João Paulo De Araujo

Luciana Arantes
email: luciana.arantes@lip6.fr

Elias P Duarte

Luiz A Rodrigues
email: luiz.rodrigues@unioeste.br

Pierre Sens
email: pierre.sens@lip6.fr

VCube-PS: A Causal Broadcast Topic-based Publish/Subscribe System

Keywords: Publish/Subscribe, Topic-based Pub/Sub, Causal Broadcast, Distributed Spanning Trees, Hypercube-like Topologies

In this work we present VCube-PS , a topic-based Publish/Subscribe system built on the top of a virtual hypercube-like topology. Membership information and published messages are broadcast to subscribers (members) of a topic group over dynamically built spanning trees rooted at the publisher. For a given topic, the delivery of published messages respects the causal order. VCube-PS was implemented on the PeerSim simulator, and experiments are reported including a comparison with the traditional Publish/Subscribe approach that employs a single rooted static spanning-tree for message distribution. Results confirm the efficiency of VCube-PS in terms of scalability, latency, number and size of messages.

Introduction

Publish/Subscribe (Pub/Sub) systems consist of a set of publishers which are distributed nodes that publish messages that are consumed by subscribers. The communication between publishers and subscribers is conducted on an overlay infrastructure, which is generally composed by a set of nodes that organize themselves for ensuring the delivery of published messages to all (and preferably only) subscribers interested in those messages. Hence, publishers and subscribers exchange information asynchronously, without interacting directly [START_REF] Baldoni | Distributed event routing in publish/subscribe communication systems: a survey[END_REF][START_REF] Esposito | On reliability in publish/subscribe services[END_REF]. They might even not know each other.

In topic-based Pub/Sub systems, a subscriber can register its interests in one or more topics, and then receives all published messages related to these topics (e.g., Scribe [START_REF] Castro | Scribe: a large-scale and decentralized application-level multicast infrastructure[END_REF], Bayeux [START_REF] Zhuang | Bayeux: An architecture for scalable and fault-tolerant wide-area data dissemination[END_REF], DYNATOPS [START_REF] Zhao | Dynatops: A dynamic topicbased publish/subscribe architecture[END_REF], Dynamoth [START_REF] Gascon-Samson | Dynamoth: A scalable pub/sub middleware for latency-constrained applications in the cloud[END_REF], Magnet [START_REF] Girdzijauskas | Magnet: practical subscription clustering for internet-scale publish/subscribe[END_REF], DRScribe [START_REF] Li | Drscribe: An improved topic-based publish-subscribe system with dynamic routing[END_REF], BeaConvey [START_REF] Chen | Beaconvey: Co-design of overlay and routing for topic-based publish/subscribe on small-world networks[END_REF], etc.). The advantages of topic-based Pub/Sub systems when compared to content-based systems (see Section 5) are mainly that messages can be statically grouped into topics, the diffusion of messages to subscribers is usually based on multicast groups, and the interface offered to the user is simple. The topic approach is widely used by popular applications including Twitter and Firebase/Google Cloud Messaging, IBM MQ, distributed multiplayer online games, chat systems, and mobile device notification frameworks.

Many topic-based Pub/Sub systems found in the literature are based on per topic broadcast trees built over P2P DHTs [START_REF] Castro | Scribe: a large-scale and decentralized application-level multicast infrastructure[END_REF][START_REF] Zhuang | Bayeux: An architecture for scalable and fault-tolerant wide-area data dissemination[END_REF][START_REF] Gascon-Samson | Dynamoth: A scalable pub/sub middleware for latency-constrained applications in the cloud[END_REF][START_REF] Li | Drscribe: An improved topic-based publish-subscribe system with dynamic routing[END_REF]. A single multicast tree is associated to each topic composed by both subscribers (resp., brokers) and forwarders, i.e., non-subscribers (resp., non-brokers) of the topic. Therefore, all publish messages related to a topic are broadcast through the same tree. In this work, we call these systems SRPT (Single Root Per Topic). As they are built over P2P DHTs, they are scalable in terms of the number of subscribers. On the other hand, the maintenance of the one single tree per topic can be costly, particularly when the membership of the system changes [START_REF] Castro | Scribe: a large-scale and decentralized application-level multicast infrastructure[END_REF][START_REF] Zhao | Dynatops: A dynamic topicbased publish/subscribe architecture[END_REF]. SRPT employs multiple forwarders, which are nodes that do not deliver the messages themselves but are employed in the dissemination. Forwarders induce a higher latency and, in the case of a high number of simultaneous publications of a single topic, the root of the tree presents contention problems, becoming a performance bottleneck.

In [START_REF] Sanli | Local variation of hashtag spike trains and popularity in twitter[END_REF], the authors show that in applications like Twitter, most of the publications are concentrated in few topics: roughly 83% of the analyzed topics have up to 5 published messages and only 0.15% of the topics ("hot topics") are related to more than 1,000 publishing messages. An example of such applications is multiplayer online combat games in which locations are mapped to topics [START_REF] Gascon-Samson | Dynfilter: Limiting bandwidth of online games using adaptive pub/sub message filtering[END_REF][START_REF] Arantes | Enhanced drtree for low latency filtering in publish/subscribe systems[END_REF]. During the game, players move towards the same location increasing the publishing load for the topic corresponding to the location, i.e., the location becomes a "hot topic". We argue that SRPTbased Pub/Sub systems are not suitable to handle a high publishing load as they present root contention constraints.

We also claim that a topic-based Pub/Sub system must enforce, for a given topic, the causal order of published messages. For instance, in a discussion group, a question published on a group should never be delivered to any subscriber after an answer to that question which was also published in the same group, as the answer is causally related to the question. In other words, if a node publishes a message after it delivers another message, then no node delivers the second message after the first. It is worth emphasizing that causal message ordering is of prime interest to the design of many distributed applications. Examples of them are event notification systems [START_REF] Lwin | Causal ordering in event notification service systems for mobile users[END_REF], multimedia applications [START_REF] Baldoni | Broadcast with time and causality constraints for multimedia applications[END_REF][START_REF] Plesca | A coordination-level middleware for supporting flexible consistency in cscw[END_REF], multi-part online games [START_REF] Gilmore | A survey of state persistency in peerto-peer massively multiplayer online games[END_REF], systems that provide distributed replicated causal data consistency [START_REF] Ahamad | Implementing and programming causal distributed shared memory[END_REF], distributed snapshots [START_REF] Acharya | Recording distributed snapshots based on causal order of message delivery[END_REF], distributed database [START_REF] Terry | Managing update conflicts in bayou, a weakly connected replicated storage system[END_REF], and shared objects [START_REF] Perrin | Causal consistency: Beyond memory[END_REF]. Specifically for the case of Pub/Sub systems, few works deal with causal ordering [START_REF] Cugola | The jedi event-based infrastructure and its application to the development of the opss wfms[END_REF][START_REF] Nakayama | Reduction of unnecessarily ordered event messages in peer-to-peer model of topic-based publish/subscribe systems[END_REF][START_REF] Yamamoto | Merging topic groups of a publish/subscribe system in causal order[END_REF].

Considering the above discussed points, we propose in this work VCube-PS , a non DHT Pub/Sub system, that ensures low latency, and load balancing for publishing messages. It also respects the causal delivery order of published messages of a given topic, which is a crucial feature for several types of Pub/Sub applications. In our system, a published message is sent to all subscribers of a topic by a broadcast protocol that creates a spanning tree composed just by the subscribers, whose root is the publisher. Hence, the root "hot topic" contention problem of SRPT does not exist in VCube-PS since there is no single root tree per topic, as each node that publishes a message becomes the root of the corresponding spanning tree. Broadcast trees are dynamically built on top of a virtual hypercube-like topology, called VCube [START_REF] Duarte | VCube: A provably scalable distributed diagnosis algorithm[END_REF], that presents several logarithmic properties, thus ensuring scalability. Contrarily to SRPT Pub/Sub systems and thanks to VCube's properties, both the construction and maintenance of spanning trees by VCube-PS have no overhead, even in the presence of subscriber membership changes. In other words,VCube-PS locally defines to which nodes the messages need to be forwarded, without the need of routine tables. In the absence of churn, VCube-PS does not present forwarder nodes and in the presence of churn, forwarders are temporary.

It is important to highlight that, contrarily to SRPT systems, our target applications are mainly those that present "hot topics" (e.g. multiplayer combat games, company chat groups, etc.).

We implemented VCube-PS and two SRPT -like Pub/Sub systems on top of the PeerSim simulator [START_REF] Montresor | Peersim: A scalable p2p simulator[END_REF]. One SRPT Pub/Sub is subscriber-based (e.g., Scribe, Magnet, DRScribe) while the second one is broker-based (e.g. Dynatops). In Dynatops, subscribers are connected to brokers based on locality. Results confirm the advantages of using per-publisher dynamically built spanning trees in terms load balancing, latency, number and size of messages metrics.

The rest of the paper is organized as follows. Section 2 gives an overview of VCube. Section 3 presents VCube-PS 's algorithms to manage topics, order messages, as well as the specification of VCube-PS 's algorithms. Section 4 presents evaluation of results conducted on PeerSim simulator. Section 5 discusses related work and, finally, Section 6 concludes the paper.

VCube

In VCube [START_REF] Duarte | VCube: A provably scalable distributed diagnosis algorithm[END_REF], a node i groups the other N -1 nodes in d = log 2 N clusters forming a d-VCube, each cluster s (s = 1, .., d) having 2 s-1 nodes. The ordered list of nodes in each cluster s is defined by function c i,s below, where ⊕ is the bitwise exclusive or operator (xor).

c i,s = i ⊕ 2 s-1 c i⊕2 s-1 ,k | k = 1, . . . , s -1
This recursive function can be described as follows. Initially, the first neighbor of node i in cluster s is computed. The identifiers of these two nodes differ only in one bit, the bit that is set to one in 2 s-1 . Then, the remaining nodes in the cluster are nodes in clusters 1, . . . , s-1 of the hypercube neighbor, i.e.,

c i⊕2 s-1 ,1 , c i⊕2 s-1 ,2 , . . . , c i⊕2 s-1 ,s-1 .
The table of Figure 1 contains, for N = 8, the composition of all c i,s of the 3-VCube. The same figure also shows node 0's hierarchical cluster-based logical organization in the 3-VCube.

VCube-PS: Publish/Subscribe System

In this section, we present the topic-based VCube-PS Pub/Sub system. We first describe the system model. Then, we describe causal order broad- cast, the use of causal barriers, and the per-source FIFO reception order of VCube-PS . Finally, we give the algorithms that compose VCube-PS .

System Model and Definitions

We consider a distributed system composed of a finite set of Π = {0, .., N -1} nodes with N = 2 d nodes, d > 0. Each node has a unique identifier (id) and nodes communicate only by message passing. A user of the Pub/Sub system corresponds to a node. Nodes are organized on a logical hypercube.

Nodes communicate by sending and receiving messages. The network is fully connected: each pair of nodes is connected by a bidirectional pointto-point channel and there is no network partitioning. Nodes do not fail and links are reliable. Thus, messages exchanged between any two processes are never lost, corrupted nor duplicated. The system is asynchronous, i.e., relative processor speeds and message transmission delays are unbounded.

The source of a message is the node that broadcasts the message. We distinguish between the arrival of a message (reception) at a process and the event that corresponds to the message being delivered to the application/user (delivery). Only the latter respects the causal order of published messages.

Causal and Per-source FIFO Reception Ordering

For each topic, VCube-PS enforces the causal order of published messages, implementing, thus, causal broadcast. It also implicitly ensures that for a single publisher, nodes will receive messages in the order they are published.

Causal Ordering

For a given topic t, if a process publishes a message m after it has delivered a message m, then no process in the system will deliver m after m . Note that if a process i never delivers m (i.e., i leaves the topic before delivering m ) or delivers m but never delivers m (i.e., i was not subscribed to t when m was published), the causal order of published messages is not violated.

In order to implement the causal order of published messages, we apply causal barriers [START_REF] Prakash | An efficient causal ordering algorithm for mobile computing environments[END_REF]. The key advantage of the causal barrier approach is that it does not enforce the causal order based on the identifiers of the nodes (per node vector) but by using direct message dependencies, which renders the algorithm more suitable for dealing with node dynamics (subscriptions and unsubscriptions), in comparison to other vector clock-based implements of causal broadcast such as [START_REF] Birman | Reliable communication in the presence of failures[END_REF] or [START_REF] Schiper | A new algorithm to implement causal ordering[END_REF].

Let m and m be two application messages published for topic t. Message m immediately precedes m (m ≺ im m ) if (1) the publishing of m causally precedes the publishing of m and (2) there exists no message m such that the publishing of m causally precedes the publishing of m , and the publishing of m causally precedes the publishing of m . The causal barrier of m (cb m ) consists of the set of messages that are immediate predecessors of m.

Figure 2 shows a distributed system with three nodes (p 0 , p 1 , and p 2 ) that have subscribed to the same topic t. Message m s,t,c is the message published by s with sequence number c for topic t. On the left, a timing diagram shows messages being published and delivered; the graph with message dependencies is shown on the right side. We can observe that the delivery of m 1,t,1 is conditioned by the delivery of m 0,t,1 (m 0,t,1 ≺ im m 1,t,1 ) since p 1 delivered m 0,t,1 before publishing m 1,t,1 , (i.e., cb m 1,t,1 = {m 0,t,1 }). On the other hand, m 1,t,2 directly depends on m 2,t,1 and m 1,t,1 (i.e., cb m 1,t,2 = {m 2,t,1 , m 1,t,1 }). Note that since m 0,t,1 precedes m 1,t,1 that precedes m 1,t,2 , m 0,t,1 is an indirect dependency of m 1,t,2 , and was not included, therefore, in cb m 1,t,2 . Now suppose that in the same system shown in Figure 2, p 3 subscribes to t after messages m 2,t,1 was published to the other nodes, i.e., node p 3 did not take part in the spanning trees that broadcast m 2,t,1 and, consequently, in this case, node p 3 will neither receive nor deliver m 2,t,1 . Hence, after having delivered m 1,t,1 , p 3 can deliver m 1,t,2 . Since nodes can dynamically subscribe to or unsubscribe from a topic in VCube-PS , our implementation of causal order must distinguish between the case in which a message will be delivered (e.g., m 1,t,1 ) from the one that it will never be delivered (e.g., m 2,t,1 by p 3 ). To this end, VCube-PS guarantees the following property on the FIFO order of messages published on a given topic.

Per-source FIFO Reception Ordering

Messages published by a same publisher are received by subscribers in the same order as they were produced. This order allows a subscriber of t to know that it will never receive some messages previously published, i.e., if m s,t,c is the first message that node i receives from s on topic t after it joined t's group, i will never receive m s,t,c , ∀c < c .

In VCube-PS , per-source FIFO reception order is ensured by the acknowledgment of published messages: a source node broadcasts a new message only after having received all the acknowledgments for the previous message it broadcast. Note that the per-source FIFO reception order is defined in regard to the reception of messages and not delivery, as in the traditional FIFO order definition.

Algorithms

This section presents VCube-PS 's algorithms. Due to the lack of space, proofs are available in an accompanying Technical Report [START_REF] De Araujo | Vcube-ps: A causal broadcast topic-based publish/subscribe system[END_REF].VCube-PS is based on VCube, which organizes nodes in a logical hypercube-like topology. Note that in VCube-PS nodes do not fail, VCube-PS thus exploits VCube's organization but not its failure detection functionality.

Types of Messages, Local Variables and Auxiliary functions:

Each message m is uniquely identified by the source (s) and a sequence counter (c). It also carries information about the topic t. Messages can be of type SUB (subscription), UNS (unsubscribe), PUB (publication), and ACK (acknowledge). The value of the data field depends on the type of the message: for SUB and UNS messages, it holds no information while for PUB or ACK messages, it respectively holds the published message itself plus causal dependencies (causal barrier). M AX T OP ICS is a constant value that limits how many topics the system can support. The following local variables are kept by every node i:

• counter: is a local counter of node i which is incremented at every subscription, unsubscription, or publishing of a message by node i;

• br queue[M AX T OP ICS]: each br queue[t] is a set of pending messages (PUB, SUB, or UNS) related to the topic t waiting to be broadcast;

• view[M AX T OP ICS]: set of the latest subscription and unsubscription operations of which node i is aware. Each entry view[t] has format n, o, rc where n is the identity of the node that has joined or left the topic t; o is equal to SUB or UNS and rc stores the value of the counter of n at the moment the subscription or unsubscription took place;

• causal barrier[M AX T OP ICS]: each causal barrier[t] keeps information on all messages that are predecessors of the next message that will be published by node i for topic t; the causal barrier consists thus of a set of message identifiers of format s, c (source and sequence counter).

• acks: set of pending ACK messages for which i waits confirmation. For each message propagation to its nb children in the spanning tree of a message m identified by s, t, c received from j, i adds the element j, nb, s, t, c, mem to the acks set. The set mem gathers membership information sent by ACK messages;

• msgs: set of messages that are being temporarily kept by node i because they have not been delivered yet. Upon delivering m, identified by s, t, c , the latter can be removed from msgs;

• not delvs[M AX T OP ICS]: each not delvs[t] contains a set of messages received by node i for topic t and not yet delivered because their respective causal barrier has not been satisfied. Each element has format s, c, cb where s is the identity of the source node that broadcast the message whose counter is c, and cb corresponds to the causal barrier of the message.

• last delvs[M AX T OP ICS]: each last delvs[t] keeps the identifiers of the last message from each publisher node delivered by node i for topic t. Each element of the set is the tuple s, c where s is the source identity of the message whose counter is c;

• f irst rec[M AX T OP ICS]: each f irst rec[t]
keeps the identifiers of the first message received from each publisher for a topic t. Each element of the set is a tuple s, c .

In the algorithms, the symbol ⊥ represents a null element while the underscore ( ) is used to indicate any element.

We have defined two auxiliary functions that exploit VCube organization and are used to dynamically build broadcast spanning trees:

• Cluster(i, j): function that returns the index s of the cluster of node i that contains node j, (1 ≤ s ≤ log 2 N ). For instance, in Figure 1, Cluster(0, 1) = 1, Cluster(0, 2) = Cluster(0, 3) = 2, and Cluster(0, 4) = Cluster(0, 5) = Cluster(0, 6) = Cluster(0, 7) = 3. • Children(i, t, h): returns a set with all nodes virtually connected to node i. A child of i is the first node of cluster c i,s which is also a subscriber of topic t; or the first node in c i,s in case of no topic (t = ' * '). The parameter h can range from 1 to log 2 N . If h = log 2 N , the result set contains the i's children where each child is in c i,s , s = 1, .., log 2 N . For any other value of h < log 2 N , the function returns only a subset of i's children, i.e., those children whose respective cluster number s is smaller or equal to h Application (User Interface) functions: VCube-PS offers an interface consisting of functions Subscribe(t), Unsubscribe(t), and Publish(t, m), all presented in Algorithm 1. A node can publish a message related to a topic if it is currently a subscriber of this topic. These functions generate messages of types SUB, UNS, or PUB, respectively, which are sent to all nodes, in case of subscription, or all subscribers of topic t, otherwise.

(s ≤ h) For instance, in Figure 1, if t = ' * ', Children(0, * , 3) = {1, 2, 4}, Children(0, * , 2) = {1,
Propagation of a Message: When node i invokes one of the application functions (Algorithm 1) for topic t, the procedure CO Broadcast (line 5 of Algorithm 2) is called, generating a new message of the corresponding type (PUB, SUB, or UNS) which is inserted in the queue of t. Then, a task related to t (Task ST ART M SG P ROP AGAT ION ) continuously removes the first message from this queue and starts the broadcast. The next message is removed from the queue only after the reception of acknowledge (message ACK) from all current subscribers (per-source FIFO reception order) to whom node i sent the previous message (line [START_REF] Kurose | Computer Networking: A Top-Down Approach[END_REF]. The task associated with t is created when node i becomes a new subscriber of the group of topic t (line 11).

Algorithm 1 Functions offered as the interface to the application: node i Task ST ART M SG P ROP AGAT ION for topic t starts the propagation of m, the first message removed from the queue (line 15), by dynamically building a hierarchical spanning tree, rooted at i, composed by the nodes which are either the subscribers of t, in case of messages of type UNS or PUB or by all nodes, in case of messages of type SUB (lines [START_REF] Yamamoto | Merging topic groups of a publish/subscribe system in causal order[END_REF][START_REF] Duarte | VCube: A provably scalable distributed diagnosis algorithm[END_REF][START_REF] Montresor | Peersim: A scalable p2p simulator[END_REF][START_REF] Prakash | An efficient causal ordering algorithm for mobile computing environments[END_REF][START_REF] Birman | Reliable communication in the presence of failures[END_REF][START_REF] Schiper | A new algorithm to implement causal ordering[END_REF]. For this purpose, node i calls function Children(i, t, log 2 N ) which renders, for PUB and UNS messages, the set of the first subscriber nodes of t for each of its clusters (line 26) or the first node of each of i's clusters (line 24) in the case of a SU B message (t = ' * '). These nodes become i's children in the spanning tree and m is sent to them. Upon the reception of m from a node j, by calling function Cluster(i, j) (line 42 or 44 depending on the type of message), every child of node i's sends m to its own children in the s -1 clusters, in relation to topic t and the cluster s of i to which j belongs, i.e., c i,s . These nodes then become j's children, and so on.

1: Init 2: counter ← 0 3: ∀t ∈ M AX T OP ICS : view[t] ← ∅ 4: function Subscribe(topic t) 5: if i, SU B, / ∈ view[t] then 6: view[t] ← { i, SU B,
For instance, consider the left side of Figure 3. All nodes are subscribers of t 1 , and node p 0 , subscriber of t 1 , publishes a message m 0 related to t 1 (PUB messages). p 0 is the root of the respective spanning tree: Algorithm 2 Causal broadcast algorithm and delivery executed by node i m 0 will be sent to the log 2 N = 3 children of p 0 (Children(0, t 1 , 3) = {1, 2, 4}). Upon the reception of message m 0 , it is not forwarded by p 1 since Children(1, t 1 , 0) = ∅, while p 2 forwards m 0 to its child p 3 , the first subscriber of cluster c 2,1 (Children(2, t 1 , 1) = {3}). When p 3 receives m 0 , as Children(3, t 1 , 0) = ∅, p 3 does not forward m 0 to any node. However, in the case of p 4 (Children(4, t 1 , 2) = {5, 6}), it forwards m 0 to its children p 5 ∈ c 4,1 and p 6 ∈ c 4,2 . Finally, p 6 sends m 0 to p 7 . Consider now a second example, on the right side of Figure 3, where only p 0 , p 2 , p 3 , p 5 , and p 7 are subscribers of t 2 and p 2 publishes m 2 related to t 2 . In this case, p 2 sends m 2 to each of its child of its log 2 N = 3 clusters that are also subscribers of t 2 : Children(2, t 2 , 3) = {3, 0, 7} (p 6 is the first node in c 2,3 but it has not subscribed to t 2 ). Upon receiving m 0 , p 3 does not forward it, because it is already a leaf node in the tree. Node p 0 does not forward it to p 1 since the latter is not a subscriber of t 2 . On the other hand, p 7 verifies that in cluster c 7,2 = (5, 4), p 5 is a subscriber of t 2 (Children(7, t 2 , 2) = {5}), and therefore sends m 2 to p 5 which on its turn does not send it to p 4 , because even if p 4 is the first and only node in c 5,1 , it is not a subscriber of t 2 . For more details about how to build spanning trees over VCube, see [START_REF] Rodrigues | An autonomic implementation of reliable broadcast based on dynamic spanning trees[END_REF].

1: Init 2: ∀t ∈ M AX T OP ICS: view[t] ← ∅; f irst rec[t] ← ∅; not delvs[t] ← ∅; delv[t] ← ∅; br queue[t] ← ∅ 3: msg ← ∅ 4:
After forwarding a message m to a child k, node i waits for an ACK message from k, which confirms the reception and propagation of m by k. A node will send an ACK to its parent node only after it receives itself ACK messages from all its current children related to the topic in question (lines 58-61). ACK messages will, thus, be propagated to the root, the source node of m. Eventually the latter receives all the ACK messages it waits for and, in this case, the task related to t removes the next message to be published from the queue associated to the topic t, if there is one. These sequences of SUB, UNS, or PUB and then ACK messages from/to the source ensure the per-source FIFO reception order of published messages of the topic. Reception and Delivery of Messages: When receiving a PUB message m of topic t from s (lines 63-68), if node i is a subscriber of t and has not already delivered m, it keeps m in set msgs and both its identification and causal barrier in set not delvs [t]. If m is the first message received from s to t, i registers it in f irst rec[t] in order to enforce the causal dependencies even under the dynamics of subscriptions. Then, node i verifies, based on direct causal dependencies, which of the previously received messages can be delivered to the application. To this end, node i invokes function CheckDelivery(t) (lines 83-89) which, in it its turn, calls CheckCB(t, cb) in order to check direct dependencies (line 90-94). A message m can be delivered to i only when every message m on which m causally depends either has already been delivered to i or will never be received by i because VCube-PS has not considered i as a subscriber of t during the construction of the spanning tree that broadcast m . In other words, the first PUB message received from s on topic t by i has a higher sequence number than the sequence number of m . Such a detection of the first message is possible thanks to the f irst rec i [t] set and the fact that, for the same source, publications of messages of the same topic respect per-source FIFO order.

After delivering m, node i removes it from its pending messages (lines 85-88) and updates its local causal barrier variable (line 89). Note that, since the delivery of one message m can enable the delivery of other messages that causally depend on m, all remaining non delivered messages are rechecked. Membership Management: In VCube-PS , distributed spanning trees are also used to notify membership changes. When a node i subscribes (resp., unsubscribes) to (resp., from) a topic t, a broadcast SUB (resp., UNS) message will be received by all (resp., current) subscribers of t. Upon receiving either a SUB our UNS message, a subscriber of t updates its view of the membership related to t (line 72) by calling function Update(set 1 , set 2 ) (lines 75-82) which merges two membership sets, keeping only the current subscribers.

When a node i subscribes to a topic t, the ACK messages related to the SUB messages will also gather information about t's membership. Function SendACKs (lines 95-98) is responsible for sending ACK messages. Before forwarding a received ACK message to its parent, each subscriber of t includes in the message its current view of t's membership (line 97) merged with the partial membership information coming from its own children (line 57). When receiving all ACK messages from its children, the new subscriber i is aware of t's membership.

If node i unsubscribes from topic t, it no longer delivers messages related to the topic (line 33). On the other hand, node i can continue to forward messages related to t to the other subscribers of t in the spanning tree if one of the following situations occurs: (1) there exist subscribers of t that are not aware of i's unsubscription, i.e., they have not received the corresponding UNS message from i yet or (2) there are messages queued in i's br queue [t] waiting to be forwarded. Node i also sends ACK messages to its parent node in the respective spanning tree. These ACK messages are related to published messages that i received and forwarded before leaving t or to messages that satisfy the above-mentioned situations. However, eventually all ACK messages will be sent and, thereafter, node i will no more take part in the broadcast of messages related to t. When a subscriber of t receives an UNS message related to node i, it removes i from its view of t's membership (line 72) as well as the information about the first message received from i with regard to t (line 74). The latter will be renewed if i rejoins t later.

Experimental Results

In order to assess the performance of VCube-PS with different configuration scenarios, we conducted experiments with the event-driven PeerSim [START_REF] Montresor | Peersim: A scalable p2p simulator[END_REF] simulator. In most of the experiments we compare VCube-PS to SRPT . For each topic, SRPT selects a node to act as the root of the broadcast tree for the respective topic.

We consider that each message exchanged between two nodes consumes t pc + t q + t t + t pp + t d units of time (u.t.). Apart from t d which represents the time necessary for a subscriber to satisfy all causal dependencies, all other components are based on a packet-switched network delay model [START_REF] Kurose | Computer Networking: A Top-Down Approach[END_REF]: t pc accounts for the processing time of a message by a node; t q is the time a message must wait in the queue before being transmitted; t t is the time necessary to transmit all bits of the message into the link; and t pp expresses how long it takes for a message to traverse the link and reach the next hop. Assuming that there is no broadcast feature available in the system, if a message is sent to multiple destinations, a copy of the message is queued for each of the destinations. Based on [START_REF] Ramaswamy | Characterizing network processing delay[END_REF], we set t pc = t t = 1 u.t. and t pp = 100 u.t. (1/100 ratio).

For most experiments, the number of nodes N varies from 8 up to 4096, always a power of two, and each experiment was executed 40 times.

We consider the following metrics for comparison: (1) Latency: the time that a published message takes to be received and delivered by all subscribers;

(2) Number of messages: overall number of PUB messages; (3) Number of messages to be processed by a node: size of each node's queue; (4) Size of PUB messages: characterizes the number of direct causal dependencies that PUB messages hold; and (5) Number of false positives: number of messages received by nodes that act as forwarders of messages of type PUB.

A Single Publisher

This experiment evaluates the impact of the logarithmic properties of VCube-PS . A single publisher publishes a single message. Hence, when a subscriber receives the message, there is no delay for delivery. Figure 4(a) shows the delivery latency when the number of nodes of the system varies and either 25% or 100% of them are subscribers. The set of subscribers is randomly chosen following a uniform distribution. In the case of 4096 nodes with 25% of subscribers uniformly distributed, the latency of VCube-PS is on average 533 units of time, 26% less compared to the latency of SRPT in the same scenario (720 u.t.) We remark that when 100% of the nodes are subscribers, SRPT has no forwarder and, therefore, the latency of both Pub/Sub systems is always proportional to log 2 N . The only difference in this case is that SRPT has an additional hop as the message to be published must be first sent to the root of the only tree that is employed. The average number PUB messages follows the same behavior as shown in Figure 4(b). In the figure, for the two approaches with 25% of the nodes as subscribers, VCube-PS always presents the same number for PUB messages, since there is no forwarder in the tree. On the other hand, forwarders in SRPT are responsible for up to 2.7 times more messages (for 8 nodes) compared to VCube-PS . As the number of nodes increases, this difference is reduced, although VCube-PS generates, on average, at least 43% fewer messages than SRPT (4096 nodes).

A more detailed analysis of the impact of the number of subscribers in VCube-PS and SRPT performance is given in the Technical Report [START_REF] De Araujo | Vcube-ps: A causal broadcast topic-based publish/subscribe system[END_REF].

Multiple Publishers

In these experiments, all nodes are subscribers of a single topic and the number of publishers varies. Each publisher i sends one message at time t i which is uniformly distributed between [0, 1000] units of time. By having multiple publishers of the same topic, differences in latency will arise from the distribution of the load among the nodes when using one root per publisher (VCube-PS ) or one root per topic (SRPT ).

Figure 5 shows in logarithmic scale the average reception latency when the number of nodes of the system varies and either 25% or 100% of them are publishers. Since the ratio between the processing time (t pc ) and the propagation time (t pp ) has an impact on the load contention, we consider the ratio 1/100 (Figure 5 but also a propagation time which is ten times greater, (t pp = 1000 u.t.), leading to a ratio 1/1000 (Figure 5(b)). We can observe in Figure 5(a) that VCube-PS presents a maximum increase of 38.8% of the load distribution (4096 nodes and 100% of publishers) when compared to VCube-PS with 4096 nodes and 25% of publishers. This happens because even though there are 4 times more messages, they traverse different paths in the network. On the other hand, in SRPT , if several messages arrive at the root of the tree at the same time they will be queued before transmission, increasing, thus, the reception latency. For up to 128 nodes, SRPT latencies are on average one hop in time higher compared to VCube-PS , because in these cases the arrival and output rates of messages are very similar, which avoids contentions. Beyond this number of nodes, the root receives more messages than it can process and transmit per interval of time and starts to saturate. For instance, in comparison with VCube-PS with 256 nodes and 100% of publishers, SRPT has an average latency 2.48 times greater, and this ratio grows linearly after this point.

Comparing Figures 5(a)(b), the average reception latency increases less in SRPT in relation to VCube-PS because, with a 1/1000 ratio, it takes longer to receive messages, although the output throughput remains the same.

Table 1 shows the distribution of nodes according to the average size of their sending queues, in a scenario with 1024 nodes, 1/100 ratio, and where all nodes are publishers and subscribers.

The load distribution on the nodes in SRPT is uneven when compared to VCube-PS : 98% of the nodes in VCube-PS have an average load between [START_REF] Zhuang | Bayeux: An architecture for scalable and fault-tolerant wide-area data dissemination[END_REF][START_REF] Gilmore | A survey of state persistency in peerto-peer massively multiplayer online games[END_REF] messages, while 44% of the nodes in SRPT have on average between (0, 2] messages in their buffers. In SRPT , 50% of the nodes simply do not participate in the routing of any message, because they are leaf nodes of the single tree of the topic and one node (the root) has an average load of 9240 (σ = 4617) messages, which incurs in high reception latencies.

Message Order

Besides the published message itself, every PUB message contains its causal barrier, i.e., a list of the direct causal dependencies of the message. Thus, the size of a PUB message increases depending on the number of elements in this list. In order to evaluate the size of the list and the latency due to message ordering, we consider that one node s, chosen randomly, publishes a first message m s . Upon receiving this message, each node k waits a random interval of time (t w ) before broadcasting message m k . This situation corresponds to all members of a message discussion group answering a question posted by one of the members. For N nodes, the number of messages is N 2 -N messages. Additionally, we extend this scenario to evaluate the case in which a node k has to wait for at least p messages before broadcasting its own message. To this end, there are p ≥ 1 nodes that independently broadcast a message each, all in the beginning of the experiment. Just after receiving all these initial messages, any node can publish a message.

Figure 6 groups messages according to the size interval of their causal barriers for VCube-PS . When it is necessary to wait for just one message before a node broadcasts its own message, 51.6% of the messages generated in the system have less than 5 preceding messages. More precisely, 19.9% of them have just one causal dependency. On the other hand, if a node waits for more messages (10 in the case of the figure) before broadcasting its own, a larger number of nodes will have 10 or more direct dependencies. In this case, 35.2% of the messages have size 10 (10 direct dependencies) and 79.7% of them have sizes smaller than 15. However, in both cases, the number of direct dependencies keeps reasonable.

We also evaluated the additional delay imposed by causal barriers before delivering a message. When a node waits for 1 message before broadcasting its own, about 95.1% of the messages are delivered in less than 10 u.t. after the message is received (87.2% are delivered with no delay). Only 81 messages (out of 65280) have a delay higher than 50 u.t., with an upper limit of 150 units of time. Increasing the number of the waiting messages to 10, 457 messages wait more than 50 u.t. to be delivered (maximum 187), although the number of messages with no delay remains high (84.2%).

Multiple Topics

As discussed in [START_REF] Sanli | Local variation of hashtag spike trains and popularity in twitter[END_REF], in real world applications like Twitter, a few topics are related to most of the messages. The authors show that in Twitter, roughly 60% of the topics have only one message published, 83% of them have no more than 5, only 0.15% of the topics are related to more than 1000 messages each. This behavior follows a Zipf-like distribution with a coefficient of 0.825 according to the data provided in the reference. We evaluated VCube-PS and SRPT with multiple topics. Messages are assigned following both the Zipf-like and uniform distributions. Figure 7 shows results for 256 nodes, 128 topics, and a varying number of messages. Each node publishes a new message on average every 500 u.t. for a topic, randomly chosen. Therefore, messages are uniformly distributed among the publishers, but not necessarily among the topics. No matter the distribution of messages among the topics, VCube-PS always relies on the same root for a given publisher, while SRPT does not. This is the reason why the behavior of SRPT is the same as VCube-PS 's for a uniform distribution of messages. However, when the number of messages sent per node increases beyond a threshold, VCube-PS increases the latency due to contention at the source of the messages, i.e., the root of the tree. On the other hand, for the Zipf distribution, SRPT has an average reception latency 30.6% higher compared to the uniform distribution (for 2 14 messages). VCube-PS increases latency, on average, only 9.2%.

These results confirm that VCube-PS is scalable in terms of publishers, while SRPT is scalable in terms of topics. However, as noted above, in real scenarios most of the messages are concentrated on a small number of topics.

Churn Evaluation

In this set of experiments, we evaluate how SRPT and VCube-PS tolerate membership changes. The parameters used for the evaluation are those proposed by [START_REF] Rhea | Handling churn in a dht[END_REF], which considers that the time a node keeps connected to a P2P system is heterogeneous (session time) and that the average time ranges from a few minutes up to hours, following a Poisson process. For every node that leaves a given topic, another randomly selected node joins that topic, thus, always keeping the number of subscribers equals to N s nodes1 .

For the experiments, we consider one topic and each unit of time represents 1ms. Every 500ms, a new message is published by a randomly selected node (uniform distribution). Each simulation corresponds to 120 minutes. Figure 8 presents the average reception latency and standard deviation. It is worth reminding that in VCube-PS , every membership change (subscription or unsubscription) generates a new message which is broadcast to all nodes of the system, similarly to a publishing message, while SRPT needs to rebuild its per topic single trees. Furthermore, SRPT trees often have forwarders (non-subscriber nodes) while in VCube-PS , when a node i unsubscribes, it can still receive and forward publications related to the topic for a while (temporary forwarder, see Section 3.3). Figure 8(a) summarizes the results with 500, 1000, 2000, and 4000 subscribers. The dynamics of subscriptions were simulated for three different average session times (t med ): 1, 30, and 60 minutes. For baseline comparison sake, along with the scenarios with churn, the figure also shows results with static membership. Standard deviation values, although small, are also depicted.

Comparing VCube-PS with churn to the static baseline, the former presents average latencies up to 10% higher. In other words, to some extent, VCube-PS is sensitive to churn since static membership does not induce falsepositives while, with churn, VCube-PS has temporary forwarders, responsible for the 10% latency increase. On the other hand, except for 4000 subscribers, SRPT latencies vary only up to 1.4% compared to the corresponding static baseline. This stable behavior can be explained as, even in scenarios with no churn, SRPT trees have usually non-subscribers (forwarders) and, therefore, the size of their branches does not vary with churn. However, these forwarders are also responsible for the longer SRPT tree branches when compared to VCube-PS ones, justifying why, for a given churn rate, SRPT presents higher latency than VCube-PS , independently of the number of subscribers. The highest impact of the churn is observed in SRPT with 4000 subscribers and t med = 1min, with approximately 46 unsubscriptions and 46 new subscriptions per minute. In this case (high churn rate), the average latency is much higher than the static one (3.56 times), not only because of the presence of false-positives (2.74% of all received PUB messages), but also due to contention caused by SUB and UNS messages. A last interesting observation is that, except for SRPT with 4000 subscribers and t med = 1min, average latency values of both approaches keep the same behavior and close values for both static and dynamic scenarios.

For the results presented in Figure 8(b) with N s = 1000, the churn rate increases beyond usual values, i.e., it varies from 1% up 10% of the subscribers per minute. In this case, t med varies from 69s to 7s. Note that for the experiments shown in Figure 8(a) with N s = 1000 and t med = 1min, the churn rate is approximately 1.1% of the subscribers per minute. Although the higher the churn rate, the greater the number of messages over the network, we can observe in Figure 8(b) that, even if latency increases, VCube-PS tolerates quite well the increase in the number of messages: when the churn rate increases 10 times, latency grows in average 2.55 times, false positives represent in average 2.2% (σ = 0.15%) of the PUB messages, and, in average, messages wait in queue no more than 28.36ms (σ = 0.66ms) before being forwarded. On the other hand, when the churn rate increases, SRPT 's single tree is not able to treat and send all the messages in time in order to avoid contention. With churn rate of 4% per minute (t med = 17s) and 1000 subscribers, the overall number of sent messages is slightly smaller than that of the scenario with 4000 subscribers and t med = 1min (Figure 8(a)). In both cases, this is the point where SRPT 's reception latency starts to suffer from contention. Beyond it, SRPT 's single root is unable to treat and forward messages without queuing them for long periods. For 5% churn rate per minute, messages are kept in queue, in average, 468ms (σ = 185ms) while for 10% churn rate up to 10s (σ = 451ms).

Broker-based SRPT

For the results presented in this section, we consider a SRPT Pub/Sub system based on brokers (e.g., DYNATOPS [START_REF] Zhao | Dynatops: A dynamic topicbased publish/subscribe architecture[END_REF], see Section 5). We call it SRPT -B and the previous SRPT system was renamed as SRPT -S. In SRPT -B, the single broadcast tree per topic is composed of nodes that are either brokers (instead of subscribers) or forwarders. Subscribers are directly connected to brokers, according to their locality and/or interests. Each published message for a topic is transmitted over the corresponding tree and each broker, directly sends each received message to the subscribers to which it is connected. We defined 3 configurations for SRPT -B with different number of brokers: 32, 256, and 2048. The other nodes are subscribers evenly distributed among the brokers: 127, 15, and 1 subscribers per broker. Note that for both SRPT -B and SRPT -S, forwarders were not employed, i.e., trees are composed only by the respective numbers of brokers or by 4096 subscribers, respectively.

The reception latency of SRPT -B is composed of the time to send a message to the brokers (Tree in the figure) plus the time for the broker to send the message to the connected subscribers (B-S in the figure). On one hand, we observe that the fewer the number of brokers, the lower the Tree reception latency. On the other hand, the fewer the number of brokers, the higher the number of messages per broker forwarded to subscribers, inducing broker-level contention (much like the roots of SRPT ) and, therefore, the higher the B-S reception latency. With 32 brokers, the average B-S latency is 4 times higher than the other SRPT -B's B-S latencies due to high brokerlevel contention while, with 256 nodes, the load is better distributed.

We also point out that even if VCube-PS builds trees with larger heights compared to SRPT -B's, it presents lower average reception latency than all SRPT -B configurations (22% better for SRPT -B with 256 brokers) since it avoids contention by exploiting multiple paths. A last observation is that SRPT -B with 2048 brokers has lower reception latency than SRPT -S the latter presents more contention in the root of the tree, which is composed by 4096 subscribers.

Related Work

Basically, there exist two models of Pub/Sub systems: topic-based [START_REF] Castro | Scribe: a large-scale and decentralized application-level multicast infrastructure[END_REF][START_REF] Zhuang | Bayeux: An architecture for scalable and fault-tolerant wide-area data dissemination[END_REF][START_REF] Gascon-Samson | Dynamoth: A scalable pub/sub middleware for latency-constrained applications in the cloud[END_REF][START_REF] Zhao | Dynatops: A dynamic topicbased publish/subscribe architecture[END_REF] and content-based [START_REF] Cugola | The jedi event-based infrastructure and its application to the development of the opss wfms[END_REF][START_REF] Bianchi | Stabilizing distributed r-trees for peer-to-peer content routing[END_REF]. In the first model, subscribers share a common knowledge on a set of available topics and every published message is labeled with a topic. In a topic-based Pub/Sub system, a subscriber can register its interest in one or more topics, and then it receives all published messages related to these topics (e.g., Scribe [START_REF] Castro | Scribe: a large-scale and decentralized application-level multicast infrastructure[END_REF], Bayeux [START_REF] Zhuang | Bayeux: An architecture for scalable and fault-tolerant wide-area data dissemination[END_REF], DYNATOPS [START_REF] Zhao | Dynatops: A dynamic topicbased publish/subscribe architecture[END_REF], Dynamoth [START_REF] Gascon-Samson | Dynamoth: A scalable pub/sub middleware for latency-constrained applications in the cloud[END_REF], BeaConvey [START_REF] Chen | Beaconvey: Co-design of overlay and routing for topic-based publish/subscribe on small-world networks[END_REF], etc.). In the content-based model [START_REF] Eugster | The many faces of publish/subscribe[END_REF], messages are structured based on multiple attributes, and subscribers express their interests by specifying constraints over the values of these attributes (e.g., SIENA [START_REF] Carzaniga | Achieving scalability and expressiveness in an internet-scale event notification service[END_REF], JEDI [START_REF] Cugola | The jedi event-based infrastructure and its application to the development of the opss wfms[END_REF], BlueDove [START_REF] Li | A scalable and elastic publish/subscribe service[END_REF], etc.). This approach offers more flexibility to subscribers for defining their interests, but at the expense of more complex user interfaces and the need for filtering. On the other hand, topic-based systems provide simpler and more efficient implementations and they are usually deployed in contexts where efficient and fast notifications are required.

Similarly to VCube-PS , many Pub/Sub systems use tree-based overlays (e.g., Scribe [START_REF] Castro | Scribe: a large-scale and decentralized application-level multicast infrastructure[END_REF], Bayeux [START_REF] Zhuang | Bayeux: An architecture for scalable and fault-tolerant wide-area data dissemination[END_REF], Marshmallow [START_REF] Gao | Marshmallow: A content-based publish-subscribe system over structured p2p networks[END_REF], DR-Tree [START_REF] Bianchi | Stabilizing distributed r-trees for peer-to-peer content routing[END_REF], DYNATOPS [START_REF] Zhao | Dynatops: A dynamic topicbased publish/subscribe architecture[END_REF], Magnet [START_REF] Girdzijauskas | Magnet: practical subscription clustering for internet-scale publish/subscribe[END_REF], DRScribe [START_REF] Li | Drscribe: An improved topic-based publish-subscribe system with dynamic routing[END_REF], etc.). The advantage of using trees is mainly due to logarithmic guarantees as, for example, reception time of messages with respect to the number of nodes that compose a tree. However, different from VCube-PS , most solutions often implement a single multicast tree (usually one per topic in topic-based systems), statically constructed from the start or rebuilt/updated as nodes join the system. Consequently, every publication should be broadcast from the root of this tree that can become a bottleneck. Moreover, the paths of many of these multicast trees include nodes that are not subscribers but have to forward messages in which they are interested, thus, the problem of false positives and the need of message filtering (e.g. DR-Tree [START_REF] Bianchi | Stabilizing distributed r-trees for peer-to-peer content routing[END_REF] and Scribe [START_REF] Castro | Scribe: a large-scale and decentralized application-level multicast infrastructure[END_REF]). We also point out that maintenance cost is usually high, specially in presence of churn. Many Pub/sub systems (e.g. Scribe [START_REF] Castro | Scribe: a large-scale and decentralized application-level multicast infrastructure[END_REF], DYNATOPS [START_REF] Zhao | Dynatops: A dynamic topicbased publish/subscribe architecture[END_REF], Magnet [START_REF] Girdzijauskas | Magnet: practical subscription clustering for internet-scale publish/subscribe[END_REF], DRScribe [START_REF] Li | Drscribe: An improved topic-based publish-subscribe system with dynamic routing[END_REF], etc.) build multicast trees on top of Distributed Hash Table (DHT) overlays (e.g Pastry, CAN). They adopt the rendezvous point approach, where a node, responsible for the hash key of a topic name, becomes the rendezvous point, i.e., the root of the multicast tree related to the topic. In order to join this tree, a node seeks a DHT path that leads to the root. Hence, nodes in the tree are either subscribers/brokers of the topic or merely forwarders, which are added to the tree because they are there: in the path towards the root. HOMED is a content-based system proposed in [START_REF] Choi | Homed: a peer-to-peer overlay architecture for large-scale content-based publish/subscribe system[END_REF] that maps nodes to a logical hypercube. However, contrarily to VCube-PS , spanning tress are not necessarily rooted at the publisher.

Few Pub/Sub systems ensure message ordering [START_REF] Baldoni | Dynamic message ordering for topic-based publish/subscribe systems[END_REF][START_REF] Cugola | The jedi event-based infrastructure and its application to the development of the opss wfms[END_REF][START_REF] Lumezanu | Decentralized message ordering for publish/subscribe systems[END_REF][START_REF] Zhang | Total order in content-based publish/subscribe systems[END_REF], and when they do it is usually total order. Authors in [START_REF] Baldoni | Dynamic message ordering for topic-based publish/subscribe systems[END_REF] propose a topic-based Pub/Sub system where messages published on different topics are either delivered in the same order to all subscribers or tagged as out-of-order (weak total order); while in [START_REF] Lumezanu | Decentralized message ordering for publish/subscribe systems[END_REF], the task of ordering messages is distributed across sequencer nodes which totally order messages for the same topic. Considering FIFO links, [START_REF] Zhang | Total order in content-based publish/subscribe systems[END_REF] presents a distributed total order protocol for a content-based Pub/Sub system where a broker can decide if a message can be delivered immediately or some consistent delivery order is required. The approach proposed in [START_REF] Malekpour | Probabilistic FIFO ordering in publish/subscribe networks[END_REF] measures the variations of end-to-end delay of messages, which cause out-of-order messages. Based on the measurements, nodes delay or not the delivery of a message aiming at reducing FIFO delivery order violations. JEDI [START_REF] Cugola | The jedi event-based infrastructure and its application to the development of the opss wfms[END_REF] is a Pub/Sub system that ensures per topic causal order. The latter is implemented by using a return value, a message for the receiver to notify the producer that a message was delivered, unlike VCube-PS , which does not require these extra messages since causal dependencies of a message are included in the message itself (causal barriers). The articles [START_REF] Nakayama | Reduction of unnecessarily ordered event messages in peer-to-peer model of topic-based publish/subscribe systems[END_REF][START_REF] Yamamoto | Merging topic groups of a publish/subscribe system in causal order[END_REF] exploit message causal order in Pub/Sub systems. However, neither of them provide a mechanism for assuring causal delivery order of messages for the same topic, as VCube-PS . The first one proposes to causally order messages from different topics while the second one claims to ensure causal order when network partitions are merged, assuming that messages published in each partition are already causally ordered.

Conclusion

In this work we presented VCube-PS , a distributed topic-based Pub/Sub system. VCube-PS propagates information about membership changes and disseminates published messages to the subscribers of a topic using dynamic spanning trees built on top of a hypercube-like topology that presents multiple logarithmic features. While most other Pub/Sub approaches use static trees and rendezvous points, VCube-PS creates a new spanning tree rooted on the source of every message that is published, without any extra cost, due to V Cube's properties. As the spanning trees contain only subscribers of a specific topic, the trees have a shorter height when compared to a per-topic single root tree and, therefore, present lower latencies and employ less messages. Furthermore, VCube-PS enforces the causal delivery of messages using causal barriers adapted to cope with the dynamics of the system. Experimental results from simulations on PeerSim confirm benefits of the logarithmic properties of VCube-PS . Compared to an approach with one single root per topic, our solution presents the best results under a high publication rate per topic since it intrinsically provides load balancing. Furthermore, VCube-PS does not employ permanent forwarders which induce false positives and employs decentralized message broadcast which is efficient in terms of time.

Future directions of our work include adapting the proposed strategy to tolerate node faults. Furthermore, VCube's inference rules and causal history, provided by causal barriers, can be exploited in order to combine, without any extra cost, causal related broadcast messages within a single message, reducing, therefore, the number of sent messages and contention over the network, as shown in our paper [START_REF] De Araujo | A communication-efficient causal broadcast protocol[END_REF].

Figure 1 :

 1 Figure 1: VCube hierarchical organization.

Figure 2 :

 2 Figure 2: Example of causal barrier.

  2}, and Children(4, * , 2) = {5, 6}. On the other hand, if only nodes 0, 3, and 4 have joined topic t 1 , Children(0, t 1 , 3) = {3, 4} and Children(4, t 1 , 2) = ∅.

Figure 3 :

 3 Figure 3: Broadcast trees for two different sources and topics.

  PUB messages with 25% of subscribers.

Figure 4 :

 4 Figure 4: Latency and number of messages with a single publisher.

  (a)), which is used in all other evaluations of this work, 1/100 ratio (t pp = 100). 1/1000 ratio (t pp = 1000).

Figure 5 :

 5 Figure 5: Reception latency with 25% and 100% of publishers (log. scale).

Figure 6 :

 6 Figure 6: Distribution of causal dependencies for VCube-PS with 256 nodes.

Figure 7 :

 7 Figure 7: Average reception latency with 256 nodes and 128 topics.

  Different numbers of subscribers and churn rates.

  1000 subscribers and a varying churn rate.

Figure 8 :

 8 Figure 8: Average reception latency under churn.

Figure 9 :

 9 Figure 9: Average reception latency for different approaches and 4096 nodes.

Figure 9

 9 Figure9shows the average reception latency for SRPT -S, SRPT -B, and VCube-PS . Publishers are randomly chosen among the subscribers of the topic and send a new message on average every 500 u.t., up to 128 messages.We defined 3 configurations for SRPT -B with different number of brokers: 32, 256, and 2048. The other nodes are subscribers evenly distributed among the brokers: 127, 15, and 1 subscribers per broker. Note that for both SRPT -B and SRPT -S, forwarders were not employed, i.e., trees are composed only by the respective numbers of brokers or by 4096 subscribers, respectively.The reception latency of SRPT -B is composed of the time to send a message to the brokers (Tree in the figure) plus the time for the broker to send the message to the connected subscribers (B-S in the figure). On one

  create task HAN DLE RECEIV ED M SG 5: procedure Co Broadcast(message type type, topic t, message data)

	37: Task HAN DLE RECEIV ED M SG 83: procedure CheckDelivery(topic t)
	38: loop 84: while (∃ s, c, cb ∈ not delvs[t] : CheckCB(t, cb) = true) do
	39: 85:	upon receive m from p j Co Deliver(m), m ∈ msgs: m.s = s, m.t = t, and m.c = c	block if no message
	40: 86:	if m.type = ACK then not delvs[t] ← not delvs[t] { s, c, cb }
	41: 87:	if m.type = SU B then msgs ← msgs {m}
	42: 88:	chd ← Children(i, * , Cluster(i, j) -1) last delvs[t] ← last delvs[t] { s, } ∪ { s, c }
	43: 89:	else causal barrier[t] ← causal barrier[t] cb ∪ { s, c }
	44:	chd ← Children(i, m.t, Cluster(i, j) -1)
	45: 90: function CheckCB(topic t, causal barrier cb) if chd = ∅ then		leaf node
	46: 91:	New(m ) for all s, c ∈ cb do
	6: 47: 48: 92: 7: 49: 93: 8: 50: 94:	m .type ← ACK; m .s ← m.s; m .t ← m.t m .c ← m.c; m.data ← ∅ (∃ s , c ∈ last delvs[t]: s = s and c ≥ c) or (∃ s , c ∈ f irst rec[t]: s = s and c > c) SendACKs(j, m ) cb ← cb { s, c } New(m) if m.type ← type; m.s ← i; m.t ← t m.c ← counter; m.data ← data else return (cb = ∅)	then	propagate m
	9: 51:	counter ← counter + 1 acks ← acks ∪ { j, #(chd), m.s, m.t, m.c, ∅ }
	10: 52:	if type = SU B then for all k ∈ chd do
	11: 53:	create task ST ART M SG P ROP AGAT ION (t) Send(m) to p k
	12: 54:	br queue[t].insert(m) else			m.type = ACK
	55:
	19:	Co Deliver(m)
	20:	last delvs[t] ← last delvs[t]	{ i, } ∪ { i, m.c }
	21:	m.cb ← causal barrier[t]
	22:	causal barrier[t] ← { i, m.c }
	23:	if m.type = SU B then
	24: 25: 67: 26: 68: 69:	chd ← Children(i, * , log 2 N ) msgs ← msgs ∪ {m} else CheckDelivery(m.t) chd ← Children(i, t, log 2 N ) else if m.type = ACK then		received messages may be delivered
	27: 70:	for all k ∈ chd do view[m.t] ← Update(view[m.t], m.data)
	28: 71:	Send(m) to p k else			SU B or U N S message
	29: 72:	if chd = ∅ then view[m.t] ← Update(view[m.t], { m.s, m.type, m.c })
	30: 73:	acks ← acks ∪ { ⊥, #(chd), i, t, m.c, ∅ } if m.type = U N S then
	31: 74:	wait until (acks ∩ { ⊥, , m.s, m.t, m.c, f irst rec[m.t] ← f irst rec[m.t]	} = ∅) { m.s, }
	32:	if m.type = U N S then
	33: 75: function Update(set 1 , set 2 ) msg ← msg {m | m.t = t} not delvs[t] ← ∅
	34: 76:	f irst rec[t] ← ∅; delv[t] ← ∅ for all n 1 , , rc 1 ∈ set 1 do
	35: 77:	if br queue[t] = ∅ then if (∃ n 1 , , rc 2 ∈ set 2 ) then
	36: 78:	exit if rc 2 > rc 1 then
	79:	set 1 ← set 1 { n 1 , , rc 1 }
	80:	else
	81:	set 2 ← set 2 { n 1 , , rc 2 }
	82:	return set 1 ∪ set 2

13: Task ST ART M SG P ROP AGAT ION (topic t) 14: loop 15: m ← br queue[t].f irst() block if queue is empty 16: if m.type = P U B then 17: if i, / ∈ f irst rec[t] then 18: f irst rec[t] ← f irst rec[t] ∪ { i, m.c } k, nb, mem ← k , nb , mem : k , nb , m.s, m.c, m.t, mem ∈ acks 56: acks ← acks k, nb, m.s, m.c, m.t, mem 57: m.data ← m.data ∪ mem 58: if nb > 1 then 59: acks ← acks ∪ k, nb -1, m.s, m.c, m.t, m.data 60: else if k = ⊥ then All pending ACKs were received 61: SendACKs(k, m) 62: if i, SU B, ∈ view[m.t] then i is subscribed to m.t 63: if m.type = P U B then 64: if ( m.s, ∈ f irst rec[m.t]) then 65: f irst rec[m.t] ← f irst rec[m.t] ∪ { m.s, m.c } 66: not delvs[m.t] ← not delvs[m.t] ∪ { m.s, m.c, m.cb } 95: procedure SendACKs(j, m) 96: if ( i, SU B, ∈ view[m.t] and m.s, ∈ f irst rec[m.t]) then 97: m.data ← m.data ∪ { i, SU B, c : i, SU B, c ∈ view[m.t]} 98: Send(m) to p j

Table 1 :

 1 Average size of the queue per group of nodes.

	# of messages # of nodes (VCube-PS) # of nodes (SRPT)
	0	0	512
	(0, 2]	0	448
	(2, 4]	0	60
	(4, 8]	495	3
	(8, 16]	510	0
	(16, 32]	19	0
	(32, 4096]	0	0
	(4096, 8192]	0	1

N s is smaller than the total number of nodes of the simulation in order to have some extra nodes in the churn process while keeping the same hypercube dimension.


Dr L Perrin

A Laurent

CURRENT SITUATION AND FUTURE IMPLEMENTATION OF SAFETY CURRICULA FOR CHEMICAL ENGINEERING EDUCATION IN FRANCE

Keywords: safety, education, loss prevention, chemical engineering

The paper describes an overview of the curricula concerning the safety and loss prevention courses delivered in the three following French departments of chemical engineering:

INTRODUCTION

The importance of safety and loss prevention has been underlined by a number of major chemical disasters. Those at Feyzin (1966), Flixborough (1974), Seveso (1976), Mexico City (1984), Bhopal (1984), Schweitzerhall Basel (1986), Port Herriot Lyon (1987), Pasadena (1989), Blaye (1997), AZF Toulouse (2001), Buncefield (2005) and Texas City (2005) for example are the best known, but there have been several others with death tolls. Some of these accidents have particular impact in the Continental Europe. The trend has been particularly in France for petrochemical, heavy chemical, fines chemical, food and pharmaceutical industries to urge universities to teach safety and for professional bodies to introduce a requirement that safety and loss prevention be part of the academic curriculum. The challenge was to develop a way to improve the ability of chemical engineers to integrate a widespread safety culture. This paper describes an overview of the actual curricula concerning the safety and loss prevention courses delivered in the three following French departments of chemical engineering: Ecole Nationale Supérieure des Industries Chimiques de Nancy (ENSIC), Ecole Nationale Supérieure des Arts Chimiques et Technologiques de Toulouse (ENSIACET) and Ecole Nationale Supérieure en Génie des Technologies Industrielles de Pau (ENSGTI). [START_REF] Harvey | Third report of the advisory committee on major hazards[END_REF] has stated the justification to include safety in chemical engineering curriculum as following: «It is important that students be introduced to the concept of inherently safer design and that they realize that safety in plant operation must be considered right at the start of the design study. Process safety must be taught in a rigorous, stimulating way by staff of appropriate experience. Departments which initially do not have this expertise may need to use the services of experts from other universities, industry and consulting firms. By virtue of the nature of processes which give rise to major hazards, it is the chemical engineer who often fills the position of responsible person in the design or operation of plant». [START_REF] Kletz | Should undergraduates be instructed in loss prevention?[END_REF] advanced three principal arguments to support this view. One is the importance of treating safety from the outset as an integral part of the design of plant and of aiming for inherently safer design. Another is that whatever use he may make of other subjects taught at university, any practising chemical engineer will be involved in safety matters. He has a moral and legal responsibility and will probably be faced with issues from the first day. The third is that safety and loss prevention involve basic principles.

WHY TO TEACH SAFETY IN CHEMICAL ENGINEERING?

The extent to which safety and loss prevention rank as a mainstream subject in chemical engineering has been examined by Marshall (1991). He argues that to qualify a subject must meet the following criteria. It should:

(a) be acknowledged as such by academic culture, (b) be recognized as relevant by students, (c) be intellectually demanding, (d) comprise a well established corpus of knowledge, organized on clearly defined unifying principles, (e) be highly quantitative and thus capable of being subjected to mathematical analysis, (f) possess a content and unifying principles set out in authoritative textbooks, (g) be taught by specialists, (h) be a compulsory subject which must normally passed and (i) be examined formally.

He goes on to consider the extent to which safety and loss prevention now meet these criteria.

WHEN TO TEACH SAFETY IN CHEMICAL ENGINEERING?

As Europe is implementing the Bologna three cycle degrees system, it would be useful to present the survey for a French "Safety, Health and Environment" education in a Bologna type study organization. This three stages structure will also facilitate one of the goals of Bologna process such as more and simple exchange in Europe during studies. The French existing structure is The two semesters L5 and L6 of the French departments are equivalent to the two last semesters of the three years first degree. The four semesters M1 to M4 correspond with the two years second degree. The teaching approach of SHE is then developed during the three years of the curriculum. At the present time, the inclusion of safety and loss prevention over the three year period of the curriculum is shown in table (I).

HOW TO TEACH SAFETY IN CHEMICAL ENGINEERING?

A question that should be answered right at the beginning is: Should the safety and hazard aspects be -included as part of all chemical engineering courses?

-taught as a separate full course?

The final choice depends upon the philosophy teaching of each department, but the following points should be considered. The first way has an advantage in that it can be coordinated with the rest of course material. Safety can serve as an integrating factor in course. Table (II) illustrates some examples of the links between safety topics and regular subjects in chemical engineering curriculum.

Table (II)

-Some examples of the links between safety topics and regular subjects in chemical engineering curricula (Lees, 1996;IChemE, 1990). This way of integration could be continual reinforcement over a three years period of curriculum in France. But there are problems in dealing only with other subjects. It cannot be expected that staff across the whole discipline will have the necessary interest, knowledge and experience.

SAFETY TOPICS REGULAR SUBJECTS Chemical hazards and toxicity

More such treatment is unlikely to get across the unifying principles. At the present time this way is ever in France the most difficult to implement because the lack of faculty members with sufficient background and interest to teach such material. These latter arguments have weight and the tendency appears to be promoting a separate course on safety. In this second way, teaching a separate full course, the above disadvantages would disappear; the course would be more coherent and could better coordinate. We believe that the main advantage of a separate course is that such course can concentrate on the subject and especially present a systemic approach.

WHAT TO TEACH SAFETY IN CHEMICAL ENGINEERING?

The answer is not trivial. As a matter of fact the fundamental problem lies in the basically "vertical" training given to chemical engineers, since those are taught in narrow and well-defined specialised fields. Now HSE definitely requires a horizontal approach: there is a need for such a horizontal vision and integration of knowledge and expertise. This suggests actions to be taken to make trainers aware of this multidisciplinary approach. In practice, chemical engineers have to consider complex situations involving different disciplines. Therefore, training is moving progressively to a more integrated approach, involving concepts from a number of disciplines (including social sciences and humanities) to expand the perspectives of chemical engineers and to promote a multidisciplinary approach to decision-making. At first we introduce an initiation with many examples of systemic approach and particularly the systemic model of hazard (Laurent, 1999;Perilhon et al., 2001).

To treat a phenomenon perceived as a complex system consists to establish the fact that the knowledge of this phenomenon is subordinated to the knowledge of the parts that make the whole, of the interactions between these parts, of the interactions with the environment and of the objectives of the observer or actor of the whole. The systemic approach proposes methodological principles for the investigation of natural and artificial systems with the aim of improving their conception, their functioning and their management. The Analysis Methodology for Malfunctions in Systems (acronym MADS in French) model consider installation, hardware, software, humans, management decision-making and organizational design as an integrated whole. The hazard analysis techniques based on this expanded model provide a means for obtaining the information necessary to design safety into the system and to determine the most critical parameters to monitor during the operations and how to respond to them. The reference model called "hazard process" put into relation a danger source system and a target system by means of a hazard flux within an active environmental field. (Laurent, 1999;Perilhon et al., 2001).

Figure (

3) shows a schematic view of the reference model of hazard process (Laurent, 1999;Perilhon et al., 2001). (Laurent, 1999;Perilhon et al., 2001).

Figure (3) -Schematic view of the reference model of hazard process

During the semester L5 of the first year, chemical process safety is introduced in the three departments via existing laboratory work courses in chemistry and chemical engineering. For each cycle of experiments safety procedures for the laboratory and pilot plant work courses are reviewed. Plant visits and summer positions for worker training that emphasize some aspects of safety and health are organized for all students.

After that the aim of the general content of the safety courses is made up of the following three general subject matters:

-Technical knowledge (including such aspects as definitions, risk assessment methodologies, accident analysis, and statistics and probability);

-Organisational knowledge (such as roles and responsibilities of various stakeholders, economic/financial aspects, relevant laws and regulations, business and safety management systems, and decision-making processes);

-Social/human knowledge (including risk communication, human factors and very soon ethical issues).

Our detailed list of course topics is similar to many accounts of practice in particular safety courses given in the literature [START_REF] Kletz | Safety in design[END_REF][START_REF] Kaufmann | Health, safety and loss control topics in the senior design courses[END_REF][START_REF] Crowl | Safety and loss prevention in the undergraduate curriculum -A dual perspective[END_REF]Levitzky, 1988;[START_REF] Fleischman | Rationale for incorporating health and safety into the curriculum[END_REF][START_REF] Gupta | A chemical plant safety and hazard analysis course[END_REF]Nolan, 1989;[START_REF] Fleischman | Risk reduction in the chemical engineering curriculum[END_REF][START_REF] Laurent | Pour un enseignement de sûreté de fonctionnement des procédés dans les écoles d'ingénieurs de chimie et de génie chimique : l'expérience pédagogique acquise dans ce domaine par l'ENSIC NANCY[END_REF][START_REF] King | Incorporating safety into a unit operations laboratory course[END_REF]Sheppard, 1998;Louvar and Hendershot, 2003;Papadki, 2007 and[START_REF] Ferjencik | Best starting point comprehensive process safety education[END_REF]. The content of the core course was proposed in agreement with the safety and environmental guidelines recommended by the Accreditation Committee of the Institution of Chemical Engineers (IChemE, 1990). The Safety Health and Environment Committee (SHEPC) of IChemE decided to promote a matrix approach that divided the topics into basic principles and design project, special topics as well as integral with other topics, mandatory integral, mandatory separate and optional topics (Smith, 1997). In the same way the comparison of the main content is similar with the too much detailed guidance entitled « Lehrprofil Sicherheitstechnik » proposed by the Dechema / GVC Committee « Sicherheitstechnik in Chemieanlagen » (Dechema/GVC, 1997). At last our proposed safety curriculum complies with the recommendations on the one hand of the simplified guide of the EFCE Working Party Education [START_REF] Gillett | Chemical engineering education in the next century[END_REF] and on the other hand of the ECTS Bologna scheme (Pohorecki, 2005).

An example of the content of the core compulsory courses delivered in 2007 during the semester M2 at ENSIC Nancy is presented in table (III). Note that the lecture part of the course was given weekly in two successive sessions of 90 minutes. A written examination forces students to read the courses book. We give a three hours open book exam. During this curriculum the students can obtain the certificate of first-aid worker. The organization of this certification, validated by the ministry for health, is at the ENSIC Nancy under the responsibility of the students association. The courses related to this possible certificate validation are fully integrated in the ENSIACET Toulouse curriculum.

WHICH TEACHERS TO TEACH SAFETY IN CHEMICAL ENGINEERING?

The three departments presented in this document use three different strategies. The ENSIC Nancy decided to integrate this curriculum, and after having used during a few years outside contributors (industrial) decided to compose a teaching team of four teachers. Nowadays 95% of the courses are carried out by this team.

The ENSGTI Pau shares its curriculum 50/50 between courses carried out by teachers of its department and conferences carried out by industrialists.

The courses of the ENSIACET Toulouse are mainly carried out by lecturers external to the department.

WHAT DEPTH TO TEACH SAFETY IN CHEMICAL ENGINEERING?

We adapted one practical answer proposed by J.E. Gillett, then by S. F. de Azevedo to teach chemical engineering [START_REF] Gillett | Chemical engineering education in the next century[END_REF][START_REF] Azevedo | Which education of chemical engineers in 2020?[END_REF]. It was to consider SHE subjects in elements that reflected three stages of learning. The first stage is to provide a basic awareness (beginner level), a second stage to provide an increasing appreciation sufficient to work with subjects experts (practical level) and the third stage to provide the level of full understanding and expertise (expert level). The idea of considering these three levels may have helped with SHE curriculum design and also have utilized to introduce difficult SHE subjects gradually to assist a deeper better understanding. Like this the core SHE subjects, as for example basic concepts and risk analysis methodology, had to be taught in depth.

WHAT TEACHING AIDS TO USE FOR SAFETY?

For the particular subjects of HSE we used many aids to teaching available that can be categorized as follows:

-Vicarious experience: books [START_REF] Crowl | Chemical process safety: fundamentals with applications[END_REF][START_REF] Kletz | Plant design for safety: a user-friendly approach[END_REF]Lees, 1996;AIChE/CCPS books and Laurent, 2003), videos (IChemE packages; AIChE SACHE materials) films, sound recording…used to generate awareness and for short term arousal during long teaching sessions.

-Models: laboratory experiments, demonstrations, case studies, project work, computerized models [START_REF] Cameo | Manual of computer-aided management of emergency operations (CAMEO II)[END_REF], sequenced exercises, examples…widely used to provide insight and understanding of deeper knowledge.

-Dramatizations: films, novels, role playing (Verdel, 2006)…used to provide insight into subjective issues and to develop mindset.

-Automatic teaching devices: programmed learning modules (Perilhon, 1998;Fouchecourt, 2005), computerised teaching machines…best used for routine knowledge and procedures.

A first mandatory worker's training (one month at the end of the first year) and a second mandatory industrial training (4 to 6 months at the end of the second year) are another different and further approach to bringing HSE into the curriculum.

CONCLUSION: POTENTIAL PROSPECTS IN THE FRENCH FUTURE SAFETY EDUCATION

The education of chemical engineers in the principles of safety has been a priority in France for fifteen years. Although the integration of safety with chemical engineering education is important, it has not been sufficiently wide spread. It has been noted that a barrier to better integration safety is the already crowded nature of chemical engineering curricula and the continued pressure for the inclusion of new materials. There appears to be obstacles at least in the short term to its full integration. However that may be the next challenge in France will be to develop notable efforts for an extensive integration. Marshall (1990) supports a proposal for a better integrated approach concerning safety, occupational health and environmental protection with the constraint of social acceptability of the chemical and process industries. The proposition and the experience of Lemkowitz (1992) in the Delft University of Technology with the development of a unique program for integrating health, safety, environment and social aspects into chemical engineering education will be helpful for the potential application in France. The same author extends this multidisciplinary basically societal approach in relation with the concept of sustainability (Lemkowitz et al., 1999;Lemkowitz et al., 2000a andLemkowitz et al., 2000b).

At present we try to generate thoughts and opinions among the teachers to introduce an initiation to ethics in chemical engineering education. Indeed open-ended problems are the essence of any chemical engineering practice and a potential application cannot possibly be provided without going through ethical considerations, often ethical dilemmas. Now chemical engineering acts in a global market and therefore it is imperative that the students are prepared to work everywhere in the world where their expertise is needed. Ethics is not only about recognising ethical values, but also to realize how those can be interpreted and applied in a diverse cultural context. In an ideal pedagogical way, we would like to see ethics accessed implicitly as part of the assessment of almost each chemical engineering module. But this proposition raises the same difficulties as for teaching classical safety.

We tested first as introduction a simple approach proposed in the literature with the help of two safety and environmental scenarios that pose ethical problems (Mascone et al., 1991a andMascone et al., 1991b). At the beginning of a course the students were asked to fill out two survey questionnaires; next they discussed the scenarios and the obtained answers in interaction with the session moderated by the teacher. The goal of the discussion was to get the students to consider and discuss the consequences of the various alternative actions. The evaluation of the session was useful but too pedagogically limited.

A more complete example of that opportunity was discussed in detail by Ocone (2005) The detailed content of these elements is described in the reference [START_REF] Jr | The safety ethic: where can you get one?[END_REF]. This simple model for the safety ethic provides the opportunity to strive to a new level of attention to safety.

In conclusion, for the future French safety education, the potential application of several trends summarized as follows:

-contribute to learning safety programme in early chemical engineering curricula, particularly with the introduction of the inherent safety concepts improve knowledge of the field "health, safety and environment" with the strengthening of the role of science and engineering -improve awareness of ethical in safety and in risk management -further the establishment of a safety culture will be the main outlines for the requisite improvement of teaching safety in chemical engineering curriculum.

  based on three main cycles of Licence -Master -Doctorate (LMD) equivalent to Bachelor's -Master's -Doctorate Model. The situation of the three examined French chemical engineering departments in the Bologna process is scheduled in the figure (1).

Figure ( 1

 1 Figure (1) -Situation of the French chemical engineering departments in the Bologna process.

  Figure (2) -Illustration of the systemic MADS model(Laurent, 1999; Perilhon et al., 2001).

  with the proposition of two possible main broad routes to teach ethics. She feels to conclude that we do need to teach ethics, but the way we teach is open to interpretations, personal views and experience. In the same way, Lemkowitz et al. (2004) note in their industrial ecology teaching approach the necessity to distinguish between epistemological and ethical questions.Finally what do we know and propose about the safety ethic? At the present time we try to apply the cohesive model of the safety ethic identified by[START_REF] Jr | The safety ethic: where can you get one?[END_REF]. This model recapitulates the five following elements: I value safety as a positive, integral part of my every day activities I work safely by minimizing risks of injury and illness I prevent at risk behaviour whenever I encounter it I promote safety to others whenever possible I accept responsibility for safety as a free act of caring for others

Table ( I

 ( ) -General overview of the inclusion of safety and loss prevention over the three year period of the curriculum.

	Year Semester NANCY	PAU	TOULOUSE
		L5	Safety awareness in	Safety awareness in	Initiation courses(18hr)
	1		laboratory work	laboratory work course	ECTS = 2
			course.
			Safety of external
			contractors (individual
			certification level #1)
		L6	Initiation courses
			(12hr)
		M1			Core compulsory
					courses (18 hr)
					ECTS = 1
	2	M2	Core compulsory	Core compulsory
			courses (42 hr)	courses (49hr)
			ECTS = 4	ECTS = 6
		M3	Design project		Elective courses
			Industrial training	Industrial training	(222 hr)
			Core compulsory		ECTS = 15
	3		courses (30hr)
			ECTS = 2
			Safety of external	Design project
			contractors (individual
			certification level #2)
		M4			Design project
					Industrial training

internationales des formations universitaires et avancées dans le domaine des sciences et techniques du danger, INFORISK, Actes 149, Bordeaux, France. Laurent A., 1999, Information feedback for improving safety and loss prevention courses on French chemical engineering education, ECCE 2, Montpellier, 5-7 October 1999, Chemical engineering education, Now teaching: safety, health and environment, Récents Progrès en génie des procédés, volume 13, N°64, 537-544, Ed. Lavoisier Paris, France. Laurent A., 2003, Sécurité des procédés chimiques: connaissances de base et méthodes d'analyse de risques, Ed. Lavoisier Tec & Doc, Paris, France. Lees F. P., 1996, Loss prevention in the process industries, Hazard identification and control, Second edition, Volumes I -II -III, Ed. Butterworth-Heinemann, Oxford (UK). Lemkowitz S. M., 1992, A unique program for integrating health, safety, environment and social aspects into undergraduate chemical engineering education, Plant and Operations Progress, 11 (3), 140-150. Lemkowitz S. M., Pasman H. J. and Harmsen G. J., 1999, Complementing safety, health and environment in chemical engineering education with the new paradigm of the 21st century : sustainability, 2nd European Congress of Chemical Engineering, Topic 11, Montpellier (F). Lemkowitz S.M., Harsem G.H., Korevaar G; and Lameris G.H., 2000a, Implementation of sustainable development into industrial and university chemical engineering, 14 th International Congress of Chemical and Process Engineering (CHISA), Session: Chemical engineering education in 21 st century, Paper K3.3, 27-31 August 2000, Praha (CS). Lemkowitz S.M., Pasmann H.J. and Schupp B.A., 2000b, Integration of safety, health, environment and societal questions into engineering education and industrial training, 14 th International Congress of Chemical and Process Engineering (CHISA), Session: Chemical engineering education in 21 st century, Paper K3.4, 27-31 August 2000, Praha (CS). Lemkowitz S.M., Lameris G.H., Van der Voet E. and Nikoli´c I., 2004, An industrial ecology teaching approach suitable to all university students, International Conference on Engineering Education in Sustainable Development, EESD 2004, D. Ferrer-Balas, K.F. Mulder, J. Bruno and R. Sans (Eds), CIMNE and UPC, Barcelona (SP). Levitzky J. J., 1988, Safety, health and loss prevention in the undergraduate chemical engineering curriculum, Plant and Operations Progress, 7(3), 190-194. Louvar J. F. and Hendershot D. C., 2003, SACHE: 17 years of promoting teaching of safety to chemical engineering students, Chemical Health & Safety, September/October, 8-10. Marshall V. C., 1991, Teaching process safety, The Chemical Engineer, August, 502, 30-31. Mascone C.F., Santaquili A.G. and Butcher C., 1991, Engineering ethics: what are the right choices?, Chemical Engineering Progress, 61-64, April. Mascone C.F., Santaquili A.G. and Butcher C., 1991, Engineering ethics: how ChEs respond, Chemical Engineering Progress, 73-82, 0ctober. Nolan P.F., 1989, Safety and loss prevention teaching, J. Loss Prev. Process. Ind., 2(1), 3-4. Ocone R., 2005, Should we teach ethics in chemical engineering? The Chemical Engineer, 24-29, November. Papadaki M., 2007, Inherent safety, ethics and human error, Journal of Hazardous Materials,???? Perilhon P., 1998, Software MADS -MOSAR II, CD Rom, Fox Media. Perilhon P., Leroux J.P., Perrin L. and Laurent A., 2001, Potentialités pédagogiques de la méthode MADS -MOSAR pour la formation à l'analyse des risques, 8 ième Congrès Francophone de Génie des Procédés, Nancy, 17-19 Octobre 2001, Thème 6, Sûreté et sécurité: connaissances de base et analyse des risques, Récents Progrès en génie des procédés, 15(85), 101-106, Ed. Lavoisier Paris (F). Pohorecki R., 2005, European Federation of Chemical Engineering recommendations for chemical engineering education in a Bologna two cycle degree system, September. Sheppard C. M., 1998, Process safety in the curriculum, Chemical Engineering Education, Fall, 270-276. Smith M. K., 1997, Safety Health and Environment Committee, Institution of Chemical Engineers, A matrix of safety, health and environment topics for undergraduate courses, Rugby (UK). Verdel T., 2006, Simulation of crisis and emergency management, March 24, 2006, http://www.thierry.verdel.com, http://www.mines.inpl-nancy.fr/~verdel/mode.php?id=simulation.php

LIST OF FIGURE CAPTIONS

 (Laurent, 1999;Perilhon et al., 2001). (Laurent, 1999;Perilhon et al., 2001). (Laurent, 1999;Perilhon et al., 2001). (Laurent, 1999;Perilhon et al., 2001).

Figure (3) -Schematic view of the reference model of hazard process

Figure (3) -Schematic view of the reference model of hazard process