Pierre Fleckinger

Matthieu Glachant
email: matthieu.glachant@mines-paristech.fr

Paul-Hervé Tamokoué Kamga

ENERGY PERFORMANCE CERTIFICATES AND INVESTMENTS IN BUILDING ENERGY EFFICIENCY: A THEORETICAL ANALYSIS

Keywords: Q48, R31 Energy labeling, energy efficiency, buildings

In the European Union, Energy Performance Certificates (EPCs) provide potential buyers or tenants with information on a property's energy performance. By mitigating informational asymmetries on real estate markets, the conventional wisdom is that they will reduce energy use, increase energy-efficiency investments, and improve social welfare. We develop a dynamic model that partly contradicts these predictions. Although EPCs always improve social welfare, their impact on energy use and investments is ambiguous. This implies that, in a second-best world where energy externalities are under-priced and/or homeowners have behavioral biases hindering investments (myopia), EPCs can damage social welfare. This calls for using mandatory energy labeling in contexts where additional instruments efficiently mitigate the other imperfections.

Introduction

Improving energy efficiency is viewed as a major means to curb greenhouse gas emissions and, more generally, to limit the negative externalities generated by energy production, distribution, and use. This has led many countries to include ambitious energy efficiency objectives in their climate plans. As an illustration, the European Union set a binding target mandating a 20% reduction in energy use by 2020 relative to a business-as-usual scenario and current policy discussions focus on a 30% target for 2030.

Taxing energy taxation the primary policy strategy to reduce energy use, but it is usually combined with sector-specific policies. This is particularly true for buildings, which are responsible for a sizable share of total energy use (e.g. 40% in the EU). Many countries grant tax credits and subsidies to energy retrofits of existing buildings. Building codes include energy performance provisions for new buildings.

Another popular policy approach consists in providing potential buyers or tenants with information on the energy performance. In the European Union, so-called Energy Performance Certificates (EPCs) give information on a property's typical energy use and energy cost, an energy efficiency rating from A (most efficient) to G (least efficient), practical advice on improving such performance. Their publication is compulsory in all advertisements for the sale or rental of buildings since 2007. In other countries, energy labeling is usually voluntary (e.g. Energy Star, Leadership in Energy and Environmental Design).

The rationale for EPCs, and energy labeling more generally, is that buyers/tenants do not observe a dwelling's or an office's energy performance before moving in. In economic parlance, energy performance is an experience-good attribute. That is, a product characteristic which is difficult to observe in advance, but that will be revealed after the transaction. When considering a given property, a potential buyer or a tenant thus depends on the information provided by the seller/landlord who have clear incentives to manipulate this information by overstating the performance.

By limiting these informational asymmetries, EPCs are primarily expected to improve the matching between properties with heterogeneous energy performance and households on the real estate market. In particular, households with high energy needs -and thus a high willingness to pay for energy performance -will be able to choose energy-efficient properties, while households with lower needs will opt for cheaper, but lesser efficient properties. EPCs also raise the incentives to invest in energy efficiency as the price of energy-efficient properties is higher than that of inefficient ones. These two mechanisms are expected to reduce energy use and to improve social welfare.

We develop a dynamic model which examines the impact of EPCs on the level energy use, investments, and social welfare and find results that partly contradict these arguments. The model describes how the building stock of a city evolves over time. It includes two main ingredients: First, homeowners1 can make investments to upgrade their dwelling's energy performance. Second, a fraction of dwellings is sold on a competitive real estate market in each period.

We use this framework to identify the equilibrium investment paths with and without energy certification, and the resulting impact on energy consumption.

We confirm that, in the absence of other market imperfections, the introduction of EPCs improves social welfare in any case. However, the impact on the level of energy use and on the volume of energy efficiency investments is ambiguous. This has a very important policy implication. In a second-best world where energy externalities are under-priced and/or where consumers have behavioral biases that hinder investments (myopia), EPCs can damage social welfare. This calls for using EPCs in contexts where other imperfections are addressed by adequate instruments.

Literature on Building Energy Certification

We contribute to the economic literature on energy labeling of buildings with the first theoretical study dealing with its impact on energy use, retrofit investments and social welfare.

Almost all existing studies are empirical and concentrates on the impact on housing prices and rents (e.g., [START_REF] Brounen | On the economics of energy labels in the housing market[END_REF][START_REF] Kok | Doing Well by Doing Good? Green Office Buildings[END_REF][START_REF] Fuerst | The impact of Energy Performance Certificates on the rental and capital values of commercial property assets[END_REF][START_REF] Fuerst | Does energy efficiency matter to home-buyers? An investigation of EPC ratings and transaction prices in England[END_REF][START_REF] Hyland | The value of domestic building energy efficiency-evidence from Ireland[END_REF][START_REF] Michael Jensen | Market response to the public display of energy performance rating at property sales[END_REF][START_REF] Kok | The impact of energy labels and accessibility on office rents[END_REF]. They commonly find a positive impact although some studies are not able to identify whether this signals the effects of energy performance per se or the sole effect of labeling. The policy implications of these results are however limited. The ultimate objectives of energy labeling is reducing energy use and improving social welfare. In theory, this can occur through two mechanisms: a better matching between heterogeneous households and dwellings and higher investment incentives. The existence of a price premium is a necessary condition for this to occur, but is not sufficient to test for these goal achievements.

An exception is a paper by [START_REF] Comerford | The Supply-side Effects of Energy Efficiency Labels[END_REF] who examine the impact on energy performance. Relying on UK data, they identify a threshold effect.

After the introduction of the EPC, more homes have an energy rating just above the D grade and less homes have a rating just below (the color-coded letter grade of the EPC overlaid a pre-existing 0-100 point scale. It illustrates a situation already identified by [START_REF] Dranove | Quality Disclosure and Certification: Theory and Practice[END_REF]: sellers might want to game the system when information is disclosed. Here, sellers seem to invest in a strategic way to reach the letter D. This leads to potential inefficiency issues: some sellers might over-invest to reach the letter D, some sellers might under-invest because their letter is already D or above. 2 .

Note that we only refer here to schemes which publicly disclose energy performance on real estate markets. There have been many studies on private signals providing home occupiers with informational feedbacks on their home energy consumption (for instance, see [START_REF] Jessoe | Knowledge is (less) power: Experimental evidence from residential energy use[END_REF]). The underlying mechanisms are totally different since this information does not reduce informational asymmetries on real estate markets, but is expected to mitigate behavioral biases.

Model

Assumptions

We develop a dynamic model in discrete time, which describes the evolution of the building stock of a city. The stock include dwellings with energy performance θ. Each dwelling can either be energy-efficient (θ = 1) or inefficient (θ = 0). The dwellings are owned and occupied by a continuum of households with heterogeneous energy needs.3 More specifically, each household consumes a quantity of energy θ × e per period where e is distributed over [0, +∞) with cumulative F . F is continuous and the overall level of energy consumption is bounded:

+∞ 0 e dF (e) < +∞.

Let q t denote the share of efficient dwellings. We assume that all dwellings are inefficient at the beginning of the game: q 0 = 0. Any household can then invest in any period to upgrade its property if θ = 0. The cost is I and θ = 1 after investment, which is irreversible and which has an infinite lifetime (after investment, the energy performance is 1 over the entire time horizon). The share of efficient dwellings at time t is q t . In each period, m households exogenously move out and sell their dwelling to the same number of households living outside the city who move in. Incoming and outgoing households are drawn from the same distribution. The exogeneity of moving decisions captures the fact that most people decide to move in or out for professional or family reasons that are not related to home energy performance. The real estate market is competitive.

When there is certification, energy performance is perfectly observable before the sale. Without certification, we assume that incoming households only observe it after moving in. The timing of events within each period t is as follows:

1. m households move out and m households move in.

2. Outgoing households sell their dwellings to incoming households.

3. Incoming households observe the energy performance of their home.

4. Each household living in an inefficient dwelling (θ = 0) decides whether to invest I or not.

Payoffs are realized.

Last, we assume that all households form perfect expectations about future housing prices in all scenarios.

Social optimum

We can now identify the investment path and the allocation of households in the dwellings that implement the first best outcome. Under our assumptions, this optimum minimizes the discounted sum of investment and energy expenditures over the entire time horizon:

Social cost function is C = ∞ t=0 δ t +∞ 0 P t (θ = 0|e)(1 + α)e dF (e) + (q t+1 -q t )I
Consider first the socially optimal matching rule in period t contingent on a given building stock with a share of energy efficient dwellings q t . In this context, perfect marching requires the allocation of households with the highest energy needs in the energy-efficient dwellings. Formally, let g * t denote this socially optimal allocation function e → θ which maps each household type to a dwelling's level of energy performance in period t. Perfect matching means that:

g * t (e * t ) = 1 {e≥e * t } (1)
where e * t is the limit type which binds the city capacity constraint:

1 -F (e * t ) = q t .
Turning next to the investment path, recall that the distribution of households' types e does not vary over time: incoming households are drawn from the same distribution as that of the initial population. As a result, an investment in a given dwelling should either be made in the first period or never, which in turn leads to a time-invariant threshold e * t . Ignoring the time index, the value of e * is then obtained by considering that the investment decision in period 1 should be made as if the same household was staying forever. In this context, energy retrofit is socially optimal if the household e is such that the investment cost is lower than the net present value of the energy cost over the infinite time horizon:

I ≤ ∞ k=0 δ k e = e 1 -δ (2)
where δ denotes the household discount factor. This completes the characterization of the social optimum.

Lemma 1 (Social optimum). In the first best optimum, investments are only made in period t = 1 and the share of efficient dwellings is q * = 1 -F (e * ) with e * = I(1 -δ) for any t > 0. The energy-efficient dwellings should then be occupied by households with types higher than e * : g * t (e * t ) = 1 {e≥e * } ).

Decentralized Equilibrium with an EPC

In this section, we examine the equilibrium investment path under perfect information on energy performance. From now on, let u t (e, θ) denote the expected lifetime surplus of a household of type e living in a dwelling with performance θ at the beginning of period t. In the case where the dwelling is efficient (θ = 1), this surplus is given by the recurrence relation:

u t (e, 1) = δ[mp 1 t+1 + (1 -m)u t+1 (e, 1)]
That is, the energy expenditure is zero in period t while the household moves out in the next period with probability m, thereby selling the dwelling at price p 1 t+1 , or stays with probability 1 -m and derives surplus u t+1 (e, 1).

When θ = 0, the surplus depends on whether the homeowner invests or not.

Denoting u I t (e) and u ∅ t (e) the expected utility is:

u t (e, 0) = max{u I t (e), u ∅ t (e)} (3)
with:

u I t (e) = -I + δmp 1 t+1 + δ(1 -m)u t+1 (e, 1)
u ∅ t (e) = -e + δmp 0 t+1 + δ(1 -m) × u t+1 (e, 0)
We now examine how incoming households are allocated in the different dwellings by the real estate market. To start with, perfect information implies a separating equilibrium with a price premium for the energy efficient dwellings:

p 0 t < p 1 t .
The outcome of the sales is then given by p 0 t , p 1 t , and the allocation function g t : e → θ which satisfies two conditions:

• Market clearing:

+∞ 0 g t (e)dF (e) = q t .

• Incentive compatibility: g t (e) = argmax θ u t (e, θ) -p θ t .

From the incentive compatibility condition easily follows that the market perfectly matches the households with the dwellings. That is, there is a threshold type such that all households with lower types purchase inefficient dwellings whereas the highest types choose efficient ones. Hence g t = g * t .

Lemma 2 (Perfect matching). Under perfect certification, all incoming households with types such that e ≥ ẽt where ẽt is defined by F (ẽ t ) = 1 -q t purchases energy-efficient dwellings.

Proof. By contradiction, assume there exists e 1 < e 2 such that g t (e 1 ) = 1 and g t (e 2 ) = 0. From the incentive compatibility, this would imply that

u t (e 1 , 1) -p 1 t ≥ u t (e 1 , 0) -p 0 t u t (e 2 , 1) -p 1 t < u t (e 2 , 0) -p 0 t
This is not possible because the function u t (e, 1) -p 1 t -u t (e, 0) + p 0 t is increasing with e. To see this, note first that p 1 t and p 0 t do not vary with e because the market is competitive. This also holds true for u t (e, 1) which only depends on the price trajectory as shown by Eq.(??). Last, from Eq.( 3) follows that u t (e, 0) is decreasing with e as u ∅ t (e) is decreasing. The market clearing condition directly gives the value of the threshold ẽ.

A direct implication is that the relative prices in equilibrium are those making the limit type ẽ indifferent between both dwelling types:

Corollary 1. In the market equilibrium, we have

p 1 t -p 0 t = u t (ẽ, 1) -u t (ẽ, 0).
In order to predict the investment decisions in this market environment, we now compare u I t with u ∅ t . It is intuitive that investors are the households with the highest energy needs.

Lemma 3. In period t, a household of type e living in an inefficient dwelling invests if e ≥ ȇ where ȇ is the unique solution of u ∅ t (e, 0) = u I t (e, 0).

Proof. u I t does not vary with e while u ∅ t is strictly decreasing with e. When e → ∞, we have u ∅ t → -∞, implying that u I t > u ∅ t . Last, we show that

u I t (0) -u ∅ t (0) < 0 when e = 0 by contradiction. Assume that u I t (0) > u ∅ t (0) ≥ 0.
This implies that have u I t (0) = u t (0, 0) = -I + u t (0, 1), and thus u t (0, 1)u t (0, 0) = I. We know that u t (e, 1) -u t (e, 0) is increasing with e, meaning that u t (0, 1) -u t (0, 0) < u t (ẽ, 1) -u t (ẽ, 0). Corollary 1 then implies that I < p 1 t -p 0 t , which is absurd.

Establishing that perfect certification implements the first best is then straightforward as we just need to show that ẽ = ȇ = e * .

Proposition 1. Perfect certification implements the first best optimum.

Proof. u I t (ȇ) = u ∅ t (ȇ) implies that -I + ȇ + δm(p 1 t+1 -p 0 t+1 ) + [u t+1 (ȇ, 1)u t+1 (ȇ, 0)] = 0. From Corollary 1 and ẽ = ȇ follows that this equation is equivalent to -I + ȇ + δ(u t+1 (ȇ, 1) -u t+1 (ȇ, 0)) = 0. Plugging u t+1 (ȇ, 1) =

u I t+1 + I yields that ȇ = I(1 -δ) = e * .
The intuition underlying this result is as follows. Lemma 2 implies that investing households anticipate that, if they move out in a next period, their home will be purchased by the highest types. As incoming types are drawn from the same distribution, they invest as if they were going to stay forever in the dwelling, trading off the investment cost and the total discounted energy cost e/(1 -δ).

Equilibrium without EPC

The main difference with the certification case is that we now have a pooling equilibrium on the real estate market with p 0 t = p 1 t . This greatly simplifies the analysis as the real estate market gives zero value to energy retrofit (p 0 t = p 1 t )

and incoming households are randomly assigned to the dwellings.

When making an investment decision, the households just need to compare the investment cost with the savings in their own energy consumption in the current period and in future periods if they do not move. Household e will thus invest if:

I ≤ e × ∞ k=1 (δ(1 -m)) k = e 1 -δ(1 -m) (4)
This condition shows a partial internalization of the investment benefit by the investor. As the household may move out and sell its dwelling with perperiod probability m, investing households discount the future at rate δ(1 -m),

that is the conventional discount rate times the probability of staying in the next period. Hence, we have: Although individual investment incentives are lower than the first best in a given period, they persist over time in contrast with the first best where all investments are made in the first period. The reason is that the randomized market allocation implies that high types inevitably move in inefficient dwellings in each period. Once installed, they cannot but invest to consume less energy.

To be more precise, the process unfolds as follows:

• At t = 0, all households occupy inefficient dwellings.

• In period 1, the types higher than ê upgrades their home. As a result, the share of inefficient dwellings is F (ê) at the end of the period.

• At the beginning of period 2, m households randomly move out. A share mF (ê) of inefficient dwellings are thus (randomly) sold to incoming households. Households moving in these inefficient dwellings invest if their type is higher than ê. The share of efficient dwellings thus increases up to

(1 -m)(1 -F (ê).
The process goes on so that we have Lemma 5. In period t, the share of efficient dwellings is

q t = 1 -F (ê)[1 - m(1 -F (ê))] t-1 .
The overall level of energy investment flow is

I t = mI(1 - F (ê))F (ê)[1 -m(1 -F (ê))] t-1
and the overall level of energy consumption is

E t = [1 -m(1 -F (ê))] t ê 0 e dF (e).
Proposition 2. Households never stop investing so that the share of efficient dwellings converges to 1 in the long run: q t → 1. The levels of per-period investments and energy use converge to zero: E t → 0 and I t → 0

This dynamics is represented in Figure 1 which compares the evolution over time of q t with and without certification. Accounting for the dynamics of the building stock thus yields the counter-intuitive results that the absence of energy certification leads to more energy efficiency investments and less energy consumption in the long run. This trajectory however damages social welfare compared to energy certification which implements the first best optimum.

Figure 1: Example of energy-efficient dwellings stock q t trajectories Until now, it has been assumed that EPCs are introduced at t = 0 (when q 0 = 0). From a policy perspective, it is more realistic to consider that certification is introduced in period τ > 0. We now investigate this case, introducing two additional assumptions. First, owners do not anticipate the introduction of certification in previous periods. Before τ > 0, their investment behavior is thus not influenced by future signals on the real estate market. Second, at the beginning of period τ , the share q τ of energy-efficient buildings and the allocation correspond to those of the trajectory described in Lemma 5. Under these assumptions, it is straightforward that:

Proposition 3. In the case where the EPC is introduced at the beginning of period τ , all investments are immediately made. This leads to a (constant) share of efficient dwellings such 1 > q τ +1 > q * . After τ , per-period energy

consumption E t decreases towards a value E ∞ τ which verifies E * > E ∞ τ > 0.
The proof and the intuition is straightforward. In period τ , there remains a share q τ of inefficient dwellings, which can be lower or higher than the first best. Suddenly, a price gap between efficient and inefficient dwellings appears on the real estate market. The households occupying inefficient dwellings whom types lies in between ê and e * thus decide to invest. At the end of the period, there however remains one inefficiency: there remain low types who live in efficient dwellings. This imperfect matching will progressively vanishes in the next periods when the low types will move out and sell their property to high types. Note that this result decisively hinges upon the assumption that moving decisions are exogenous. That is, we rule out cases where low types living in efficient dwellings would all move in inefficient dwellings in the city, thereby increasing their surplus by selling at a high price to high types.

EPC in a second best world

We have just seen that introducing EPCs may lead to higher energy consumption and lower cumulative investments. This implies that certification may reduce welfare in a second-best world where energy externalities are not sufficiently internalized or where households do not invest enough due to behavioral biases or other imperfections ("myopia).

Under-priced energy externalities

Assume now that energy expenditure e generates an externality αe which is not internalized with a tax or another policy instruments. Households thus use too much energy under EPCs. More precisely, cumulative energy cost, excluding the externality, is now Under EPCs, cumulative energy use follows from Lemma 5:

+∞ t=0 δ t Êt = 1 1 -δ[1 -m(1 -F (ê))] ê 0 edF (e)
It is then clear that the difference with the EPC scenario is ambiguous. In particular, it depends on the cumulative F . If most households lie in between e * and ê (the population has intermediary energy needs), they will not invest in the absence of EPCs), leading to a higher energy use4 . This is just the opposite if most of the households have high energy so that e > ê. Their propensity to invest is identical in the first period, but a fraction of incoming households continue to invest in the next periods without EPCs because they move in an inefficient dwellings.

Depending on the size of the externality, this can lead to a higher social cost with EPCs. Formally, the social cost function is

C = ∞ t=0 δ t +∞ 0 P t (θ = 0|e)(1 + α)e dF (e) + (q t+1 -q t )I
And straightfoward calculation yields that EPCs improve welfare iff:

(1 + α) ê 0 e dF (e) 1 -δ(1 -m(1 -F (ê))) - e *
0 e dF (e) (1 -δ))

+ I 1 -δ(1 -m) 1 -δ(1 -m(1 -F (ê))) (1 -F (ê)) -(1 -F (e * )) > 0
The sign of this (cumbersome) welfare difference is ambiguous. If α is very small, the EPC scenario converges to the first best. If α is large, EPCs may damage welfare if q t quickly converge towards 1. And we have seen that this depends on the distribution F (among other factors). We collect these insights in a new proposition.

Proposition 4. In the case where energy consumption generates an externality of size α per unit, introducing EPCs may damage social welfare. This ultimately depends on the sets of parameters m, δ, I, α and on the distribution of energy needs F .

Owner myopia

The empirical literature on residential energy efficiency provide evidence that energy users may under-estimate future private energy savings when making investment decisions (for a general discussion, see [START_REF] Gillingham | Bridging the Energy Efficiency Gap: Policy Insights from Economic Theory and Empirical Evidence[END_REF]).

This leads to decisions that are not privately optimal and justifies the existence of policies that promote investments (e.g., subsidies, tax credits).

In line with these arguments, assume now that the owners discount future costs with a private discount factor µ which is higher than the social discount rate δ. Again, one can expect that the absence of EPCs, which increases investments in the long run, may be more efficient. By analogy with the previous case, we can easily show that EPCs improve welfare iff:

êµ 0 e dF (e) 1 -δ(1 -m(1 -F ( êµ ))) - e * µ 0 e dF (e) (1 -δ)) + I 1 -δ(1 -m) 1 -δ(1 -m(1 -F ( êµ ))) (1 -F ( êµ )) -(1 -F (e * µ )) > 0
with e * µ = I(1 -µ) and êµ = I(1 -µ(1 -m)). This difference is again ambiguous and we have a proposition which is similar to the previous one.

Proposition 5. In the case where owners discount too much the future, introducing EPCs may damage social welfare. This ultimately depends on the sets of parameters m, δ, I, α and on the distribution of energy needs F .

Conclusions

We have developed a dynamic model featuring a building stock with endogenous energy characteristics. The model includes three main ingredients. First, in the absence of EPCs, potential buyers do not observe energy performance before moving in their new home (experience good). Second, each homeowner can invest in order to increase his/her dwelling's energy performance. Third, an exogenous fraction of dwellings is sold in each period.

If asymmetric information on quality is the only market failure, we show that EPCs implement the social optimum. Less intuitively, the impact on the volume of investments and on the level of energy use is ambiguous. In the short run, that is, holding fixed the energy characteristics of the building stock, EPCs decrease energy use by improving the matching between buyers with heterogeneous energy needs and dwellings with heterogeneous energy performance.

In the long run, EPCs can however either decrease of increase investments in energy efficiency, and thus energy use. Two countervailing factors drive this outcome. On the one hand, EPCs create on the real estate market a wedge between the price of efficient dwellings and inefficient dwellings. Homeowners are thus more prone to retrofit their homes because they anticipate a possible resale in the future. On the other hand, EPCs give potential buyers with two instruments to reduce energy use: purchasing an inefficient dwelling and invest or purchasing a dwelling which is already efficient. In contrast, investing is their unique instrument if they do not observe energy performance. In the long run, this increases investments as the random allocation of newcomers inevitably leads to the installation of a fraction of households with high energy needs in inefficient properties.

These results have important policy implications. In a second-best world where energy externalities are under-priced -leading to a too high energy useand/or where consumers show behavioral biases that hinder investments (myopia), EPCs can thus damage social welfare. It is however extremely difficult to identify the contexts in which this could occur, in particular, because household heterogeneity -captured by the shape of the distribution of e in our setting -strongly influences the equilibrium path. This thus calls for using EPCs in contexts where other imperfections are properly addressed by other instruments.

While the empirical literature on EPCs and energy labeling is well developed as mentioned in introduction, it yields nearly no useful inputs for our conclusions as it does not deal with the impacts on energy use and investments.

These are preliminary results and we plan extending the paper in several directions. First, we want to generalize the results to the rental case. While the above mechanisms would still operate, the investment incentives are clearly lower without EPCs as the owner derives zero benefit from energy savings.

Second, we want to calibrate the theoretical model with realistic figures in order to derive more clear-cut results on the impact of EPCs. Third, we also plan to explore the impacts of voluntary labeling. We now consider the case where households rent their dwellings.

Model

Compared to the previous sections, we now distinguish two categories of agents: At each period occurs the following sequence:

1. m tenants inside the city exogeneously decide to move out. Landlords who own empty energy-inefficient dwellings can choose to weatherize their dwelling for a cost I. Similar results for such a setting.

8 Appendix

Lemma 4 .

 4 In any period, a household of type e living in an inefficient dwelling invests if e ≥ ê where ê = I(1 -δ(1 -m)).

  best with a threshold e * * = I(1 -δ)/(1 + α) which is lower than e * .

  landlords and tenants (we still consider a continuum of agents in both categories). Landlords play an infinite-horizon game. At each period, they offer their dwelling for rent. Landlords are profit-maximizers and can weatherize their dwelling for a cost I. Tenants have a type e distributed according to the cumulative distributive function F as in the previous sections. At each period, a tenant has an exogenous probability m of moving out of the city and m incoming tenants move in.

2 .

 2 m tenants outside the city decide to move in. Incoming tenants pick up their new dwelling in a competitive equilibrium setting. Energy-efficient dwellings of type θ rent at pt and energy-inefficient dwellings of type θ rent at p t . 3. Incoming tenants learn the energy performance of their new dwellings if not previously known. Tenants who live in energy-inefficient dwellings can weatherize their dwelling for a cost I.4. Tenants of type e who live in an energy-efficient dwelling receive a payoff e. Tenants who live in an energy-inefficient dwelling receive zero payoff.

  to fuel economy policy. Journal of PublicEconomics, 96(11-12):981-999, 2012. ISSN 00472727. doi: 10.1016/j.jpubeco.2012.06.005.

	7 Appendix
	7.1 Extension: rental case with landlords and tenants

Although we cast the model in terms of residential homes, it equally applies to office buildings.

In this respect,Sallee and Slemrod [2012] develops an interesting evaluation of the size of such inefficiencies in a different sector (the auto industry).

We extend the analysis to the rental case in section XX.

Formally, F (ê) → 1, implying that the first multiplicative tends to be equal across scenarios (1/(1 -δ)) while the integral tends to 0 in the EPC scenario.

ieb@ub.edu www.ieb.edu


Ahmed Amari

Ahlem Mifdaoui

QoS-Aware Ring Redundancy Protocol (QoS-ARRP) for High-Availability Ethernet Networks

Keywords: Real-Time Ethernet, Availability, Redundancy, QoS, IEC62439, IEEE 802.1CB

During the last decade, Ethernet's significance has increased in many embedded systems application areas, such as automotive, avionics and automation. However, guaranteeing the required availability level for such applications on Ethernet is still a hot research topic. In this specific area, we propose in this paper a new redundancy protocol for high availability Ethernet networks, called QoS-Aware Ring Redundancy Protocol (QoS-ARRP). First, the specifications of such a protocol are detailed, including the frame redundancy and filtering management, the auto-configuration mechanisms, as well as the maximum recovery time analysis. Second, the numerical results of the recovery time have shown the impact of the protocol parameters to tune and the trade-off between availability and scalability of the network. Moreover, we have benchmarked the state-of-the-art results on the recovery time against ours. A noticeable enhancement of the maximum recovery time with our proposal, thus of the availability level, has been highlighted.

I. INTRODUCTION

During the last decade, Ethernet's significance has increased in many embedded systems application areas, such as automotive, avionics and automation. Due to its high bandwidth, scalability and low operating costs, Ethernet becomes very appealing to succeed legacy networks, such as CAN [START_REF] Gmbh | CAN specification Version 2[END_REF]. Nevertheless, guaranteeing stringent predictability and availability requirements of safety-critical embedded systems with such a technology is still a hot research topic. This fact is due to its native non-deterministic behavior and the long switchover time of its common redundancy protocols, e.g., few seconds with the Spanning Tree Protocol (STP) [START_REF]1D -IEEE Standard for Local and Metropolitan Area Networks Media Access Control (MAC) Bridges[END_REF] and hundreds of milliseconds with the Rapid STP (RSTP) [START_REF]1D -IEEE Standard for Local and Metropolitan Area Networks Media Access Control (MAC) Bridges[END_REF].

Various approaches improving Ethernet predictability have been standardized by the International Electrotechnical Commission (IEC) and published in IEC 61784-2 [START_REF]Industrial Communication Networks -Profiles -Part 2: Additional Fieldbus Profiles for Real-Time Networks Based on ISO/IEC 8802-3[END_REF], such as EtherCAT [START_REF]EtherCat -the Ethernet Fieldbus[END_REF], Profinet/ IRT [START_REF] Pigan | Automating with PROFINET: Industrial Communication Based on Industrial Ethernet[END_REF] and PowerLink [START_REF]Real-Time Ethernet: EPL (Ethernet Powerlink): Proposal for a Publicly Available Specification for Real-Time Ethernet[END_REF].

However, these solutions have been developed for specific domains, which limits their interoperability with standard (classic) Ethernet technology. To cope with this issue, the IEEE 802.1 TSN (Time Sensitive Networking) [START_REF] Tsn Tg | Time Sensitive Networking Specifications[END_REF] task group is currently working on the standardization of the main features to enable real-time communication on Switched Ethernet systems, such as scheduling [START_REF]1Qci-2017[END_REF] and redundancy [START_REF]1CB-2017 -IEEE Standard for Local and metropolitan area networks-Frame Replication and Elimination for Reliability[END_REF].

In this paper, our main concern is guaranteeing the high availability requirement in Ethernet networks with mixedcriticality traffic pattern, e.g., hard real-time, soft real-time and best-effort, through using redundancy protocols. As we detail in Section II, most common redundancy protocols can be categorized into two main classes, static and dynamic. The former, e.g., [START_REF]Industrial Communication Networks -High Availability Automation Networks -Part 3: Parallel Redundancy Protocol (PRP) and High-availability Seamless Redundancy (HSR)[END_REF] [START_REF]1CB-2017 -IEEE Standard for Local and metropolitan area networks-Frame Replication and Elimination for Reliability[END_REF], is generally based on fully duplicated networks, where both networks are used in parallel to increase the fault detection coverage. This class offers a zero recovery time 1 , but also has high deployment costs and limited resource efficiency. On the other hand, the dynamic redundancy solutions [START_REF]Industrial Communication Networks -High Availability Automation Networks -Part 6: Distributed Redundancy Protocol (DRP)[END_REF] [12] [START_REF]Industrial Communication Networks -High Availability Automation Networks -Part 7: Ring-based Redundancy Protocol (RRP)[END_REF] have been introduced to decrease the installation costs and improve resource efficiency through using a backup path in case of failures, but they are more suitable for soft real-time or best-effort traffic tolerating a bounded recovery time. Hence, each existing redundancy protocol class has been optimized for a specific use case with limited support of mixed-criticality traffic pattern.

To remedy the above problems, we have specified a new redundancy protocol, called QoS 2 -Aware Ring Redundancy Protocol (QoS-ARRP), with the following key advantages: (a) support of mixed-criticality traffic pattern, (b) low configuration effort and (c) low deployment costs. This redundancy protocol has been incorporated in AeroRing network [START_REF] Amari | Specification and Performance Indicators of AeroRing-A Multiple-Ring Ethernet Network for Avionics Embedded Systems[END_REF], a multiple-ring Ethernet network for avionics.

Contributions: we conduct in this paper the analysis of the recovery time of QoS-ARRP. The numerical results show a zero recovery time for hard real-time traffic and bounded for soft real-time and best-effort traffic, e.g., less than 4.5ms for a large-scale network of 200 nodes. Moreover, we benchmark the state-of-the-art results on the recovery time against ours. A noticeable enhancement of the maximum recovery time with our proposal, thus of the availability level, has been highlighted.

The rest of the paper is organized as follows. We report the main related work in Section II. The specifications of QoS-ARRP and the analysis of the recovery time are detailed in Section III. Numerical results to validate our proposal when varying the protocol parameters and in reference with existing protocols are illustrated in Section IV. Finally, we draw the main conclusions and future work in Section V.

II. RELATED WORK

To improve the availability level in Ethernet, many redundancy protocols based on ring topologies have been standardized in IEC 62439 series [START_REF]Industrial Communication Networks -High Availability Automation Networks -Part 2: Media Redundancy Protocol (MRP)[END_REF] [10] [START_REF]Industrial Communication Networks -High Availability Automation Networks -Part 6: Distributed Redundancy Protocol (DRP)[END_REF] [13] and more recently in TSN [START_REF]1CB-2017 -IEEE Standard for Local and metropolitan area networks-Frame Replication and Elimination for Reliability[END_REF]. Such topologies enable high availability level, while limiting cabling costs. They actually provide an implicit redundant path through introducing only one additional connection between the two end nodes, compared to line or star topologies [START_REF] Kleineberg | Redundancy Enhancements for Industrial Ethernet Ring Protocols[END_REF]. These solutions can be categorized into two main classes, static and dynamic. The main features of these protocols are summarized in Table I.

The most relevant static protocols are the Parallel Redundancy Protocol (PRP) [START_REF]Industrial Communication Networks -High Availability Automation Networks -Part 3: Parallel Redundancy Protocol (PRP) and High-availability Seamless Redundancy (HSR)[END_REF] and High-availability Seamless Redundancy protocol (HSR) [START_REF]Industrial Communication Networks -High Availability Automation Networks -Part 3: Parallel Redundancy Protocol (PRP) and High-availability Seamless Redundancy (HSR)[END_REF]; whereas, the main dynamic protocols are Distributed Redundancy Protocol (DRP) [START_REF]Industrial Communication Networks -High Availability Automation Networks -Part 6: Distributed Redundancy Protocol (DRP)[END_REF], Media Redundancy Protocol (MRP) [START_REF]Industrial Communication Networks -High Availability Automation Networks -Part 2: Media Redundancy Protocol (MRP)[END_REF] and Ring-based Redundancy Protocol (RRP) [START_REF]Industrial Communication Networks -High Availability Automation Networks -Part 7: Ring-based Redundancy Protocol (RRP)[END_REF].

Both PRP and HSR offer a zero recovery time when a failure occurs, through guaranteeing two redundant paths for each transmitted data. The PRP handles this feature due to a fully redundant network, i.e., two parallel networks, where most of the devices are attached to both parallel networks, and each data is duplicated at the transmission and filtered at the reception using a specific device, called Dual Attached Node (DAN). The HSR protocol achieves the same purpose through a daisy-chain ring topology, where each device has both ports operating in parallel and called Doubly Attached Node with HSR protocol (DANH). A source node duplicates the data message on both directions, then the destination node consumes only the first valid one. The unicast messages are filtered by the destination and the broadcast messages by the source using the MAC addresses to avoid infinite message looping.

The MRP is based on a manager, called Media Redundancy Manager (MRM), that monitors the status of the network and the other nodes, called Media Redundancy Clients (MRCs). Each equipment integrates an internal switch with two ports, and supports three status: disabled, when the port is down; blocked, the forwarding function is disabled; forwarding, the port can receive and forward messages. In the nominal case, the ring is closed and all MRCs are forwarding the data, except the MRM which blocks one of its ports to create a logical line topology and to avoid the infinite message looping. Furthermore, the MRM monitors the status of the network by sending periodically Test frames on both ports, and if the frames are received on the opposite ports, then the ring is closed. However, if the frames are lost, then the MRM concludes that the network is faulty. In addition to that, each MRC monitors the local connection with its neighbors, if it detects a failure or a recovery, then it announces it to the MRM by a LinkChange frame. In both scenarios, the MRM activates both ports to transmit data and informs the MRCs about the topology change by sending TopoChange frames.

The DRP implements a local failure detection mechanisms, where each equipment can check the status of its neighbors by sending a link test frame "LinkCheck" to detect failures. It transforms the ring topology into a line topology by disabling a port of an elected device (the device with the highest ID is elected) to avoid infinite packet looping. In addition to the local failure detection, DRP implements a centralized failure detection mechanism to check the ring status in a cyclic manner, i.e., during each cycle, only one equipment can check the ring status via a ring test frame "RingCheck", gather and broadcast the information to the rest of equipment in case of a change. When a failure occurs, the device with the blocking port activates its port to allow packets transmission. It is worth noting that an accurate synchronisation protocol is required to manage such a cyclic process.

The RRP manages the failure detection and network configuration dynamically. Based on the physical layer mechanisms as specified in ISO/IEC 8802-3:20000 Clause 24, the devices can detect their neighbors and also occurred failures, then they share these information through the network. Based on these information, all network devices will build their routing tables in a distributed way. However, RRP transforms the ring topology into a line topology to avoid infinite packet looping, through the selection of two adjacent devices, called Ring Network Managers (RNMs), and disabling one of their ports.

The benchmarking of these existing protocols vs the main identified requirements is illustrated in Table II. We particularly consider the following requirements:

• Deployment costs: this metric is evaluated according to the required redundancy level of the network: fully redundant or not; • Fexibility: this metric is evaluated according to the (re)configuration effort needed to enable the failure detection and recovery mechanisms; • Resource efficiency: this metric is evaluated according to the maximum available bandwidth accounting for the protocol overhead; • Availability: this metric is evaluated according to the recovery time. Both static protocols, PRP and HSR offer a high flexibility and availability levels, since they do not require any (re)configuration mechanism and offer a zero recovery time when a failure occurs. However, both protocols limit the resource efficiency, since the available bandwidth is only of 50% due to the duplication of all packets on both networks (resp. ring directions) for PRP (resp. HSR). However, HSR was designed to reach the same availability level as PRP using redundancy within the same network, instead of using fully redundant one, which allows reducing the deployment costs.

On the other hand, the dynamic protocols allow reducing the deployment costs through enabling redundancy within the same network. However, they degrade the availability level by transforming the ring into a line topology to avoid infinite message looping. Moreover, RRP offers the best flexibility level due to its dynamic mechanisms to detect failures and configure the network, in comparison with DRP and MRP. Finally, the MRP guarantees the lowest resource efficiency level, in comparison with DRP and RRP, due to its high overhead to detect failures, i.e., local and global mechanisms.

We can notice that each existing protocol satisfies some requirements better than others, but there is no best protocol in terms of all the requirements. Hence, to overcome these limitations, our introduced redundancy protocol QoS-ARRP has the main following features:

• Using ring topology to decrease the deployment costsunlike the existing dynamic protocols which transform the ring into line, the QoS-ARRP takes the full advantage of the multi-path feature of ring topologies due to the frame filtering functions, implemented within each device to avoid infinite packet looping and detailed in Section III-A; • QoS-aware redundancy management to improve resource efficiency and availability levelthe hard realtime traffic is sent on both redundant paths to guarantee a zero recovery time; and the soft real-time and besteffort traffic is sent only on the shortest path with a short recovery time, e.g., less than 4.5ms for a largescale network of 200 nodes. This feature leads to better availability level than classic dynamic protocols, while improving the resource efficiency in comparison to the static protocols; • Plug and play devices to increase the flexibilitythe devices are incorporating an auto-configuration mechanism, described in Section III-C, to build dynamically the routing tables during the different phases of network operations, i.e., start-up, nominal and non-nominal operations, to offer a high flexibility level and limited configuration effort as static redundancy protocols.

III. QOS-AWARE RING REDUNDANCY PROTOCOL (QOS-ARRP)

The QoS-ARRP operates within the end nodes at layer 2 (in the ISO OSI network model) and its use is completely transparent to high layer protocols, e.g., UDP and TCP. The QoS-ARRP is implemented at the software level and is effective for any Ethernet speed, e.g., 100Mbps, 1Gbps or faster interfaces. At the hardware level, it supports a ring topology, where each ring device incorporates a 3 port Ethernet switch, as illustrated in Fig. 1, and has the following requirements:

• Cut-Through forwarding technique: the packet is forwarded just after its identification, i.e., only the header of each packet is decoded to determine its destination; • Disabling the Spanning Tree protocol and enabling the specific QoS-aware routing algorithm (described in Section III-A); • Strict priority scheduling with at least 3 queues: the highest priority queue is reserved to QoS-ARRP control messages; whereas the medium and low priority queues are for hard real-time messages and soft real-time or besteffort messages, respectively. Moreover, the prioritization is compliant with IEEE 802.1Q specifications [START_REF]1Q -IEEE Standard for Local and Metropolitan Area Networks-Media Access Control (MAC) Bridges and Virtual Bridged Local Area Networks[END_REF].

A. Frame Redundancy and Filtering Management

The main idea of the QoS-ARRP is to enable a frame redundancy management through a QoS-aware routing algorithm. The latter allows the message (re)transmission within each ring device according to the priority level, and the main rules of such an algorithm are described herein.

First, the QoS-ARRP control messages are used for network management issues, such as: (i) building/updating the routing tables of the ring devices; (ii) the failure detection management; (iii) neighbor status checking. For the two former, the control messages are sent on both ring ports to ensure a high availability level; whereas for the latter, the control messages are only sent to the neighbors to check their status and guarantee a fast failure detection. The failure detection mechanism is detailed in Section III-B.

Afterwards, the messages received from port 3, i.e., from the connected equipment in Fig. 1, are transmitted to port 1 or/and 2 according to their priority level as follows:

• Unicast and broadcast messages with the medium priority, i.e., hard real-time messages, are sent through both ports to guarantee messages redundancy; • Unicast messages with low priority, i.e., soft real-time and best-effort messages, are sent through the port corresponding to the shortest path to offer short delays;

• Broadcast messages with low priority are transmitted through a predefined or a random port; • Non 802.1Q tagged messages are treated as messages of low priority. Messages received from port 1 or 2 are treated according to their priority level and destination address. If the destination address corresponds to the connected equipment, then the message is sent to port 3; else, the messages are forwarded to the opposite port. It is worth noting that each message with the medium priority is sent to port 3 only if its replica has not been received yet. This last point is related to the filtering rules, implemented within the ring devices. Indeed, to take the full advantage of redundant paths on ring topologies while avoiding infinite message looping, the QoS-ARRP specifies the following filtering rules within the ring devices:

• for transmission where both the message and its FCS field are correct:

-Unicast messages, independently from their priority level, are filtered from the ring within the destination device. In addition, in the specific case of hard realtime messages, the destination node delivers only the first valid received replica. This fact is enabled due to the added sequence number of 2 bytes within the payload field, as illustrated in Fig. 2, which allows identifying and discarding the replicas. When the destination receives a correct hard real-time message, it stores the couple (src MAC, sequence number); and once the replica is received, or after a timeout, the stored couple (src MAC, sequence number) is removed from the memory. It is worth noting that the timeout is a parameter fixed by the network designer, which must be greater than the maximum end-to-end delay; -Broadcast messages, independently from their priority level, are filtered within the source node;

• for transmission where the FCS field is not correct, i.e., detected error, the filtering rules are similar to the previous case;

• for transmission where the message is not correct and its FCS field is correct, i.e., non detected error: if the error occurs on the header, then the frame can be eliminated from the network by any ring device based on its routing table, i.e., the source or the destination MAC address is not within the routing table.

B. Failure Detection and Recovery

To reduce the failure detection time, the QoS-ARRP uses a local failure detection mechanism. In practice, any QoS-ARRP device has to consider a connection as down with a neighbor, if it does not receive any message from its neighbor during a certain period called "detection period". This detection period can be easily tuned by the network designer. Furthermore, the QoS-ARRP uses the link status information provided by the physical layer mechanisms of Ethernet, as specified in ISO/IEC 8802-3:20000 Clause 24 [START_REF]IEEE Standard for Information Technology -Telecommunications and Information Exchange Between Systems -Local and Metropolitan Area Networks -Specific Requirements Part 3: Carrier Sense Multiple Access with Collision Detection (CSMA/CD) Access Method and Physical Layer Specifications[END_REF]. (i) First, if a ring device has no data to transmit to its neighbor(s), then it announces periodically each announcing period its status to the neighbor(s) through sending control messages. These messages have the minimum Ethernet frame length of 64 bytes, and are identified with a CTL field set to "0000" and a type value "0x9000", as illustrated in Fig. 3; (ii) Second, any ring device, which did not receive any data or control message from a ring port for a duration equal to the detection period3 , will detect a failure. Afterwards, this ring device informs the other ring devices about the failure through a control message, which has the same structure illustrated in Fig. 3 and a CTL field set to "0010";

(iii) Finally, any ring device receiving the control message with a CTL code "0010" from the device detecting the failure will update its routing table to bypass the failure during the data transmission. This step is based on the auto-configuration mechanism of the QoS-ARRP (described in Section III-C).

It is worth noting that such a failure detection mechanism is a distributed mechanism and it has no restrictions on the number of failures. Concerning the failure recovery process, when the ring device that has detected the failure starts receiving messages (data or control) from its neighbor again, then it deduces that the connection is operational again. Consequently, it sends a control message with a CTL code "0010" to enable the routing tables update of the other ring devices; thus to take into account the failure recovery, based on the auto-configuration mechanism of the QoS-ARRP.

C. Auto-Configuration Mechanism

To reduce the configuration effort, the QoS-ARRP provides an auto-configuration mechanism to build and update the routing tables within all the ring devices. This auto-configuration mechanism enables the QoS-aware routing algorithm to transmit the low priority level messages, i.e., soft real-time and best-effort, on the shortest path (ports 1 or 2 in Fig. 1).

The QoS-ARRP auto-configuration mechanism is enabled through the exchanged control messages between the ring devices. The structure of such control messages is illustrated in Fig. 4 and consists of: (i) a CTL field set to "0001"; (ii) a NBAD field to encode the number of MAC addresses inserted in ADDx fields; (iii) ADDx fields to insert the MAC addresses of the different ring devices. This kind of control message can contain up to 249 MAC addresses if we respect the maximum Ethernet size of 1500 bytes, and up to 1499 MAC addresses if the use of jumbo frames, i.e., up to 9000 bytes, is enabled. The QoS-ARRP auto-configuration mechanism is based on the main following steps:

• First, any ring device detecting a topology change event, i.e., equipment connection, device/link failure or recovery, sends periodically4 on both ring ports a control message with a NBAD field set to zero and empty ADDx fields, to update the routing tables of the other ring devices;

• Second, any ring device receiving such a control message will contribute in building/updating the routing tables through: 1) updating the control message by incrementing the NBAD counter, inserting its MAC address at the end of the ADDx list to respect the physical order of the ring and computing the new FCS field; 2) forwarding the updated control message to the next device; 3) updating its routing table through inserting the MAC addresses of new devices and deleting the ones that no longer exist;

• Third, when receiving such a control message on one of the ring ports of the device that has detected the topology change event, then that device deduces that it has a neighbor on that port and it is no longer the last device of the segment. Consequently, it stops the periodic transmission of the control messages with a CTL "0001" on the corresponding ring port; and it stops completely transmitting control messages on both ring ports when detecting both neighbors;

• Finally, the transmission of such control messages stops completely when the ring is closed; thus all the routing tables are up to date. Figures 5 and6 illustrate the different steps of the QoS-ARRP auto-configuration mechanism for a failure detection event and a failure recovery event, respectively. As we can notice in Fig. 5, after the failure detection of the ring device 5 by the ring devices 4 and 6, the latter send control messages on both opposite ring ports, to inform the rest of the ring devices about the failure and to enable their routing tables update. Afterwards, at the reception of the control message on a ring port, each ring device updates its routing table by erasing the MAC addresses located after the device detecting the failure, Fig. 5. The QoS-ARRP Auto-configuration Mechanism after a failure detection e.g., the device 3 erases all MAC addresses in its routing table located after the device 4 (5,6,1,2), when receiving the control message on the corresponding ring port. In Fig. 6, after the failure recovery of the ring device 5, the latter sends control messages on both ring ports to enable the routing tables update of the other ring devices. Therefore, each ring device receiving the control message inserts its own MAC address, increments the NBAD and updates the FCS. At the end, the device 5 receives the control messages on its both ring ports containing the list of MAC addresses respecting the physical order to build its routing table, e.g., the list (4, 3, 2, 1, 6) on the left port.

D. Maximum Recovery Time Analysis

According to the IEC 61784-2 [START_REF]Industrial Communication Networks -Profiles -Part 2: Additional Fieldbus Profiles for Real-Time Networks Based on ISO/IEC 8802-3[END_REF] and IEC 62439-1 [START_REF]Industrial Communication Networks High Availability Automation Networks-Part 1: General Concepts and Calculation Methods[END_REF], one of the most relevant Performance Indicators (PIs) of Ring Redundancy Protocols is the Maximum Recovery Time. This indicator is essential to evaluate the network availability, a key requirement for safety-critical embedded systems. Moreover, this recovery time has not to exceed the grace time [START_REF]Industrial Communication Networks High Availability Automation Networks-Part 1: General Concepts and Calculation Methods[END_REF], i.e., time during which we tolerate a system degradation, which is typically less than 20ms for safety-critical systems. In this section, we express the maximum recovery time induced by our proposed protocol QoS-ARRP. According to the QoS-ARRP, since the hard real-time traffic is sent on both paths, then in case of a failure occurrence the guaranteed recovery time for this kind of traffic is zero. Hence, we will express herein the maximum recovery time guaranteed for the soft real-time or best-effort traffic sent only on the shortest path; thus can be submitted to an additional delivery delay in case of a failure occurrence.

The maximum recovery time of QoS-ARRP, T recovery , covers the duration of the different steps, which need to be handled since the failure occurrence until the ring reconfiguration to bypass this failure. Therefore, to compute such a maximum recovery time, we need to consider the main following steps of QoS-ARRP, depicted in Fig. 7.

Failure Detection

First, when a failure occurs, the QoS-ARRP needs a detection time, T detection , to be aware of the failure, e.g., faulty device or link. In absence of received traffic on one of the ring ports of a given device, the latter sends a control message to its neighbor on that port. After a maximum number of control messages, N detect , sent periodically each P local detect without receiving a feedback from the corresponding neighbor, the QoS-ARRP device detects a failure. Furthermore, the ring device is able to detect a failure based on the link status information provided by the physical layer of the IEEE 802.3 [START_REF]IEEE Standard for Information Technology -Telecommunications and Information Exchange Between Systems -Local and Metropolitan Area Networks -Specific Requirements Part 3: Carrier Sense Multiple Access with Collision Detection (CSMA/CD) Access Method and Physical Layer Specifications[END_REF], which detects the failure after a network fault sense time, T f ault sense . Hence, the detection time is as follows:

T detection = min(T f ault sense , N detect × P local detect ) (1)
For instance, T f ault sense = 2ms for the Gigabit Ethernet [START_REF]IEEE Standard for Information Technology -Telecommunications and Information Exchange Between Systems -Local and Metropolitan Area Networks -Specific Requirements Part 3: Carrier Sense Multiple Access with Collision Detection (CSMA/CD) Access Method and Physical Layer Specifications[END_REF].

Failure Declaration

After the failure detection, the ring devices, neighbors of the failure, need to declare the failure to all the other devices; thus to enable the ring reconfiguration and bypass the failure. This declaration corresponds to the transmission time of one control message with a CTL code "0010" and of minimum size L ctl , i.e., L ctl /C, where C is the transmission capacity of the network.

In addition, due to the QoS-aware redundancy management, the control message with the highest priority 0 can be at the worst-case delayed by at most one maximum length packet of low priority pp at each crossed device, L pp . This blocking delay, T BlocDelay , is as follows:

T BlocDelay = (M -3) × ( max pp>0 L pp C + τ ) (2)
, where τ is the technological latency of each crossed device, and (M -3) is the number of crossed devices apart the both detecting the failure and the faulty one. Hence, using Eq. ( 2), the declaration time is as follows:

T declaration = L ctl /C + T BlocDelay (3)
Ring Reconfiguration Now that all the ring devices are aware of the occurred failure, they need to update their routing tables to bypass the failure when transmitting data. This duration corresponds to the routing table update, T tab-up , which is equivalent to the transmission time of the control message containing the list of the MAC addresses, L add-list , exchanged between the ring devices to update their routing table. As detailed in Section III-C, QoS-ARRP needs only one control message to update the routing table, which inherently reduces the control overhead. Moreover, as illustrated in Fig. 5, since the control message for ring reconfiguration (with a CTL code "0001") is sent right after the control message for failure declaration (with a CTL code "0010"), the blocking delay of the reconfiguration message due to low priorities has been already integrated in the declaration time in Eq. ( 3).

Hence, the ring reconfiguration time corresponds to the time needed for routing table update, which is as follows:

T tab-up = L adr-list C (4)
, where L add-list is equal in bytes to 42 + max(42, 2 + 6 × (M -2)) with: 42 bytes for the overhead of the Ethernet header (with the 802.1q tag), 12 bytes for the IFG, 2 bytes to identify the message type, and (M -2) × 6 bytes due to the size of an Ethernet MAC address multiplied by the maximum number of crossed devices (M -2), i.e., all the devices apart the both detecting the failure. Therefore, based on Eqs. ( 1), ( 3) and ( 4), the maximum recovery time is as follows:

T recovery = T detection + T declaration + T tab-up (5)
It is worth noting that the propagation delay is neglected herein, since it is typically less than 50 ns per 10m for a cable of category 5.

IV. NUMERICAL RESULTS

In this section, we report the numerical results of the maximum recovery time of the QoS-ARRP protocol. First, we present the considered case study and the considered network configurations. Afterwards, we discuss the impact of varying the protocol parameters that need to be tuned by the designer on the maximum recovery time. Finally, we compare the QoS-ARRP with existing protocols to evaluate its efficiency.

A. Case Study

We consider the case study with the following assumptions:

• The network is a ring connecting M devices;

• The transmission capacity is C = 1Gbps;

• Each device has a technological latency τ = 600ns;

• Each device generates a periodic data flow with a period of 2ms and a maximum packet length of 1500bytes. The latter is used to compute the T BlocDelay in Eq. ( 2). We experiment various network configurations, as illustrated in Table III, through varying the network size M and the protocol parameters to tune, i.e., (T detection , N detect , P local detect ), to assess their impact on the recovery time.

It is worth noting that the lowest value of P local detect is higher than the transmission time of one control message with a minimum length (64 bytes). Moreover, the highest value of the same parameter multiplied by the maximum number of N detect = 3 allows a T detection smaller than the T f ault sense = 2ms of the Gigabit Ethernet.

The results are illustrated in Figures 8,9, 10 and 11. As shown in Fig. 8, when increasing the T detection from 0.1ms until 2ms, the maximum recovery time increases linearly from 0.6ms until 2.5ms and then becomes constant. This is due to the fact that T detection is at most equal to the T f ault sense of the Gigabit Ethernet, i.e., 2ms, and T declaration and T tab-up (Eqs. ( 3) and (4) respectively) are also constant for a fixed network size, i.e., M = 40. Consequently, for a medium-scale network, the failure detection phase has the most noticeable impact on the recovery time, in comparison to the failure declaration and the ring configuration phases.

However, when increasing the network size, as illustrated in Fig. 9, we actually observe the inverse for a large-scale network. For instance, for M = 200, the recovery time is about 3ms for T detection = 0.5ms; thus, less than 17% of the recovery time is due to the failure detection phase.

Hence, to better understand the impact of the detection time parameter on the recovery time, we have varied the parameters N detect and P local detect , as depicted in Figures 10 and11. There are actually two main observations to note: (i) for a fixed network size, the maximum recovery time grows logarithmically with the N detect , e.g., for M = 200, when the N detect increases from 1 to 3, i.e., ×3, the recovery time grows only from 3.1ms to 4.4ms, i.e., ×0.42; (ii) the maximum recovery time for a fixed network size increases in a less noticeable way with the P local detect but still grows logarithmically, e.g., for M = 200, the recovery time goes from 2.6ms to 4.4ms, i.e., ×0.69, when P local detect increases from 10us to 600us, i.e., ×60.

These results infer that the protocol parameter N detect has higher impact on the recovery time than P local detect .

As shown in Figures 9, 10 and 11, the recovery time grows linearly in terms of the network size for a fixed protocol parameter, i.e., T detection , N detect and P local detect . This fact is consistent with the recovery time expression in Eq. ( 5), where T declaration and T tab-up grow linearly with the network size M while T detection stays constant. In addition, to avoid losing more than one data packet sent by each device because of a failure occurrence, we need to guarantee a maximum recovery time at most equal to 2ms, i.e., the implicit deadline of the generated data flow. This constraint limits the maximum network size when varying the different protocol parameters, e.g., for T detection = 1ms, the accepted network size is at most M = 80 in Figure 9. Therefore, the network designer needs to cope with the trade-off between the protocol overhead and the scalability of the network when tuning the QoS-ARRP parameters. For instance, increasing P local detect infers a decrease of the protocol overhead. Nevertheless, this choice will limit the network scalability.

C. Comparison with existing protocols

Similarly to static redundancy protocols like PRP and HSR, QoS-ARRP offers a high availability level with zero recovery time for hard real-time traffic by duplicating the message on both directions. However, like the most common dynamic protocols, QoS-ARRP improves the resource-efficiency in comparison to HSR, since it sends the soft-real time and best effort traffic only on the shortest path.

To conduct further comparative analyses in terms of availability of existing dynamic protocols against QoS-ARRP, we consider the recovery time expressions of MRP, DRP and RRP detailed in [START_REF]Industrial Communication Networks -High Availability Automation Networks -Part 2: Media Redundancy Protocol (MRP)[END_REF] [11] [START_REF]Industrial Communication Networks -High Availability Automation Networks -Part 7: Ring-based Redundancy Protocol (RRP)[END_REF], respectively. Moreover, we extrapolate their transmission capacity to 1Gbit/s and their different parameters, i.e., all the existing constants have been divided by 10 in our analysis. Finally, we have considered N detect = 3, P local detect = medium for the QoS-ARRP since it is considered as a good configuration regarding the trade-off between availability and scalability (as shown in Figure 11). The results regarding the network size are shown in Fig. 12. As we can see, the QoS-ARRP offers the lowest recovery time, e.g., the recovery time for a large-scale network of 200 nodes with QoS-ARRP, RRP, MRP and DRP is 3ms, 5.6ms, 14.5ms and 16ms, respectively. This fact is mainly due to: (i) the optimized local failure detection mechanism, based on control messages having the highest priority level and sent in cut-through mode, inducing shorter failure detection time than the centralized mechanisms implemented within MRP and DRP and the local mechanism of RRP based on the fault sense of the Ethernet physical layer, i.e., equal to 2ms for the Gigabit Ethernet; (ii) the use of only one control message to update the routing tables, limiting the overhead and enabling shorter reconfiguration time than using as many control messages as devices like in RRP.

Hence, QoS-ARRP outperforms the most common dynamic redundancy protocols in terms of guaranteed availability level.

V. CONCLUSION

A new redundancy protocol, called QoS-ARRP, has been proposed in this paper to handle the emerging requirements in terms of high availability for real-time communications on Ethernet networks. The main features of the QoS-ARRP enable a high flexibility level as static protocols, and low deployment costs as common dynamic protocols. Moreover, the numerical results show that QoS-ARRP outperforms the main existing dynamic protocols in terms of availability level, i.e., maximum recovery time.

The implementation of QoS-ARRP on FPGA is an on-going work. This step will enable the measurement of the recovery time and the consolidation of the numerical results.

Fig. 1 .

 1 Fig. 1. The QoS-ARRP switch ports

Fig. 2 .

 2 Fig. 2. QoS-ARRP frame structure

Fig. 3 .

 3 Fig. 3. Sub-structure of a control message Therefore, the QoS-ARRP failure detection mechanism is based on three main steps:(i) First, if a ring device has no data to transmit to its neighbor(s), then it announces periodically each announcing period its status to the neighbor(s) through sending control messages. These messages have the minimum Ethernet frame length of 64 bytes, and are identified with a CTL field set to "0000" and a type value "0x9000", as illustrated in Fig.3;(ii) Second, any ring device, which did not receive any data or control message from a ring port for a duration equal to the detection period 3 , will detect a failure. Afterwards, this ring device informs the other ring devices about the failure through a control message, which has the same structure illustrated in Fig.3and a CTL field set to "0010";(iii) Finally, any ring device receiving the control message with a CTL code "0010" from the device detecting the failure will update its routing table to bypass the failure during the data transmission. This step is based on the auto-configuration mechanism of the QoS-ARRP (described in Section III-C).

Fig. 4 .

 4 Fig. 4. Sub-structure of a control message to build/update the routing tables

Fig. 6 .

 6 Fig. 6. The QoS-ARRP Auto-configuration Mechanism after a failure recovery

Fig. 7 .

 7 Fig. 7. Recovery time since the failure occurence until the ring reconfiguration

Fig. 8 .Fig. 9 .

 89 Fig. 8. The impact of T detection on the Maximum Recovery Time for (M = 40, T detection ∈ [0.1 : 0.2 : 3]ms)

Fig. 10 .

 10 Fig. 10. The impact of N detect on the Maximum Recovery Time vs the Network Size for (M ∈ [10 : 10 : 200], N detect ∈ [1 : 1 : 3], P local detect = high)

Fig. 11 .

 11 Fig. 11. The impact of P local detect ) on the Maximum Recovery Time vs the Network Size for (M ∈ [10 : 10 : 200], N detect = 3, P local detect ∈ {low, medium, high})

Fig. 12 .

 12 Fig. 12. Recovery time for the different Redundancy Protocols

"the maximum time from failure to become fully operational again in case of a single permanent failure"

This period is higher than the announcing period and covers in general the reception of more than one control message.

The period can be tuned according to the application requirements by the network designer