client sends messages.

• A receiving port: Subscriber or Server receives messages.

• A data type: a Topic is assigned a data type for messages.

Several Publishers and Subscribers can communicate on the same Topic according to a unique message format, a given data type. The connection of a new node to the system implies creating a new Topic with its own data type. Suppose that Node A and B are connected to a Node C. When the data type from A to C and B to C is different, then two Topics are needed. If the same data type is used, then just one Topic is needed.

We defined two types of dynamic bindings: a) dynamic binding on Pre-Defined Topics (PDT); b) dynamic binding on UnAnticipated Topics (UAT). Some topics can be pre-defined, for instance two topics, one between the Client and the primary, one between the Client and the backup in a PBR replication strategy. Others topics are unanticipated: some new topics are needed when a new node is created with a new data type for messages. This might be needed for the on-line composition of FTM later during the lifetime of the system.

Dynamic binding on PDT: This is the simpler case since Topics preexist in the ROS configuration. For example, in the PBR replication strategy, the two Protocols nodes (in the two replicas) are bound to the same topic, but the Slave's port is deactivated. The Proxy sends the request but only one Protocol node receives it.

A third Node, in our implementation the Recovery node, is used to activate the Slave's port when the Master crashes. A dedicated topic is defined and used to this aim. After recovery, the former Slave, i.e. new Master, can now listen to the Proxy and receive messages. It is the simplest way to dynamically bind Nodes since the same data type is used in this case.

Dynamic binding on UAT: In the case of unanticipated topics, the binding is a bit more difficult to achieve. Instead of reactivating a port, two communication ports must be created. Suppose that two nodes A and B must be connected at a given point in time through a new topic. The solution is based on:

• methods added to both A and B to create ports, one for the publisher, one for the subscriber;

• a third node used to trigger and control the creation of the channel (activation of the methods).

The Topic defined offline corresponds to one data type that is handled by the methods. The third Node is part of the implementation of AFT, in fact part of the implementation of an adaptation engine responsible for the manipulation the FTM configuration.

VI. LESSONS LEARNT AND CONCLUSION

Installing an FTM within a ROS application or adapting an existing FTM does not incur technical difficulties as long as the system's nodes (application + FTM) can be stopped and relaunched. Indeed, using the remapping capability of ROS implies rewriting some configuration files, which are taken into account only during the initialization of the nodes. For system where interruption of service is not an option, adaptation has to be done at runtime. In the context of ROS, this requires some additional software development.

Regarding the features of ROS for implementing AFT, we can say that they are not fully satisfactory. The main troubles relate to the dynamic binding on unanticipated topics and on the weak API to control components at runtime. However, ROS provides separation of concerns, since component can be mapped to nodes (Unix processes) that have their own address space. Dynamic binding is possible on pre-defined topics. For unanticipated topics, a customized solution was proposed in this work. Control over components relies on the underlying operating system to suspend and activate nodes, i.e. processes and threads, and to store input messages. However, ROS is an acceptable candidate for AFT, in other words, resilient computing using AFT can be implemented on ROS.

Regarding safety issues, the design of AFT and its validation is always carried out off-line. Any composition of mechanisms due to a change in the various axis of the change model denoted (FT, A, R) follows a design and validation process off-line that can be conformant to standards like DO178C or ISO26262, to comply with certification if needed. Some performance measurements have been obtained. The overhead of the FTM (composition of PBR+TR) is less than 10 ms (on a PC, Intel I7 Quad Core, 8 Go RAM). Actually, the real overhead is very dependent of the complexity of the application, in particular the handling of the application state, and the network performance. As a conclusion, the implementation of AFT on ROS is independent from the application and the network.

Fig. 3 .

 3 Fig. 3. Generic computation graph for FTM

Fig. 4 .

 4 Fig. 4. Computation graph of a PBR mechanism

Fig. 1 .

 1 Fig. 1. Generic computation graph for FTM

Fig. 5 .

 5 Fig. 5. Composition principle of FT mechanisms (PBR+TR).

Fig. 6 .

 6 Fig. 6. Composition principle of FT mechanisms.

Fig. 7 .

 7 Fig. 7. Composition principle of SEC with other FT mechanisms.

Fig. 3 .

 3 Fig. 3. Composition of FTM mechanisms

  .

	FTM	Before	Proceed	After
	PBR (primary)		Compute	Checkpointing
	PBR(backup)			State update
	LFR (leader)	Forward request	Compute	Notify
	LFR (follower)	Handle request	Compute	Handle notification
	TR	Save/restore state	Compute	Compare
	A&D		Compute	Assert
	Fig. 2. Generic execution scheme for FT design patterns

ttp://wiki.ros.org/ROS/Introduction


Julien Andrieu
email: julien.andrieu@unice.fr

Paysages forestiers et agro-forestiers en changement dans la partie septentrionale des Rivières du Sud (Afrique de l'Ouest)

La bande littorale de l'Afrique de l'Ouest entre le delta du Sine-Saloum et le Rio Mansôa correspond à la transition du soudanien vers le guinéen. Les paysages forestiers s'y différencient en fonction de trois critères : le gradient climatique nord-sud, l'alternance bas plateaux -bas-fonds -vasières et les pratiques sur ces milieux de différentes sociétés paysannes. L'article cherche à mettre en évidence les conséquences des fluctuations de la pluviosité de 1936 à nos jours sur la végétation dans ses trois dimensions : phénologique, floristique, paysagère.

Les paysages forestiers et agro-forestiers considérés ont notablement changé au cours des dernières décennies. Ces changements concernent, sous réserve d'études plus poussées, peu le contenu botanique. En revanche la phénologie, étudiée par le biais de la fluctuation dans le temps de l'indice normalisé de végétation et l'occupation du sol, étudiée par analyse diachronique d'images multispectrales, ont varié dans des proportions fortes. L'étude de quelques finages permet de reconstituer les trajectoires paysagères : la succession d'années très sèches de la période 1968-1995 a souvent le rôle d'élément déclenchant, mais ce sont les changements sociaux et économiques qui ont été déterminants en modifiant souvent profondément les pratiques. Celles-ci ne doivent cependant pas, pour autant, a priori être interprétées négativement comme une dégradation du couvert végétal.

Introduction

La partie septentrionale des Rivières du Sud (fig. 1) entre le delta du Saloum et le Rio Mansôa dans le nord de la Guinée-Bissau, en passant par la Gambie et la Casamance, constitue une bande de territoires où alternent vasières à mangrove et bandes de terre ferme couvertes par des savanes plus ou moins denses ou des palmeraies. La physionomie du couvert végétal y est assez largement dominée par des formations ligneuses, diversifiées en fonction de la latitude et de la topographie. Ces paysages connaissent peu les usages forestiers proprement dits (Pélissier, 1966). Lorsque les usages agricoles ou pastoraux l'emportent, cela a été traduit par le terme d'agroforesterie [START_REF] Torquebiau | A renewed perspective on agroforestry concepts and classification[END_REF].

Ces paysages connaissent aujourd'hui des changements (;Tappan et al., 2004 ;[START_REF] Vasconcelos | Land cover change in two protected areas of Guinea-Bissau (1956 -1998)[END_REF] dont la nature et l'ampleur ne sont pas toujours bien précisées. Généralement, ces changements sont interprétés négativement comme signes d'une dégradation [START_REF] Dir | [END_REF][START_REF] Avenard Jean-Michel | Réflexions sur l'état de la recherche concernant les problèmes posés par les contacts forêts -savane[END_REF] qu'il est habituel d'attribuer, d'une part, à la longue période de péjoration des pluies (Heumann, 2007 ;[START_REF] Nicholson Sharon | On the question of the "recovery" of the rains in the West African Sahel[END_REF][START_REF] Dai Aiguo | The recent Sahel Drought is real[END_REF][START_REF] Le Barbé Luc | Rainfall climatology of the HAPEX Sahel region during the years 1950-1990[END_REF][START_REF] El | Recent changes of the mangroves of the Saloum River Estuary, Senegal, Mangroves and salt marshes[END_REF][START_REF] Bassel Mohamadane | Conséquence durable de deux décennies de sécheresse : l'hypersalinisation de la Casamance entre 1987 et[END_REF]), d'autre part, aux transformations démographiques, sociales et économiques [START_REF] Lericollais André | La mort des arbres à Sob en Pays serer (Sénégal)[END_REF][START_REF]Gestion et évolution des espaces aquatiques : la Casamance[END_REF][START_REF]Du riz, des poissons, des hommes. Stratégies paysannes des populations littorales de Rivières du Sud (Du Sénégal à la Sierra Leone)[END_REF][START_REF] Wright | The World and a Very Small Place in Africa. A history of globalization in Niumi, The Gambie[END_REF]Sidibé, 2005). Le plus souvent, les deux facteurs sont envisagés conjointement (Sà, 1994 ;[START_REF] Barusseau Jean-Paul | L'environnement physique[END_REF]Tappan et al., 2004). Le facteur politique doit ici être ajouté sur un terrain morcelé en trois états qui ont connu des colonisateurs différents et qui ont parfois été encore récemment, en Casamance et dans le nord de la Guinée-Bissau, en proie à des troubles non sans conséquence sur les paysages forestiers. L'étude, dont il est ici proposé quelques résultats tente d'analyser les évolutions de la végétation directement reliées à l'impact des fluctuations du climat. En effet, la région, à l'instar de l'ensemble de l'Afrique de l'Ouest, a connu une diminution de la pluviosité à la fin des années 1968. La figure 1a montre que cette diminution mesurée entre les périodes 1950 -1968 et 1968 -1994 Nous présenterons les résultats de trois analyses des changements : une analyse temporelle du NDVI ; une analyse des changements de la composition floristique et une analyse diachronique de la couverture du sol par la végétation. Une synthèse plus systémique de l'évolution de deux finages villageois permettra de replacer le facteur climatique dans les évolutions des systèmes ruraux.

1. La végétation a-t-elle réagi à la fluctuation de la pluviosité par une variation de son activité photosynthétique ? 2. La végétation a-t-elle réagi à la fluctuation de la pluviosité par une variation de la distribution de certaines espèces ?

Présentation synthétique de la méthode

Si la végétation a réagit sur le plan phénologique il est justifié de tester cette réaction sur le plan floristique. Or, contrairement à l'analyse de série temporelle de l'activité chlorophyllienne, l'étude du contenu botanique de la végétation ligneuse est à envisager de façon différente suivant que l'on se situe dans les vasières à mangrove ou sur la terre ferme. D'une richesse floristique beaucoup plus réduite que celle du bassin indo-pacifique (Schnell, 1952 ;[START_REF] Tomlinson Philip | Botany of mangroves[END_REF] Par ailleurs il a été montré que les résultats obtenus pour la fraction ligneuse ne différaient pas de ceux concernant l'ensemble de la flore [START_REF] Lecompte | Biogéographie de la montagne marocaine : le Moyen-Atlas central[END_REF][START_REF] Alexandre Frédéric | Entre Midis méditerranéen et atlantique, une transition phytoclimatique du Languedoc à l'Aquitaine[END_REF].

Pour la flore forestière soudano-guinéenne, A. Aubréville (1950) avait fait un choix identique.

152 espèces ligneuses ont ainsi été recensées. Des calculs probabilistes [START_REF] Michel | Une application de la théorie de l'information à l'étude de l'homogénéité et de la structure de la végétation[END_REF] ont été appliqués à ce jeu de données : la théorie de l'information appliquée aux analyses de la fréquence des espèces dans un lot de relevés offre, en effet, un outil précieux qui permet de décrire finement la structure spatiale de la flore. Par ailleurs, chaque relevé est accompagné de renseignements sur les principaux descripteurs écologiques (Emberger et Godron, 1968). Dans ce qui suit, la structure spatiale de la flore ligneuse est mise en relation avec le descripteur ressorti des analyses comme le plus efficace (quantité d'information de 2,77 sha) : le total annuel de précipitations évalué, pour chaque relevé, par interpolation spatiale des données stationnelles sur la période 1960-1995.

La probabilité élémentaire à calculer est celle de la table de contingence entre la présence ou l'absence de l'espèce et chacune des classes de pluviosité. L'information calculée est apportée par la connaissance du nombre de présences de chaque espèce dans chaque classe du descripteur. Plus cette distribution est exceptionnelle (exemple : Ficus vallis-choudae présente seulement dans les 3 relevés les plus méridionaux), plus l'information apportée est forte (probabilité entre 0,01 et 0,001 ; quantité d'information correspondante supérieure à 7 shannons), ce qui correspond à une liaison très significative avec la classe de pluviosité correspondante (total annuel supérieur à 1200 mm). Seules les espèces significativement liées à au moins une gamme pluviométrique sont présentées, le seuil de sélection est celui d'une liaison supérieure à 7 shannons. 3. La végétation a-t-elle réagi à la fluctuation de la pluviosité par une variation de la couverture du sol par les formations boisées ? L'interprétation des courbes radiométriques permet ensuite de définir, pour chaque classe, si l'espace est boisé ou non. La limite entre boisé et non boisé est établie grâce à l'existence de seuils radiométriques au niveau des rapports respectifs entre la luminance de la fin du visible et celle du proche infrarouge et entre ce dernier et l'infrarouge à ondes courtes. Les observations de terrain révèlent que ces seuils correspondent à un boisement d'un taux de recouvrement de 20 à 30 %. (1979-1988-2001) Or, ce bilan global masque de grosses disparités régionales : celles-ci apparaissent moins à l'échelle des grands bassins versants (Saloum, Gambie, Casamance, Nord de la Guinée-Bissau) qu'à celle de petites régions qui trouvent leur unité dans des facteurs ethnologiques ou naturels. Ainsi le Sine et les îles du Gandoul sont-ils caractérisés par la combinaison de la régression des mangroves et de la progression des boisements en terre ferme. La mangrove en régression dans le nord du delta du Saloum recule surtout par progression des tannes sur la mangrove. Le processus de tannification est lié à l'augmentation du sel et de l'acidité des sols par allongement des phases d'assèchement et par augmentation de la salinité des eaux libres [START_REF] Vieillefon | Les sols des mangroves et des tannes de Basse Casamance (Sénégal)[END_REF][START_REF] Marius | Mangroves du Sénégal et de la Gambie : écologie, pédologie, géochimie : mise en valeur et aménagement[END_REF]. Le taux de boisement en progression en arrière du delta dans le Sine l'est particulièrement dans les îles et les bas-fonds où les rizières sont abandonnées.

Résultats

A l'inverse, dans le Bas-Saloum continental et le Niumi, les boisements de terre ferme régressent. Deux explications sont avancées pour ce phénomène : le défrichement de forêts classées ou des boisements limitrophes (Sidibé, 2004) et la dégradation des systèmes agroforestiers [START_REF] Lericollais André | La mort des arbres à Sob en Pays serer (Sénégal)[END_REF]. En revanche, la mangrove est caractérisée par une stabilité assez remarquable, seule l'arrière-mangrove reculant localement, la tannification étant ici limitée.

Le Fogny gambien et casamançais présente des évolutions plus contradictoires qui se traduisent par une mosaïque complexe de tâches de stabilité, et de changements, le long des routes ou au contact avec les vasières. Loin des routes et des villages, les boisements sont stables sur de plus grandes superficies. Dans le Fogny gambien, les mangroves présentent, à l'instar des secteurs centraux et méridionaux du Saloum, une matrice stable et des taches linéaires de régression de la mangrove à la limite avec les tannes.

En Casamance, la mangrove a régressé à l'amont et progressé dans le secteur central (de Ziguinchor à la confluence du fleuve Casamance et de la rivière Diouloulou, surtout en rive nord). Dans la partie sud de la région, les boisements de terre ferme ont nettement progressé en proportion inverse de la régression notée de l'autre côté de la frontière au nord du Rio Cacheu.

En Guinée-Bissau, les presqu'îles de Canchungo et de Biombo-Quinhamel sont caractérisées par la stabilité des mangroves, voire à leur progression du fait de l'abandon de rizières [START_REF] Ecoutin Jean-Marc | Aménagement technique du milieu[END_REF] quelques secteurs de régressions sont au contraires liés aux nouveaux endiguements. En terre ferme on retrouve une mosaïque d'espaces non boisés aux deux dates, et de changements qui peuvent être tant durables et significatifs d'un changement réel, comme la mise en place de vergers d'anacardiers [START_REF] Vasconcelos | Land cover change in two protected areas of Guinea-Bissau (1956 -1998)[END_REF], que cycliques et marque d'une stabilité des usages, comme la culture itinérante sur brûlis.

Il résulte de la campagne d'explication des changements par les analyses de terrain que seules les dynamiques de la mangrove des trois deltas septentrionaux résultent directement de la fluctuation de la pluviosité.

Comment la fluctuation de la pluviosité est-elle rentrée en interaction dans les systèmes ruraux avec les autres facteurs d'évolution ?

En complétant cette approche par des relevés botaniques dans les cas de figure obtenus (progression, stabilité, régression) et par des enquêtes auprès des villages, on passe de la cinématique des paysages à une analyse de la dynamique des anthroposystèmes et à ses causes naturelles (fluctuations de la pluviosité) ou anthropiques (croissance démographique, changements dans les pratiques). On passe aussi d'une analyse proprement spatiale à une analyse systémique en termes de territoires.

Bani

En marge du delta du Saloum, Bani a des activités surtout tournées vers le continent comme en témoigne le faible nombre de pirogues. Les boisements y sont exploités sous forme de coupes d'éclaircies ou de coupes sur des placettes de petite taille (de 4 à 400 m²) où la régénération est ensuite bonne [START_REF] Ackermann Gabriela | Dynamique des paysages et perspective de développement durable sur la Petite Côte et dans le delta du Sine -Saloum (Sénégal)[END_REF]

Brefet

Brefet, village gambien situé à quelques dizaines de km au sud de Bani, s'en rapproche par le climat et les sols : le finage est, lui-aussi au contact entre vasière et terre ferme. Ici, cependant, des rizières occupent la partie haute de l'estran et le terroir agroforestier est absent. A priori, ni l'Etat ni les organisations internationales n'y ont laissé de structures de gestion forestière.

Les villageois de Brefet, confrontés eux-aussi à la sécheresse et à l'effondrement des cours de l'arachide, y ont répondu par un choix tout différent. D'une part, la culture de l'arachide (et du mil) a été abandonnée sur une partie des terres qui ont été mises en friche, ce qui a permis de mieux concentrer les apports en fumure sur les parcelles encore cultivées. D'autre part, un effort tout particulier a été déployé sur la riziculture qui s'est étendue sur les formations végétales ouvertes à Phoenix reclinata voisines.

Au début des années 1990, une nouvelle méthode de gestion forestière s'est introduite dans la région. Il a été attribué à une certaine partie du finage boisé un caractère communautaire et créé deux comités, un comité de gestion et un comité de surveillance. Des règles strictes et adaptées de prélèvement ont été mises en place et appliquées, les feux de brousse ont été éliminés de la région, toute forme d'exploitation non gérée par le village interrompue et le pâturage contrôlé. L'application de ces simples règles a eu un impact remarquable sur les paysages boisés et sur le village. La densification du boisement a, tout d'abord, été sensible. L'absence de feux de brousse et le contrôle du pâturage a mis fin à l'élimination quasi systématique des recrûs forestiers, menant à la mise en place d'une strate de jeunes arbres, généralement absente dans les savanes soudaniennes. Cette gestion forestière a aussi favorisé le développement du village. A Brefet, l'activité forestière a permis l'éclairage des rues et la construction d'un campement écotouristique. Ce mode de gestion qui s'est répandu de village en village a permis, dans toute la région, une modification de la perception que les villageois portent aux espaces boisés. Il existe aujourd'hui dans les finages gambiens (et seulement ici) un espace à vocation sylvicole dont le patrimoine forestier est à gérer durablement.

Fig. 6 : Dynamique des paysages du village de Brefet

Discussion et conclusion

Conclusion :

Si l'on considère les surfaces boisées, on aurait pu s'attendre à une dégradation importante de cellesci à la suite de la longue succession d'années de pluviosité plus faible que la moyenne ; celles-ci ne se constate pas de façon significative ni dans la physionomie ni dans la composition floristique ; on peut cependant noter le recul de la mangrove par tannification dans les secteurs où le système hydrologique a été affecté et agit comme catalyseur des effets de la sècheresse par sur-salinisation des sols. Ailleurs, les effets des fluctuations du climat sont beaucoup plus indirects et se combinent aux transformations des systèmes ruraux comme l'a montré l'étude des quelques finages pris en exemples.

Figure 1 :

 1 Figure 1 : Cartographie locale des fluctuations de la pluviosité depuis les données de Sultan (2000) a : à gauche avant et après 1968 ; b : à droite avant et après 1994.

Figure 3 :

 3 Figure 3 : quatrième axe factoriel de l'ACP. Il différencie les régions de stabilité et de reprise phénologiques entre 1982 et 2002

Tableau 1 :

 1 liaisons entre distribution et pluviositéLe tableau 1 présente les 47 espèces qui ont une liaison significative avec une gamme pluviométrique précise, les meilleures indicatrices a priori de la transition bioclimatique. Les espèces sont représentées en fonction du barycentre de leur distribution sur le transect.En leur sein on sélectionne celle qui présente des limites nettes terminant des distributions d'une densité significative selon l'algorithme de l'information de début et de l'information de fin de présence sur le transect (Tableau 2) Tableau 1 : liaisons entre distribution et pluviosité2.2. RésultatsSur le fil du gradient climatique, les espèces défilent suivant le modèle des groupes imbriqués en écailles[START_REF] Michel | Les groupes écologiques imbriqués en écailles[END_REF] : les distributions spécifiques se chevauchent les unes les autres et l'on passe ainsi des espèces guinéennes aux espèces soudaniennes puis aux espèces sahéliennes. On peut suivre la succession des groupes mis en évidence du sud vers le nord à mesure que le bilan hydrique défavorable élimine les espèces. Dans le détail, la composition est modulée par la topographie, ce qui rejoint les observations de J.[START_REF] Trochain | Contribution à l'étude de la végétation du Sénégal. Dakar : IFAN / Paris : Larose (coll[END_REF] qui a décrit la transition par le biais de stations contrastées pour la topographie et les sols : les stations basses, humides permettant à la flore guinéenne d'être présente plus haut en latitude au sein de stations hautes, sèches à végétation soudanienne. Il se dessine ainsi un continuum régional à deux facettes[START_REF] Alexandre Frédéric | Seuils biologiques et limites climatiques en Méditerranée occidentale[END_REF] Andrieu et Godron, 2008), l'une, plus humide dans les bas-fonds, l'autre plus sèche sur les interfluves. Cette même structure s'observe aujourd'hui en rive Nord Gambienne.La comparaison avec les relevés de J.[START_REF] Trochain | Contribution à l'étude de la végétation du Sénégal. Dakar : IFAN / Paris : Larose (coll[END_REF] paraît indiquer une certaine stabilité de la structure régionale d'ensemble : 31 espèces communes aux deux dates : Acacia macrostachya, A. sieberiana, Albizzia zygia, Annona senegalense, Anogeissus leiocarpus, Bombax costatum, Cassia sieberiana, Cola cordifolia, Combretum glutinosum, Cordyla pinnata, Daniellia olivieri, Entada africana, Hymenocardia acida, Icacina senegalensis, Khaya senegalensis, Lannea acida, Lannea veluta, Parkia biglobosa, Prosopis africana, Pterocarpus erinaceus, Sclerocarya birrea, Securidaca longepedunculata, Strychnos spinosa, Terminalia avicennioides, Terminalia macroptera, Combretum nigricans, Ozoroa insignis, Vitex madiensis, Dichrostachys cinerea, Piliostigma sp. Lannea microcarpa, Ficus gnaphalocarpa. 7 espèces relevées en 2005, et non relevées en 1936, bien que relevées plus au nord : Hannoa undulata, Ziziphus mauritiana, Fluegga virosa, Calotropis procera, Mitragyna inermis, absente des relevés de 2005 : Trichilia emetica (rare), Maytenus senegalensis, Ximenia americana (Importée). La confrontation entre l'analyse diachronique 1936 -2004 et la sélection des espèces qui en 2004 montrent une liaison significative avec la pluviosité et une distribution à la limite géographique significative isole 3 espèces sur 152. Seules Ziziphus mauritiana, Pericopsis laxiflora (Figure 4) et Fluegga virosa sembleraient avoir pu connaître une migration qui puisse être liée aux fluctuations de la pluviosité.

Figure 4 :

 4 Figure 4 : carte de distribution de Ziziphus mauritiana et de Pericopsis laxiflora dont la distribution est particulièrement bien reliée à une gamme de pluviosité.

  Cette classification s'est révélée solide et adaptée à l'ensemble de la zone(Andrieu et Mering, 2008). En outre, sa simplicité permet une analyse rétrospective sur une trentaine d'années. Nous disposons ici d'une couverture assez homogène (années et saisons) pour la fin des années 1970, la fin des années 1980 et le début des années 2000. Le croisement des cartes d'occupation du sol mène à la carte de la cinématique de l'occupation du sol (fig.2et 3) et à la quantification des types de changement (Tableau 1).

FigureFigure 6 :

 6 Figure 5 : variation des superficies boisées et non boisées.

Fig. 5 :

 5 Fig. 5 : Dynamique des paysages du village de Bani

  Depuis les plus grandes sécheresses du début des années 1980, la tendance est plutôt à une reprise de la pluviosité, reprise plus nettement perceptible depuis le milieu des années 1990. La figure 1b montre que la région a connu entre la période 1968 -1994 et la période 1994 -2000 une reprise entre 5 % au nord-est et 10 % au centre et sud-ouest.

est de 10 % au Sud et de 25 % Au nord-ouest de notre zone d'étude.

3.1. Présentation synthétique de la méthode

  Pour compléter le raisonnement, c'est maintenant l'évolution de la dimension paysagère de la végétation qui va être ici examinée. L'analyse d'images satellite multispectrales à haute résolution est un bon outil pour cartographier à l'échelle régionale des grands types d'occupation du sol et de couvert végétal. La modestie ici s'impose : il n'est déjà pas si aisé de distinguer sur ces images ce qui est boisé de ce qui ne l'est pas, au moins sur terre ferme. Pour les raisons évoquées ci-dessus, il existe, en effet, une infinité d'intermédiaires entre le couvert ligneux dense, le couvert ligneux ouvert, les formations à dominante herbacées fermées ou ouvertes, formant une mosaïque aux pièces faiblement contrastées sur le terrain comme sur les images qui traduisent l'état de surface. Dans l'optique d'une analyse diachronique, l'adaptation à cette complexité n'est pas la démultiplication des classes de la typologie de la carte à établir, mais au contraire son extrême simplicité : eau, mangrove, vasières non boisées (tannes et rizières), espace boisé de terre ferme, espace non boisé de terre ferme. L'approche par classification non dirigée est la seconde réponse à cette complexité. La classification automatique des pixels discrétise l'ensemble en fonction de l'homogénéité des classes.

Terre ferme (en% de la terre ferme) non boisé* aux deux dates

  Sur la carte (figure6), un fort pourcentage (20 %) de l'espace apparaît en changement, tant entre la fin des années 1970 et la fin des années 1980 qu'entre la fin des années 1980 et le début des années 2000. Ceci étant, notamment sur terre ferme, ces changements peuvent n'être que temporaires. A chaque date, à l'échelle régionale, progressions et régressions des boisements s'équilibrent quasiment pour la mangrove comme pour les espaces boisés de terre ferme.Le bilan global (figure5) montre cependant, dans le détail, une diminution des superficies boisées dans la période de péjoration pluviométrique et une augmentation de celles-ci durant la reprise des pluies (et le reverdissement observé par l'analyse temporelle du NDVI). Cette tendance est la même pour les boisements de terre ferme et pour les mangroves.

	progression des tannes sur la mangrove ou endiguement	10,3	5,9
	progression de la mangrove vers l'eau	3,1	1,2
	progression de l'eau sur la mangrove	1,8	0,4
	*Boisé = taux de recouvrement des ligneux > 25 % ; Non boisé = taux de recouvrement des ligneux < 25 %)
	Tableau 3 : quantification des changements et superficie
		Mais les variations sont faibles et il
		est impossible d'affirmer que c'est
		là un effet des fluctuations de la
		pluviosité.
		entre 79	entre 86-88 et
		et 86-88	99-2000-2001
		30,6	29,5
	boisé* aux deux dates	50,4	50,3
	progression du boisement	9,2	11,0
	régression du boisement	9,9	9,2
	Vasières (en % des vasières)
	sol nu aux deux dates	39,3	43,0
	mangrove aux deux dates	37,7	41,6
	progression de la mangrove sur les tannes ou les rizières	7,2	6,6

  . Bani est située entre les forêts classées de Sangako-Toubacouta au nord et de Fathala au Sud. Ces forêts sont aujourd'hui illégalement utilisées comme parcours pour les troupeaux ou pour extraction du bois de feu. Entre les forêts classées, l'espace agricole est continu de finage en finage. Sur sols sableux, le terroir est destiné en alternance au mil, culture vivrière et à l'arachide, culture de rente. Au milieu des champs, subsistent de grands arbres d'espèces fruitières (Cola cordifolia) ou permettant d'enrichir les sols (Parkia biglobosa, Faidherbia albida) et de jeunes arbres d'espèces vendues en pépinières (Eucalyptus camaldulensis et Azadirachta indica). Les champs sont cultivés dès le début de la saison des pluies, les chaumes des cultures sont vouées au pâturage et les arbres sont émondés à la saison des cultures où les ressources fourragères sont les plus faibles. Sur sols argileux, le terroir est une agroforêt à Cailcédrat (Khaya senegalensis) sous laquelle des cultures plus exigeantes en eau ont lieu, riz dans les bas-fonds inondés plusieurs semaines, maïs, sorgho dans les secteurs moins humides.Le village a été confronté, dès la fin des années 1960 à la sécheresse. Le terroir agricole, autrefois largement complanté, a connu, au cours des années de sècheresse accrue, une transformation : aux cultures exigeantes en eau se sont substitués, en alternance, le mil et l'arachide. Dans le même temps, le labour attelé a mené à la destruction d'une grande partie des arbres et arbustes des paysages agricoles(Lericollais, 1982). Ainsi y a-t-il eu conversion d'agroforêts en terroirs agricoles non boisés et, globalement, une diminution de la couverture boisée dans les terroirs agricoles. Face à l'effondrement des cours de l'arachide, les agriculteurs ont, par ailleurs, fait le choix, comme dans l'ensemble du Sénégal, de l'extensivité : cultiver de plus grandes superficies pour contrer les aléas climatiques, ceux du commerce international, pallier l'absence d'intrants et d'un outillage performant(Sidibé, 2005). Ces défrichements ont ici consommé les derniers espaces boisés ni agroforestiers ni classés par l'état.Dans le même temps, les règles progressivement renforcées notamment dans le cadre de la réserve de Biosphère du Delta du Saloum ont entraîné une certaine protection de la mangrove ce qui a contribué au recul de l'exploitation (modeste) du bois de palétuvier ; les coupes se sont reportées sur les forêts classées et sur les arbres des terroirs agricoles. Cette pression, cumulée à celle des troupeaux, à l'action des feux de brousse et à l'expansion non souhaitée du Neem (Azadirachta indica), espèce exogène, a amené une forte dégradation de l'ensemble des paysages de terre ferme du finage de Bani, dégradation que l'on retrouve dans le reste de la région du Saloum.