Marie Bossard

Prof Karine Weiss

Prof Gilles Dusserre

Do hospital workers feel they are ready to manage a sanitary crisis in a pre-crisis context?

Keywords: Sanitary crisis, Disaster preparedness, Hospital workers, Readiness perception

Objective: Measure the perception of readiness to manage a sanitary crisis for hospital workers and to study the factors related to this perception. Methods: This study is a cross-sectional study, 408 French hospital workers responded to an online questionnaire. The variables studied concerned the perceived personal preparedness, the perception of colleagues' and hospital's preparedness, perception of the situation and preparatory behavioral acts. Correlations, partial correlations, and multiple linear regressions were applied. Results: Based on Pearson's correlations, the higher the participants' sense of personal efficacy and control over their behavior, the more ready they feel (r p =.77*** and r p =.55***). The more participants perceive their colleagues as ready and their hospital as prepared, the more ready they feel (r p =.52*** and r p =.46***). Based on Pearson's partial correlations, upon controlling the effect of preparedness perception, declared preparedness, is not significantly correlated with personal readiness perception (r p =.01).

Conclusion:

The perception of personal readiness does not depend only on actual preparedness but also on individual and collective variables. Technically, these results confirm the value of relying on psychosocial variables during training. It would be interesting to propose empowerment in training courses. It also seems necessary to demonstrate crisis management efficacy at different levels: institutional, collective, and individual.

INTRODUCTION

Recent examples highlight the risk of occurrence of a sanitary crisis, such as COVID-19 (CoronaVirus Disease appeared in 2019) pandemic. Climate change increases the risk of these crises, with emerging diseases associated with the warmer climate, which favors the transmission of pathogens and the multiplication of disasters, such as floods or heatwaves. [START_REF] Bein | Climate change, global warming, and intensive care[END_REF] Our societies will likely face some sanitary crises in the coming years. The severity of a sanitary crisis depends not only on its intrinsic intensity, but also on the vulnerability of the exposed society. [START_REF] Zaninetti | Catastrophes et adaptation sur le littoral du Mississippi[END_REF] To lessen the impact of these crises, organizational response is essential. Hospitals are a front-line service, the first refuge during sanitary crises. [START_REF] Barbarin-Costes | L'hôpital face à une situation sanitaire exceptionnelle à caractère biologique[END_REF] The processes to prepare and manage these crises require efficiency that depends not only on a protocol and its strict adherence, but also on the way in which it is implemented by professionals. [START_REF] Combalbert | L'agilité des organisations dans la gestion des crises[END_REF][START_REF]A Science Plan for Integrated Research on Disaster Risk: Addressing the Challenge of Natural and Human-Induced Environ-Mental Hazards[END_REF] For organizations and professionals, preparedness is essential to optimize the management of sanitary crisis.

Scientific literature has recently focused on assessing the preparedness of hospital workers for sanitary crises. [START_REF] Gowing | Disaster Preparedness among Health Professionals and Support Staff: What is Effective? An Integrative Literature Review[END_REF][START_REF] Labrague | Disaster preparedness among nurses: a systematic review of literature[END_REF] Research is mainly focused on declared preparedness. The psychosocial factors affecting preparedness are studied in the general population. [START_REF] Mishra | Psychology of Disaster Preparedness[END_REF] There is a lack of information on the psychosocial evaluation of hospital workers' preparedness for sanitary crises.

1.1.

FACTORS INFLUENCING PERCEIVED PREPAREDNESS

According to the literature concerning the general public, many factors influence preparatory behaviors. Risk perception is a key precursor variable in the literature on public education on natural disaster risk. [START_REF] Burns | Risk Perception and Behaviors: Anticipating and Responding to Crises[END_REF][START_REF] Espina | A Social Cognitive Approach to Disaster Preparedness[END_REF] Risk perception can be defined as the assessment of a risk, its probability and consequences. [START_REF] Kouabenan | Chapitre 2. Percevoir et évaluer les risques : les apports de la psychologie en matière de traitement des informations[END_REF] This assessment is a subjective construction of risk, influenced by psychosocial variables. Therefore, a subjective dimension of risk perception needs to be added. The three most important variables in risk perception are perceived severity, perceived frequency and reported fear. [START_REF] Peretti-Watel | Sociologie Du Risque[END_REF] Age and gender have an effect on adopting preparatory behaviors in the general population. 13- 15 The influence of perceived self-efficacy on adoption of protective behavior against natural disasters has been highlighted. [START_REF] Mishra | Psychology of Disaster Preparedness[END_REF][START_REF] Lindell | Correlates of Household Seismic Hazard Adjustment Adoption[END_REF][START_REF] Paton | Disaster preparedness: a social-cognitive perspective[END_REF] Self-efficacy is defined by the belief that individuals can act in a variety of situations. Thus, it is not limited to the sum of the skills that individuals possess. [START_REF] Bandura | Self Efficacity[END_REF] This study tends to highlight the effect of variables that have not been assessed in recent literature. This study suggests that personal and professional involvement influences preparedness. The concept of personal and professional involvement was proposed by Rouquette in 1997. Personal involvement refers to the relationship an individual has with an object of social representation. [START_REF] Rouquette | La Chasse à l'immigré: Violence, Mémoire et Représentations[END_REF] Social representations are defined as "a form of knowledge, socially developed and shared, having a practical aim and contributing to the construction of a reality common to a social whole". [START_REF] Jodelet | Représentations Sociales[END_REF] The relationships between an individual and an object are based on three dimensions: the identification of the object ("I feel concerned"), the evaluation of the object (the perceived importance) and the perceived capacity for action (believing that the individual can him/herself act on this object). [START_REF] Rouquette | La Chasse à l'immigré: Violence, Mémoire et Représentations[END_REF] For collective risks, the perceived capacity for professional action is added (believing that the individual can act on this object as a professional). [START_REF] Ernst-Vintila | La crise financière de 2008 : menace collective ou défi individuel ? Une analyse de la pensée sociale mobilisée en situation de crise[END_REF] Diffusion of responsibility might influence the personal readiness perception. Diffusion of responsibility is a process of group influence; leading an individual to a loss of personal responsibility due to the social presence of others. It has been shown that in an emergency, this process can influence individuals not to act. [START_REF] Darley | Bystander intervention in emergencies: Diffusion of responsibility[END_REF] Finally, for hospital workers, the perceived colleague preparedness and perceived hospital preparedness might influence the concept of overall readiness perception.

1.2.

PERCEPTION OF PREPAREDNESS, READINESS PERCEPTION AND DECLARED PREPAREDNESS

A differentiation must be made between the perception of preparedness, the readiness perception, and the declared preparedness. The perception of preparedness refers to the feeling of being sufficiently prepared to manage a sanitary crisis. The readiness perception refers to the belief in the capacity to manage the sanitary crisis. Thus, people may believe that they can manage the crisis but at the same time, think that they are not well enough prepared. The contrary is also possible: one can feel sufficiently prepared, but nevertheless not believe he/she can manage the crisis. These notions are linked, but they refer to different beliefs. Declared preparedness refers to declaring that one has had preparatory behavior. Individuals may report having participated in preparedness training, but they do not feel sufficiently prepared or ready to manage a crisis. These definitions have been set up from a previous study (unpublished) from 43 interviews conducted with hospital workers from all over France from January 2019 to July 2019 on sanitary crises preparedness.

AIM OF THIS STUDY

The objective of this study is to measure the hospital workers readiness perception and variables related to this perception. Answers to the following questions were sought in this study: Do hospital workers feel they are ready to manage sanitary crises in a pre-crisis context? What factors influence this readiness perception?

Given the exploratory nature of the study, the hypotheses are general :

(H1) Readiness perception is linked to perceived personal preparedness.

(H2) Readiness perception is linked to risk perception and personal involvement.

(H3) Readiness perception is linked to perception of preparatory behavior.

(H4) Readiness perception is linked to preparedness perception of colleagues and hospital.

METHODS

STUDY SETTING, DESIGN, AND SAMPLE

This study is a cross-sectional study. Participant inclusion criteria is that the participants must reside in France and practice their profession, whatever it may be, within a hospital. In France, 1.24 million employees were working in a hospital in 2015. [START_REF] Holcman | Les composantes du personnel hospitalier In: Holcman R, ed. Management hospitalier[END_REF] Based on this figure, with a 5% margin of error and 95% confidence level, the required sample size is 385 participants. 68 hospitals, 13 regional health agencies and groups of caregivers on social networks were contacted. The distribution method called "snowballing" was used to circulate an online questionnaire carried out using the Qualtrics© online survey and analyses platform. For this method, participants share to new contacts and these share to new contacts and so on. [START_REF] Vogt | Dictionary of Statistics & Methodology: A Nontechnical Guide for the Social Sciences[END_REF] The software prevents participants from answering the questionnaire more than once using their IP address. After getting information about the study, all the participants gave their written declaration of consent before answering the questionnaire. The data is confidential and anonymous. Ethical approval was not deemed necessary since this was a voluntary survey without disclosure of any personal identifiable or protected health information. We have no agreement with the participants' employers. This was made clear to the participants before starting the questionnaire. The questionnaire was released from 14th to 20 th March 2020. The evolution of COVID-19 crisis was uncertain but the international context as well as forecasts suggested that hospital workers would have to manage a sanitary crisis. The questionnaire was sent before the overflow from hospital. [START_REF] Mishra | Psychology of Disaster Preparedness[END_REF] . The questionnaire was pre-tested by 5 people to ensure that the items were well understood.

The questionnaire contains 63 items including 17 items concerning the characterization of the hospital population in the form Boolean open-ended or multiple-choice questions. The variables are the experience of one or more sanitary crises, age, gender, profession, hospital department specialty, work experience, city and department of the hospital. The questionnaire includes 46 items about the supposed predictors of readiness perception. These items are put forward in a linear numeric response format, with statements followed by response scales ranging from 0 (I strongly disagree) to 10 (I strongly agree). Some items with satisfactory Cronbach's alpha scores are grouped into scales. These scores are presented in the following paragraph. The other variables mentioned are assessed by only one item. The variables are divided into four categories:

a. Personal preparedness: perceived personal readiness (general perception of readiness, the perception of readiness for a sudden situation and the perception of readiness for an anticipated situation (α=.91)), perceived personal preparedness (general perception of preparedness, knowledge and skills (α=.83)), self-efficacy and declared effective preparedness. For these last variables, Boolean questions (yes/no) are used: participation in simulation exercises, participation in specialized training, participation in feedback from previous sanitary crises, reading the emergency plan and requesting information from sanitary crisis referents are tested. b. Risk perception and personal involvement: Perceived likelihood of occurrence, perceived severity, perceived fear, identification, and evaluation for the object, perceived personal and professional capacity for action. c. Perception of preparatory behavior: effectiveness of individual preparedness, effectiveness of collective preparedness, effectiveness of procedures, behavioral control (perception of "can do" actions to prepare and perception to be able to prepare (α=.79)), injunctive norm from colleagues, injunctive norm from society, affective attitude (perception of preparedness as pleasurable and distracting (α=.82)), cognitive attitude (perception of preparedness as helpful and prudent (α=.92)), difficulty attitude (perception of preparedness as difficult and requiring effort (α=.78)) and behavioral intention (intention to prepare in the future and in the coming months (α=.79)). d. Perception of the colleagues' preparedness and the hospital's preparedness:

perceived preparedness of colleagues (on hospital service and out of hospital service (α=.90)), perceived readiness of colleagues (on hospital service and out of hospital service (α=.93)), perceived hospital preparedness (material and human resources (α=.84)), perceived hospital readiness and diffusion of responsibility.

DATA ANALYSES

The data was analyzed using SPSS© (Statistical Package for the Social Sciences) software. To determine the significance of the tests employed, we used the p-value. A test result with a pvalue of less than 0.05 is considered significant. First, descriptive analyses allowed to observe the data were carried out. Then analyses of variance (ANOVA) was conducted to explore the

MEASUREMENT TOOLS

To our knowledge, there is no validated questionnaire that could have been applied in this context. Therefore, the measurement tool is a developed one. The questionnaire was inspired by the results of interviews conducted previously and by literature on personal and professional involvement [START_REF] Ernst-Vintila | La crise financière de 2008 : menace collective ou défi individuel ? Une analyse de la pensée sociale mobilisée en situation de crise[END_REF] , risk perception [START_REF] Peretti-Watel | Sociologie Du Risque[END_REF] , the theory of planned behaviour [START_REF] Francis | Constructing Questionnaires Based on the Theory of Planned Behaviour: A Manual for Health Services Researchers[END_REF] and disaster preparedness

3.3.

VARIABLES LINKED TO THE READINESS PERCEPTION 3.3.1. ANALYSES OF VARIANCE

Differences of personal readiness perception according to sociodemographic and experience factors are tested with analyses of variance followed by Bonferroni correction. Results are presented in the subsequent table (cf. Table 1).

links between perceived readiness perception and categorial variables. Then, for variables with more than two categories, the differences in averages with each category pair tested by applying the Bonferroni correction. Then, Pearson's correlations between the variables according to the hypotheses and personal readiness perception were carried out. We then performed Pearson's partial correlations to control the effect of variables on the simple correlations. According to Cohen, the strength of effect sizes of correlation coefficients of .10 are small, those of .30 are medium, and those of .50 are large. [START_REF] Cohen | Statistical Power Analysis for the Behavioral Sciences[END_REF] Therefore, multiple linear regressions were conducted with variables having a correlation coefficient (r p ) greater than .30 and which retained a significant correlation (with a p value lower than at least 0.05), despite the control of other variables to determine the strongest predictors in the quantitative variables.

Items about declared preparedness (previously cited) were added together to make a score ranging from 0 to 5. Concerning diffusion of responsibility, 4 items are put forward to estimate the importance of the role of 4 categories of professions (paramedical, health managers, physicians and administrative). The average differences between the importance of the estimated role of their own category and the other categories are calculated.

RESULTS

PARTICIPANTS

The sample includes 408 hospital workers. This is appropriate for the sample size required by our method. The sample includes 88.2% of women with an average age of 36.8 years (SD (Standard Deviation)=10.4). The sample is composed of 8 physicians, 38 health managers (A health manager is a hospital worker, exercising in the paramedical field who supervises and manages a team), 344 paramedics, 9 administrative and directing workers. 18.5% of the participants are undergraduates and 81.5% are postgraduates. Concerning experience, 35% of participants have worked for less than 5 years, 22.3% have worked between 5 and 10 years, 13.5% have worked between 10 and 15 years, 29.2% for more than 15 years and 29.9% of the participants have a prior experience of sanitary crises.

MEAN READINESS PERCEPTION

On a scale from 0 to 5, participants present an average score of declared preparedness (M (Mean)=2. There are no significant mean differences between the scores of personal readiness perception according to gender. However, the other differences in means according to other sociodemographic variables and experience are significant (cf. Table 1).

CORRELATIONS

Correlations between the personal readiness perception and all the variables mentioned above were tested (cf. Table 2).

INSERT TABLE 2 HERE.

Perceived personal readiness is positively correlated with perceived personal preparedness and declared preparedness. However, by controlling the effect of the perceived personal preparedness Pearson's partial correlations between declared preparedness and personal perceived readiness show that the correlation is no longer significant (the p value associated with the r p between perceived personal readiness and declared preparedness is no longer less than 0.05). Similarly, partial correlations between perceived personal preparedness and personal perceived readiness controlling the effect of self-efficacy and behavioral control show that the coefficient r decreases to .28, with a p-value inferior to .001 (cf. Table 2).

Perceived personal readiness is not significantly correlated with items about risk perception and only partly significantly correlated with items about personal involvement. Evaluation and identification of the object are not correlated with perceived personal readiness, unlike personal and professional perceived capacity, for actions which are significantly and positively correlated with perceived personal readiness (cf. Table 2).

Personal perceived readiness is significantly correlated with variables about perception of preparatory behavior, except for cognitive attitude and injunctive norm from society (cf. Table 2).

Personal perceived readiness is significantly and positively correlated with variables about preparedness perception of colleagues and hospital but not with diffusion of responsibility. However, once we make partial correlations between perceived hospital readiness and personal perceived readiness by controlling the effect of the perceived readiness of colleagues, then the correlation is no longer significant. Once we make partial correlations between perceived preparedness of colleagues and personal perceived readiness by controlling the effect of the perceived readiness of colleagues, then the correlation is no longer significant (cf. Table 2).

MULTIPLE LINEAR REGRESSION

We carried out a multiple linear (stepwise) regression with variables having a r coefficient greater than .30, except for perceived hospital readiness, perceived colleagues' preparedness and declared preparedness which is no longer correlated, once controlling the effect of other variables. Tested variables are: Self-efficacy (r p =.77***), perceived personal preparedness (r p =.69***), perceived colleagues' readiness (r p =.65***), behavioral control (r p =.55***), perceived hospital preparedness (r p =.45***) and effectiveness of hospital procedures (r p =.

RESULTS SUMMARY

Results of this study show that years of work experience, profession, and previous experience of managing a sanitary crisis are related to the personal readiness perception: health managers, participants with more than 15 years of experience and those who have already experienced a sanitary crisis have a higher score of readiness perception than others. The readiness perception is linked to perceived personal preparedness but not with declared preparedness once we control the effect of perceived personal preparedness. The link between readiness perception and preparedness perception decreases because of the self-efficacy and behavioral control effect. Perceived personal readiness is not linked to risk perception items, identification and personal involvement evaluation items. Professional and personal capacity for action are linked to personal readiness perception. Personal perceived readiness is linked to perception of preparatory behavior, except for cognitive attitude and injunctive norm from society. Personal perceived readiness is linked to perception of readiness colleagues and perception of hospital preparedness but not with diffusion of responsibility. It is not linked to perceived hospital readiness and perceived preparedness of colleagues once we control the effect of the perceived readiness of colleagues. According to multiple linear regression, the variables most related to personal perceived readiness are self-efficacy, perceived colleague readiness, perceived personal preparedness, behavioral control and perceived hospital preparedness.

IMPLICATIONS OF THE RESULTS

PREPAREDNESS IS NOT ENOUGH TO FEEL READY

Results of this study confirm the hypothesis that actual preparedness is not sufficient to predict the perception of personal readiness. Once controlling effect of perceived preparedness is carried out, declared preparedness is not related to personal readiness perception. The effect of perceived preparedness is not sufficient to predict the perception of personal readiness, selfefficacy and behavioral control are linked to this effect. So, it is relevant to focus on the perception of being ready rather than on the perception of being prepared and the actual preparedness.

When addressing the perception of self-efficacy, the concept of "self" is composed of one's direct experiences and evaluations formulated by people who are important to them. [START_REF] Bandura | Self Efficacity[END_REF] This research reviewed the perception of their preparedness but not how skills resulting from preparedness are applied. According to the effect of self-efficacy, the perception of one's capacity to apply skills is relevant. This concept deserves an evaluation with more precise and complex scales. This exploratory study shows that a more in-depth analysis of this theme is necessary. The psychological preparedness is relevant. For example, managing one's emotions is a particularly interesting area to explore. 27

THE COLLECTIVE DIMENSION

Results show that the collective dimension is an essential variable: the perception of colleagues as being ready is important in the model for predicting perceived personal. This latter result can also be put into perspective using the socio-cognitive theory and more specifically the collective self-efficacy theory. According to this theory, collective self-efficacy is defined as "the shared belief of a group in its joint capacities to organize and execute the actions necessary to produce given levels of achievement". [START_REF] Bandura | Self Efficacity[END_REF] This concept consists of the social cohesion (i.e. trust and solidarity) required for collective action and the belief in efficiency in relation to specific tasks Personal and professional involvement and the perception of risk is not significantly related to the perception of readiness. The professional involvement modelled by Mias in 1998 could be used to understand these results. Involvement is composed of three dimensions: the meaning that links the objects that individuals face in their professional context, the reference points as a shared system of representation and the perception of control of their actions in a system of collective practices. [START_REF] Lac | Les représentations professionnelles et l'implication professionnelle comme modèles d'intelligibilité des processus de professionnalisation[END_REF] According to an unpublished study by Lac and De Zotti in 1999, in an unusual situation, reference points and the perception of control are no longer operative, whereas meaning would be activated to compensate for the ineffectiveness of the other dimensions. [START_REF] Lac | Les représentations professionnelles et l'implication professionnelle comme modèles d'intelligibilité des processus de professionnalisation[END_REF] Yet, the results show that the professional capacity for professional action is related to the perception of personal readiness. The perception of control of their actions in a system of collective practices is operating in this study. Further research needs to be carried out to understand why, in this context, this element may be operative. Regarding other measures used to assess professional involvement, it would be relevant to use the conceptualization of Mias to study its other components, such as the meaning and the reference point.

A study by Miceli in 2008 shows that the cognitive component of risk perception does not influence preparatory behavior, unlike its affective component. [START_REF] Miceli | Disaster preparedness and perception of flood risk: A study in an alpine valley in Italy[END_REF] The item concerning fear and gravity are probably not sufficient to assess the complex affective dimension of risk perception. A closer examination using the best psychometric tools deserves to be applied to compare these results.

The results show that perceiving preparatory behavior as distracting and pleasurable increases the perception of personal readiness. The results show that participants' sense of control over their ability to prepare positively related to the perception of personal readiness. Perceived effectiveness of preparedness also has an important effect. Thus, it is not the perception of the situation that impacts the perception of personal readiness, but rather the perception of the preparatory behaviors, both in themselves (attitude) and in their accessibility. These variables are used in the socio-cognitive theory when applied to sanitary crisis preparedness. [START_REF] Paton | Disaster preparedness: a social-cognitive perspective[END_REF] These that enable the conversion of social cohesion into collective action. [START_REF] Babcicky | Collective efficacy and natural hazards: differing roles of social cohesion and task-specific efficacy in shaping risk and coping beliefs[END_REF] Given the task studied here and the importance of personal self-efficacy and the collective aspect, studying collective self-efficacy would be extremely interesting to deepen the importance of the collective dimension.

Results show that health managers feel more ready than paramedics. We assume that health managers feel more responsible for dealing with health crises, which could explain this result. This result suggests that the participants' place in the institution plays an important role in their personal perception of readiness. Research has shown that nurses are more inclined to mobilize during health crises when they trust their leaders and colleagues. The quality of leadership is also important for engagement during such crises. [START_REF] Arbon | Australasian emergency nurses' willingness to attend work in a disaster: A survey[END_REF] These results indicate that the individual cannot feel ready alone and can thus improve our understanding of the mechanisms involved through the concept of collective self-efficacy, leadership, or trust but not only. It is important to conceptualize the collective both as internalization by the individual and therefore as a socio-cognitive reconstruction. 30 This study puts forward that the effect of the group is an encouraging avenue. More specifically, the concepts of professional representations, leadership, cohesion, and group membership are promising elements. results suggest that this model is relevant for understanding the perception of personal readiness.

LIMITATION

The sample size corresponds to the required sample size according to our calculations. But the use of snowball sampling may have resulted in sampling bias. There may be statistical margin of error in results (95% confidence interval). Moreover, given the health context, few people are willing to respond, so the sample is not large enough to be considered representative of the population of hospital workers. Indeed, some hospitals contacted said that they did not wish to send the questionnaire to their workers in order not to overload them as they were already busy.

Respondents may have a different engagement profile with the topic than non-respondents.

There may be response bias, such as social desirability. Participants may have overestimated their readiness. Finally, there may be measurement error especially because it is a developed tool. As this study has an exploratory objective, many variables have been studied but the measurement tools do not provide a detailed analysis of these concepts. The variables were not assessed by multiple items.

CONCLUSIONS

Perception of personal readiness is a complex process which deserves a psychosocial study combining individual and collective variables. Results disclose that the perception of personal readiness depends on individual variables, such as the perception of self-efficacy and on social variables, such as the perceived readiness of colleagues. Technically, these results confirm the value of relying on psychosocial variables during training. As results highlight self-efficacy and behavioral control, it would be interesting to propose empowerment in training courses to increase these perceptions. It also seems necessary to rely on crisis management capacity at different levels: institutional, collective, and individual. More specific research should be carried out to highlight the processes and their combinations that influence this perception. The sample may not be representative of the population. These findings may need to be qualified.

The exploratory dimension of this study does not allow for a detailed analysis of the psychosocial mechanisms related to the perception of personal readiness; however, it does provide a promising first step.

FFigure 1 .

 1 Figure 1. Multiple linear regression model with perceived personal readiness as the dependent variable β : the β coefficient indicates the change in standard deviation of the DV (personal readiness perception) for each increase of one standard deviation of the IV (the model variables: self-efficacy, perceived colleagues' readiness, perceived personal preparedness, behavioral control and perceived hospital preparedness) ***=p<.001 **=p<.01 *=p<.05

Table 1 Analysis of variance after Bonferroni correction with personal readiness perception according to sociodemographic and experience factors

 1 categories where the difference between the means is significant after Bonferroni correction b coefficient of Levene's test for equality of variances. If the test is significant then the differences are probably not due to chance

	Factor		Mean
		Categories	(Standard	F b
			Deviation)
	Profession	Physicians	5.92 (1.71)	3.39**
		Paramedics a	5.09 (2.27)
		Health managers a	6.31 (1.88)
		Administrative and directing	4.50 (2.48)
		workers
	Level of diploma	BTEC First Diploma	6.25 (1.73)	3.87**
		Baccalaureate diploma	5.17 (2.17)
		2 years of graduate	4.75 (2.50)
		3 years of graduate a	4.91 (2.29)
		5 years of graduate a	6.00 (2.05)
		Ph.D	6.33 (1.33)
	Gender	Women	5.13 (2.29)	2.39
		Men	5.67 (1.98)
	Professional experience	< 5 years a	4.95 (2.33)	3.91**
		>5 and <10 years a	4.79 (2.43)
		>10 and <15 years	5.33 (2.19)
		> 15 years a	5.75 (1.97)
	Having experienced a sanitary crisis	Yes a	6.02 (2.20)	23.68***
		No a	4.84 (2.20)
	Having participated in a simulation exercise Yes a	5.88 (2.10)	24.32***
		No a	4.75 (2.26)
	Having participated in a specific professional formation	Yes a No a	5.78 (2.14) 4.89 (2.27)	14.45***
	Having participated in a feedback on an anterior sanitary crisis	Yes a No a	6.21 (2.22) 2.19 (2.19)	23.99***
	Having read the hospital's emergency plan Yes a	5.49 (2.20)	12.94***
		No a	4.64 (2.27)
	Having asked their references for information on managing sanitary crisis	Yes a No a	5.49 (2.32) 4.64 (2.14)	8.95***
	*** = p<.001
	** = p<.01
	* = p<.05

a

Table 2 Correlations between personal perceived readiness and tested variables, sorted by the four dimensions explored

 2


Basma Mostaf

Miklos Molnar

Mohamed Saleh

Abderrahim Benslimane

Sally Kassem

Optimal Proactive Monitor Placement & Scheduling for IoT Networks

Keywords: IoT, Optimization, Critical missions, Reliability, Proactive monitoring, Monitor assignment, Scheduling, RPL

This work is fulfilled in the context of the optimized monitoring of Internet of Things (IoT) networks. IoT networks are faulty; Things are resource-constrained in terms of energy and computational capabilities; they are also connected via lossy links. For IoT systems performing a critical mission, it is crucial to ensure connectivity, availability, and network reliability, which requires proactive network monitoring. The idea is to oversee the network state and functioning of the nodes and links; to ensure the early detection of faults and decrease node unreachability times. It is imperative to minimize the resulting monitoring energy consumption to allow the IoT network to perform its functions. Furthermore, to realize the integration of the monitoring mechanism with IoT services, this latter should work in tandem with the IoT standardized protocols, especially the IPv6 for Low-power Wireless Personal Area Networks (6LoWPAN) and the Routing Protocol for Low-power and lossy networks (RPL). In this paper, an optimized, proactive, passive, centralized monitoring system is proposed for IoT networks. The proposition ensures the optimal placement of monitoring nodes (monitors). Leveraging the graph built by RPL for routing (the DODAG), minimal sets of monitors are optimally placed to cover a given domain. The monitoring activity is optimally scheduled between several subsets of nodes to prolong longevity while minimizing the energy consumption for monitoring, communication, and state transitions. Our proposition provides the exact solution to the defined monitoring placement and scheduling problem via a Binary Integer Program. The model serves as a benchmark for the performance evaluation of contemporary models. Experimentation is designed using network instances of different topology. Results demonstrate the proposed model's effectiveness in realizing full monitoring coverage with minimum energy consumption and communication overhead and a balanced distributed monitoring role.

Introduction

The Internet of Things (IoT) is an Internet-based network of networks; which relies on arbitrary smart, low-power devices (Things) capable of performing sensing or actuation, and communication tasks. By connecting billions of Things to the Internet, IoT created a plethora of applications that touch every aspect of human life, including Smart Homes, Wearables, Smart Cities, Smart Grids, Connected Cars, and Connected Health [START_REF] Dhall | An iot based predictive connected car maintenance[END_REF][START_REF] Metcalf | Wearables and the internet of things for health: Wearable, interconnected devices promise more efficient and comprehensive health care[END_REF]. CONTACT Basma Mostafa. Email: basma.mostafa@lirmm.fr Contrasting the IoT and the standard Internet, the ultimate difference resides in the fact that IoT networks mainly use Low-power Lossy Networks (LLN). LLNs have stringent resource constraints with respect to energy, processing power, and memory of devices (Montenegro, [START_REF] Montenegro | Transmission of IPv6 packets over IEEE 802[END_REF]. They are also known for their unreliable, lossy channels, with low-power, low-bit-rate, and unpredictable bandwidth. The links are typically non-transitive, and their local scope is defined by node reachability and radio strength.

The connection of such networks to the IPv6-based Internet required an adaptation layer between the MAC and network layers; hence, the IPv6 over LoWPAN (6LowPAN) [START_REF] Kushalnagar | IPv6 over low-power wireless personal area networks (6LoWPANs): overview, assumptions[END_REF]. 6LowPAN enabled the reliance on IPv6 for addressing, which allowed the provision of the large address space required for connecting such a tremendous number of devices to the Internet.

On the other hand, IoT networks are characterized by their vulnerability to security risks from the Internet and the shared wireless medium, self-configuration, lack of infrastructure, and complexity of the design of network protocols [START_REF] Türkogulları | Optimal placement, scheduling, and routing to maximize lifetime in sensor networks[END_REF][START_REF] Yücel | A copy-at-neighbouring-node retransmission strategy for improved wireless sensor network lifetime and reliability[END_REF]. They are possibly deployed in unknown, hostile networks with highly dynamic network topologies. Energy constraints impose hard duty cycles to maximize longevity, causing unreliable connectivity and eventual node unreachability [START_REF] Jara | The internet of everything through ipv6: An analysis of challenges, solutions and opportunities[END_REF], leading to incomplete information about the current network state. The situation is regarded as a form of entropy, where a system deteriorates unless effort is invested in developing monitoring and correction mechanisms to maintain a fault-tolerant performance.

Knowing when things break is good. Knowing before they break is even better. Although a significant number of IoT applications are not time-sensitive, there is a whole class of mission-critical applications, especially those that target human safety. For instance, health monitoring, critical control, and fault detection applications [START_REF] Hassanalieragh | Health monitoring and management using internet-of-things (iot) sensing with cloud-based processing: Opportunities and challenges[END_REF][START_REF] Wu | An internet-of-things (iot) network system for connected safety and health monitoring applications[END_REF]. These applications require a high level of network reliability. According to IEEE, reliability is "the ability of a system or component to perform its required functions under stated conditions and for a specified period of time." [START_REF] Stanisavljević | Reliability of nanoscale circuits and systems: methodologies and circuit architectures[END_REF] Unfortunately, given the unreliable nature of LLNs and IoT, faults are common rather than rare events [START_REF] Kiani | A survey on management frameworks and open challenges in iot[END_REF]. Maintaining robustness, continuous availability of devices, and communication reliability are critical factors to guarantee a reliable application data flow.

For mission-critical applications, proactive monitoring approaches are preferable. As a kind of preventive maintenance, proactive mechanisms enforce continual network monitoring; so that node and link failures are detected early, and alerts are promptly issued. Consequently, disconnectivity and service failures are prevented from occurring in the first place. Nevertheless, all supplementary monitoring mechanisms must have minimal effect on energy consumption and traffic load, leaving the network unconstrained in performing its normal function of sensing, actuation, or transmission. If not applied carefully, proactively verifying network performance will negatively impact nodes' resources. If ignored, this impact may lead to battery depletion due to idle listening to the radio channel and excessive control, increased congestion, or network traffic delays, violating critical applications' requirements. Consequently, the existing (conventional) monitoring mechanisms cannot be applied directly to the IoT. Therefore, optimizing the monitoring energy consumption and traffic overhead is crucial.

To realize the integration with already-existing (and future) IoT services, it is detrimental that monitoring prepositions are entirely interoperable with the standardized IoT protocol suite, especially 6LoWPAN and RPL. Interoperability is challenging mainly because IoT solutions are often tailored to specific scenario requirements without neither focusing on horizontal integration with other IoT services nor re-usability.

In light of the above, the absence of any monitoring mechanism for detecting network faults would dramatically reduce the network's performance, which renders monitoring the IoT network state a vital research area that will only develop in significance. An effective and efficient monitoring mechanism could immensely improve robustness in network connectivity, reliability, and, eventually, Quality of Service, which will significantly increase the uptake of the technology by stakeholders, especially for mission-critical applications.

In this work, we propose a proactive, passive monitoring mechanism of mission-critical 6LoWPAN-based IoT networks. The problem is mathematically formulated, and the optimal solution to the minimum monitor assignment problem and the scheduling of the monitoring roles throughout a predetermined lifetime is given. The objective of the mathematical model is minimizing the amount of energy consumed in (1) monitoring the set of critical nodes, (2) communication of the monitoring data to the central entity (6LoWPAN Border Router), (3) and transition between monitoring states. To the best of our knowledge, the exact solution to monitoring mission-critical 6LoWPAN-based IoT networks has not yet been analyzed. The global optimum will serve as a benchmark for comparisons and performance evaluation of contemporary models.

The rest of the paper is structured as follows. A brief background and overview of the related monitoring techniques for Wireless Sensor Networks (WSN) and IoT are given in Section 2. The monitoring problem requirements, assumptions, and objectives are provided in Section 3. The problem is mathematically formulated in Section 4. The proposed proactive, passive, optimal IoT monitoring mechanism is described in Section 5. The model is then implemented using a domain-specific modeling language for mathematical optimization embedded in Julia language and solved using a Gurobi solver, tested on networks with different topology, and results are illustrated in Section 6. Finally, conclusions and insights into possible future research directions are given in Section 7.

Monitoring for IoT Networks: Research Gap

Several network management and routing protocols are designed to deal with the inherent technical challenges of the IoT. However, the Routing Protocol for Low-power and lossy networks (RPL) is the best candidate for critical systems that need fast recovery mechanisms [START_REF] Geng | Internet of things and data analytics handbook[END_REF]. RPL is defined by the Internet Engineering Task Force (IETF), specifically the Routing Over Low-power Lossy networks (ROLL) working group. RPL is a self-healing routing and topology control protocol. It can respond to some node or link failures by applying route repair mechanisms for network recovery.

RPL favors the use of reactive repair approaches; (pro)active mechanisms for regularly probing neighbors do not exist in the ContikiRPL implementation, to minimize the cost of monitoring the links that are not being used. Neighbor Unreachability Detection (NUD) is not obligatory in neither 6LoWPAN nor RPL [START_REF] Gaddour | RPL in a nutshell: A survey[END_REF], not until a node had already failed to reach its default router (parent) [START_REF] Lin | A survey on internet of things: Architecture, enabling technologies, security and privacy, and applications[END_REF]. Only then, RPL triggers a repair mechanism. Thus, fault-tolerance is traded for routing stability and less control traffic [START_REF] Korte | A study of the RPL repair process using Con-tikiRPL[END_REF]. As a result, the recovery time, which is the time required to establish a new route in the case of node unreachability, could be relatively long.

Monitoring for WSNs has been approached frequently in the literature; a survey is provided by [START_REF] Suriyachai | A survey of mac protocols for mission-critical applications in wireless sensor networks[END_REF]. Several heuristics have been proposed to place monitors to uniquely localize a limited number of link failures [START_REF] Ma | On optimal monitor placement for localizing node failures via network tomography[END_REF][START_REF] Stanic | Active monitoring and alarm management for fault localization in transparent all-optical networks[END_REF]. The sniffer technology for WSNs is one of the distinguished passive real-time monitoring tools. Sniffers listen to the packets transmitted over the network and directly capture them from the shared wireless medium. The information obtained from the sniffed packets gives them real-time access to network operations, the ability to promptly assess network performance, and detect network malfunctions without affecting the network's functioning. Information may include partial topology, routing information, and data content. There have been some related works on sniffing tools for WSNs in academia and industry, such as SNDS [START_REF] Kuang | SDNS: A distributed monitoring and protocol analysis system for wireless sensor network[END_REF]. However, their high costs and lack of integration with LoWPAN protocols such as 6LoWPAN and RPL diminish their application into the IoT domain [START_REF] Zhao | Nssn: A network monitoring and packet sniffing tool for wireless sensor networks[END_REF].

Unlike WSNs, most of the research work pertaining to fault-tolerance in the IoT focus on security [START_REF] Mayzaud | Using the RPL protocol for supporting passive monitoring in the Internet of Things[END_REF], intrusion detection, or anomaly detection [START_REF] Zarpelão | A survey of intrusion detection in Internet of Things[END_REF]. These solutions are security-oriented and do not provide solutions to the monitoring aspects that target the underlying network structure, more specifically, guaranteeing node availability and stable, reliable, and scalable end-to-end connectivity. A survey of the state-of-the-art security methods in IoT is conducted by [START_REF] Alaba | Internet of Things security: A survey[END_REF].

The few research work that tackles related IoT network-layer monitoring problems often suffers from being heavy-weight or depend only on highly-powered nodes, such as [START_REF] Mayzaud | Using the RPL protocol for supporting passive monitoring in the Internet of Things[END_REF]. [START_REF] Sehgal | Management of resource constrained devices in the Internet of Things[END_REF]) investigated how to adapt existing IP-based network management protocols, namely SNMP and NETCONF, enabling their implementation on resource-constrained devices. Service interfaces were simplified to include a subset of their functions to minimize network overhead. The authors conclude that the time and memory requirements are low, with only trivial security levels. However, enabling authentication and privacy increases message processing times significantly.

The most relevant work is a mechanism for passive monitoring with RPL, proposed by [START_REF] Mayzaud | Using the RPL protocol for supporting passive monitoring in the Internet of Things[END_REF]. The monitoring responsibility is put exclusively on higher-order devices that are not limited in their resources, to reduce the overhead on the constrained IoT nodes. The mechanism imposes a hard constraint since higher-order devices typically do not constitute the majority of nodes in IoT networks. According to their location and the topology, it might be impossible to entirely cover the critical set of nodes and links using only highly powered devices. Moreover, determining the optimal placement of monitoring nodes was beyond the scope of their proposed work.

According to the comprehensive literature review performed in this research, we noticed that the optimal placement of monitors to cover a mission-critical IoT network had not been proposed so far. To the best of our knowledge, no research work has proposed monitoring models with optimized, energy-efficient role scheduling and integration with RPL and 6LoW-PAN protocols [START_REF] Alaba | Internet of Things security: A survey[END_REF].

IoT Monitoring Assumptions, Requirements & Objectives

This section explains the monitoring problem requirements, assumptions, and objectives; stated in a nutshell in Table 1. IoT network topology is often unstable due to node mobility, unreliable connectivity, and the fact that link connections between nodes are transient [START_REF] Jara | The internet of everything through ipv6: An analysis of challenges, solutions and opportunities[END_REF] (Table 1: Assumptions 1 & 2). In general, network monitoring mechanisms aim at detecting and localizing network faults. They should provide the appropriate tools for overseeing the network state, availability of, and connectivity between nodes. By mapping symptoms of detected problems to possible root causes, the necessary corrective measures can be taken.

Focusing on mission-critical IoT network services, the main problem is to guarantee network reliability, nodes' availability, and robust connectivity. The proposed monitoring mechanism aims to observe network traffic to verify the availability of the critical set of nodes.

Assumptions Reference

The IoT network is unstable, 6LoWPAN-based, uses RPL for routing, and performs a critical-mission

Links are lossy and can only be monitored by their extremities

In addition to the monitoring role, things perform sensing, transmission, and/or actuation Things have stringent resource constraints with only a fraction of the battery reserved for monitoring

The monitoring mechanism is centralized, and the 6LoWPAN Border Router (6BR) is the central entity where the monitoring data is gathered

The active/sleep alternation is the turn on/off of the monitoring activity of the active node

Requirements Reference

Monitors should be placed in the correct locations to guarantee full monitoring coverage

The monitoring energy and communication costs should be minimal to satisfy the low-cost, low-power and scalable objectives of LLNs

The monitoring mechanism should support the presence of sleeping nodes A monitoring duty cycle mechanism is required, where the monitoring function is periodical across the planning horizon

Monitoring should be interoperable with the standardized IoT protocol suite, specifically 6LoWPAN and RPL protocols.

Objectives Reference

Minimize the number of placed monitors while respecting the monitoring coverage requirement, regardless of the lack of current network activity

Place the monitors such that in the centralized mechanism, the energy consumed in relaying the data to the 6BR is minimized

Balance the monitoring role among nodes

Provide the exact solution to the optimal scheduling of the monitoring roles throughout a predetermined lifetime, using minimal monitor sets in each period

Minimizing the state transitions resulting from duty-cycling the monitoring activity Support passive (and active) monitoring approaches (although passive monitoring is recommended)

Node failures can be utilized to model failures of both physical nodes and links [START_REF] Ma | On optimal monitor placement for localizing node failures via network tomography[END_REF]. Performance metrics such as end-to-end delay and link quality level are not that significant in this context as long as successful transmission of mission-critical-related information is always guaranteed.

IoT networks are of enormous scale, consisting of potentially (hundreds of) thousands of nodes. Naturally, it is required that monitors are embedded (placed) in the correct locations to guarantee full monitoring coverage (Table 1: Requirement 1). Given the constrained resources of LLNs, it is also required to reduce the monitoring cost, this energy consumption is different from the energy dedicated to the thing's main function (Table 1: Assumptions 3) &4). Therefore, the number of monitors to be placed must be minimized (Table 1: Objective 1), while satisfying the coverage condition (Table 1: Requirement 2).

The most common IoT architectures are entirely centralized, mainly due to security reasons. The 6LoWPAN Border Router (6BR) is the central entity and is always assumed to be accessible [START_REF] Sheng | A survey on the IETF protocol suite for the Internet of Things: Standards, challenges, and opportunities[END_REF]. Therefore, 6BRs can perform a potentially crucial role in centralized monitoring (Table 1: Assumption 5). Through multi-hop communication, the gathered data can be forwarded from monitors to the 6BR, then to a Network Operations Center (NOC), where sophisticated data analysis and mining can be performed. However, energy is lost in the communication between monitors and the 6BR, which is why it is necessary to find the shortest path in terms of the number of hops to the 6BR (Table 1: Objective 2).

Furthermore, since life span concerns ordinarily constrain the design of LLNs, a prevalent approach toward expanding network longevity is by utilizing duty cycling [START_REF] Türkogulları | Optimal placement, scheduling, and routing to maximize lifetime in sensor networks[END_REF]. In duty-cycled networks, nodes enter sleep state frequently to conserve energy, and intermittently wake up to check for action [START_REF] Sahoo | Pre-scheduled and self organized sleep-scheduling algorithms for efficient k-coverage in wireless sensor networks[END_REF]. High redundancy in network deployment is necessary to achieve this goal; only then is it possible to identify small subsets of active nodes at a time and put the major part of nodes into a sleeping state and thus saving energy (Table 1: Requirement 3). Various scheduling algorithms are applied to organize the alternation between active and sleeping node sets to provide continuous network service. For critical applications, monitoring coverage should always be guaranteed throughout the entire network lifetime, where each link is monitored by at least one monitoring node, regardless of the lack of activity in the network. In this context, the active/sleep alternation is the turn on/off of the monitoring activity of the active node (Table 1: Assumption 6). Therefore, effective and energy-efficient monitoring scheduling algorithms are necessary with duty cycling to satisfy the coverage constraints and balance the distribution of the monitoring burden among nodes, thus maximizing longevity (Table 1: Requirement 4 & Objective 3). In LLNs, nodes can only monitor the traffic within their radio transmission range. Consequently, the monitoring coverage and scheduling connectivity problems are significantly challenging in duty-cycled LLNs.

As stated before, to realize the integration with already existing (and future) IoT services, it is required that monitoring prepositions are completely interoperable with the standardized IoT protocol suite, especially 6LoWPAN and RPL-based networks (Table 1: Requirement 5). Our research is related to the optimal placement of monitoring devices to cover a given network topology. The static problem of assigning the minimum number of monitors to cover a given domain is known in the literature as the minimum monitor assignment problem [START_REF] Kumar | Efficient beacon placement for network tomography[END_REF], which has been proven to be NP-hard [START_REF] Liu | Robust monitor assignment with minimum cost for sensor network tomography[END_REF]; implying that unless = , efficient algorithms for solving it do not exist. In a previous proposition towards monitoring mission-critical IoT networks [START_REF] Mostafa | An Energy-Efficient Multiobjective Scheduling Model for Monitoring in Internet of Things[END_REF], we tackled the problem using a Divide and Conquer approach; via decomposing and mapping it into three well-known sub-problems. Separately solving each sub-problem is efficient, given that there exist several heuristics and approximation algorithms for each sub-problem. However, the one major limitation of the proposed three-phase decomposition is that it is not an exact solution. Therefore, it does not guarantee global optimality.

Here, we target the exact solution to the minimum monitor assignment problem and the optimal scheduling of monitoring roles throughout a predetermined lifetime (Table 1: Objective 4). The formulated mathematical model's objective is minimizing the amount of energy consumed in monitoring the set of critical nodes, communication of the monitoring data to the central entity (6LoWPAN Border Router), and transition between monitoring states (Table 1: Objective 5).

The proposed mechanism is characterized as an optimized, proactive, centralized, and passive monitoring for 6LoWPAN-based IoT networks that utilize the standardized RPL protocol for routing. In passive monitoring, the monitors will only listen to the channel, and the monitoring energy is the cost energy consumed when the device is in receiving mode. That said, our mechanism also supports active monitoring, where monitors participate in the network traffic; via probing the monitored neighborhood and collecting the response. Active monitoring can be needed if the network traffic is sparse. However, it is not recommended for the more efficient energy consumption of the resource-constrained things, which is why we limit the experimentation to passive monitoring (Table 1: Objective 6). The accurate specification of the model is required for a realistic estimation of energy consumption. In Section 6.1, the exact monitoring energy consumption of the model is computed.

Modeling & Mathematical Formulation

The exact mathematical model and the monitoring mechanism are described in this section and Section 5, respectively, while respecting the above requirements and objectives.

Decision Variables & Parameters

A graph can model the network topology. In tandem with RPL, the directed graph we use is the DODAG, = ( , ), where = { , = 1, 2, ..., } is the set of vertices representing the entire set of critical nodes, and is the set of arcs. In a duty-cycled monitoring mechanism where a periodical functioning is assumed, a planning horizon of several periods is defined and represented by = { , = 1, 2, ..., }.We formulate a Binary Integer Programming (BIP) model for the exact placement and scheduling of monitors across the planning horizon. The modeling terms are listed in Table 2 and explained as follows.

, is a binary Decision Variable (DV) that represents whether a node is assigned to monitor in a period (1). In the proposed centralized monitoring approach, monitors forward the monitoring data to their default parents in a path towards the DODAG root. A node routes monitoring packets if it is assigned to monitor, or if it is in the default route of an activemonitoring node in the same period. In the second case, the node is a relay node; for which we define another binary DV , . It indicates whether acts as a relay in period (2).

For minimizing the cost of monitoring state transitions which are incurred as a result of the required duty cycle, the transition DV , and , are introduced to the mathematical model. , identifies whether there is a monitoring state transition of from sleep-monitoring in into active in +1 (3); whereas , denotes whether is active-monitoring in and asleep in +1 (4).

The modeling costs depend on the targeted monitoring mechanism. We opted to target passive monitoring, which implies that to verify their neighbors' availability, monitors need only observe the regular traffic passing through the radio channel. Therefore, the monitoring cost comes in the form of the energy consumed while monitors listen to the messages transmit- List of parents of in the DODAG ted by their neighbors. Depending on the total number of packets overheard from its set of neighbors , a monitor consumes an amount of energy expressed as during a period .

, on the other hand, stands for the amount of energy consumed by the relays while forwarding the monitoring data. The communication cost for each node is a function of the number of times forwards monitoring data through its default parent to the root. Finally, the transition costs are defined as and . They respectively denote the transition costs from sleep-monitoring to active and that from active-monitoring to asleep. , = 1, if is assigned to monitor in period 0, otherwise

, =

1, if is a relay node in period 0, otherwise

, =        (2)
1, if is sleep-monitoring in period and awake in period +1 0, otherwise

       (3) , =       
1, if is active-monitoring in period and asleep in period +1 0, otherwise

       (4)
It is worth mentioning that the transition decision variables are dependent on , and

, +1 ; they are the product of the later two binary variables. Equations ( 5) and ( 6) represent the dependence relationship. Consequently, with the addition of , and , , the mathematical model becomes a quadratic BIP model, which implies an expensive computational cost that goes against scalability objectives. However, we use standard techniques like the one mentioned in [START_REF] Adamatzky | Advances in Unconventional Computing[END_REF] to convert the quadratic formulation into a linear one (described in Section 4.2).

, = (1 -, )

, +1

(5)

, = , (1 - , +1 ) (6)
It is assumed that each node has a reserved battery ( ) for the monitoring activity across the entire planning horizon. This monitoring energy is different from the energy dedicated to the thing's main function (Table 1: Assumption 3). Thus, it is critical to ensure that all sorts of energy consumption never exceed the reserved battery threshold. This threshold is assigned by the network operator, depending on the monitoring role's criticality relative to the primary function. Section 4.2 describes the BIP model for optimal monitor placement and scheduling problems.

Binary Integer Program

The objective of the proposed model is to find the exact placement of monitors in the DODAG, as well as the optimal scheduling of multiple sets of monitors across the planning horizon; while minimizing the total energy consumed for monitoring, transmitting the monitoring data to the root, and the monitoring state transitions (Table 1: Objective 4). Remember that the overriding goals are to ensure full monitor coverage, and a balanced, energy-efficient dutycycling of monitoring and relaying roles across the node set (Table 1: Objectives 1), 3, 5), & 2). Eq. ( 7) represents the model's objective function.

The constraint stated in (8) guarantees that the energy consumed by each monitoring node at the end of the planning horizon must never exceed the ( ) for monitoring. Optimal monitor placement entails finding the minimal number of monitoring nodes placed on the graph while ensuring full monitor coverage. The coverage is forced in the optimal solution by including constraint (9); which states that each edge in the DODAG (( , ) ∈ ) is incident to at least one active-monitoring node in the current period .

There must be a connected path of active nodes from each monitor or relay node towards the root to ensure the successful transmission of the monitoring data from the monitors to the DODAG root. Constraints ( 10) and ( 11) are introduced to the model for this purpose. They state that in each period , if is currently monitoring or relaying, then at least one member of its set of parents, denoted as ( ), is also active in the same period.

Linear constraints are augmented to the mathematical model to eliminate the computational cost coming from the quadratic product of the binary variables , and , +1 . Constraints (12) and (13) ensure that , takes the value of zero if either (1-, ) or , +1 are zero, while (14) makes sure that , takes the value of one if both binary variables are set to 1.

Similar constraints, ( 15) -( 17), are defined for , .

min

∈ ∈ , + , + -1 =1 ∈ , + , (7)
. .

∈ , + , + -1 =1 , + , ≤ ∀ ∈ (8) , + , > 0 ∀ ∈ and ∀{ , } ∈ (9) , ≤ ∈ ( ) , + , ∀ ∈ and ∀ ∈ (10) , ≤ ∈ , , + , ∀ ∈ and ∀ ∈ (11) , ≤ 1 - , (12)
, ≤

, +1

, ≥ , +1 -

, ( 14
) , ≤ , (15)
, ≤ 1 -

, ( 16
) , ≥ , - , +1 (17)
, , , , , , , ∈ {0, 1} ∀ ∈ and ∀ ∈ (18)

Optimal Proactive Passive Monitoring Mechanism

Centralized Passive Monitoring

This section presents how to implement and use the proposed mathematical program to perform a schedule of passive monitoring in relatively small IoT domains. Targeting full interoperability with 6LoWPAN-based IoT networks, this section highlights the relations between the mathematical model and the implemented network monitoring mechanism. The BIP model is implemented using Julia, a high-performance dynamic programming language for numerical computing [START_REF] Bezanson | Julia: A fresh approach to numerical computing[END_REF] and solved using Gurobi solver (Gurobi Optimization, 2018); which is a powerful mathematical programming solver integrated into JuMP [START_REF] Dunning | Jump: A modeling language for mathematical optimization[END_REF]. The latter is a modeling language for mathematical programming that extends Julia. Algorithm 1 describes the procedure SOLVE_EXACT_MODEL; which takes as arguments the DODAG representing the topology of the mission-critical network, the formulated BIP (cf. Section 4.2), and the model's parameters (cf. Section 4.1). Gurobi solves the BIP and the optimal solution is returned to the calling procedure; SOLVE_EXACT_MODEL (step 5.2). The following matrices represent the solver's output, the dimensions of each are the number of nodes × number of periods:

(1) , ( 2) , (3)

, and (4) SOLVE_EXACT_MODEL interprets the output of the solved mathematical model and translates it into the required ℎ and ℎ (steps 5.5 & 5.9); which are returned to EXACT_MONITORING (Algorithm 2) at step 5.13.

Procedure EXACT_MONITORING (Algorithm 2) is the interface between the mathematical formulation and the monitoring mechanism. The procedure is functioning during the length of the monitoring timeline, represented by . Initially, the optimal duty cycle of monitors is obtained by calling the procedure SOLVE_EXACT_MODEL (Algorithm 1); which returns the ℎ (step 6.1). Next, following a passive monitoring approach, the neighbors' availability of each is verified via calling the procedure the LISTEN_TO_NEIGHBORS (Algorithm 3); which returns the set of ℎ ℎ detected during the period it is assigned to (step 6.4). LISTEN_TO_NEIGHBORS (Algorithm 3) works as follows: during the period it is assigned to, given by ℎ, the checks whether each of its ℎ s had participated in the radio transmission (step 7.4). Note that the set of neighbors (parents, children, and siblings) is known from the DODAG, which is passed as a parameter to the calling procedure. If there is a ℎ from which the has not received any messages throughout the entire period, its address is appended to the list of ℎ ℎ (step 7.5). After the expiry of the , the list of ℎ ℎ is returned to the In the centralized monitoring approach, the list of ℎ ℎ of each is forwarded to its default parent (step 6.6); which is responsible for relaying that message to its default parent, and so forth until it reaches a central entity, the 6BR or the DODAG root. The 6BR has unconstrained resources and a global view of the network state, enabling it to perform powerful analysis of the monitoring data and further corrective measures. On the other hand, leveraging RPL's repair mechanism, an attempt at a fast recovery of the DODAG is made by the via calling LOCAL_REPAIR (step 6.7) [START_REF] Gaddour | RPL in a nutshell: A survey[END_REF].

It is noteworthy that the ℎ should be carefully chosen, such that it is neither too short nor too long. Too short ℎ may result in false alarms. A false positive alarm occurs when a monitoring mechanism reports as fault a state that is legitimate network activity [START_REF] Chen | A cloud computing based network monitoring and threat detection system for critical infrastructures[END_REF], whereas failure to detect a faulty state is termed as a false negative alarm. On the other hand, too long ℎ will unnecessarily exhaust the energy of monitors as they are awake-monitoring for quite a long time. Fortunately, some studies focus on the optimal period length, such as the one in [START_REF] Bergmann | Optimal period length for the cgs sensor network scheduling algorithm[END_REF].

Separate DODAG for Routing

Even though the centralized approach allows for sophisticated monitoring tasks, which might otherwise exhaust the resources of the things, they are achieved at the expense of high communication overhead. To take the burden of routing the monitoring data to the DODAG root off the constrained nodes, we leverage the multiple instance feature of RPL and create another DODAG. It is considered as an overlay structure within which the monitors communicate separately. The separate DODAG may consist of only monitoring nodes, and the monitoring data is transmitted from monitors to the 6BR through the shortest paths. Those routes may not have been defined by application-specific routing.

However, according to the network topology, the separate instance of monitors might not

Algorithm 2 PROCEDURE EXACT_MONITORING Input: , , Output: ℎ ℎ ∀ ∈ ℎ begin 6.1 ℎ ←- SOLVE_EXACT_MODEL( , , ); 6.2 while < do 6.3 forEach ∈ ℎ do 6.4 ℎ ℎ ←- LISTEN_TO_NEIGHBORS( , ℎ); 6.5 forEach ℎ ∈ ℎ ℎ do 6.6
FORWARD_TO_PARENT( ℎ ℎ ); 6.7 LOCAL_REPAIR( ); 6.8 end forEach 6.9 end forEach 6.10 end while end

Algorithm 3 PROCEDURE LISTEN_TO_NEIGHBORS Input: , ℎ Output: ℎ ℎ begin 7.1 ℎ ℎ ←-; 7.2 while < do 7.3 forEach ℎ ∈ do 7.4 if! RECEIVE_MESSAGE( ℎ ) do 7.5 ℎ ℎ ←- ℎ ℎ ∪ ℎ ; 7.6 end if 7.7
end forEach 7.8 end while 7.9 return ℎ ℎ ; end guarantee the presence of a connected path between themselves and the DODAG root. Therefore, for the successful transmission of monitoring data, relay nodes may be required. The optimal placement of the required relays is obtained from the ℎ given by procedure SOLVE_EXACT_MODEL (Algorithm 1). Even though it is probable that relay nodes are not currently involved in monitoring, they still share the monitoring burden as there is an amount of energy consumed by forwarding the monitoring data. This is cost is represented in the model's objective function by (cf. Section 4.2).

Experimental Evaluation

Extensive computational experiments are conducted using different network sizes and topologies to verify and validate the BIP model. The experiments are designed to test the model's ability to optimally place monitors and relays on the DODAGs representing the nodes associated with the critical mission, and to find answers to the following questions:

• How long does it take to find the optimal schedule of monitors?

• How much energy is consumed for monitoring the critical set of nodes?

• Can the model operate smoothly under challenging battery conditions?

• Is the overhead of the communication between monitors and the central node significant? • Does the model scale well?

• Is it beneficial to leverage the separate DODAG feature of RPL?

Parameter Settings

Before commencing the experiments, the parameters must be carefully chosen to reflect a reallife mission-critical IoT network. This section explains how energy costs are estimated. The parameters' settings are displayed in Table 3. The amount of energy consumption is platform- dependent. TelosB, also known as the TMote Sky motes, is selected as a target platform for regular and monitoring nodes; its computational resources allow it to function as an RPL router node within the Contiki RPL implementation [START_REF] Mayzaud | Using the RPL protocol for supporting passive monitoring in the Internet of Things[END_REF]. Tmote Sky motes use 2 AA batteries with a total available energy of 30780 Joules. Referring to Tmote Sky's datasheet [START_REF] Datasheet | Moteiv corporation[END_REF], its measurements in different modes of operation are shown in Table 4. While monitors passively listen to their neighbors, they consume a significant et al., 2007), the size of the data packet, hereby denoted , is 17 bytes for the header frame in addition to the size of the data payload. Assuming that the payload is 2 bytes, is 19 bytes. Acknowledgment packets are not mandatory in IEEE 802.15.4. Nevertheless, since the target is reliable communication, acknowledgment costs are considered in our computations. 6LoWPAN dedicated 11 bytes to the acknowledgment packet, which is expressed here as . To compute the communication cost, (20) for IEEE 802.15.4 networks that employ Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA), there is a fixed energy cost associated with the Clear Channel Assessment; symbolized as . Moreover, it is necessary to estimate the costs related to the radio energy consumption of receiving and relaying messages, expressed as and , respectively. Given Tmote Sky measurements in Table 3, we compute the costs of receiving and relaying one message of size 19 bytes using Equations 19 and 20, respectively. Accordingly, the default values of the BIP model are obtained and given in Table 5.

= + × + × (20)

Results & Discussion

Experiments are performed on a personal computer with 16 Gigabytes of RAM and 2.20 Gigahertz Intel Core i7 processor. The proposed model is tested using 21 instances, some of which are of random network topology with variable densities, while the rest are of famous networks, namely KARATE [START_REF] Zachary | An information flow model for conflict and fission in small groups[END_REF], DOLPHINS [START_REF] Lusseau | The bottlenose dolphin community of doubtful sound features a large proportion of long-lasting associations[END_REF], POL-BOOKS [START_REF] Rossi | The Network Data Repository with Interactive Graph Analytics and Visualization[END_REF], FOOTBALL [START_REF] Girvan | Community structure in social and biological networks[END_REF], POWER [START_REF] Watts | Collective dynamics of "small-world[END_REF], and NETSCIENCE [START_REF] Newman | Finding community structure in networks using the eigenvectors of matrices[END_REF]. Results are displayed in Table 6, where the values of the following metrics are recorded:

• number of nodes (|V|), links (|E|), and graph's density ( ),

• percentage of monitors (monitor(%)),

• average number of neighbors per monitor (|N|),

• average energy consumption per node in monitoring, relaying, and state transitions (Energy cons. (mJ)), Initially, the model was tested on a relatively sparse topology, that of the KARATE [START_REF] Zachary | An information flow model for conflict and fission in small groups[END_REF] network of 34 nodes and 114 links. Fig. 1 pinpoints the optimal placement of three types of monitors; specifically, the ones that: (1) transitioned from active-monitoring in the previous period -1 to sleep in , (2) transitioned from sleep-monitoring to active in said periods, and (3) the ones that did not transition at all, i.e., they are monitoring in both periods -1 and . Node labeled 1 represents the 6BR, and the rest of the vertices correspond to the monitored nodes. [START_REF] Zachary | An information flow model for conflict and fission in small groups[END_REF] network topology with 34 Vertices and 114 edges.

= 1641.6 (0.05 % of total power).

Next, we experimented with a slightly denser network, the DOLPHINS [START_REF] Lusseau | The bottlenose dolphin community of doubtful sound features a large proportion of long-lasting associations[END_REF] topology, consisting of 62 nodes and 159 edges; node 1 represents the 6BR. Here, the multiple instance feature of RPL is exploited. A separate DODAG is created to reduce the communication overhead of routing the monitoring data to the 6BR and verify the model's placement of the relaying nodes if required. As mentioned in Section 5.2, the optimal placement of the required relays is obtained from the ℎ given by procedure SOLVE_EXACT_MODEL (Algorithm 1).

Fig. 2a shows the original DOLPHINS topology. Creating a separate instance consisting of monitors only does not provide a connected path between the monitors and the 6BR (except for monitors 14 and 61). Fig. 5 displays the required relay nodes for an arbitrary period, , corresponding to the values of , in the optimal solution of the proposed mathematical model.

DODAG root

Regular node Furthermore, we tested the model's response towards variations in the Right Hand Side (RHS) vector of the for the monitoring constraint (Section 4.2 -( 8)). Using the same KARATE topology depicted in Fig. 1, we run 14 trials while varying the node's in the range between 1539 -307800 ; which corresponds to 0.05% -10% of Tmote Sky total power. This particular range is selected as the nodes are incapable of monitoring the network for the length of the planning horizon on a below the range's lower bound, and the model converges to the same solution with the upper bound and beyond. The results of these trials are displayed in figures 3a, 3b, and 4.

Fig. 3a shows a clear trend; the more the constraint is tightened, the more is the execution time. Fig. 3b, on the other hand, shows the significant effect of the size of the on the total energy consumption. The interpretation is that the tighter the battery constraint, the more is the number of monitoring state transitions since a node does not have enough power to continue monitoring for several periods, thus goes to sleep.

A remarkable conclusion emerges from the experimental results: tightening the [START_REF] Zachary | An information flow model for conflict and fission in small groups[END_REF] topology; = 307800 , 2052 and 1641.6 ; corresponding to 10 %, 0.07% and 0.05% of Tmote Sky total power, respectively; = 20. constraint has the advantage of balancing the monitoring role among nodes. Consequently, the average energy consumption per node decreases. This result is depicted in Fig. 4; which shows the average energy consumption per node after 20 periods as the is varied between 307800 , 2052 , and 1641.6 ; corresponding to 10 %, 0.07% and 0.05% of the total power of Tmote Sky, respectively. This finding highlights the fact that the size of should be set with considerable care. (approximately 0.01% of its total power); regardless of the size of for monitoring. It can be seen in Table 6 and Fig. 6, that the execution time for a dense network of 600 nodes and 17970 links is approximately 8.5 minutes, which is not exceedingly expensive. However, it is a fact that computing the exact solution to the BIP model for large-sized networks will be computationally expensive, a result of the NP-hardness of the MVC problem, which is represented in constraint 9 [START_REF] Beame | The resolution complexity of independent sets and vertex covers in random graphs[END_REF]. Nevertheless, it is worth mentioning that the model's performance was tested under a tight battery constraint, with a 50 from a total available power of 30780 of the TMote Sky mote.

Conclusions & Perspectives

Our study presents the exact solution to the minimum monitor assignment problem with a duty-cycled monitoring approach. The optimal schedule guarantees monitor coverage with minimum energy consumption. The solution is incorporated into a centralized, passive monitoring mechanism that is interoperable with RPL and 6LoWPAN protocols.

The overall findings confirm the proposed model's effectiveness in achieving full monitor coverage with minimum energy consumption in all tested network topologies. The results also confirm that the execution times are tolerable even for relatively large or dense networks. These conclusions are crucial for the adoption of network monitoring into critical-mission IoT networks.

Even though the optimization is computed off-line, for benchmarking, we tested how scalable the model is, concerning the size and density of networks. We have seen that the execution time for relatively dense networks is not very expensive. However, it is a fact that computing the exact solution to the BIP model for large-sized networks will be computationally expensive, a result of the NP-hardness of the MVC problem. This fact implies an exponential lower bound on the running time of solving the proposed linear BIP model. Despite the computational limitations, the proposed mechanism can serve as a benchmark for comparisons and performance evaluation of contemporary models, which has been missing from the literature.

The proposed models represent a static view of the IoT network, rendering the optimal solution unrepresentative to a new situation if a significant change in the network topology is detected. Dynamic models are required to avoid a complete re-optimization of the problem, which is the current study.

Figure 1 .

 1 Figure1. Optimal solution in a given period for the KARATE[START_REF] Zachary | An information flow model for conflict and fission in small groups[END_REF] network topology with 34 Vertices and 114 edges.= 1641.6 (0.05 % of total power).

Figure 2 .

 2 Figure2. The DOLPHINS topology[START_REF] Lusseau | The bottlenose dolphin community of doubtful sound features a large proportion of long-lasting associations[END_REF] (62 vertices and 159 edges).

Figure 3 .Figure 4 .

 34 Figure 3. Effect of variation of for the KARATE (Zachary, 1977) topology; = 20; (a) versus model execution time; (b) versus network total energy consumption.

Figure 5 .

 5 Figure 5. Monitoring DODAG with the necessary relays for the DOLPHINS Lusseau et al. (2003) topology of 62 Vertices and 159 edges. Node labeled 1 is the root.

Fig. 4

 4 Fig.4also emphasizes the efficiency of the proposed passive monitoring mechanism, since the average energy consumption per node does not exceed 300 (approximately 0.01% of its total power); regardless of the size of for monitoring. It can be seen in Table6and Fig.6, that the execution time for a dense network of 600 nodes and 17970 links is approximately 8.5 minutes, which is not exceedingly expensive. However, it is a fact that computing the exact solution to the BIP model for large-sized networks will be computationally expensive, a result of the NP-hardness of the MVC problem, which is represented in constraint 9[START_REF] Beame | The resolution complexity of independent sets and vertex covers in random graphs[END_REF]. Nevertheless, it is worth mentioning that the model's performance was tested under a tight battery constraint, with a 50 from a total available power of 30780 of the TMote Sky mote.

Figure 6 .

 6 Figure 6. Effect of varying network density on the execution time. Data labels are the number of nodes and links.

Table 1 .

 1 Monitoring Requirements, Assumptions & Objectives

Table 2 .

 2 Glossary of Modeling Terms

	Term	Description
		Set of vertices, =	, = 1, 2, ...,
		Periodical planning horizon, =	, = 1, 2, ...,
		Binary decision variable denotes whether changed its state from sleep
		in into active-monitoring in +1
	,	Binary decision variable denotes whether changed its state from ac-
		tive in into sleep-monitoring in +1
		Energy consumption of passive monitoring of neighbors
		Energy consumption of relaying messages to the preferred parent
		Energy consumption of transitioning from sleep into active-monitoring
		state
		Energy consumption of transitioning from active into sleep-monitoring
		state
		Fraction of the available battery reserved for monitoring functions
	( )

,

Binary decision variable denotes whether is assigned to monitor in , Binary decision variable denotes whether acts as a relay in ,

Table 3 .

 3 Default Values of Physical Network Parameters

	Parameter	Description	Default
			Value
		Energy cost of listening to the radio channel	0.58
		Energy cost of Clear Channel Assessment	0.08
		Radio energy consumption of sending 1 byte 0.0020
		Radio energy consumption of receiving 1	0.0022
		byte
		Size of the data packet	19
		Size of acknowledgment packet	11

Table 4 .

 4 Tmote Sky Measurements in Typical Operating Conditions[START_REF] Datasheet | Moteiv corporation[END_REF] the listening cost, the cardinality of a monitor's set of a neighbors | |, and the number and size of the sniffed packets. Based on the framework of 6LoWPAN (Kushalnagar

	Parameter	Default Value
	Maximum supply voltage	3.6
	Radio transmitting current consumption	17.4
	Radio receiving current consumption	19.7
	Radio on current consumption	365
	Power down current consumption	1
	Maximum startup time	860
	Maximum supply energy	30780
	Transmit bit rate	250
	amount of energy, which can be expressed as	. The total monitoring cost,	(19), is

Table 5 .

 5 Default Values of Model Parameters

	Parameter	Default Value
		0.621
		0.486
		0.0011
		0.02
		50
		20
	=	+	×	(19)

Table 6 .

 6 Experimental Results of Exact Monitor Placement & Scheduling• percentage of battery consumed for monitoring, relaying and state transitioning from per node (Battery cosns. (%)), • average number of overheard packets per monitor (msgs), and • model execution time in seconds (time).

	Energy cons.( ) battery cons.(%) msgs time ( )	9.936 19.872 5 109.66	9.439 18.878 5 7.20	10.432 20.865 6 28.82	10.432 20.865 5 8.30	10.929 21.859 6 8.75	11.923 23.846 5 8.46	11.040 22.080 5 56.76	8.280 16.560 6 59.73	9.522 19.044 5 153.82	5.607 11.214 5 66.90	10.914 21.829 5 49.57	7.013 14.026 5 175.30	7.211 14.850 7 104.95	7.570 15.430 6 13.61	10.152 20.304 5 78.55	5.437 10.875 5 51.30	3.673 7.346 6 15.00	12.395 24.790 6 276.60	12.3993 24.798 5 466.90	45.005 90.011 5 2.82	5.799 11.598 5 111.24
	monitor(%) |N|	80 13	76 16	84 18	84 21	88 23	96 25	88 26	66 11	77 13	41 5	87 29	56 5	58 9	60 8	82 11	44 2	29 6	99 499	99 599	57 6	47 5
	Topology |V| |E|	Random 25 150 0.250	Random 25 180 0.300	Random 25 210 0.350	Random 25 240 0.400	Random 25 270 0.450	Random 25 300 0.500	Random 27 330 0.550	Random 30 130 0.150	Random 30 174 0.200	KARATE 34 78 0.101	Random 34 470 0.430	DOLPHINS 62 159 0.024	DOLPHINS* 62 207 0.054	POLBOOKS 105 441 0.040	FOOTBALL 115 613 0.047	POWER 200 209 0.005	POLBOOKS* 399 950 0.005	Complete Graph 500 249500 0.990	Random 600 179700 0.500	NETSCIENCE 1589 4331 0.002	POWER* 4941 11535 0.0005
	Instance	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21