Inti Gonzalez-Herrera
email: inti.gonzalez_herrera@irisa.fr

Johann Bourcier
email: johann.bourcier@irisa.fr

Erwan Daubert
email: erwan.daubert@irisa.fr

Walter Rudametkin
email: walter.rudametkin@inria.fr

Olivier Barais
email: barais@irisa.fr

François Fouquet
email: francois.fouquet@uni.lu

Jean-Marc Jézéquel
email: jezequel@irisa.fr

Scapegoat: an Adaptive monitoring framework for Component-based systems

Modern component frameworks support continuous deployment and simultaneous execution of multiple software components on top of the same virtual machine. However, isolation between the various components is limited. A faulty version of any one of the software components can compromise the whole system by consuming all available resources. In this paper, we address the problem of efficiently identifying faulty software components running simultaneously in a single virtual machine. Current solutions that perform permanent and extensive monitoring to detect anomalies induce high overhead on the system, and can, by themselves, make the system unstable. In this paper we present an optimistic adaptive monitoring system to determine the faulty components of an application. Suspected components are finely instrumented for deeper analysis by the monitoring system, but only when required. Unsuspected components are left untouched and execute normally. Thus, we perform localized just-in-time monitoring that decreases the accumulated overhead of the monitoring system. We evaluate our approach against a state-of-the-art monitoring system and show that our technique correctly detects faulty components, while reducing overhead by an average of 80%.

I. INTRODUCTION

Modern computing systems, such as home automation, pervasive and ubiquitous systems are becoming a larger part of our lives. The tight connection with our living environment introduces new needs for these systems, such as the coevolution of the system with its environment, the adaptation of the system to available resources and to users' behaviours, and the reliability of the system in front of faulty or malicious behaviours. Modern component frameworks assist software developers in coping with these new needs by providing introspection, reconfiguration, advanced technical services, among other facilities. These frameworks provide an extensible middleware and assist in managing technical issues such as security, transaction management, or distributed computing. They also support the simultaneous execution of multiple software components on the same virtual machine [START_REF]OSGi Service Platform Core Specification, Release 5.0[END_REF], [START_REF] Fouquet | A dynamic component model for cyber physical systems[END_REF], [START_REF] Bruneton | The FRACTAL Component Model and its Support in Java[END_REF].

While component frameworks simplify the programming model for software developers, the isolation between the various components is limited because they are collocated on the same virtual machine. This allows components to be communicate efficiently and to share references to complex objects, something which is generally not possible when crossing the process boundary. However, one faulty software artifact may compromise the whole system by, for example, consuming all available resources on the machine. Furthermore, because these systems evolve in open environments where humans have central roles, software developers are unable to anticipate all future configurations of the application at design-time [START_REF] Baresi | Toward open-world software: Issue and challenges[END_REF]. In these highly unpredictable environments, detecting irregular behaviour and maintaining the system in a consistent state is an important concern that can be addressed through continuous monitoring.

State of the art monitoring systems [START_REF] Frénot | Open-service-platform instrumentation: Jmx management over osgi[END_REF], [START_REF] Kreger | Java and JMX: Building Manageable Systems[END_REF], [START_REF] Binder | Exact and portable profiling for the {JVM} using bytecode instruction counting[END_REF] extract steady data-flows of system parameters, such as the time spent executing a component, the amount of I/O and memory used, and the number of calls to a component. The overhead that these monitoring systems introduce into applications is high, which makes it unlikely for them to be used in production systems. Results presented in [START_REF] Binder | Platform-independent profiling in a virtual execution environment[END_REF] show that overhead due to fine-grain monitoring systems can be up to a factor of 4.3. Our experiments, presented in this paper, show that overhead grows with the size of the monitored software. Thus, overhead greatly limits the scalability and usage of monitoring systems.

In this paper, we address excessive overhead in monitoring approaches by introducing an optimistic adaptive monitoring system that provides lightweight global monitoring under normal conditions, and precise and localized monitoring when problems are detected. Although our approach reduces the accumulated amount of overhead in the system, it also introduces a delay in finding the source of a faulty behaviour. Our objective is to provide an acceptable trade-off between the overhead and the delay to identify the source of faulty behaviour in the system.

Our optimistic adaptive monitoring system is based on the following principles:

• Contract-based resource usage. The monitoring system follows component-based software engineering principles. Each component is augmented with a contract that specifies their expected or previously calculated resource usage [START_REF] Beugnard | Making components contract aware[END_REF]. The contracts specify how a component uses memory, I/O and CPU resources. • Localized just-in-time injection and activation of monitoring probes. Under normal conditions our monitoring system performs a lightweight global monitoring of the system. When a problem is detected at the global level, our system activates local monitoring probes on specific components in order to identify the source of the faulty behaviour. The probes are specifically synthesized according to the component's contract to limit their overhead. Thus, only the required data are monitored (e.g., only memory usage is monitored when a memory problem is detected), and only when needed. • Heuristic-guided search of the problem source. We use a heuristic to reduce the delay of locating a faulty component as quickly as possible while maintaining an acceptable overhead. This heuristic is used to inject and activate monitoring probes on the suspected components. However, overhead and latency in finding the faulty component are greatly impacted by the precision of the heuristic. A heuristic that quickly locates faulty components will reduce both delays and the accumulated overhead of the monitoring system. We propose using Models@run.time techniques in order to build an efficient heuristic.

The evaluation of our optimistic adaptive monitoring system shows that, in comparison to other state-of-the-art approaches, the overhead of the monitoring system is reduced by up to 80%. Regarding latency, our heuristic reduces the delay to identify the faulty component when changing from global, lightweight monitoring to localized, just-in-time monitoring.

The remainder of this paper is organized as follows.

Section II presents the background on Models@run.time and motivates our work through a case study which is used to validate the approach. Section III provides an overview of the Scapegoat framework. It highlights how the component contracts are specified, how monitoring probes are injected and activated on-demand, how the ScapeGoat framework enables the definition of heuristics to detect faulty components without activating all the probes, and how we benefit from Models@run.time to build efficient heuristics. Section IV validates the approach through a comparison of detection precision and detection speed with other approaches. Finally, section V discusses related work and section VI discusses the approach and presents our conclusion and future work.

II. BACKGROUND AND MOTIVATING EXAMPLE

A. Motivating example

In this section we present a motivating example for the use of an optimistic adaptive monitoring process in the context of a real-time crisis management system in a fire department. During a dangerous event, many firefighters are present and need to collaborate to achieve common goals. Firefighters have to coordinate among themselves and commanding officers need to have an accurate real-time view of the system.

The Daum project1 provides a software application that supports firefighters in these situations. The application runs on devices with limited computational resources because it must be mobile and taken on-site. It provides numerous services for firefighters depending on their role in the crisis. In this paper we focus on the two following roles:

• A collaborative functionality that allows commanding officers to follow and edit tactical operations. The firefighters' equipment include communicating sensors that report on their current conditions. • A drone control system which automatically launches a drone equipped with sensors and a camera to provide a different point-of-view on the current situation.

As is common in many software applications, the firefighter application may have a potentially infinite number of configurations. These configurations depend on the number of firefighters involved, the type of crisis, the available devices and equipment, among other parameters. Thus, it is generally not possible to test all configurations to guarantee that the software will always function properly. Consequently, instead of testing all configurations, there is a need to monitor the software's execution to detect faulty behaviours and prevent system crashes. However, fine-grained monitoring of the application can have excessive overhead that makes it unsuitable with the application and the devices used in our example. Thus, there is a need for an accurate monitoring system that can find faulty components while reducing overhead.

The Daum project has implemented the firefighter application using a Component Based Software Architecture. The application makes extensive use of the Kevoree2 component model and runtime presented below.

B. Kevoree

Kevoree is an open-source dynamic component platform, which relies on Models@run.time [START_REF] Blair | Models@run.time[END_REF] to properly support the dynamic adaptation of distributed systems. Our use case application and the implementation of the Scapegoat framework make extensive use of the Kevoree framework. The following subsections detail the background on componentbased software architecture, introduce the Models@run.time paradigm and give an overview of the Kevoree platform.

1) Component-based software architecture: Software architecture aims at reducing complexity through abstraction and separation of concerns by providing a common understanding of component, connector and configuration [START_REF] Dashofy | An infrastructure for the rapid development of XML-based architecture description languages[END_REF], [START_REF] Medvidovic | A Classification and Comparison Framework for Software Architecture Description Languages[END_REF], [START_REF] Van Ommering | The Koala Component Model for Consumer Electronics Software[END_REF]. One of the benefits is that it facilitates the management of dynamic architectures, which becomes a primary concern in the Future Internet and Cyber-Physical Systems [START_REF] Nitto | A journey to highly dynamic, self-adaptive service-based applications[END_REF]. Such systems demand techniques that let software react to changes by self-organizing its structure and self-adapting its behaviour. Many works [START_REF]Proceedings of the 15th ACM SIGSOFT Symposium on Component Based Software Engineering, CBSE 2012, part of Comparch '12 Federated Events on Component-Based Software Engineering and Software Architecture[END_REF] have shown the benefits of using componentbased approaches in such open-world environments [START_REF] Baresi | Toward open-world software: Issue and challenges[END_REF].

To satisfy the needs for adaptation, several component models provide solutions to dynamically reconfigure a software architecture through, for example, the deployment of new modules, the instantiation of new services, and the creation of new bindings between components. In practice, componentbased (and/or service-based) platforms like Fractal [START_REF] Bruneton | The FRACTAL Component Model and its Support in Java[END_REF], Open-COM [START_REF] Coulson | A component model for building systems software[END_REF], OSGi [START_REF]OSGi Service Platform Core Specification, Release 5.0[END_REF] or SCA [START_REF] Seinturier | A Component-Based Middleware Platform for Reconfigurable Service-Oriented Architectures[END_REF] provide platform mechanisms to support dynamic architectures.

2) Models@run.time: Built on top of dynamic component frameworks, Models@run.time denote model-driven approaches that aim at taming the complexity of dynamic adaptation. It basically pushes the idea of reflection [START_REF] Morin | Taming Dynamically Adaptive Systems with Models and Aspects[END_REF] one step further by considering the reflection-layer as a real model: "something simpler, safer or cheaper than reality to avoid the complexity, danger and irreversibility of reality". In practice, component-based and service-based platforms offer reflection APIs that allow instrospecting the application (e.g., which components and bindings are currently in place in the system) and dynamic adaptation (e.g., changing the current components and bindings). While some of these platforms offer rollback mechanisms to recover after an erroneous adaptation [START_REF] Léger | Reliable dynamic reconfigurations in a reflective component model[END_REF], the purpose of Models@run.time is to prevent the system from actually enacting an erroneous adaptation. In other words, the "model at runtime" is a reflection model that can be decoupled from the application (for reasoning, validation, and simulation purposes) and then automatically resynchronized. This model can not only manage the application's structural information (i.e., the architecture), but can also be populated with behavioural information from the specification or the runtime monitoring data.

The Kevoree framework: Kevoree provides multiple concepts that are used to create a distributed application that allows dynamic adaptation. The Node concept is used to model the infrastructure topology and the Group concept is used to model the semantics of inter-node communication, particularly when synchronizing the reflection model among nodes. Kevoree includes a Channel concept to allow for different communication semantics between remote Components deployed on heterogeneous nodes. All Kevoree concepts (Component, Channel, Node, Group) obey the object type design pattern [START_REF] Johnson | The Type Object Pattern[END_REF] in order to separate deployment artifacts from running artifacts. Kevoree supports multiple execution platforms (e.g., Java, Android, MiniCloud, FreeBSD, Arduino). For each target platform it provides a specific runtime container. Moreover, Kevoree comes with a set of tools for building dynamic applications (a graphical editor to visualize and edit configurations, a textual language to express reconfigurations, several checkers to valid configurations).

As a result, Kevoree provides a promising environment by facilitating the implementation of dynamically reconfigurable applications in the context of an open-world environment. Because our goal is to design and implement an adaptive monitoring system, the introspection and the dynamic reconfiguration facilities offered by Kevoree suit the needs of the ScapeGoat framework.

III. THE SCAPEGOAT FRAMEWORK

Our optimistic adaptive monitoring system extends the Kevoree platform with the following principles: i) component contracts that define per-component resource usage, ii) localized and just-in-time injection and activation of monitoring probes, iii) heuristic-guided faulty component detection. The following subsections present an overview of these three principles in action.

A. Specifying component contracts

In both the Kevoree and ScapeGoat approaches, we follow the contract-aware component classification [START_REF] Beugnard | Making components contract aware[END_REF], which applies B. Meyer's Design-by-Contract principles [START_REF] Meyer | Applying "design by contract[END_REF] to components. In fact, ScapeGoat provides Kevoree with Quality of Service contract extensions that specify the worst-case values of the resources the component uses. The resources specified are memory, CPU, I/O and the time to service a request.

For example, for a simple Web server component we can define a contract on the number of instructions per second it may execute [START_REF] Binder | Exact and portable profiling for the {JVM} using bytecode instruction counting[END_REF] and the maximum amount of memory it can consume. The number of messages can be specified per component or per component-port. The example is shown in Listing 1. 3 This contract extension follows the component interface principle [START_REF] Alfaro | Interface theories for component-based design[END_REF], and allows us to detect if the problem comes from the component implementation or from a component interaction. That is, we can distinguish between a component that is using excessive resources because it is faulty, or because other components are calling it excessively. addComponent WsServer650@node0 : WsServer { // Specify that this component can use 258 CPU // instructions per second, cpu_wall_time = '258', // Specify that this component can consume a maximum of 15000 // bytes of memory, memory_max_size = '15000', // Specify that the contract is guaranteed under the assumption that // we do not receive more than 10k messages on the component and // 10k messages on the port named service // ( this component has only one port ) throughput_msg_per_second='all=10000;service=10000' } Listing 1. Component contract specification example

B. An adaptive monitoring framework within the container

Scapegoat provides a monitoring framework that adapts its overhead to current execution conditions and leverages the architectural information provided by Kevoree to guide the search for faulty components. The monitoring mechanism is mainly injected within the component container.

Each Kevoree node/container is in charge of managing the component's execution and adaptation. Following the Models@run.time approach, each node can be sent a new architecture model that corresponds to a system evolution. In this case, the node compares its current configuration with the configuration required by the new architectural model and computes the list of individual adaptations it must perform. Among these adaptations, the node is in charge of downloading all the component packages and their dependencies, and loading them into memory. During this process, Scapegoat provides the existing container with (i) checks to verify that the system has enough resources to manage the new component, and (ii) instrumentation for the component's classes in order to add bytecode for the monitoring probes. Scapegoat uses the components' contracts to check if the new configuration will not exceed the amount of resources available on the device. And Scapegoat instruments the components' bytecode to monitor object creation (to compute memory usage), to compute each statement (for calculating CPU usage), and to monitor calls to classes that wrap I/O access such as the network or file-system.

We provide several instrumentation levels that vary in the information they obtain and in the degree they impact the application's performance:

• Global monitoring does not instrument any components, it simply uses information provided directly by the JVM. • Memory instrumentation or memory accounting, which monitors the components' memory usage. • Instruction instrumentation or instruction accounting, which monitors the number of instructions executed by the components. • Memory and instruction instrumentation, which monitors both memory usage and the number of instructions executed.

Probes are synthesized according to the components' contracts. For example, a component whose contract does not specify I/O usage will not be instrumented for I/O resource monitoring. Probes can be dynamically activated or deactivated, with the exception of memory usage probes. Memory consumption probes must remain activated to guarantee that all memory usage is properly accounted for, from the component's creation to the component's destruction. Indeed, deactivating memory probes would cause object allocations to remain unaccounted for. However, probes for CPU and I/O usage can be activated on-demand to check for component contract compliance.

To take advantage of having dynamic probes, we attempt to minimize the overhead of the monitoring system by activating selected probes only when a problem is detected at the global level. We estimate the most likely faulty components and then activate the pertinent monitoring probes. This technique means we only activate fine-grain monitoring on components suspected of misbehavior. After monitoring this subset of components, if any of them are indeed faulty, the monitoring system has finished and determines that these components are the source of the problem. If the subset of components are determined to be healthy, the system continues its search and starts monitoring the second most likely faulty subset. The monitoring mechanism implemented for ScapeGoat is summarized in listing 2.

As a result, at any given moment, applications must be in one of the following monitoring modes:

• No monitoring. The software is executed without any monitoring probes or modifications. Type; therefore it is user customizable. It is in charge of implementing the heuristic that ranks the components from the most likely to be faulty to the least likely. • Adaptation component. This component type is in charge of dealing with the adaptation of the application when a contract violation is detected. It is also a customizable component. The adaptation strategy whenever a faulty component is discovered is out os scope of this paper. Nevertheless, several strategies may be implemented in Scapegoat, such as removing faulty components or slowing down communication between components when the failure is due to a violation in the way one component is using another.

2) Implementation strategy: Scapegoat aims minimizing monitoring overhead when the framework is running in Global Monitoring mode. To achieve this, ScapeGoat removes as many monitoring probes as possible and only activates probes that are required. This requires changing the bytecode that defines the application's classes at runtime, when the monitoring mode changes. Bytecode is changed at a per-component basis. We use the ASM library to perform bytecode manipulation and a Java agent to get access to and transform the classes. Bytecode manipulation has been proposed before for resource accounting and profiling in Java [START_REF] Binder | Portable and accurate sampling profiling for java[END_REF], [START_REF] Binder | Exact and portable profiling for the {JVM} using bytecode instruction counting[END_REF], [START_REF] Czajkowski | JRes: a resource accounting interface for java[END_REF].

C. Leveraging Models@run.time to build an efficient monitoring framework

As presented in section III-B, our approach offers a dynamic way to activate and deactivate fine-grain localized monitoring. We use a heuristic to determine which components are more likely to be faulty. Suspected components are the first to be monitored.

Our framework can support different heuristics, which can be application or domain-specific. In this paper we propose a heuristic that leverages the use of the Models@run.time approach to infer the faulty components. The heuristic is based on the assumption that the cause of newly detected misbehavior in an application is likely to come from the most recent changes in the application. This can be better understood as follows:

• recently added or updated components are more likely to be the source of a faulty behaviour; • components that directly interact with recently added or updated components are also suspected.

We argue that when a problem is detected it is probable that recent changes have led to this problem, or else, it would have likely occurred earlier. If recently changed components are monitored and determined to be healthy, it is probable that the problem comes from direct interactions with those components. Indeed, changes to interactions can reveal dormant issues with the components. The algorithm used for ranking the components is presented in more detail in listing 3. In practice, we leverage the architectural-based history of evolutions of the application, which is provided by the Models@run.time approach.

IV. EVALUATION

In this section we present our experiments and discuss the usability of our approach. We focus on the following research questions to assess the quality and the efficiency of ScapeGoat:

• What is the impact of the various levels of instrumentation on the application? Our approach assumes high overhead for full monitoring and low overhead for a lightweight global monitoring system. The experiments presented in section IV-A show the overhead for each instrumentation level. • Does our adaptive monitoring approach have better performance than state-of-the-art monitoring solutions? The experiment presented in section IV-B highlights the performances benefits of our approach considering a real-world scenario. • What is the impact of using a heuristic in our adaptive monitoring approach? The experiment presented in section IV-C highlights the impact of the application and component sizes, and the need of a good heuristic to quickly identify faulty components.

The efficiency of our monitoring solution is evaluated on two dimensions: the overhead on the system and the delay to detect failures. We show there is a trade-off between the two dimensions and that ScapeGoat provides a valuable solution that increases the delay to detect a faulty component but reduces accumulated overhead. a) Use case: We have built several use cases based on a template application from our motivating example in section II-A. We reused an open-source crisis-management application for firefighters that has been built with Kevoree components. We use two functionalities of the crisis-management application. The first one is for managing firefighters. The equipment given to each firefighter contains a set of sensors that provides data for the firefighter's current location, his heartbeat, his body temperature, his acceleration movements, the environmental temperature, and the concentration of toxic gases. These data are collected and displayed in the crisis-management application, which provides a global-view of the situation. The second functionality uses drones to capture real-time video from an advantageous point-of-view.

Figure 1 shows the set of components that are involved in our use-case, including components for firefighters, drones and the crisis-management application 4 . The components in the crisis-management application are used in our experiments, but the physical devices (drones and sensors) are simulated through the use of mock components.

Every use case we present extends the crisis-management base application by any one of the following possibilities: adding new or redundant components, adding external Java applications with wrapper components (e.g., Weka, DaCapo), or modifying existing components (e.g., to introduce a fault into them).

b) Measurement Methodology:

To obtain comparable and reproducible results, we used the same hardware across all experiments: a laptop with a 2.90GHz Intel(R) i7-3520M processor, running Fedora 19 with a 32 bit kernel and 8GB of system memory. We used the HotSpot Java Virtual Machine version 1.7.0-40, and Kevoree framework version 2.0.12. Each measurement presented in the experiment is the average of ten different runs under the same conditions.

The evaluation of our approach is tightly coupled with the quality of the resource consumption contracts attached to each component. We built the contracts following classic profiling techniques. The contracts were built by performing several runs of our use cases, without inserting any faulty components into the execution. Firstly, we executed the use cases in an environment with global monitoring activated to get information for the global contract. Secondly, percomponent contracts were created by running the use cases in an environment with full monitoring.

A. Overhead of the instrumentation solution

Our first experiment compares the various instrumentation levels to show the overhead of each one. In this experiment, we compare the following instrumentation levels: No monitoring, Global monitoring, Memory instrumentation, Instructions instrumentation, Memory and instructions instrumentation (i.e., Full monitoring).

In this set of experiments we used the DaCapo 2006 benchmark suite [START_REF] Blackburn | The DaCapo benchmarks: Java benchmarking development and analysis[END_REF]. We developed a Kevoree component to execute this benchmark 5 . The container was configured to use full monitoring and the parameters in the contract are upper bounds of the real consumption 6 .

Figure 2 shows the execution time of several DaCapo tests under different scenarios. First, we wish to highlight that Global monitoring introduces no overhead compared with the No monitoring mode. Second, the overhead due to memory accounting is lower than the overhead due to instruction accounting. This is very important because, as we described in section III-B, memory probes cannot be deactivated dynamically. We calculated the overhead as: The average overhead due to memory accounting is 3.70, while the value for instruction accounting is 6.54. These values are not as good as the values reported in [START_REF] Binder | Platform-independent profiling in a virtual execution environment[END_REF]; the difference is negligible for memory accounting but they obtain a superior value between 3.2 and 4.3 for instructions accounting. The performance difference comes from a specific optimization that we chose not to apply. The optimization provides fast access to the execution context by adding a new parameter to each method. Nevertheless, this solution needs to keep a version of the method without the new parameter because native calls cannot be instrumented like that. We decided to avoid such an optimization because duplication of methods increases the size of the applications, and with it, the memory used by the heap. In short, our solution can reach similar values if we include the mentioned optimization, but at the cost of using more memory. On the other hand, the values we report are far lower than the values reported in [START_REF] Binder | Platform-independent profiling in a virtual execution environment[END_REF] for hprof. Hence, we consider that our solution is comparable to state of the art approaches in the literature.

In addition, we plan to study alternatives to improve instruction accounting. For example, we plan to study the use of machine learning for monitoring [START_REF] Tesauro | A hybrid reinforcement learning approach to autonomic resource allocation[END_REF]. Based on a machine learning approach, it is possible to train the monitoring system to do the instruction instrumentation. Then, instead of doing normal instruction instrumentation, we might only do, for example, method-calls instrumentation and with the learning data, the monitoring system should be able to infer the CPU usage of each call, whilst lowering the overhead.

The results of our experiment shown in figure 2 demonstrate the extensive impact the Full monitoring mode, which uses either Memory instrumentation or CPU instrumentation, has on the application. Our Adaptive monitoring mode, which uses Global monitoring and switches to Full monitoring or localized monitoring, is able to reduce this accumulated overhead due to the fact that Global monitoring has no appreciable overhead.

B. Overhead of Adaptive Monitoring vs Full Monitoring

The previous experiment highlights the usefulness of using Adaptive monitoring. However, switching from Global monitoring to either Full or Localized monitoring introduces an additional overhead due to having to instrument components and activate monitoring probes. Our second experiment compares the overhead introduced by the adaptive monitoring with the overhead of Full monitoring as used in state-of-the-art monitoring approaches.

Table I shows the tests we built for the experiment. We developed the tests by extending the template application. Faults were introduced by modifying an existing component to break compliance with its resource consumption contract. We reproduce each execution repetitively; thus, the faulty behaviour is triggered many times during the execution of the application. The application is not restarted. Figure 3 shows the execution time of running the use cases with different scenarios. Each scenario uses a specific monitoring policy (Full monitoring, Adaptive monitoring with All Components, Adaptive monitoring with Localized monitoring, Global monitoring). This figure shows that the overhead differences between Full monitoring and Adaptive monitoring with All Components is clearly impacted by scenarios that cause the system to transition too frequently between a lightweight Global and a fine-grain Adaptive monitoring. Such is the case for use cases UC3 and UC4 because the faulty component is inserted and never removed. Using Adaptive monitoring is beneficial if the overhead of Global monitoring plus the overhead of switching back and forth to All Components monitoring is less than the overhead of the Full monitoring for the same execution period. If the application switches between monitoring modes too often then the benefits of adaptive monitoring are lost.

The overhead of switching from Global monitoring to full components or Localized monitoring comes from the fact that the framework must reload and instrument classes to activate the monitoring probes. Therefore, using Localized monitoring reduces the number of classes that must be reloaded. This is shown in the third use-case of figure 3, which uses a heuristic based on the number of failures. Because we execute the faulty component many times, the heuristic is able to select, monitor and identify the faulty component quickly. This reduces overhead by 80%. We use the following equation to calculate overhead:

Gain = 100 - OurApproach -GlobalM onitoring F ullM onitoring -GlobalM onitoring * 100 U C 1 U C 2 U C 3 U C 4 U C 5 U C

C. Overhead from switching monitoring modes, and the need of a good heuristic

As we explain in the previous experiments, even if using Localized monitoring is able to reduce the overhead of the monitoring system, the switch between Global and Localized monitoring introduces additional overhead. If this overhead is too high, the benefits of adaptive monitoring are lost.

In this experiment we show the impact of the application's size, in terms of number of components, and the impact of the component's size, in terms of number of classes, on adaptive monitoring. We also show that the choice of the heuristic to select suspected components for monitoring is important to minimize the overhead caused from repeated instrumentation and probe activation processes.

For the use case, we created two components and we introduced them into the template application separately. Both components perform the same task, which is performing a primality test on a random number and sending the number to another component. However, one of the components causes 115 classes to be loaded, while the other only loads 4 classes. We used the same basic scenario with a varying number of primality testing components and component sizes. In this way, we were able to simulate the two dimensions of application size. The exact settings, leading to 12 experiments, are defined by the composition of the following constraints:

• N comp = {4, 8, 16, 32, 64, 128} which defines the number of components for the application • Size comp = {4, 115} which defines the number of classes for a component With these use cases, we measured the delay to find the faulty component and the execution-time overhead caused by monitoring. Figures 4 and5 show the delay to detect the faulty component with regards to the size of the application. In the first figure, the component size is 115 classes, and in the second figure, the component size is four classes.

1) Impact of the application size: Using figures 5 and 7, we see that the size of the application has an impact on the delay to detect faulty components, and also on the monitoring overhead. We also calculated the time needed to find the faulty component with the All components mode after its initialization (the time needed to switch from Global monitoring). This time is around 2 seconds no matter the size of the application. That is the reason the switch from Global monitoring to All components has such a large effect on overhead.

These figures also show that using Localized monitoring instead of All components when switching from Global monitoring helps reduce the impact of the application's size by reducing the number of components to monitor and the number of classes to instrument. However, we also see that using a sub-optimal heuristic may have negatively impacted the delay to detect faulty components. This can be explained by the multiple switches that the Random heuristic may often require to locate the faulty component.

2) Impact of the component size: In figures 4 and 5 we see that even if we use a good heuristic, the size of the components to monitor impacts the delay in detecting the faulty component. Like the application's size, component size impacts the switch from Global monitoring to Localized monitoring. A good heuristic reduces the number of transitions; thus, it reduces overhead.

D. Threats to validity

Our experiments show the benefits of using adaptive monitoring instead of state-of-the-art monitoring approaches. As in every experimental protocol, our evaluation has some bias which we have tried to mitigate. All our experiments are based around the same case study. We have tried to mitigate this issue by using an available real case study. We have also used different settings across our experiments, even if all of the experiments are based on the same case study. Thus, our experiments limit the validity of the approach to applications with the same characteristics of the presented case study. New experiments with other use cases are needed to broaden the validation scope of our approach.

The evaluation of the heuristic mainly shows the potential impact of using an ideal heuristic. More case study and experiments are needed to fully validate the value of our Models@run.time based heuristic.

V. RELATED WORK

The Scapegoat framework is related to component monitoring, Models@run.time, component isolation and component Performance and resource-consumption prediction approaches are complementary to the Scapegoat framework because they can assist in better specifying the component contracts. Some approaches require developers to provide extensive per-component metadata at design-time in order to calculate the application's overall performance or resource consumption [START_REF] Becker | Model-based performance prediction with the palladio component model[END_REF], [START_REF] Jonge | Scenario-based prediction of run-time resource consumption in component-based software systems[END_REF]. Prediction approaches have been achieved by using combinations of design-time and runtime analyses [START_REF] Autili | A hybrid approach for resource-based comparison of adaptable java applications[END_REF]. However, although many approaches to performance prediction have been proposed, none of them have obtained widespread use [START_REF] Koziolek | A qos driven development process model for component-based software systems[END_REF]. KAMI [START_REF] Ghezzi | Predicting performance properties for open systems with kami[END_REF] builds performance models at design-time but uses and continually refines them at runtime. By collecting runtime data, they are able to build performance and resource consumption models that reflect real usage. They are able to adapt the application according to changes in components' behavior, but they do not use nor propose an adaptive monitoring system to minimize overhead.

State of the art monitoring systems [START_REF] Frénot | Open-service-platform instrumentation: Jmx management over osgi[END_REF], [START_REF] Kreger | Java and JMX: Building Manageable Systems[END_REF], [START_REF] Binder | Exact and portable profiling for the {JVM} using bytecode instruction counting[END_REF] extract steady data-flows of system parameters, such as, the time spent executing a component, the amount of I/O and memory used, and the number of calls to a component. The overhead that these monitoring systems introduce into applications is high, which makes it unlikely for them to be used in production systems. Maurel et al. [START_REF] Maurel | Adaptive monitoring of end-user osgi-based home boxes[END_REF] propose an adaptive monitoring framework for the OSGi platform. Similarly to our work, they propose a global monitoring system that changes to a localized monitoring system when a problem is detected. However, their work is focused on CPU usage and does not consider other resources, such as, memory or I/O. Gama and Donsez [START_REF] Gama | A self-healing component sandbox for untrustworthy third party code execution[END_REF] propose using virtual machines in separate processes or using MVM isolates [START_REF] Czajkowski | Multitasking without compromise: a virtual machine evolution[END_REF] to manage trusted and untrusted components. After an evaluation period, untrusted components can be moved to the trusted JVM if no problems are detected. This allows the main application to depend on potentially faulty components without risking severe crashes. We can also cite Microsoft technologies such as COM (Component Object Model) components which can be either loaded in the client application process or provided in an isolated process [START_REF] Löwy | NET: Component Services[END_REF]. In addition to process virtualization, some operating systems also propose user-space virtualization, which isolates not only the processes but also the memory, the network interface and the file system. Examples of these approaches are Jails7 for BSD, LXC 8 and CGroups for Linux, and lmctfy 9 . All of these approaches have the drawback of limiting code and instance sharing and introduce additional overhead in cross-boundary component interactions. Furthermore, depending on the complexity of the approach, there is also overhead in having to manage multiple processes.

VI. CONCLUSION

In this paper we presented ScapeGoat, an adaptive monitoring framework to perform lightweight yet efficient monitoring of Component-Based Systems. In ScapeGoat, each component is augmented with a contract that specifies its resource usage, such as peak CPU and memory consumption. ScapeGoat uses a global monitoring mode that has a very small overhead on the system, and a fine-grained localized monitoring mode that performs extensive checking of the components' contracts. The system switches from the global monitoring mode to the localized monitoring mode whenever a problem is detected at the global level in order to identify the faulty component. Furthermore, we proposed a heuristic that leverages information produced by the Models@run.time approach to quickly predict the faulty components.

ScapeGoat has been implemented on top of the Kevoree component framework which uses the Models@run.time approach to tame the complexity of distributed dynamic adaptations. The evaluation of ScapeGoat shows that the monitoring system's overhead is reduced by up to 80% in comparison with state-of-the-art full monitoring systems. The evaluation also presents the benefits of using a heuristic to predict the faulty component. This paper contributes to the state of the art by providing a monitoring framework which adapts its overhead depending on current execution conditions and leverages the architectural information provided by Kevoree to drive the search for the faulty component.

The work presented in this paper opens various research perspectives. Scapegoat currently uses code injection at loadtime to perform fine-grain monitoring. The adaptive monitoring approach we have presented provides good results, but we believe we can reduce the overhead of CPU and memory monitoring by using a modified JVM and injecting specialized bytecode to cooperate with it. The modified JVM would account for the resources at a low-level, while the instrumentation code could provide application-level information like the component boundaries. This should result in a more efficient solution than calculating resource usage at the applicationlevel only. A second research perspective consists in proposing an appropriate reaction when the source of a problem is discovered by ScapeGoat. Indeed, the reconfiguration when a resource-consumption problem is found could range from resource limitations for guilty components, to a replacement of the component or of part of the application. In the context of a distributed system, the set of possible reconfigurations is larger and can include moving components across the distributed infrastructure. In this context, choosing a reconfiguration to efficiently deal with the discovered fault will be necessary.

Listing 3 .

 3 ranker () : list <Component> visited = ∅ ranking = {} for each model M ∈ History N = {c | c was added in M} Neighbors = c∈N c.neighbors ranking . add N\ visited visited = visited ∪ N SortedNeighbors = sort (Neighbors \ visited ) ranking . add SortedNeighbors visited = visited ∪ Neighbors return ranking sort (S : Set<Component>) : list <Component> r = {} if S = ∅ choose b | b ∈ S ∧ b is newer than any other element in S r . add b, sort (S\{b}) return r The ranking algorithm (uses the model history for ranking).

Fig. 1 .

 1 Fig. 1. The component configuration for our crisis-management use-case.

Fig. 2 .

 2 Fig. 2. Execution time for tests using the DaCapo Benchmark

Fig. 3 .

 3 Fig. 3. Execution time for some use cases under different monitoring policies.

Fig. 4 .Fig. 5 .Fig. 6 .

 456 Fig. 4. Delay time to detect fault with a component size of 115 classes.

Fig. 7 .

 7 Fig. 7. Execution time of main task with a component size of four classes.

  The Scapegoat framework is built using the Kevoree component framework. Scapegoat extends Kevoree by providing a new Node Type and three new Component Types:

	while container is running
	wait violation in global monitoring
	checked = ∅
	faulty = ∅
	while checked = C ∧ f aulty = ∅
	subsetToCheck = heuristic ( C \ checked )
	instrument for adding probes ( subsetToCheck )
	faulty = fine -grain monitoring( subsetToCheck )
	instrument for removing probes ( subsetToCheck )
	checked = checked ∪ subsetToCheck
	if faulty = ∅
	adapt the system ( faulty , C)
	fine -grain monitoring( C : Set<Component> )
	wait few milliseconds // to obtain good information
	faulty = {c | c ∈ C ∧ c.consumption > c.contract}
	return faulty
	Listing 2. The main monitoring loop implemented in ScapeGoat
	• Localized monitoring. Only a subset of the components
	are monitored.
	• Adaptive monitoring. The monitoring system changes
	from Global monitoring to Full or Localized monitoring
	if a faulty behaviour is detected.
	• Monitored Node. Handles the admission of new compo-
	nents by storing information about resource availability.
	Before admission, it checks the security policies and
	registers components with a contract in the monitoring
	framework. Moreover, it intercepts and wraps class load-
	ing mechanisms to record a component type's loaded
	classes. Such information is used later to (de)activate the
	probes.
	• Monitoring Component. This component type is in
	charge of checking component contracts. Basically, it
	implements a complex variant of the algorithm in listing
	2. It communicates with other components to identify
	suspected components.
	• Ranking Component. This is an abstract Component

• Global monitoring. Only global resource usage is being monitored, such as the CPU usage and memory usage at the Java Virtual Machine (JVM) level. • Full monitoring. All components are being monitored for all types of resource usage. This is equivalent to current state-of-the-art approaches. monitor(C: Set<Component>, heuristic : Set<Component>→Set<Component>) init memory probes (c | c ∈ C ∧ c.memory_contract = ∅)

For the rest of this paper we use the term all components for the adaptive monitoring policy that indicates that the system changes from global monitoring mode to full monitoring mode if and when a faulty behaviour is detected.

1) ScapeGoat's architecture:

TABLE I .

 I FEATURES OF USE CASES.

	performance prediction approaches.
	Test Name	Monitored Resource	Faulty Resource	Heuristic	External Task
	UC1	CPU, Memory	CPU	number of failures	Weka, training neural network
	UC2	CPU, Memory	CPU	number of failures	dacapo, antlr
	UC3	CPU, Memory	CPU	number of failures	dacapo, chart
	UC4	CPU	CPU	number of failures	dacapo, xalan
	UC5	CPU, Memory	CPU	less number of failures	dacapo, chart
	UC6	Memory	CPU	number of failures	Weka, training neural network

https://github.com/daumproject

http://www.kevoree.org

Contract examples for the architecture presented in section II-A can be found at http://goo.gl/uCZ2Mv.

More information about these components is given in http://goo.gl/ x64wHG

http://www.freebsd.org/doc/handbook/jails.html

http://lxc.sourceforge.net/

https://github.com/google/lmctfy

ACKNOWLEDGEMENT This work has been supported by the European FP7 Marie Curie Initial Training Network RELATE (Grant Agreement No. 264840). It has been also supported by the ITEA2 MERgE project, and by the French project InfraJVM (Grant Agreement No. ANR-11-INFR-0008).


Philippe Laurenc ¸ot

Christoph Walker
email: walker@ifam.uni-hannover.de

THE TIME SINGULAR LIMIT FOR A FOURTH-ORDER DAMPED WAVE EQUATION FOR MEMS

We consider a free boundary problem modeling electrostatic microelectromechanical systems. The model consists of a fourth-order damped wave equation for the elastic plate displacement which is coupled to an elliptic equation for the electrostatic potential. We first review some recent results on existence and nonexistence of steady-states as well as on local and global well-posedness of the dynamical problem, the main focus being on the possible touchdown behavior of the elastic plate. We then investigate the behavior of the solutions in the time singular limit when the ratio between inertial and damping effects tends to zero.

INTRODUCTION

An idealized electostatically actuated microelectromechanical system (MEMS) consists of a fixed horizontal ground plate held at zero potential above which an elastic plate (or membrane) held at potential V is suspended, see Figure 1. A Coulomb force is generated by the potential difference across the device and results in a displacement of the elastic plate, thereby converting electrostatic energy into mechanical energy, see [START_REF] Esposito | Mathematical Analysis of Partial Differential Equations Modeling Electrostatic MEMS[END_REF][START_REF] Pelesko | Modeling MEMS and NEMS[END_REF] for a more detailed account and further references. After a suitable scaling and assuming homogeneity in the transversal horizontal direction (i.e. no y-dependence in Figure 1), the ground plate is assumed to be located at z = -1 and the plate displacement u = u(t, x) ∈ (-1, ∞) evolves according to γ 2 ∂ 2 t u + ∂ t u + β ∂ 4 x u -τ∂ 2 x u = -λ ε 2 |∂ x ψ(t, x, u(t, x))| 2 + |∂ z ψ(t, x, u(t, x))| 2 [START_REF] Escher | A parabolic free boundary problem modeling electrostatic MEMS[END_REF] for t > 0 and x ∈ I := (-1, 1) with clamped boundary conditions [START_REF] Escher | Dynamics of a free boundary problem with curvature modeling electrostatic MEMS[END_REF] u(t, ±1) = ∂ x u(t, ±1) = 0 , t > 0 , (3) u(0, x) = u 0 (x) , γ 2 ∂ t u(0, x) = γ 2 u 1 (x) , x ∈ I .

In (1), γ 2 ≥ 0 measures the ratio of inertial and damping forces which are given by the second and first order time derivatives, respectively, while β ∂ 4

x u with β ≥ 0 and -τ∂ 2 x u with τ ≥ 0 account for bending and stretching of the elastic plate, respectively. The right hand side of (1) reflects the electrostatic forces exerted on the elastic plate, where the parameter λ > 0 is proportional to the square of the voltage difference between the two components, and the parameter ε > 0 denotes the aspect ratio of the device (that is, the ratio height/length). The boundary conditions [START_REF] Escher | Dynamics of a free boundary problem with curvature modeling electrostatic MEMS[END_REF] describe an elastic plate being clamped at its fixed boundary. Finally, the electrostatic potential ψ = ψ(t, x, z) satisfies a rescaled Laplace equation in the time-varying region Ω(u(t)) := {(x, z) ∈ I × (-1, ∞) : -1 < z < u(t, x)} between the ground plate and the elastic plate which reads

ε 2 ∂ 2 x ψ + ∂ 2 z ψ = 0 , (x, z) ∈ Ω(u(t)) , t > 0 , (4) ψ(t, x, z) = 1 + z 1 + u(t, x) , (x, z) ∈ ∂ Ω(u(t)) , t > 0 . (5)
Note that, when γ > 0, equation ( 1) is a hyperbolic nonlocal semilinear fourth-order equation for the plate displacement u, which is coupled to the second-order elliptic equation ( 4) in the moving domain Ω(u(t)) for the electrostatic potential ψ. If damping effects dominate over inertia effects one may set γ = 0 in (1)-( 3) and thus obtains a parabolic equation for u.

A noteworthy feature of the above model is that it is only meaningful as long as the elastic plate does not touch down on the ground plate, that is, the deflection u satisfies u > -1. From a physical point of view it is expected that above a certain critical threshold of λ , the elastic plate "pulls in" and smashes down on the ground plate. Obviously, the stable operating conditions of a given MEMS device heavily depend on the possible occurrence of this so-called "pull in" instability. Mathematically, the touchdown singularity manifests in the definition of Ω(u(t)) which becomes disconnected if u(t, x) reaches the value -1 at some point x, but also in the right hand side of (1) as ∂ z ψ becomes singular at such points since ψ = 1 along z = u while ψ = 0 along z = -1.

1.1. State of the Art. According to the previous discussion, the mathematical investigation aims at showing that the parameter λ indeed governs the dynamics of (1)- [START_REF] Fattorini | Second Order Linear Differential Equations in Banach Spaces[END_REF], in particular the touchdown behavior and the closely related issues of global well-posedness and existence of steady states. More precisely, above a certain threshold value of λ it is conjectured that solutions to (1)-( 5) cease to exist globally in time and that there are no steady-states, while for λ below this critical value, solutions are global and there are at least two steady states. Moreover, if solutions do not exist globally, then the elastic plate pulls in at some finite time T c < ∞, i.e., [START_REF] Grunau | Positivity, change of sign and buckling eigenvalues in a one-dimensional fourth order model problem[END_REF] lim

t→T c min x∈I {u(t, x)} = -1 .
In the special situation of the so-called small aspect ratio model which corresponds to setting ε = 0 in (1)- [START_REF] Fattorini | Second Order Linear Differential Equations in Banach Spaces[END_REF], it turns out that the electrostatic potential ψ is explicitly given by ψ(t, x, z) = (1 + z)/(1 + u(t, x)) in Ω(u(t)) and the full system (1)-( 5) reduces to a singular evolution equation only involving u. In this case, a quite complete characterization of the expected dynamics -confirming almost all of these conjectures -is obtained in [START_REF] Guo | Revisiting the biharmonic equation modelling electrostatic actuation in lower dimensions[END_REF][START_REF] Laurenc | A fourth-order model for MEMS with clamped boundary conditions[END_REF], see also [START_REF] Guo | Dynamical solutions of singular wave equations modeling electrostatic MEMS[END_REF][START_REF] Lindsay | Multiple quenching solutions of a fourth order parabolic PDE with a singular nonlinearity modeling a MEMS capacitor[END_REF] for further information as well as [START_REF] Esposito | Mathematical Analysis of Partial Differential Equations Modeling Electrostatic MEMS[END_REF] and the references therein for the small aspect ratio model in general.

In contrast, due to the present coupling, the free boundary problem with ε > 0 turns out to be even more involved and the literature is far more sparse in this case. A series of recent papers, however, addresses these questions for the free boundary problem when γ = β = 0: see [START_REF] Laurenc | A stationary free boundary problem modeling electrostatic MEMS[END_REF] for steady-state solutions, [START_REF] Escher | A parabolic free boundary problem modeling electrostatic MEMS[END_REF] for the corresponding parabolic problem, and [START_REF] Escher | Dynamics of a free boundary problem with curvature modeling electrostatic MEMS[END_REF][START_REF] Escher | Finite time singularity in a free boundary problem modeling MEMS[END_REF] for a quasilinear version thereof. The fourth-order case β > 0 with γ ≥ 0 is investigated in [START_REF] Laurenc | A free boundary problem modeling electrostatic MEMS: I. Linear bending effects[END_REF] and we shall review its main results below (see also [START_REF] Laurenc | A free boundary problem modeling electrostatic MEMS: II. Nonlinear bending effects[END_REF] for a quasilinear version for β > 0 and γ = 0).

In all the just cited references on the free boundary problem, a very crucial ingredient in the analysis is the understanding of the elliptic problem (4)- [START_REF] Fattorini | Second Order Linear Differential Equations in Banach Spaces[END_REF] in the domain Ω(u) in dependence of a given (free) boundary described by a function u : [-1, 1] → (-1, ∞) for a fixed time t (being suppressed for the moment). In particular, precise information on the gradient trace of the potential ψ = ψ u on the elastic plate is required as a function of u. For this, one can transform the Laplace equation ( 4)- [START_REF] Fattorini | Second Order Linear Differential Equations in Banach Spaces[END_REF] for ψ u to an elliptic problem in the fixed rectangle I × (0, 1) (with coefficients depending on u and its x-derivatives up to second order and being singular in case that u approaches -1) for a transformed electrostatic potential φ u given by [START_REF] Guo | Dynamical solutions of singular wave equations modeling electrostatic MEMS[END_REF] φ u (x, η) := ψ u x, (1 + u(x))η -1 , (x, η) ∈ I × (0, 1) .

Using then elliptic regularity theory and pointwise multiplications in Sobolev spaces, the following key result can be shown [1, Proposition 5]:

Proposition 1.1. Given 2α ∈ (0, 1/2) and κ ∈ (0, 1) define an open subset of H 2+2α (I) by S α (κ) := v ∈ H 2+2α (I) ; v(±1) = ∂ x v(±1) = 0 , v H 2+2α (I) < 1/κ, and v(x) > -1 + κ for x ∈ I .
Then, for each u ∈ S α (κ), there is a unique solution ψ = ψ u ∈ H 2 (Ω(u)) to (4)-( 5) and

(8) ψ u H 2 (Ω(u)) ≤ C 0 (κ) , u ∈ S α (κ) , with (9) φ u 1 -φ u 2 H 2 (I×(0,1)) ≤ C 0 (κ) u 1 -u 2 H 2+2α (I) , u 1 , u 2 ∈ S α (κ) ,
for some positive constant C 0 (κ) depending on κ and also on α, β , τ, and ε, but not on u ∈ S α (κ). Moreover, the mapping

g : S α (κ) → H 2α (I) , u → ε 2 |∂ x ψ u (x, u(x))| 2 + |∂ z ψ u (x, u(x))| 2
is analytic, bounded, and uniformly Lipschitz continuous.

In fact, estimate (8) follows from [1, Lemma 6] while ( 9) is shown in [1, Eq. ( 38)]. Importantly, the minimal regularity required in order to control the potential ψ u in terms of suitable norms of u appears to be that the latter belongs to W 2 q (I) for some q > 2, whence necessarily 2α > 0 above (see [START_REF] Escher | A parabolic free boundary problem modeling electrostatic MEMS[END_REF]Proposition 5] for a more precise result). The regularity properties of the map g are stated in this form for simplicity but are still sufficient in the fourth-order case β > 0 considered in the following. As pointed out above, this case is investigated in [START_REF] Laurenc | A free boundary problem modeling electrostatic MEMS: I. Linear bending effects[END_REF]. In particular, existence and non-existence of steady states are derived in [START_REF] Laurenc | A free boundary problem modeling electrostatic MEMS: I. Linear bending effects[END_REF] in dependence of the voltage value λ . While the former is a rather immediate consequence of the implicit function theorem (once Proposition 1.1 is established), the latter is based on a nonlinear version of the eigenfunction method which involves a positive eigenfunction in H 4 (I) associated to a positive eigenvalue of the fourth-order operator β ∂ 4

x -τ∂ 2 x subject to clamped boundary conditions [START_REF] Grunau | Positivity, change of sign and buckling eigenvalues in a one-dimensional fourth order model problem[END_REF][START_REF] Laurenc | Sign-preserving property for some fourth-order elliptic operators in one dimension or in radial symmetry[END_REF][START_REF] Owen | Asymptotic first eigenvalue estimates for the biharmonic operator on a rectangle[END_REF]. The result reads [START_REF] Laurenc | A free boundary problem modeling electrostatic MEMS: I. Linear bending effects[END_REF]Theorem 1.7]:

Theorem 1.2 (Steady States).
(i) Existence: There is λ s > 0 such that for each λ ∈ (0, λ s ), there exists an asymptotically stable steady state

(U λ , Ψ λ ) to (1)-(5) with U λ ∈ H 4 (I) satisfying -1 < U λ < 0 in I and Ψ λ ∈ H 2 (Ω(U λ )).
(ii) Non-Existence: There is λ c ≥ λ s such that there is no (sufficiently smooth) steady state (u, ψ) to

(1)-( 5)

for λ > λ c .
Yet open problems are whether λ c = λ s and whether there is a second (unstable) steady state for λ < λ s as in the small aspect ratio model, see [START_REF] Guo | Revisiting the biharmonic equation modelling electrostatic actuation in lower dimensions[END_REF][START_REF] Laurenc | A fourth-order model for MEMS with clamped boundary conditions[END_REF].

In [START_REF] Laurenc | A free boundary problem modeling electrostatic MEMS: I. Linear bending effects[END_REF] also the well-posedness of the dynamical problem is addressed. Due to Proposition 1.1 one may write (1)-( 5) as a single semilinear Cauchy problem for the plate displacement u (and its time derivative) that one can then solve by means of semigroup theory. We recall here the main statements from [13, Propositions 3.1 & 3.2, Corollaries 5.7 & 5.10] and indicate an explicit dependence on the parameter γ for future purposes: 1 (±1) = 0 and such that u 0 > -1 in I. Then the following hold:

Theorem 1.3 (Well-Posedness). Let γ ≥ 0 and 2α ∈ (0, 1/2). Consider an initial condition (u 0 , u 1 ) in H 4+2α (I) × H 2+2α (I) satisfying u 0 (±1) = ∂ x u 0 (±1) = u 1 (±1) = ∂ x u
(i) Local Existence: For each λ > 0, there is a unique solution (u γ , ψ γ ) to (1)-( 5) on the maximal interval of existence [0, T γ ) in the sense that 5) obeys the following criterion for global existence: if for each T > 0 there is κ(T ) ∈ (0, 1) such that

u γ ∈ C [0, T γ ), H 2+2α (I) ∩C 1 [0, T γ ), H 2α (I) if γ > 0 , u 0 ∈ C [0, T γ ), H 4 (I) ∩C 1 [0, T γ ), L 2 (I) if γ = 0 , with ∂ k t u γ ∈ L 1 (0, T ), H 4+2α-2k (I) , k = 0, 1, 2 , T ∈ (0, T γ ) , γ > 0 , satisfies (1)-(3) together with u γ (t, x) > -1 , (t, x) ∈ [0, T γ ) × I , while ψ u γ (t) ∈ H 2 Ω(u γ (t)) solves (4)-(5) in Ω(u γ (t)) for each t ∈ [0, T γ ). (ii) Touchdown: There is γ 1 > 0 such that, if γ ∈ [0, γ 1 ], then the solution (u γ , ψ γ ) to (1)-(
u γ (t) ≥ -1 + κ(T ) in I for t ∈ [0, T γ ) ∩ [0, T ], then T γ = ∞.
(iii) Global Existence: Given κ ∈ (0, 1), there are numbers λ * = λ * (γ, κ) > 0 and

N * = N * (γ, κ) > 0 such that T γ = ∞ provided that (u 0 , u 1 ) H 4+2α (I)×H 2+2α (I) ≤ N * , u 0 ≥ -1 + κ in I , and λ ≤ λ * . In this case, u γ ∈ L ∞ (0, ∞), H 2+2α (I) with inf (t,x)∈[0,∞)×I u γ (t, x) > -1 .
Actually, in case of the damping dominated limit γ = 0, less regularity on the initial data is required while more regularity on the solution (u 0 , ψ 0 ) may be obtained, see [START_REF] Laurenc | A free boundary problem modeling electrostatic MEMS: I. Linear bending effects[END_REF]Propositions 3.1 & 3.6] for details. The global existence result for small λ values stated in part (iii) of the above theorem is based on the exponential decay of the associated semigroup which stems from the damping term. This fact will be exploited further in Section 2. Note that for small voltage values λ , touchdown is impossible, even in infinite time. An interesting, but still lacking salient feature of the physical model is a relation between λ c ≥ λ s from Theorem 1.2 and (an optimally chosen) λ * .

The probably most important contribution to be brought forward by Theorem 1.3 is the global existence criterion stated in part (ii) which implies that touchdown is the only singularity preventing global existence. This is in clear contrast to the second-order case β = 0 considered in [START_REF] Escher | A parabolic free boundary problem modeling electrostatic MEMS[END_REF][START_REF] Escher | Dynamics of a free boundary problem with curvature modeling electrostatic MEMS[END_REF][START_REF] Escher | Finite time singularity in a free boundary problem modeling MEMS[END_REF], where -in principle -a finite existence time T γ may also be due to a blowup of some Sobolev norm of u γ (t, •) as t → T γ . Roughly speaking, this physically most relevant feature is achieved by fully exploiting the additional information coming from the fourth-order term as well as the underlying gradient flow structure of ( 1)-( 5), the latter seeming to have been unnoticed so far though being inherent in the model derivation. Indeed, introducing the total energy

E (u γ ) := E m (u γ ) -λ E e (u γ ) involving the mechanical energy E m (u γ ) := β 2 ∂ 2 x u γ 2 L 2 (I) + τ 2 ∂ x u γ 2 L 2 (I)
and the electrostatic energy

(10) E e (u γ ) := Ω(u γ ) ε 2 |∂ x ψ u γ (x, z)| 2 + |∂ z ψ u γ (x, z)| 2 d(x, z) ,
the following energy equality holds [13, Propositions 1.3 & 1.6]:

Proposition 1.4 (Energy Equality). Under the assumptions of Theorem 1.3 (i),

(11) E (u γ (t)) + γ 2 2 ∂ t u γ (t) 2 L 2 (I) + t 0 ∂ t u γ (s) 2 L 2 (I) ds = E (u 0 ) + γ 2 2 u 1 2 L 2 (I) for t ∈ [0, T γ ).
Note, however, that the energy E is the sum of terms with different signs and is thus not coercive. The main difficulty in the proof of Proposition 1.4 is the computation of the derivative of E e (u γ ) with respect to u γ since its dependence on u γ is somehow implicit and involves the domain Ω(u γ ). Nevertheless, the derivative can be interpreted as the shape derivative of the Dirichlet integral of ψ γ = ψ u γ , which can be computed and shown to be equal to the right hand side of (1) -except for the sign -by shape optimization arguments [START_REF] Laurenc | A free boundary problem modeling electrostatic MEMS: I. Linear bending effects[END_REF]. An additional difficulty stems from the fact that the time regularity of u γ as stated in part (i) of Theorem 1.3 is not sufficient for a direct computation and one rather has to use an approximation argument.

To prove then the significant criterion for global existence from part (ii) of Theorem 1.3, one may proceed as follows: As long as u γ (t, •) stays away from -1, one may control the electrostatic energy E e (u γ (t)) by the mechanical energy E m (u γ (t)) and then derives from the time decrease of E (u γ (t)) implied by Proposition 1.4 first a bound on the H 2 (I)norm of u γ (t) and subsequently also on higher Sobolev norms by a bootstrapping argument which yields global existence.

1.2. The Time Singular Limit. In many research papers -mostly dedicated to the small aspect ratio model with ε = 0 -inertial effects are neglected from the outset as damping effects may be predominant, a few exceptions being [START_REF] Guo | Dynamical solutions of singular wave equations modeling electrostatic MEMS[END_REF][START_REF] Kavallaris | A hyperbolic non-local problem modelling MEMS technology[END_REF]. In this note we now shall investigate the behavior of the solutions in the damping dominated limit γ 2 → 0. Obviously, considering such a time singular limit from a mathematical point of view requires in particular a common interval of existence, independent of γ, that is, a lower bound on the maximal existence time T γ . This is provided by the first result of this paper: Proposition 1.5 (Minimal Existence Time). Let 2α ∈ (0, 1/2), γ ∈ (0, γ 1 ], λ > 0. Consider an initial condition (u 0 , u 1 ) ∈ H 4+2α (I) × H 2+2α (I) such that u 0 ∈ S α (κ) for some κ ∈ (0, 1) and u 1 (±1) = ∂ x u 1 (±1) = 0. Let (u γ , ψ γ ) be the unique solution to (1)-( 5) defined on the maximal interval of existence [0, T γ ). There are

γ := γ κ, γ 1 , u 1 H 2α D (I) ∈ (0, γ 1 ], N := N(κ, γ 1 ) > 0, and Λ := Λ(κ, γ 1 ) > 0 such that: (i) There is T := T λ , κ, γ 1 , u 0 H 4+2α (I) ∈ (0, ∞) such that, for all γ ∈ (0, γ), T γ > T and u γ (t) ∈ S α (κ/2) for t ∈ [0, T ].
(ii) If λ ∈ (0, Λ) and u 0 H 4+2α (I) ≤ N, then T γ = ∞ and u γ (t) ∈ S α (κ/2) for t ≥ 0 and γ ∈ (0, γ). The proof of this proposition is given in Section 2. It relies on an exponential decay of the energy associated to the damped wave equation being independent of γ ∈ [0, γ 1 ].

As a consequence we are in a position to investigate the damping dominated limit and prove that (u γ , ψ γ ) converges toward (u 0 , ψ 0 ) in a suitable sense as γ 2 → 0. Theorem 1.6 (Damping Dominated Limit). Under the assumptions of Proposition 1.5 (i) and as γ 2 -→ 0, [START_REF] Laurenc | A stationary free boundary problem modeling electrostatic MEMS[END_REF]

u γ -→ u 0 in C [0, T ], H 2+2ξ (I)
for each ξ ∈ (0, α) and

(13) φ u γ -→ φ u 0 in C [0, T ], H 2 (I × (0, 1)) ,
where φ u γ is the transformed electrostatic potential given by (7) (with u replaced by u γ ). In addition, if u 0 = u 1 = 0, then

(14) ∂ t u γ -→ ∂ t u 0 in L p 0, T ; H 2α (I)
for each p ∈ (1, ∞). Under the assumptions of Proposition 1.5 (ii), statements (12)-( 14) are true for each T > 0 instead of T .

The proof of Theorem 1.6 is performed in Section 3. It is based on compactness properties of (u γ , ψ γ ) γ∈(0,γ 1 ) being provided by the energy functional E .

A LOWER BOUND ON THE MAXIMAL EXISTENCE TIME

In order to prove Proposition 1.5, we consider an initial condition (u 0 , u 1 ) belonging to H 4+2α D (I) × H 2+2α D (I) and such that u 0 ∈ S α (κ) for some κ ∈ (0, 1) and 2α ∈ (0, 1/2), where

H θ D (I) :=            v ∈ H θ (I) ; v(±1) = ∂ x v(±1) = 0 , θ > 3 2 , v ∈ H θ (I) ; v(±1) = 0 , 1 2 < θ < 3 2 , H θ (I) , θ < 1 2 .
We fix γ ∈ (0, γ 1 ] with γ 1 > 0 introduced in Theorem 1.3 (ii) and let (u γ , ψ γ ) with

u γ ∈ C [0, T γ ), H 2+2α D (I) ∩C 1 [0, T γ ), H 2α D (I) and ∂ k t u γ ∈ L 1 (0, T ), H 4+2α-2k D (I) , k = 0, 1, 2 , T ∈ (0, T γ ) ,
be the unique solution to (1)-( 5) on the maximal interval of existence [0, T γ ) as provided by Theorem 1.3. Then, introducing the operator

A α := β ∂ 4 x -τ∂ 2 x ∈ L H 4+2α D (I), H 2α D (I) we have γ 2 d 2 dt 2 u γ + d dt u γ + A α u γ = -λ g(u γ ) , t ∈ (0, T γ ) ,
in H 2α D (I), the function g being defined in Proposition 1.1. We want to control a suitable norm of u γ (t) for which we basically use an idea from [9, Section 2], the difference mainly being the focus on estimates which are uniform with respect to γ ∈ (0, γ 1 ]. To this end, define v(t) := u γ (t)u 0 and f (t

) := -λ g(u γ (t)) -A α u 0 for t ∈ [0, T γ ). Then v solves the equation (15) γ 2 d 2 dt 2 v + d dt v + A α v = f , t ∈ (0, T γ ) , in H 2α D (I) with initial condition (v(0), ∂ t v(0)) = (0, u 1 ). Recall that there are real numbers c 2 ≥ c 1 ≥ c 0 ≥ 1 such that (16) z 2 H 2α D (I) ≤ c 0 z 2 H 2+2α D (I) ≤ c 1 A 1/2 α z 2 H 2α D (I) ≤ c 2 z 2 H 2+2α D (I)
for all z ∈ H 2+2α D (I). Then, defining

E(t) := A 1/2 α v(t) 2 H 2α D (I) + γ 2 ∂ t v(t) 2 H 2α D (I) , t ∈ (0, T γ ) , and
F(t) := γ v(t) , ∂ t v(t) H 2α D (I)
, t ∈ (0, T γ ) , we deduce from ( 15), [START_REF] Laurenc | A fourth-order model for MEMS with clamped boundary conditions[END_REF], and the self-adjointness of

A 1/2 α in H 2α D (I) that (17) d dt E(t) = -2 ∂ t v(t) 2 H 2α D (I) + 2 f (t) , ∂ t v(t) H 2α D (I)
and ( 18) 16)-( 18) and Young's inequality,

|F(t)| ≤ c 1 2 E(t) for a. e. t ∈ (0, T γ ). Next, let b := min 2 2γ 2 1 + c 1 + 1 , 1 2c 1 , 1 γ 1 c 1 and introduce G(t) := E(t) + bγF(t) for t ∈ (0, T γ ). According to (
d dt G(t) = -2 + bγ 2 ∂ t v(t) 2 H 2α D (I) -b v(t) , ∂ t v(t) + A α v(t) -f (t) H 2α D (I) + 2 f (t) , ∂ t v(t) H 2α D (I) ≤ -2 + bγ 2 ∂ t v(t) 2 H 2α D (I) -b A 1/2 α v(t) 2 H 2α D (I) + b 1 4c 1 v(t) 2 H 2α D (I) + c 1 ∂ t v(t) 2 H 2α D (I) + b 2 2 v(t) 2 H 2α D (I) + 1 2 f (t) 2 H 2α D (I) + b ∂ t v(t) 2 H 2α D (I) + 1 b f (t) 2 H 2α D (I) ≤ -2 + bγ 2 + bc 1 + b ∂ t v(t) 2 H 2α D (I) - b 2 A 1/2 α v(t) 2 H 2α D (I) + b 2 1 2c 1 + b v(t) 2 H 2α D (I) -A 1/2 α v(t) 2 H 2α D (I) + 1 2 + 1 b f (t) 2 H 2α D (I)
for a. e. t ∈ (0, T γ ). Since the choice of b ensures that

1 2c 1 + b ≤ 1 c 1 and -2 + b(γ 2 + c 1 + 1) ≤ -bγ 2 ,
the third term in the right hand side is non-positive by [START_REF] Laurenc | A fourth-order model for MEMS with clamped boundary conditions[END_REF] and we obtain d dt

G(t) ≤ - b 2 E(t) + b + 2 2b f (t) 2 H 2α D (I)
for a.e. t ∈ (0, T γ ) .

Observe that [START_REF] Owen | Asymptotic first eigenvalue estimates for the biharmonic operator on a rectangle[END_REF] and the choice of b also ensure 1 2

E(t) ≤ 1 - c 1 bγ 2 E(t) ≤ G(t) ≤ 1 + c 1 bγ 2 E(t) ≤ 1 + c 1 bγ 1 2 E(t) for t ∈ (0, T γ ), whence d dt G(t) ≤ - b 2 + c 1 bγ 1 G(t) + b + 2 2b f (t) 2 H 2α D (I) for a.e. t ∈ (0, T γ ) . Consequently, setting ω := b/(2 + c 1 bγ 1 ), E(t) ≤ 2G(t) ≤ b ω e -ωt E(0) + b + 2 bω 1 -e -ωt sup s∈(0,t) f (s) 2 H 2α D (I)
for t ∈ (0, T γ ). Now, owing to ( 16) and the definitions of E(t) and f (t), there is a constant

M := M(γ 1 ) > 0 such that u γ (t) -u 0 2 H 2+2α D (I) ≤ Mγ 2 u 1 2 H 2α D (I) + M 1 -e -ωt λ 2 sup s∈(0,t) g(u γ (s)) 2 H 2α D (I) + u 0 2 H 4+2α D (I)
for t ∈ (0, T γ ). Since u 0 belongs to S α (κ), it follows from its time continuity in H 2+2α

u γ (t) -u 0 2 H 2+2α D (I) ≤ Mγ 2 u 1 2 H 2α D (I) + M λ 2 c 3 (κ) 2 + u 0 2 H 4+2α D (I) 1 -e -ωt
for t ∈ [0, Tγ ). Therefore, since u 0 ∈ S α (κ) and since H 2+2α D (I) embeds continuously in L ∞ (I) with constant, say, c 4 ≥ 1, the previous inequality ensures that

u γ (t) H 2+2α D (I) ≤ u γ (t) -u 0 H 2+2α D (I) + u 0 H 2+2α D (I) < 2 κ as soon as Mγ 2 u 1 2 H 2α D (I) + M λ 2 c 3 (κ) 2 + u 0 2 H 4+2α D (I) 1 -e -ωt < 1 κ 2 and u γ (t) ≥ u 0 -u γ (t) -u 0 L ∞ (I) ≥ κ -1 -c 4 u γ (t) -u 0 H 2+2α D (I) > κ 2 -1
as soon as

Mγ 2 u 1 2 H 2α D (I) + M λ 2 c 3 (κ) 2 + u 0 2 H 4+2α D (I) 1 -e -ωt < κ 2 4c 2 4 .
Thus, since κ 2 /(4c 2 4 ) ≤ 1 ≤ 1/κ 2 , we deduce from the above analysis that u γ (t) belongs to S α (κ/2) provided t ∈ [0, Tγ ) and γ ∈ (0, γ 1 ] satisfy [START_REF] Pelesko | Modeling MEMS and NEMS[END_REF] γ 2 u 1 2

H 2α D (I) < κ 2 8Mc 2 4 and (20)
λ 2 c 3 (κ) 2 + u 0 2 H 4+2α D (I) 1 -e -ωt < κ 2 8Mc 2 4 .
Therefore, there are γ := γ κ, γ 1 , u 1 H 2α D (I) ∈ (0, γ 1 ) and T := T λ , κ, γ, u 0

H 4+2α D (I) > 0 such that u γ (t) ∈ S α (κ/2) for t ∈ [0, Tγ ) ∩ [0, T ] and γ ∈ (0, γ)
Recalling the definition of Tγ , the previous statement implies in particular that Tγ ≥ T . Finally, owing to the positivity of ω, it is clear that if one requires that

λ 2 c 3 (κ) 2 + u 0 2 H 4+2α D (I) < κ 2 8Mc 2 4
instead of [START_REF] Simon | Compact sets in the space L p (0, T ; B)[END_REF], there are Λ := Λ(κ, γ 1 ) > 0 and N := N(κ, γ 1 ) > 0 such that u γ (t) belongs to S α (κ/2) for all t ∈ [0, T γ ) and γ ∈ (0, γ) provided that λ ∈ (0, Λ) and u 0 H 4+2α D (I) ≤ N, whence T γ = ∞ by Theorem 1.3 (ii). This proves Proposition 1.5.

THE TIME SINGULAR LIMIT γ 2 -→ 0

In order to prove Theorem 1.6 we stick to the notation from the previous section. Recall that

(21) u γ (t) ∈ S α (κ/2) , t ∈ [0, T ] , γ ∈ (0, γ) .
It then follows from (8) that

ψ u γ (t) H 2 (Ω(u γ (t))) ≤ C 0 (κ) , t ∈ [0, T ] , γ ∈ (0, γ) .
This gives a uniform bound on the electrostatic energy E e (u γ (t)) defined in [START_REF] Kavallaris | A hyperbolic non-local problem modelling MEMS technology[END_REF] so that (11) implies

(22) γ 2 2 u γ (t) 2 L 2 (I) + t 0 ∂ t u γ (s) 2 L 2 (I) ds ≤ c(κ) , t ∈ [0, T ] , γ ∈ (0, γ) .
Now, let ξ ∈ (0, α). Owing to (21) and ( 22), the set {u γ ; γ ∈ (0, γ)} is bounded in L ∞ (0, T ; H 2+2ξ (I)) with {∂ t u γ (t) ; γ ∈ (0, γ)} bounded in L 2 (0, T ) × I . We then infer from the compactness of the embedding of H 2+2ξ (I) in H 2+2α (I) and [START_REF] Simon | Compact sets in the space L p (0, T ; B)[END_REF]Corollary 4] that there are subsequence of γ 2 -→ 0 (not relabeled) and ū0 in C [0, T ], H Clearly, ū0 (t) ∈ S α (κ/4) for t ∈ [0, T ] by ( 21) and ( 23). The latter and (9) also imply φ u γ (t) -φ ū0 (t) H 2 (I×(0,1)) ≤ C 0 (κ/4) u γ (t) -ū0 (t) H 2+2ξ (I)

for t ∈ [0, T ] and γ ∈ (0, γ). Consequently, Theorem 1.6 follows if we can show that ū0 and u 0 coincide. To this end recall that the function g : S(κ/4) → H 2α D (I), defined in Proposition 1.1, is uniformly Lipschitz continuous. In particular, from (23) we deduce that for each p ∈ (1, ∞), Since the above Cauchy problem has a unique solution according to Theorem 1.3, namely u 0 (restricted to [0, T ]), we conclude that ū0 = u 0 and since this limit is independent of the subsequence γ 2 -→ 0, Theo- rem 1.6 is proven.

FIGURE 1 .

 1 FIGURE 1. Sketch of an idealized electrostatic MEMS device.

D

  (I) and the continuous embedding of H 2+2αD (I) in L ∞ (I) that Tγ := sup t 0 ∈ (0, T γ ) ; u γ (t) ∈ S α (κ/2) for all t ∈ [0,t 0 ) > 0 .Then, by Proposition 1.1,g(u γ (t)) H 2α D (I) ≤ c 3 (κ) := sup w∈S α (κ/2) g(w) H 2α D (I) , t ∈ [0, Tγ ) ,and we conclude that

  u γ -→ ū0 in C [0, T ], H 2+2ξ D (I) .

  (24) g(u γ ) -→ g 0 := g( ū0 ) in L p 0, T ; H 2α D (I) . Thus, if v γ denotes the solution to the linear Cauchy problemγ 2 d 2 dt 2 v + d dt v + A α v = -λ g(u γ ) , t ∈ [0, T ] , subject to zero initial conditions v(0) = γ 2 ∂ t v(0) = 0 ,for γ ∈ (0, γ) (with v 0 denoting accordingly the solution with γ = 0), it follows from (24), the fact that -A α generates a strongly continuous cosine family in H 2α D (I) as pointed out in [13, Section 3.2], and [5, VI.Theorem 7.6] that(25) v γ -→ v 0 in C [0, T ], H 2α D (I) , ∂ t v γ -→ ∂ t v 0 in L p 0, T ; H 2α D (I). On the other hand, if w γ denotes the solution to the homogeneous Cauchy problemγ 2 d 2 dt 2 w + d dt w + A α w = 0 , t > 0 , subject to the initial conditions w(0) = u 0 , γ 2 ∂ t w(0) = γ 2 u 1 ,for γ ∈ (0, γ) (with w 0 denoting accordingly the solution with γ = 0), then(26) w γ -→ w 0 in C [0, T ], H 2α D (I) owing to[START_REF] Kisyński | Sur les équations hyperboliques avec petit paramètre[END_REF] Theorem 3.2]. Clearly, by uniqueness of solutions to linear wave equations, we have u γ = v γ + w γ , and consequently, from (23), (25), and (26) we derive that ū0 = v 0 + w 0 solves d dt ū0 + A α ū0 = -λ g( ū0 ) , t ∈ (0, T ] , ū0 (0) = u 0 .